PermissionService
class PermissionService (View source)
Answers permission questions for a user from their template and group grants, cached per request.
This service provides methods to check and retrieve user permissions using Domain-Driven Design principles.
Constants
| TEMPLATE_ASSIGN_DENIED |
|
| TEMPLATE_SELF_ASSIGN_DENIED |
|
| TEMPLATE_SUPERUSER_DENIED |
|
| TEMPLATE_NOT_SUBSET_DENIED |
|
| private LEVEL_PAIRS |
Level ladders: name => [grants that yield "all", grants that yield "own"]. Holders of zone_metaedit* may always see what they are allowed to edit. |
Methods
Check if a user has a specific permission
Get all permissions for a specific user (direct template and group-based)
Check whether a user may create, edit or delete groups.
Check if a user is an admin (has the "überuser" permission)
Answers isAdmin() for many users with one query, so a listing page does not check every row separately.
Check if a user owns a zone directly or via group membership
Drop the cached answers for a user after their template, groups or zone ownership changed within the request.
Drop the cached ownership answers for a zone after its owners or groups changed.
Whether the user may perform an "_own" action on a zone: the grant comes from the user's template or any of their groups (union), and the zone is owned directly or through any group.
Get view permission level for a user
Get edit permission level for a user
The user's edit level narrowed to one zone: "own" levels apply only when the zone is owned directly or via any group.
Get zone meta edit permission level for a user
Get zone metadata view permission level for a user
Get zone ownership view permission level for a user
Check if user can view other users' content
Whether the user may create (or convert a zone into) the given kind.
Check if user can add zone templates
Check if a user may access user management (any view/edit/add grant or admin).
DNSSEC key management on a zone: zone_dnssec_manage_own plus ownership (admins always).
Whether the user may open a zone: view_others (or admin), or view_own on a zone owned directly or via any group.
Whether the user holds a content-edit grant that applies to the zone: edit_others (or admin), or edit_own on an owned zone. own_as_client is NOT included, so this is the gate for record types clients may not touch and never for zone metadata.
Whether the user may edit records in the zone. Secondary and Consumer zones replicate from a primary and reject every content edit when the type is known.
canEditZoneContent() plus the own_as_client record-type restriction: SOA/NS/LUA need edit_own or better, except subzone NS records for zone_content_edit_ns_subzone holders. Pass the record and zone names (FQDN) to enable that exemption.
Zone metadata (name, type, primaries): meta_edit_others (or admin), or meta_edit_own on an owned zone.
No description
No description
No description
Why the actor may not put the target on this permission template, or null when allowed. Echoing back an unchanged ordinary template is not a change.
Zone log access level: "all" (others or admin), "own", or "none".
Change request level: "all" (others or admin), "own", or "none". Decides whether the user may file a change request instead of editing directly.
Change approve level: "all" (others or admin), "own", or "none". Reviewing additionally requires the edit permission, see ChangeApprovalPolicy::canReview().
The user's change request level narrowed to one zone: "own" applies only when the zone is owned directly or via any group.
The user's change approve level narrowed to one zone: "own" applies only when the zone is owned directly or via any group.
Several permissions at once, as name => granted, for templates that branch on them.
Get delete permission level for a user
Check if user can delete a zone
Whether the user may delete this zone; ownership is looked up only when their delete level depends on it.
Details
__construct(UserLookupInterface&UserPermissionReadInterface $userRepository)
No description
bool
hasPermission(int $userId, string $permissionName)
Check if a user has a specific permission
array
getUserPermissions(int $userId)
Get all permissions for a specific user (direct template and group-based)
Permissions do not change within a request, so they are cached per user to keep repeated checks at a single query.
bool
canManageGroups(int $userId)
Check whether a user may create, edit or delete groups.
Group management is superuser-only, unlike user permission templates which
user_edit_templ_perm delegates. Two reasons: that permission is defined as
covering the template assigned to users, and a group's template lands in the
same global permission union as a user's, so delegating it would hand out a
second, unguarded route to superuser.
bool
isAdmin(int $userId)
Check if a user is an admin (has the "überuser" permission)
void
primeAdminFlags(array $userIds)
Answers isAdmin() for many users with one query, so a listing page does not check every row separately.
bool
userOwnsZone(int $userId, int $domainId)
Check if a user owns a zone directly or via group membership
void
forgetUser(int $userId)
Drop the cached answers for a user after their template, groups or zone ownership changed within the request.
void
forgetZone(int $zoneId)
Drop the cached ownership answers for a zone after its owners or groups changed.
bool
canPerformZoneAction(int $userId, int $domainId, string $permissionName)
Whether the user may perform an "_own" action on a zone: the grant comes from the user's template or any of their groups (union), and the zone is owned directly or through any group.
string
getViewPermissionLevel(int $userId)
Get view permission level for a user
string
getEditPermissionLevel(int $userId)
Get edit permission level for a user
string
getEditPermissionLevelForZone(int $userId, int $domainId)
The user's edit level narrowed to one zone: "own" levels apply only when the zone is owned directly or via any group.
string
getZoneMetaEditPermissionLevel(int $userId)
Get zone meta edit permission level for a user
string
getZoneMetadataViewPermissionLevel(int $userId)
Get zone metadata view permission level for a user
Holders of zone_metaedit* may always see what they are allowed to edit.
string
getZoneOwnershipViewPermissionLevel(int $userId)
Get zone ownership view permission level for a user
Holders of zone_metaedit* may always see what they are allowed to edit.
bool
canViewOthersContent(int $userId)
Check if user can view other users' content
bool
canCreateZone(int $userId, string $zoneType)
Whether the user may create (or convert a zone into) the given kind.
Kinds that replicate from a primary (SLAVE, CONSUMER) are governed by zone_slave_add, the rest by zone_master_add; the add forms use the same split.
bool
canAddZoneTemplates(int $userId)
Check if user can add zone templates
bool
canManageUsers(int $userId)
Check if a user may access user management (any view/edit/add grant or admin).
bool
canManageDnssecForZone(int $userId, int $domainId)
DNSSEC key management on a zone: zone_dnssec_manage_own plus ownership (admins always).
bool
canViewZone(int $userId, int $domainId)
Whether the user may open a zone: view_others (or admin), or view_own on a zone owned directly or via any group.
bool
hasZoneContentEditPermission(int $userId, int $domainId)
Whether the user holds a content-edit grant that applies to the zone: edit_others (or admin), or edit_own on an owned zone. own_as_client is NOT included, so this is the gate for record types clients may not touch and never for zone metadata.
bool
canEditZoneContent(int $userId, int $domainId, string|null $zoneType = null)
Whether the user may edit records in the zone. Secondary and Consumer zones replicate from a primary and reject every content edit when the type is known.
bool
canEditZoneRecord(int $userId, int $domainId, string $recordType, string|null $zoneType = null, string|null $recordName = null, string|null $zoneName = null)
canEditZoneContent() plus the own_as_client record-type restriction: SOA/NS/LUA need edit_own or better, except subzone NS records for zone_content_edit_ns_subzone holders. Pass the record and zone names (FQDN) to enable that exemption.
bool
canEditZoneMeta(int $userId, int $domainId)
Zone metadata (name, type, primaries): meta_edit_others (or admin), or meta_edit_own on an owned zone.
bool
canViewZoneMetadata(int $userId, int $domainId)
No description
bool
canViewZoneOwnership(int $userId, int $domainId)
No description
bool
templateGrantsUberuser(int $permTemplId)
No description
string|null
checkPermissionTemplateAssignment(int $actorId, int|null $targetUserId, int $permTemplId)
Why the actor may not put the target on this permission template, or null when allowed. Echoing back an unchanged ordinary template is not a change.
The strings are API contract.
string
getZoneLogPermissionLevel(int $userId)
Zone log access level: "all" (others or admin), "own", or "none".
string
getChangeRequestPermissionLevel(int $userId)
Change request level: "all" (others or admin), "own", or "none". Decides whether the user may file a change request instead of editing directly.
string
getChangeApprovePermissionLevel(int $userId)
Change approve level: "all" (others or admin), "own", or "none". Reviewing additionally requires the edit permission, see ChangeApprovalPolicy::canReview().
string
getChangeRequestPermissionLevelForZone(int $userId, int $domainId)
The user's change request level narrowed to one zone: "own" applies only when the zone is owned directly or via any group.
string
getChangeApprovePermissionLevelForZone(int $userId, int $domainId)
The user's change approve level narrowed to one zone: "own" applies only when the zone is owned directly or via any group.
array
getPermissionFlags(int $userId, array $permissionNames)
Several permissions at once, as name => granted, for templates that branch on them.
string
getDeletePermissionLevel(int $userId)
Get delete permission level for a user
bool
canDeleteZone(int $userId, bool $isOwner)
Check if user can delete a zone
bool
canDeleteZoneById(int $userId, int $domainId)
Whether the user may delete this zone; ownership is looked up only when their delete level depends on it.