AccessCollections.php

Go to the documentation of this file.

<?php

namespace Elgg\Database;

use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
use Elgg\Config;
use Elgg\Database;
use Elgg\Exceptions\DatabaseException;
use Elgg\Exceptions\Database\UserFetchFailureException;
use Elgg\I18n\Translator;
use Elgg\PluginHooksService;
use Elgg\Traits\Loggable;
use Elgg\UserCapabilities;

class AccessCollections {

    use Loggable;

    const TABLE_NAME = 'access_collections';
    
    const MEMBERSHIP_TABLE_NAME = 'access_collection_membership';

    protected $config;

    protected $db;

    protected $access_cache;

    protected $hooks;

    protected $session;

    protected $entities;

    protected $capabilities;

    protected $translator;

    protected $init_complete = false;

    public function __construct(
        Config $config,
        Database $db,
        EntityTable $entities,
        UserCapabilities $capabilities,
        \ElggCache $cache,
        PluginHooksService $hooks,
        \ElggSession $session,
        Translator $translator) {
        $this->config = $config;
        $this->db = $db;
        $this->entities = $entities;
        $this->capabilities = $capabilities;
        $this->access_cache = $cache;
        $this->hooks = $hooks;
        $this->session = $session;
        $this->translator = $translator;
    }

    public function markInitComplete() {
        $this->init_complete = true;
    }

    public function getAccessArray(int $user_guid = 0, bool $flush = false) {
        $cache = $this->access_cache;

        if ($flush) {
            $cache->clear();
        }

        if ($user_guid == 0) {
            $user_guid = $this->session->getLoggedInUserGuid();
        }

        $hash = $user_guid . 'get_access_array';

        if ($cache[$hash]) {
            $access_array = $cache[$hash];
        } else {
            // Public access is always visible
            $access_array = [ACCESS_PUBLIC];

            // The following can only return sensible data for a known user.
            if ($user_guid) {
                $access_array[] = ACCESS_LOGGED_IN;

                // Get ACLs that user owns or is a member of
                $select = Select::fromTable(self::TABLE_NAME);

                $membership_query = $select->subquery(self::MEMBERSHIP_TABLE_NAME);
                $membership_query->select('access_collection_id')
                    ->where($select->compare('user_guid', '=', $user_guid, ELGG_VALUE_GUID));

                $select->select('id')
                    ->where($select->compare('owner_guid', '=', $user_guid, ELGG_VALUE_GUID))
                    ->orWhere($select->compare('id', 'in', $membership_query->getSQL()));

                $collections = $this->db->getData($select);
                if (!empty($collections)) {
                    foreach ($collections as $collection) {
                        $access_array[] = (int) $collection->id;
                    }
                }

                $ignore_access = $this->capabilities->canBypassPermissionsCheck($user_guid);

                if ($ignore_access === true) {
                    $access_array[] = ACCESS_PRIVATE;
                }
            }

            if ($this->init_complete) {
                $cache[$hash] = $access_array;
            }
        }

        $options = [
            'user_id' => $user_guid,
        ];

        // see the warning in the docs for this function about infinite loop potential
        return $this->hooks->trigger('access:collections:read', 'user', $options, $access_array);
    }

    public function hasAccessToEntity(\ElggEntity $entity, int $user_guid = 0): bool {
        if ($entity->access_id == ACCESS_PUBLIC) {
            // Public entities are always accessible
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
            $user_guid = $user ? $user->guid : 0; // No GUID given and not logged in
        } catch (UserFetchFailureException $e) {
            // Not a user GUID
            $user_guid = 0;
        }

        if ($user_guid === $entity->owner_guid) {
            // Owners have access to their own content
            return true;
        }

        if (!empty($user_guid )&& $entity->access_id === ACCESS_LOGGED_IN) {
            // Existing users have access to entities with logged in access
            return true;
        }

        // See #7159. Must not allow ignore access to affect query
        $row = elgg_call(ELGG_ENFORCE_ACCESS, function() use ($entity, $user_guid) {
            return $this->entities->getRow($entity->guid, $user_guid);
        });
        
        return !empty($row);
    }

    public function getWriteAccessArray($user_guid = 0, $flush = false, array $input_params = []) {
        $cache = $this->access_cache;

        if ($flush) {
            $cache->clear();
        }

        if ($user_guid == 0) {
            $user_guid = $this->session->getLoggedInUserGuid();
        }

        $user_guid = (int) $user_guid;

        $hash = $user_guid . 'get_write_access_array';

        if ($cache[$hash]) {
            $access_array = $cache[$hash];
        } else {
            $access_array = [
                ACCESS_PRIVATE => $this->getReadableAccessLevel(ACCESS_PRIVATE),
                ACCESS_LOGGED_IN => $this->getReadableAccessLevel(ACCESS_LOGGED_IN),
                ACCESS_PUBLIC => $this->getReadableAccessLevel(ACCESS_PUBLIC)
            ];

            $access_array += $this->getCollectionsForWriteAccess($user_guid);
            
            if ($this->init_complete) {
                $cache[$hash] = $access_array;
            }
        }

        $options = [
            'user_id' => $user_guid,
            'input_params' => $input_params,
        ];
        
        $access_array = $this->hooks->trigger('access:collections:write', 'user', $options, $access_array);
        
        // move logged in and public to the end of the array
        foreach ([ACCESS_LOGGED_IN, ACCESS_PUBLIC] as $access) {
            if (!isset($access_array[$access])) {
                continue;
            }
        
            $temp = $access_array[$access];
            unset($access_array[$access]);
            $access_array[$access] = $temp;
        }
        
        
        return $access_array;
    }
    
    protected function getCollectionsForWriteAccess(int $owner_guid) {
        $subtypes =  $this->hooks->trigger('access:collections:write:subtypes', 'user', ['owner_guid' => $owner_guid], []);
        
        $select = Select::fromTable(self::TABLE_NAME);
        
        $ors = [
            $select->compare('subtype', 'is null'),
        ];
        if (!empty($subtypes)) {
            $ors[] = $select->compare('subtype', 'in', $subtypes, ELGG_VALUE_STRING);
        }
        
        $select->select('*')
            ->where($select->compare('owner_guid', '=', $owner_guid, ELGG_VALUE_GUID))
            ->andWhere($select->merge($ors, 'OR'))
            ->orderBy('name', 'ASC');
        
        $collections = $this->db->getData($select, [$this, 'rowToElggAccessCollection']);
        if (empty($collections)) {
            return [];
        }
        
        $result = [];
        foreach ($collections as $collection) {
            $result[$collection->id] = $collection->getDisplayName();
        }
        
        return $result;
    }

    public function canEdit(int $collection_id, int $user_guid = null) {
        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        if (!$user instanceof \ElggUser) {
            return false;
        }
        
        $collection = $this->get($collection_id);
        if (!$collection instanceof \ElggAccessCollection) {
            return false;
        }

        if ($this->capabilities->canBypassPermissionsCheck($user->guid)) {
            return true;
        }

        $write_access = $this->getWriteAccessArray($user->guid, true);
        return array_key_exists($collection_id, $write_access);
    }

    public function create(string $name, int $owner_guid = 0, string $subtype = null): ?int {
        $name = trim($name);
        if (empty($name)) {
            return null;
        }

        if (isset($subtype)) {
            $subtype = trim($subtype);
            if (strlen($subtype) > 255) {
                $this->getLogger()->error("The subtype length for access collections cannot be greater than 255");
                return null;
            }
        }

        if ($owner_guid === 0) {
            $owner_guid = $this->session->getLoggedInUserGuid();
        }

        $insert = Insert::intoTable(self::TABLE_NAME);
        $insert->values([
            'name' => $insert->param($name, ELGG_VALUE_STRING),
            'subtype' => $insert->param($subtype, ELGG_VALUE_STRING),
            'owner_guid' => $insert->param($owner_guid, ELGG_VALUE_GUID),
        ]);

        $id = $this->db->insertData($insert);
        if (empty($id)) {
            return null;
        }

        $this->access_cache->clear();

        $hook_params = [
            'collection_id' => $id,
            'name' => $name,
            'subtype' => $subtype,
            'owner_guid' => $owner_guid,
        ];

        if (!$this->hooks->trigger('access:collections:addcollection', 'collection', $hook_params, true)) {
            $this->delete($id);
            return null;
        }

        return $id;
    }

    public function rename(int $collection_id, string $name): bool {

        $update = Update::table(self::TABLE_NAME);
        $update->set('name', $update->param($name, ELGG_VALUE_STRING))
            ->where($update->compare('id', '=', $collection_id, ELGG_VALUE_ID));

        if ($this->db->updateData($update, true)) {
            $this->access_cache->clear();

            return true;
        }

        return false;
    }

    public function update($collection_id, array $new_members = []) {
        $acl = $this->get($collection_id);

        if (!$acl instanceof \ElggAccessCollection) {
            return false;
        }

        $to_guid = function($elem) {
            if (empty($elem)) {
                return 0;
            }
            if (is_object($elem)) {
                return (int) $elem->guid;
            }
            return (int) $elem;
        };

        $current_members = [];
        $new_members = array_map($to_guid, $new_members);

        $current_members_batch = $this->getMembers($collection_id, [
            'batch' => true,
            'limit' => false,
            'callback' => false,
        ]);

        foreach ($current_members_batch as $row) {
            $current_members[] = $to_guid($row);
        }

        $remove_members = array_diff($current_members, $new_members);
        $add_members = array_diff($new_members, $current_members);

        $result = true;

        foreach ($add_members as $guid) {
            $result = $result && $this->addUser($guid, $collection_id);
        }

        foreach ($remove_members as $guid) {
            $result = $result && $this->removeUser($guid, $collection_id);
        }

        $this->access_cache->clear();

        return $result;
    }

    public function delete(int $collection_id): bool {
        $params = [
            'collection_id' => $collection_id,
        ];

        if (!$this->hooks->trigger('access:collections:deletecollection', 'collection', $params, true)) {
            return false;
        }

        // Deleting membership doesn't affect result of deleting ACL.
        $delete_membership = Delete::fromTable(self::MEMBERSHIP_TABLE_NAME);
        $delete_membership->where($delete_membership->compare('access_collection_id', '=', $collection_id, ELGG_VALUE_ID));
        
        $this->db->deleteData($delete_membership);

        $delete = Delete::fromTable(self::TABLE_NAME);
        $delete->where($delete->compare('id', '=', $collection_id, ELGG_VALUE_ID));

        $result = $this->db->deleteData($delete);

        $this->access_cache->clear();

        return (bool) $result;
    }

    public function rowToElggAccessCollection(\stdClass $row): \ElggAccessCollection {
        return new \ElggAccessCollection($row);
    }

    public function get(int $collection_id): ?\ElggAccessCollection {
        $query = Select::fromTable(self::TABLE_NAME);
        $query->select('*')
            ->where($query->compare('id', '=', $collection_id, ELGG_VALUE_ID));
        
        return $this->db->getDataRow($query, [$this, 'rowToElggAccessCollection']) ?: null;
    }

    public function hasUser($user_guid, $collection_id) {
        $options = [
            'guids' => (int) $user_guid,
            'count' => true,
        ];
        return (bool) $this->getMembers($collection_id, $options);
    }

    public function addUser(int $user_guid, int $collection_id): bool {

        $collection = $this->get($collection_id);
        if (!$collection instanceof \ElggAccessCollection) {
            return false;
        }
        
        $user = $this->entities->get($user_guid);
        if (!$user instanceof \ElggUser) {
            return false;
        }

        $hook_params = [
            'collection_id' => $collection->id,
            'user_guid' => $user_guid
        ];

        $result = $this->hooks->trigger('access:collections:add_user', 'collection', $hook_params, true);
        if ($result == false) {
            return false;
        }

        // if someone tries to insert the same data twice, we catch the exception and return true
        $insert = Insert::intoTable(self::MEMBERSHIP_TABLE_NAME);
        $insert->values([
            'access_collection_id' => $insert->param($collection_id, ELGG_VALUE_ID),
            'user_guid' => $insert->param($user_guid, ELGG_VALUE_GUID),
        ]);
        
        try {
            $result = $this->db->insertData($insert);
        } catch (DatabaseException $e) {
            $prev = $e->getPrevious();
            if ($prev instanceof UniqueConstraintViolationException) {
                // duplicate key exception, catched for performance reasons
                return true;
            }
            
            throw $e;
        }

        $this->access_cache->clear();

        return $result !== false;
    }

    public function removeUser(int $user_guid, int $collection_id): bool {

        $params = [
            'collection_id' => $collection_id,
            'user_guid' => $user_guid,
        ];

        if (!$this->hooks->trigger('access:collections:remove_user', 'collection', $params, true)) {
            return false;
        }

        $delete = Delete::fromTable(self::MEMBERSHIP_TABLE_NAME);
        $delete->where($delete->compare('access_collection_id', '=', $collection_id, ELGG_VALUE_ID))
            ->andWhere($delete->compare('user_guid', '=', $user_guid, ELGG_VALUE_GUID));
        
        $this->access_cache->clear();

        return (bool) $this->db->deleteData($delete);
    }

    public function getEntityCollections(array $options = []): array {
        $supported_options = ['owner_guid', 'subtype'];

        $select = Select::fromTable(self::TABLE_NAME);
        $select->select('*')
            ->orderBy('name', 'ASC');

        foreach ($supported_options as $option) {
            $option_value = elgg_extract($option, $options);
            if (!isset($option_value)) {
                continue;
            }

            switch ($option) {
                case 'owner_guid':
                    $select->andWhere($select->compare($option, '=', $option_value, ELGG_VALUE_GUID));
                    break;
                case 'subtype':
                    $select->andWhere($select->compare($option, '=', $option_value, ELGG_VALUE_STRING));
                    break;
            }
        }

        return $this->db->getData($select, [$this, 'rowToElggAccessCollection']);
    }

    public function getMembers(int $collection_id, array $options = []) {
        $options['wheres'][] = function(QueryBuilder $qb, $table_alias) use ($collection_id) {
            $qb->join($table_alias, self::MEMBERSHIP_TABLE_NAME, 'acm', $qb->compare('acm.user_guid', '=', "{$table_alias}.guid"));

            return $qb->compare('acm.access_collection_id', '=', $collection_id, ELGG_VALUE_INTEGER);
        };

        return Entities::find($options);
    }

    public function getCollectionsByMember(int $member_guid): array {
        $select = Select::fromTable(self::TABLE_NAME, 'ac');
        $select->join('ac', self::MEMBERSHIP_TABLE_NAME, 'acm', $select->compare('ac.id', '=', 'acm.access_collection_id'));

        $select->select('ac.*')
            ->where($select->compare('acm.user_guid', '=', $member_guid, ELGG_VALUE_GUID))
            ->orderBy('name', 'ASC');

        return $this->db->getData($select, [$this, 'rowToElggAccessCollection']);
    }

    public function getReadableAccessLevel(int $entity_access_id) {
        $translator = $this->translator;

        // Check if entity access id is a defined global constant
        $access_array = [
            ACCESS_PRIVATE => $translator->translate('access:label:private'),
            ACCESS_FRIENDS => $translator->translate('access:label:friends'),
            ACCESS_LOGGED_IN => $translator->translate('access:label:logged_in'),
            ACCESS_PUBLIC => $translator->translate('access:label:public'),
        ];

        if (array_key_exists($entity_access_id, $access_array)) {
            return $access_array[$entity_access_id];
        }

        // Entity access id is probably a custom access collection
        // Check if the user has write access to it and can see it's label
        // Admins should always be able to see the readable version
        $collection = $this->get($entity_access_id);

        if (!$collection instanceof \ElggAccessCollection || !$collection->canEdit()) {
            // return 'Limited' if the collection can not be loaded or it can not be edited
            return $translator->translate('access:limited:label');
        }

        return $collection->getDisplayName();
    }
}