ZoneAccessPolicy
final class ZoneAccessPolicy (View source)
Pure rules for what a user may change on the zone edit screens.
Centralizes the permission-level algebra that was previously duplicated across Twig templates.
Methods
Whether an "all" / "own" / "none" permission level applies to a zone the user does or does not own. Every *_own permission shares this algebra.
Whether the user's edit permission level grants editing this zone at all, independent of the zone type being read-only.
NS records at the zone apex stay locked for own_as_client users; the zone_content_edit_ns_subzone permission unlocks only subzone NS records.
A locked record renders read-only in the zone edit table: replicated (slave/consumer) zones entirely, SOA for non-"all" editors, and NS records caught by the own_as_client apex rule.
Details
static bool
levelAppliesToZone(string $level, bool $userIsZoneOwner)
Whether an "all" / "own" / "none" permission level applies to a zone the user does or does not own. Every *_own permission shares this algebra.
static bool
canEditZone(string $permEdit, bool $userIsZoneOwner)
Whether the user's edit permission level grants editing this zone at all, independent of the zone type being read-only.
static bool
isNsRecordLocked(string $recordType, string $permEdit, bool $permEditNsSubzone, string $recordName, string|null $zoneName)
NS records at the zone apex stay locked for own_as_client users; the zone_content_edit_ns_subzone permission unlocks only subzone NS records.
static bool
isRecordLocked(bool $zoneIsReadOnly, string $recordType, string $permEdit, bool $nsRecordLocked)
A locked record renders read-only in the zone edit table: replicated (slave/consumer) zones entirely, SOA for non-"all" editors, and NS records caught by the own_as_client apex rule.