AccessCollections.php

Go to the documentation of this file.

<?php

namespace Elgg\Database;

use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
use Elgg\Cache\AccessCache;
use Elgg\Config;
use Elgg\Database;
use Elgg\EventsService;
use Elgg\Exceptions\DatabaseException;
use Elgg\Exceptions\Database\UserFetchFailureException;
use Elgg\I18n\Translator;
use Elgg\SessionManagerService;
use Elgg\Traits\Loggable;
use Elgg\UserCapabilities;

class AccessCollections {

    use Loggable;

    public const TABLE_NAME = 'access_collections';
    
    public const MEMBERSHIP_TABLE_NAME = 'access_collection_membership';

    protected bool $init_complete = false;

    public function __construct(
        protected Config $config,
        protected Database $db,
        protected EntityTable $entities,
        protected UserCapabilities $capabilities,
        protected AccessCache $access_cache,
        protected EventsService $events,
        protected SessionManagerService $session_manager,
        protected Translator $translator) {
    }

    public function markInitComplete(): void {
        $this->init_complete = true;
    }

    public function getAccessArray(int $user_guid = 0, bool $flush = false): array {
        $cache = $this->access_cache;

        if ($flush) {
            $cache->clear();
        }

        if ($user_guid === 0) {
            $user_guid = $this->session_manager->getLoggedInUserGuid();
        }

        $hash = $user_guid . 'get_access_array';
        
        $access_array = $cache->load($hash);
        if ($access_array === null) {
            // Public access is always visible
            $access_array = [ACCESS_PUBLIC];

            // The following can only return sensible data for a known user.
            if ($user_guid) {
                $access_array[] = ACCESS_LOGGED_IN;

                // Get ACLs that user owns or is a member of
                $select = Select::fromTable(self::TABLE_NAME);

                $membership_query = $select->subquery(self::MEMBERSHIP_TABLE_NAME);
                $membership_query->select('access_collection_id')
                    ->where($select->compare('user_guid', '=', $user_guid, ELGG_VALUE_GUID));

                $select->select('id')
                    ->where($select->compare('owner_guid', '=', $user_guid, ELGG_VALUE_GUID))
                    ->orWhere($select->compare('id', 'in', $membership_query->getSQL()));

                $collections = $this->db->getData($select);
                if (!empty($collections)) {
                    foreach ($collections as $collection) {
                        $access_array[] = (int) $collection->id;
                    }
                }

                $ignore_access = $this->capabilities->canBypassPermissionsCheck($user_guid);

                if ($ignore_access === true) {
                    $access_array[] = ACCESS_PRIVATE;
                }
            }

            if ($this->init_complete) {
                $cache->save($hash, $access_array);
            }
        }

        $options = [
            'user_id' => $user_guid,
        ];

        // see the warning in the docs for this function about infinite loop potential
        return $this->events->triggerResults('access:collections:read', 'user', $options, $access_array);
    }

    public function hasAccessToEntity(\ElggEntity $entity, int $user_guid = 0): bool {
        if ($entity->access_id === ACCESS_PUBLIC) {
            // Public entities are always accessible
            return true;
        }

        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
            $user_guid = $user ? $user->guid : 0; // No GUID given and not logged in
        } catch (UserFetchFailureException $e) {
            // Not a user GUID
            $user_guid = 0;
        }

        if ($user_guid === $entity->owner_guid) {
            // Owners have access to their own content
            return true;
        }

        if (!empty($user_guid) && $entity->access_id === ACCESS_LOGGED_IN) {
            // Existing users have access to entities with logged in access
            return true;
        }

        // See #7159. Must not allow ignore access to affect query
        $row = elgg_call(ELGG_ENFORCE_ACCESS, function() use ($entity, $user_guid) {
            return $this->entities->getRow($entity->guid, $user_guid);
        });
        
        return !empty($row);
    }

    public function getWriteAccessArray(int $user_guid = 0, bool $flush = false, array $input_params = []): array {
        $cache = $this->access_cache;

        if ($flush) {
            $cache->clear();
        }

        if ($user_guid === 0) {
            $user_guid = $this->session_manager->getLoggedInUserGuid();
        }

        $hash = $user_guid . 'get_write_access_array';
        
        $access_array = $cache->load($hash);
        if ($access_array === null) {
            $access_array = [
                ACCESS_PRIVATE => $this->getReadableAccessLevel(ACCESS_PRIVATE),
                ACCESS_LOGGED_IN => $this->getReadableAccessLevel(ACCESS_LOGGED_IN),
                ACCESS_PUBLIC => $this->getReadableAccessLevel(ACCESS_PUBLIC),
            ];

            $access_array += $this->getCollectionsForWriteAccess($user_guid);
            
            if ($this->init_complete) {
                $cache->save($hash, $access_array);
            }
        }

        $options = [
            'user_id' => $user_guid,
            'input_params' => $input_params,
        ];
        
        $access_array = $this->events->triggerResults('access:collections:write', 'user', $options, $access_array);
        
        // move logged in and public to the end of the array
        foreach ([ACCESS_LOGGED_IN, ACCESS_PUBLIC] as $access) {
            if (!isset($access_array[$access])) {
                continue;
            }
        
            $temp = $access_array[$access];
            unset($access_array[$access]);
            $access_array[$access] = $temp;
        }
        
        
        return $access_array;
    }
    
    protected function getCollectionsForWriteAccess(int $owner_guid): array {
        $subtypes = $this->events->triggerResults('access:collections:write:subtypes', 'user', ['owner_guid' => $owner_guid], []);
        
        $select = Select::fromTable(self::TABLE_NAME);
        
        $ors = [
            $select->compare('subtype', 'is null'),
        ];
        if (!empty($subtypes)) {
            $ors[] = $select->compare('subtype', 'in', $subtypes, ELGG_VALUE_STRING);
        }
        
        $select->select('*')
            ->where($select->compare('owner_guid', '=', $owner_guid, ELGG_VALUE_GUID))
            ->andWhere($select->merge($ors, 'OR'))
            ->orderBy('name', 'ASC');
        
        $collections = $this->db->getData($select, [$this, 'rowToElggAccessCollection']);
        if (empty($collections)) {
            return [];
        }
        
        $result = [];
        foreach ($collections as $collection) {
            $result[$collection->id] = $collection->getDisplayName();
        }
        
        return $result;
    }

    public function canEdit(int $collection_id, ?int $user_guid = null): bool {
        try {
            $user = $this->entities->getUserForPermissionsCheck($user_guid);
        } catch (UserFetchFailureException $e) {
            return false;
        }

        if (!$user instanceof \ElggUser) {
            return false;
        }
        
        $collection = $this->get($collection_id);
        if (!$collection instanceof \ElggAccessCollection) {
            return false;
        }

        if ($this->capabilities->canBypassPermissionsCheck($user->guid)) {
            return true;
        }

        $write_access = $this->getWriteAccessArray($user->guid, true);
        return array_key_exists($collection_id, $write_access);
    }

    public function create(\ElggAccessCollection $acl): bool {
        if (!empty($acl->id)) {
            return $this->update($acl);
        }
        
        return $this->events->triggerSequence('create', $acl->getType(), $acl, function (\ElggAccessCollection $acl) {
            $insert = Insert::intoTable(self::TABLE_NAME);
            $insert->values([
                'name' => $insert->param($acl->name, ELGG_VALUE_STRING),
                'subtype' => $insert->param($acl->subtype, ELGG_VALUE_STRING),
                'owner_guid' => $insert->param($acl->owner_guid, ELGG_VALUE_GUID),
            ]);
            
            $id = $this->db->insertData($insert);
            if (empty($id)) {
                return false;
            }
            
            $acl->id = $id;
            
            $this->access_cache->clear();
            
            return true;
        });
    }

    public function update(\ElggAccessCollection $acl): bool {
        if (empty($acl->id)) {
            return $this->create($acl);
        }
        
        return $this->events->triggerSequence('update', $acl->getType(), $acl, function (\ElggAccessCollection $acl) {
            $update = Update::table(self::TABLE_NAME);
            $update->set('name', $update->param($acl->name, ELGG_VALUE_STRING))
                ->set('subtype', $update->param($acl->subtype, ELGG_VALUE_STRING))
                ->set('owner_guid', $update->param($acl->owner_guid, ELGG_VALUE_GUID))
                ->where($update->compare('id', '=', $acl->id, ELGG_VALUE_ID));
            
            if (!$this->db->updateData($update)) {
                return false;
            }
            
            $this->access_cache->clear();
            
            return true;
        });
    }

    public function delete(\ElggAccessCollection $acl): bool {
        if (empty($acl->id)) {
            return false;
        }
        
        return $this->events->triggerSequence('delete', $acl->getType(), $acl, function (\ElggAccessCollection $acl) {
            $delete = Delete::fromTable(self::TABLE_NAME);
            $delete->where($delete->compare('id', '=', $acl->id, ELGG_VALUE_ID));
            
            if (!$this->db->deleteData($delete)) {
                return false;
            }
            
            // cleanup access collection membership (doesn't affect the result of deleting the ACL)
            $delete_membership = Delete::fromTable(self::MEMBERSHIP_TABLE_NAME);
            $delete_membership->where($delete_membership->compare('access_collection_id', '=', $acl->id, ELGG_VALUE_ID));
            
            $this->db->deleteData($delete_membership);
            
            // clear cache
            $this->access_cache->clear();
            
            return true;
        });
    }

    public function rowToElggAccessCollection(\stdClass $row): \ElggAccessCollection {
        return new \ElggAccessCollection($row);
    }

    public function get(int $collection_id): ?\ElggAccessCollection {
        $query = Select::fromTable(self::TABLE_NAME);
        $query->select('*')
            ->where($query->compare('id', '=', $collection_id, ELGG_VALUE_ID));
        
        return $this->db->getDataRow($query, [$this, 'rowToElggAccessCollection']) ?: null;
    }

    public function hasUser(int $user_guid, int $collection_id): bool {
        $options = [
            'guids' => $user_guid,
            'count' => true,
        ];
        return (bool) $this->getMembers($collection_id, $options);
    }

    public function addUser(int $user_guid, int $collection_id): bool {
        $collection = $this->get($collection_id);
        if (!$collection instanceof \ElggAccessCollection) {
            return false;
        }
        
        $user = $this->entities->get($user_guid);
        if (!$user instanceof \ElggUser) {
            return false;
        }

        $event_params = [
            'collection_id' => $collection->id,
            'user_guid' => $user_guid
        ];

        // @todo https://github.com/Elgg/Elgg/issues/10823
        $result = $this->events->triggerResults('access:collections:add_user', 'collection', $event_params, true);
        if ($result === false) {
            return false;
        }

        // if someone tries to insert the same data twice, we catch the exception and return true
        $insert = Insert::intoTable(self::MEMBERSHIP_TABLE_NAME);
        $insert->values([
            'access_collection_id' => $insert->param($collection_id, ELGG_VALUE_ID),
            'user_guid' => $insert->param($user_guid, ELGG_VALUE_GUID),
        ]);
        
        try {
            $result = $this->db->insertData($insert);
        } catch (DatabaseException $e) {
            $prev = $e->getPrevious();
            if ($prev instanceof UniqueConstraintViolationException) {
                // duplicate key exception, catched for performance reasons
                return true;
            }
            
            throw $e;
        }

        $this->access_cache->clear();

        return $result !== false;
    }

    public function removeUser(int $user_guid, int $collection_id): bool {

        $params = [
            'collection_id' => $collection_id,
            'user_guid' => $user_guid,
        ];

        // @todo https://github.com/Elgg/Elgg/issues/10823
        if (!$this->events->triggerResults('access:collections:remove_user', 'collection', $params, true)) {
            return false;
        }

        $delete = Delete::fromTable(self::MEMBERSHIP_TABLE_NAME);
        $delete->where($delete->compare('access_collection_id', '=', $collection_id, ELGG_VALUE_ID))
            ->andWhere($delete->compare('user_guid', '=', $user_guid, ELGG_VALUE_GUID));
        
        $this->access_cache->clear();

        return (bool) $this->db->deleteData($delete);
    }

    public function getEntityCollections(array $options = []): array {
        $supported_options = ['owner_guid', 'subtype'];

        $select = Select::fromTable(self::TABLE_NAME);
        $select->select('*')
            ->orderBy('name', 'ASC');

        foreach ($supported_options as $option) {
            $option_value = elgg_extract($option, $options);
            if (!isset($option_value)) {
                continue;
            }

            switch ($option) {
                case 'owner_guid':
                    $select->andWhere($select->compare($option, '=', $option_value, ELGG_VALUE_GUID));
                    break;
                case 'subtype':
                    $select->andWhere($select->compare($option, '=', $option_value, ELGG_VALUE_STRING));
                    break;
            }
        }

        return $this->db->getData($select, [$this, 'rowToElggAccessCollection']);
    }

    public function getMembers(int $collection_id, array $options = []) {
        $options['wheres'][] = function(QueryBuilder $qb, $table_alias) use ($collection_id) {
            $qb->join($table_alias, self::MEMBERSHIP_TABLE_NAME, 'acm', $qb->compare('acm.user_guid', '=', "{$table_alias}.guid"));

            return $qb->compare('acm.access_collection_id', '=', $collection_id, ELGG_VALUE_INTEGER);
        };

        return Entities::find($options);
    }

    public function getCollectionsByMember(int $member_guid): array {
        $select = Select::fromTable(self::TABLE_NAME, 'ac');
        $select->join($select->getTableAlias(), self::MEMBERSHIP_TABLE_NAME, 'acm', $select->compare("{$select->getTableAlias()}.id", '=', 'acm.access_collection_id'));

        $select->select("{$select->getTableAlias()}.*")
            ->where($select->compare('acm.user_guid', '=', $member_guid, ELGG_VALUE_GUID))
            ->orderBy('name', 'ASC');

        return $this->db->getData($select, [$this, 'rowToElggAccessCollection']);
    }

    public function getReadableAccessLevel(int $entity_access_id): string {
        $translator = $this->translator;

        // Check if entity access id is a defined global constant
        $access_array = [
            ACCESS_PRIVATE => $translator->translate('access:label:private'),
            ACCESS_FRIENDS => $translator->translate('access:label:friends'),
            ACCESS_LOGGED_IN => $translator->translate('access:label:logged_in'),
            ACCESS_PUBLIC => $translator->translate('access:label:public'),
        ];

        if (array_key_exists($entity_access_id, $access_array)) {
            return $access_array[$entity_access_id];
        }

        // Entity access id is probably a custom access collection
        // Check if the user has write access to it and can see it's label
        // Admins should always be able to see the readable version
        $collection = $this->get($entity_access_id);

        if (!$collection instanceof \ElggAccessCollection || !$collection->canEdit()) {
            // return 'Limited' if the collection can not be loaded or it can not be edited
            return $translator->translate('access:limited:label');
        }

        return $collection->getDisplayName();
    }
}