1. class
  2. Poweradmin
  3. \
  4. Domain
  5. \
  6. Service
  7. \
  8. PermissionTemplateAssignmentGuard

PermissionTemplateAssignmentGuard

class PermissionTemplateAssignmentGuard (View source)

Gates perm_templ assignment on user create/update API paths.

Without this gate, any caller with user_add_new could create a new ueberuser by supplying perm_templ equal to the Administrator template id, and any caller with user_edit_own could self-elevate via PUT /users/{self}. Mirrors the web UI policy: a caller may only choose a template that stays within the authority they already hold, and retemplating their own account additionally requires user_edit_others; everyone else gets the supplied value rejected or, when omitted, a safe minimal-template default in place of the repository's historical fallback to template id 1 (Administrator).

Methods

static string|null
apply(PermissionService $permissionService, int|null $defaultUserTemplateId, int $callerId, array $input, int|null $targetUserId)

Apply the gate to a create/update input array.

Details

at line 50
static string|null apply(PermissionService $permissionService, int|null $defaultUserTemplateId, int $callerId, array $input, int|null $targetUserId)

Apply the gate to a create/update input array.

Parameters

PermissionService $permissionService
int|null $defaultUserTemplateId

Minimum-privilege template to inject when the caller cannot choose; null leaves the input untouched (suited to update paths).
int $callerId
array $input

Mutated in place when defaulting.
int|null $targetUserId

Account being written; null on the create path, where no account exists to self-elevate yet.

Return Value

string|null

Error message to surface as 403, or null if the input passes.