ApiPermissionService
class ApiPermissionService (View source)
Permission gate for the public API. A facade over PermissionService so the API and the web UI share one oracle; only the group and visible-zone lookups query here.
Constants
| TEMPLATE_ASSIGN_DENIED |
|
| TEMPLATE_SELF_ASSIGN_DENIED |
|
| TEMPLATE_SUPERUSER_DENIED |
|
Methods
No description
The underlying oracle, for callers that take a PermissionService.
Grant from the user's own template or any group template; ueberusers hold every permission.
Return the group IDs the user is a member of.
Given a list of group IDs, return the subset that actually exists in user_groups.
Direct ownership or through any group the user belongs to.
No description
Content-edit grant that applies to the zone (never own_as_client, never metadata).
No description
No description
No description
MASTER/NATIVE/SLAVE only: the API does not create catalog kinds.
No description
DNSSEC on a zone being created: the caller must end up owning it, directly or via one of the groups.
No description
No description
No description
No description
No description
No description
No description
Read the permission template currently stored on an account.
No description
No description
No description
No description
No description
Template records follow the caller's global edit level; clients may not write SOA/NS/LUA.
No description
No description
No description
No description
Get all zone IDs that the user is allowed to view (stateless)
Details
__construct(PDO $db, PermissionService|null $permissions = null, ConfigurationInterface|null $config = null)
No description
PermissionService
permissions()
The underlying oracle, for callers that take a PermissionService.
bool
userHasPermission(int $userId, string $permissionName)
Grant from the user's own template or any group template; ueberusers hold every permission.
array
getUserGroupIds(int $userId)
Return the group IDs the user is a member of.
array
getExistingGroupIds(array $groupIds)
Given a list of group IDs, return the subset that actually exists in user_groups.
bool
userOwnsZone(int $userId, int $zoneId)
Direct ownership or through any group the user belongs to.
bool
canViewZone(int $userId, int $zoneId)
No description
bool
hasZoneContentEditPermission(int $userId, int $zoneId)
Content-edit grant that applies to the zone (never own_as_client, never metadata).
bool
canEditZoneContent(int $userId, int $zoneId, string|null $zoneType = null)
No description
bool
canEditZoneRecord(int $userId, int $zoneId, string $recordType, string|null $zoneType = null, string|null $recordName = null, string|null $zoneName = null)
No description
bool
canDeleteZone(int $userId, int $zoneId)
No description
bool
canCreateZone(int $userId, string $zoneType = 'MASTER')
MASTER/NATIVE/SLAVE only: the API does not create catalog kinds.
bool
canManageDnssec(int $userId, int $zoneId)
No description
bool
canManageDnssecForNewZone(int $userId, int|null $ownerId, array $groupIds = [])
DNSSEC on a zone being created: the caller must end up owning it, directly or via one of the groups.
bool
canViewUser(int $userId, int $targetUserId)
No description
bool
canEditUser(int $userId, int $targetUserId)
No description
bool
canEditUserPassword(int $userId, int $targetUserId)
No description
bool
canCreateUser(int $userId)
No description
bool
canDeleteUser(int $userId, int $targetUserId)
No description
bool
canManageGroups(int $userId)
No description
bool
canEditPermissionTemplates(int $userId)
No description
int|null
getUserPermissionTemplateId(int $userId)
Read the permission template currently stored on an account.
bool
templateGrantsSuperuser(int $permTemplId)
No description
string|null
checkPermissionTemplateAssignment(int $userId, int|null $targetUserId, int $permTemplId)
No description
bool
canListUsers(int $userId)
No description
bool
canCreateZoneTemplate(int $userId)
No description
bool
canEditZoneTemplate(int $userId)
No description
bool
canWriteTemplateRecordType(int $userId, string $recordType)
Template records follow the caller's global edit level; clients may not write SOA/NS/LUA.
bool
canViewZoneTemplates(int $userId)
No description
bool
canEditZoneMeta(int $userId, int $zoneId)
No description
bool
canViewZoneMetadata(int $userId, int $zoneId)
No description
bool
canViewZoneOwnership(int $userId, int $zoneId)
No description
array|null
getUserVisibleZoneIds(int $userId)
Get all zone IDs that the user is allowed to view (stateless)