DbUserRepository
class DbUserRepository implements UserRepositoryInterface (View source)
SQL persistence for accounts in the users table, with permission lookups through perm_templ and perm_items.
Methods
No description
Find a user by username
Every active account registered to an email address, ordered by username.
One recipient by id: id, username, fullname, email.
Every active account with a usable email address, ordered by id. The caller filters further by permission.
Every active account, with or without an email address, ordered by id.
The password-login row: id, fullname, password, active, email. LDAP accounts are excluded so a directory account cannot be logged into with a local hash.
The LDAP-login row: id, fullname, email, for active LDAP-enabled accounts only.
Whether the account is still active and still LDAP-enabled, re-checked on every request so a disabled account loses a cached LDAP bind at once.
Whether the account still exists and is active, re-checked on every request for sessions an identity provider established.
The HTTP Basic row: id, password, use_ldap, for active accounts only.
The stored auth_method for a username, or null when no such account exists.
Update a user's password
Get user by ID
Get a user's full name by ID
Full name of the user with exactly this username (accent-exact match), or null when there is none
Get the full names of all owners of a zone, comma-separated
Check if a user owns a zone directly or via group membership
No description
No description
No description
getDirectlyOwnedZoneIds() counted for many users in one query
findZoneLimit() for many users in one query
Lock the user's row until the open transaction ends, so zone limit checks for this user run one at a time
The user's own zone limit: null when none is set (the configured default applies), 0 when the user may own no zones
Set the user's own zone limit; null removes it so the configured default applies
Get all permissions for a specific user
Check if a user has admin permissions
Get a paginated list of users with zone counts
Get all users with the number of zones each one owns
Get detailed user list with template, group, and MFA info
Get total count of users in the system
Delete a user by ID
Get zones owned by a user
Transfer zone ownership from one user to another
Count total number of uberusers (super admins) in the system
How many active super admins would remain once $change is written. Inside an open transaction it locks the active super admin rows first, as isLastUberuser() does.
Whether a group the user belongs to grants the super admin permission, so changing the user's own template cannot take it away.
Check if a specific user is an uberuser
Check if a specific user is an uberuser
Ids of every user holding the ueberuser permission directly or through a group.
Check whether a permission template grants the uberuser permission
Names of the permissions a permission template grants
Id of the permission template with exactly this name, accent-exact so an IdP-asserted claim cannot map to a look-alike template.
Resolve every permission id carrying a given name
Insert a user created from an external identity (LDAP, OIDC or SAML).
Update the identity and template columns that external provisioning owns.
Get a user by username
Get a user by email
Id of the active user with exactly this email address, accent-exact so a look-alike address from an identity provider cannot resolve to another account.
Id of a disabled user with exactly this email address, matched the same way as findActiveUserIdByEmail().
The columns external provisioning compares before writing.
Count how many users share the given email address.
Assign permission template to a user
Check if a permission template exists
Details
__construct(object $db, ConfigurationInterface $config, bool $isApiBackend, LoggerInterface|null $logger = null)
No description
User|null
findByUsername(string $username)
Find a user by username
array
findActiveUsersByEmail(string $email)
Every active account registered to an email address, ordered by username.
array|null
findNotificationRecipient(int $userId)
One recipient by id: id, username, fullname, email.
array
listNotifiableUsers()
Every active account with a usable email address, ordered by id. The caller filters further by permission.
array
listActiveUsers()
Every active account, with or without an email address, ordered by id.
array|null
findSqlLoginUser(string $username)
The password-login row: id, fullname, password, active, email. LDAP accounts are excluded so a directory account cannot be logged into with a local hash.
array|null
findActiveLdapUser(string $username)
The LDAP-login row: id, fullname, email, for active LDAP-enabled accounts only.
bool
hasActiveLdapUser(string $username)
Whether the account is still active and still LDAP-enabled, re-checked on every request so a disabled account loses a cached LDAP bind at once.
bool
isActiveUser(int $userId)
Whether the account still exists and is active, re-checked on every request for sessions an identity provider established.
array|null
findBasicAuthUser(string $username)
The HTTP Basic row: id, password, use_ldap, for active accounts only.
array|null
findAuthMethodRow(string $username)
The stored auth_method for a username, or null when no such account exists.
The row is returned rather than the value so a missing account stays distinguishable from an account with no auth_method set.
bool
updatePassword(int $userId, string $hashedPassword)
Update a user's password
array|null
getUserById(int $userId)
Get user by ID
string|null
getFullNameById(int $userId)
Get a user's full name by ID
string|null
getFullNameByUsername(string $username)
Full name of the user with exactly this username (accent-exact match), or null when there is none
string
getZoneOwnerFullNames(int $domainId)
Get the full names of all owners of a zone, comma-separated
bool
userOwnsZone(int $userId, int $domainId)
Check if a user owns a zone directly or via group membership
array
getUserGroupIds(int $userId)
No description
array
getUserOwnedZoneIds(int $userId)
No description
array
getDirectlyOwnedZoneIds(int $userId)
No description
array
countDirectlyOwnedZones(array $userIds)
getDirectlyOwnedZoneIds() counted for many users in one query
array
findZoneLimits(array $userIds)
findZoneLimit() for many users in one query
void
lockForZoneLimit(int $userId)
Lock the user's row until the open transaction ends, so zone limit checks for this user run one at a time
int|null
findZoneLimit(int $userId)
The user's own zone limit: null when none is set (the configured default applies), 0 when the user may own no zones
bool
setZoneLimit(int $userId, int|null $limit)
Set the user's own zone limit; null removes it so the configured default applies
array
getUserPermissions(int $userId)
Get all permissions for a specific user
bool
hasAdminPermission(int $userId)
Check if a user has admin permissions
array
getUsersList(int $offset, int $limit, string|null $search = null, array $sort = [])
Get a paginated list of users with zone counts
array
getUsersWithZoneCounts()
Get all users with the number of zones each one owns
array
getUserDetailList(bool $ldapUse, int|null $restrictToUserId, int|null $specific = null, int|null $limit = null, int|null $offset = null, string|null $search = null)
Get detailed user list with template, group, and MFA info
int
getTotalUserCount(int|null $restrictToUserId = null, string|null $search = null)
Get total count of users in the system
bool
deleteUser(int $userId, int|null $sharedTemplateHeir = null)
Delete a user by ID
array
getUserZones(int $userId)
Get zones owned by a user
bool
transferUserZones(int $fromUserId, int $toUserId)
Transfer zone ownership from one user to another
int
countUberusers()
Count total number of uberusers (super admins) in the system
int
countUberusersAfter(UberuserChange $change)
How many active super admins would remain once $change is written. Inside an open transaction it locks the active super admin rows first, as isLastUberuser() does.
bool
holdsUberuserThroughGroup(int $userId)
Whether a group the user belongs to grants the super admin permission, so changing the user's own template cannot take it away.
bool
isLastUberuser(int $userId)
Check if a specific user is an uberuser
bool
isUberuser(int $userId)
Check if a specific user is an uberuser
array
getAdminUserIds()
Ids of every user holding the ueberuser permission directly or through a group.
bool
templateGrantsUberuser(int $permTemplId)
Check whether a permission template grants the uberuser permission
array
getTemplatePermissionNames(int $permTemplId)
Names of the permissions a permission template grants
int|null
findPermissionTemplateIdByName(string $name)
Id of the permission template with exactly this name, accent-exact so an IdP-asserted claim cannot map to a look-alike template.
array
getPermissionIdsByName(string $name)
Resolve every permission id carrying a given name
perm_items.name has no unique constraint, so a name can map to several rows and all of them grant the permission.
int|null
createUser(CreateUserCommand $user)
Create a new user
int
createProvisionedUser(array $userData)
Insert a user created from an external identity (LDAP, OIDC or SAML).
void
updateProvisionedUser(int $userId, array $fields)
Update the identity and template columns that external provisioning owns.
array|null
getUserByUsername(string $username)
Get a user by username
array|null
getUserByEmail(string $email)
Get a user by email
int|null
findActiveUserIdByEmail(string $email)
Id of the active user with exactly this email address, accent-exact so a look-alike address from an identity provider cannot resolve to another account.
int|null
findInactiveUserIdByEmail(string $email)
Id of a disabled user with exactly this email address, matched the same way as findActiveUserIdByEmail().
array
getProvisioningProfile(int $userId)
The columns external provisioning compares before writing.
int
countUsersByEmail(string $email)
Count how many users share the given email address.
bool
updateUser(int $userId, UpdateUserCommand $changes)
Update a user's information
bool
assignPermissionTemplate(int $userId, int $permTemplId)
Assign permission template to a user
bool
permissionTemplateExists(int $permTemplId, string|null $templateType = null)
Check if a permission template exists