ahmido
e241e27853
Implements the Settings foundation workspace controls. Includes: - Settings foundation UI/controls scoped to workspace context - Related onboarding/consent flow adjustments as included in branch history Testing: - `vendor/bin/sail artisan test --compact --no-ansi --filter=SettingsFoundation` Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de> Reviewed-on: #119
103 lines
4.0 KiB
PHP
103 lines
4.0 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Auth;
|
|
|
|
use App\Support\Auth\Capabilities;
|
|
use App\Support\Auth\WorkspaceRole;
|
|
|
|
/**
|
|
* Workspace Role to Capability Mapping (Single Source of Truth)
|
|
*
|
|
* This class defines which capabilities each workspace role has.
|
|
* All capability strings MUST be references from the Capabilities registry.
|
|
*/
|
|
class WorkspaceRoleCapabilityMap
|
|
{
|
|
/**
|
|
* @var array<string, array<int, string>>
|
|
*/
|
|
private static array $roleCapabilities = [
|
|
WorkspaceRole::Owner->value => [
|
|
Capabilities::WORKSPACE_VIEW,
|
|
Capabilities::WORKSPACE_MANAGE,
|
|
Capabilities::WORKSPACE_ARCHIVE,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_ACTIVATE,
|
|
Capabilities::WORKSPACE_SETTINGS_VIEW,
|
|
Capabilities::WORKSPACE_SETTINGS_MANAGE,
|
|
],
|
|
|
|
WorkspaceRole::Manager->value => [
|
|
Capabilities::WORKSPACE_VIEW,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
|
|
Capabilities::WORKSPACE_SETTINGS_VIEW,
|
|
Capabilities::WORKSPACE_SETTINGS_MANAGE,
|
|
],
|
|
|
|
WorkspaceRole::Operator->value => [
|
|
Capabilities::WORKSPACE_VIEW,
|
|
Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
|
|
Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
|
|
Capabilities::WORKSPACE_SETTINGS_VIEW,
|
|
],
|
|
|
|
WorkspaceRole::Readonly->value => [
|
|
Capabilities::WORKSPACE_VIEW,
|
|
Capabilities::WORKSPACE_SETTINGS_VIEW,
|
|
],
|
|
];
|
|
|
|
/**
|
|
* @return array<string>
|
|
*/
|
|
public static function getCapabilities(WorkspaceRole|string $role): array
|
|
{
|
|
$roleValue = $role instanceof WorkspaceRole ? $role->value : $role;
|
|
|
|
return self::$roleCapabilities[$roleValue] ?? [];
|
|
}
|
|
|
|
/**
|
|
* @return array<string>
|
|
*/
|
|
public static function rolesWithCapability(string $capability): array
|
|
{
|
|
$roles = [];
|
|
|
|
foreach (self::$roleCapabilities as $role => $capabilities) {
|
|
if (in_array($capability, $capabilities, true)) {
|
|
$roles[] = $role;
|
|
}
|
|
}
|
|
|
|
return $roles;
|
|
}
|
|
|
|
public static function hasCapability(WorkspaceRole|string $role, string $capability): bool
|
|
{
|
|
return in_array($capability, self::getCapabilities($role), true);
|
|
}
|
|
}
|