SharedZoneIds
final class SharedZoneIds (View source)
Ownership under a zone id collision in API backend mode.
A zone this application created and a zone migrated from SQL mode can share a canonical id. The id then resolves to one of them (see CanonicalZoneSql::selectByZoneId()), but the extra-owner rows and group grants keyed by that id belong to both, so they would let the other zone's owners act on it. For a shared id only the direct owner of the row it resolves to counts.
Methods
The direct owner of the zone a shared id resolves to, or null when it has none.
Before the zones row $rowId is removed: when it is the zone an id opens and another row matches that id, point the API key scopes on the id at zone 0, which matches no zone.
Before the named zones rows $rowIds are removed by a path that keeps the grants on their ids: an id one of them opens that another named row still matches opens that row afterwards, so its API key scopes move to zone 0 and its grants and extra owners go.
Point the API key scopes on $zoneId at zone 0, which matches no zone, and return the keys that had one. Deleting the rows instead would leave a key with none, which means unrestricted.
Whether the user is the direct owner of the zone a shared id resolves to.
The name of the zone each shared id opens, keyed by that id. A list built from the backend's zone list keeps only these zones for a shared id.
Whether a zone from the backend's zone list is the one its id opens.
SQL selecting every shared canonical id, for queries that filter in SQL.
The user's owned zone ids without the shared ones whose resolved zone they do not own directly.
Details
static void
forget(PDO $db)
No description
static bool
isShared(PDO $db, int $zoneId)
Whether more than one named zone has this canonical id.
static int|null
resolvedOwner(PDO $db, int $zoneId)
The direct owner of the zone a shared id resolves to, or null when it has none.
static void
unscopeApiKeysFromOpenedRow(PDO $db, int $zoneId, int $rowId, LoggerInterface $logger)
Before the zones row $rowId is removed: when it is the zone an id opens and another row matches that id, point the API key scopes on the id at zone 0, which matches no zone.
Once the row is gone the id opens that other zone, which those keys were never restricted to.
static void
releaseIdsOpenedByRows(PDO $db, array $rowIds, LoggerInterface $logger)
Before the named zones rows $rowIds are removed by a path that keeps the grants on their ids: an id one of them opens that another named row still matches opens that row afterwards, so its API key scopes move to zone 0 and its grants and extra owners go.
static array
pointApiKeyScopesAtNoZone(PDO $db, int $zoneId)
Point the API key scopes on $zoneId at zone 0, which matches no zone, and return the keys that had one. Deleting the rows instead would leave a key with none, which means unrestricted.
static bool
ownsResolvedZone(PDO $db, int $userId, int $zoneId)
Whether the user is the direct owner of the zone a shared id resolves to.
static array
all(PDO $db)
Every shared canonical id.
static array
openedNames(PDO $db)
The name of the zone each shared id opens, keyed by that id. A list built from the backend's zone list keeps only these zones for a shared id.
static bool
isOpenedZone(array $openedNames, array $zone)
Whether a zone from the backend's zone list is the one its id opens.
static string
sharedIdsSql()
SQL selecting every shared canonical id, for queries that filter in SQL.
static array
sharedAmong(PDO $db, array $zoneIds)
The ids among $zoneIds that more than one named zone shares.
static array
filterOwned(PDO $db, int $userId, array $zoneIds)
The user's owned zone ids without the shared ones whose resolved zone they do not own directly.