1. class
  2. Poweradmin
  3. \
  4. Domain
  5. \
  6. Service
  7. \
  8. PermissionTemplateContentGuard

PermissionTemplateContentGuard

class PermissionTemplateContentGuard (View source)

Gates what a permission template may contain.

templ_perm_add/templ_perm_edit delegate template management, but a template's permission list is itself an authority grant: ticking user_is_ueberuser on the template you are already assigned to makes you a superuser without any assignment step, which would bypass PermissionTemplateAssignmentGuard entirely. So a caller who is not already a superuser may neither put that permission into a template nor touch a template that already carries it - the latter also stops them stripping the Administrator template bare to lock real admins out.

Constants

UBERUSER_PERMISSION

CONTENT_SUPERUSER_DENIED

EDIT_SUPERUSER_DENIED

Methods

static string|null
apply(UserRepository $userRepository, int $callerId, int|null $templateId, array|null $permIds)

Apply the rule to a template create or update.

static array
filterOfferedPermissions(array $permissions, bool $callerIsSuperuser)

Drop the superuser permission from a picker list shown to a non-superuser.

Details

at line 53
static string|null apply(UserRepository $userRepository, int $callerId, int|null $templateId, array|null $permIds)

Apply the rule to a template create or update.

Parameters

UserRepository $userRepository
int $callerId

Acting user
int|null $templateId

Template being written; null on the create path
array|null $permIds

Permission ids the write would persist; null leaves contents untouched

Return Value

string|null

Error to surface, or null when the write is allowed

at line 93
static array filterOfferedPermissions(array $permissions, bool $callerIsSuperuser)

Drop the superuser permission from a picker list shown to a non-superuser.

Parameters

array $permissions

Rows of id/name/descr
bool $callerIsSuperuser

Return Value

array