ChatGPT's update to harden software and run db updates.

classes/TenantAccess.php

@@ -0,0 +1,47 @@
+<?php
+
+/** Club permissions are looked up on each request, never trusted from form fields. */
+class TenantAccess extends Base {
+
+    public const SUPER = 'Super System Administrator';
+
+    public function isSuper(?PDO $db = null, ?int $user = null): bool {
+        $stmt = ($db ?? $this->connect())->prepare("SELECT 1 FROM users WHERE user_serial=? AND user_role=? AND user_status='active' LOCK IN SHARE MODE");
+        $stmt->execute([$user ?? ($_SESSION[self::USER_SERIAL] ?? 0), self::SUPER]);
+        return (bool) $stmt->fetchColumn();
+    }
+
+    public function requireSuper(?PDO $db = null): void {
+        if (!$this->isSuper($db))
+            throw new AppException('Only a Super System Administrator may manage global accounts and settings.', 403);
+    }
+
+    public function canManage(int $club, ?PDO $db = null, ?int $user = null): bool {
+        $db ??= $this->connect();
+        $user ??= (int) ($_SESSION[self::USER_SERIAL] ?? 0);
+        if ($this->isSuper($db, $user))
+            return true;
+        $stmt = $db->prepare("SELECT 1 FROM club_memberships m JOIN users u ON u.user_serial=m.user_serial WHERE m.club_serial=? AND m.user_serial=? AND m.membership_role='administrator' AND m.membership_status='active' AND u.user_status='active' AND u.user_email_verified_at IS NOT NULL LOCK IN SHARE MODE");
+        $stmt->execute([$club, $user]);
+        return (bool) $stmt->fetchColumn();
+    }
+
+    public function available(): bool {
+        return (bool) $this->connect()->query("SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='club_memberships' AND COLUMN_NAME='membership_role'")->fetchColumn();
+    }
+
+    public function managesAny(): bool {
+        if ($this->isSuper())
+            return true;
+        if (!$this->available())
+            return false;
+        $stmt = $this->connect()->prepare("SELECT 1 FROM club_memberships m JOIN users u ON u.user_serial=m.user_serial WHERE m.user_serial=? AND m.membership_role='administrator' AND m.membership_status='active' AND u.user_status='active' AND u.user_email_verified_at IS NOT NULL LIMIT 1");
+        $stmt->execute([$_SESSION[self::USER_SERIAL] ?? 0]);
+        return (bool) $stmt->fetchColumn();
+    }
+
+    public function requireManager(int $club, ?PDO $db = null): void {
+        if (!$this->canManage($club, $db))
+            throw new AppException('You cannot manage this club.', 403);
+    }
+}