generated from jric11/baseProject
48 lines
2.4 KiB
PHP
48 lines
2.4 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
/** Club permissions are looked up on each request, never trusted from form fields. */
|
||
|
|
class TenantAccess extends Base {
|
||
|
|
|
||
|
|
public const SUPER = 'Super System Administrator';
|
||
|
|
|
||
|
|
public function isSuper(?PDO $db = null, ?int $user = null): bool {
|
||
|
|
$stmt = ($db ?? $this->connect())->prepare("SELECT 1 FROM users WHERE user_serial=? AND user_role=? AND user_status='active' LOCK IN SHARE MODE");
|
||
|
|
$stmt->execute([$user ?? ($_SESSION[self::USER_SERIAL] ?? 0), self::SUPER]);
|
||
|
|
return (bool) $stmt->fetchColumn();
|
||
|
|
}
|
||
|
|
|
||
|
|
public function requireSuper(?PDO $db = null): void {
|
||
|
|
if (!$this->isSuper($db))
|
||
|
|
throw new AppException('Only a Super System Administrator may manage global accounts and settings.', 403);
|
||
|
|
}
|
||
|
|
|
||
|
|
public function canManage(int $club, ?PDO $db = null, ?int $user = null): bool {
|
||
|
|
$db ??= $this->connect();
|
||
|
|
$user ??= (int) ($_SESSION[self::USER_SERIAL] ?? 0);
|
||
|
|
if ($this->isSuper($db, $user))
|
||
|
|
return true;
|
||
|
|
$stmt = $db->prepare("SELECT 1 FROM club_memberships m JOIN users u ON u.user_serial=m.user_serial WHERE m.club_serial=? AND m.user_serial=? AND m.membership_role='administrator' AND m.membership_status='active' AND u.user_status='active' AND u.user_email_verified_at IS NOT NULL LOCK IN SHARE MODE");
|
||
|
|
$stmt->execute([$club, $user]);
|
||
|
|
return (bool) $stmt->fetchColumn();
|
||
|
|
}
|
||
|
|
|
||
|
|
public function available(): bool {
|
||
|
|
return (bool) $this->connect()->query("SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='club_memberships' AND COLUMN_NAME='membership_role'")->fetchColumn();
|
||
|
|
}
|
||
|
|
|
||
|
|
public function managesAny(): bool {
|
||
|
|
if ($this->isSuper())
|
||
|
|
return true;
|
||
|
|
if (!$this->available())
|
||
|
|
return false;
|
||
|
|
$stmt = $this->connect()->prepare("SELECT 1 FROM club_memberships m JOIN users u ON u.user_serial=m.user_serial WHERE m.user_serial=? AND m.membership_role='administrator' AND m.membership_status='active' AND u.user_status='active' AND u.user_email_verified_at IS NOT NULL LIMIT 1");
|
||
|
|
$stmt->execute([$_SESSION[self::USER_SERIAL] ?? 0]);
|
||
|
|
return (bool) $stmt->fetchColumn();
|
||
|
|
}
|
||
|
|
|
||
|
|
public function requireManager(int $club, ?PDO $db = null): void {
|
||
|
|
if (!$this->canManage($club, $db))
|
||
|
|
throw new AppException('You cannot manage this club.', 403);
|
||
|
|
}
|
||
|
|
}
|