1 # BEGIN BPS TAGGED BLOCK {{{
5 # This software is Copyright (c) 1996-2011 Best Practical Solutions, LLC
6 # <sales@bestpractical.com>
8 # (Except where explicitly superseded by other copyright notices)
13 # This work is made available to you under the terms of Version 2 of
14 # the GNU General Public License. A copy of that license should have
15 # been provided with this software, but in any event can be snarfed
18 # This work is distributed in the hope that it will be useful, but
19 # WITHOUT ANY WARRANTY; without even the implied warranty of
20 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
21 # General Public License for more details.
23 # You should have received a copy of the GNU General Public License
24 # along with this program; if not, write to the Free Software
25 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
26 # 02110-1301 or visit their web page on the internet at
27 # http://www.gnu.org/licenses/old-licenses/gpl-2.0.html.
30 # CONTRIBUTION SUBMISSION POLICY:
32 # (The following paragraph is not intended to limit the rights granted
33 # to you to modify and distribute this software under the terms of
34 # the GNU General Public License and is only of importance to you if
35 # you choose to contribute your changes and enhancements to the
36 # community by submitting them to Best Practical Solutions, LLC.)
38 # By intentionally submitting any modifications, corrections or
39 # derivatives to this work, or any other work intended for use with
40 # Request Tracker, to Best Practical Solutions, LLC, you confirm that
41 # you are the copyright holder for those contributions and you grant
42 # Best Practical Solutions, LLC a nonexclusive, worldwide, irrevocable,
43 # royalty-free, perpetual, license to use, copy, create derivative
44 # works based on those contributions, and sublicense and distribute
45 # those contributions and any derivatives thereof.
47 # END BPS TAGGED BLOCK }}}
51 RT::ACL - collection of RT ACE objects
56 my $ACL = new RT::ACL($CurrentUser);
70 no warnings qw(redefine);
75 Hand out the next ACE that was found
82 =head2 LimitToObject $object
84 Limit the ACL to rights for the object $object. It needs to be an RT::Record class.
91 unless ( defined($obj)
93 && UNIVERSAL::can( $obj, 'id' )
99 FIELD => 'ObjectType',
102 ENTRYAGGREGATOR => 'OR'
108 ENTRYAGGREGATOR => 'OR',
118 =head2 LimitNotObject $object
120 Limit the ACL to rights NOT on the object $object. $object needs to be
128 unless ( defined($obj)
130 && UNIVERSAL::can( $obj, 'id' )
135 $self->Limit( FIELD => 'ObjectType',
138 ENTRYAGGREGATOR => 'OR',
139 SUBCLAUSE => $obj->id
141 $self->Limit( FIELD => 'ObjectId',
144 ENTRYAGGREGATOR => 'OR',
146 SUBCLAUSE => $obj->id
152 # {{{ LimitToPrincipal
154 =head2 LimitToPrincipal { Type => undef, Id => undef, IncludeGroupMembership => undef }
156 Limit the ACL to the principal with PrincipalId Id and PrincipalType Type
161 if IncludeGroupMembership => 1 is specified, ACEs which apply to the principal due to group membership will be included in the resultset.
166 sub LimitToPrincipal {
168 my %args = ( Type => undef,
170 IncludeGroupMembership => undef,
172 if ( $args{'IncludeGroupMembership'} ) {
173 my $cgm = $self->NewAlias('CachedGroupMembers');
174 $self->Join( ALIAS1 => 'main',
175 FIELD1 => 'PrincipalId',
177 FIELD2 => 'GroupId' );
178 $self->Limit( ALIAS => $cgm,
181 $self->Limit( ALIAS => $cgm,
184 VALUE => $args{'Id'},
185 ENTRYAGGREGATOR => 'OR' );
188 if ( defined $args{'Type'} ) {
189 $self->Limit( FIELD => 'PrincipalType',
191 VALUE => $args{'Type'},
192 ENTRYAGGREGATOR => 'OR' );
194 # if the principal id points to a user, we really want to point
195 # to their ACL equivalence group. The machinations we're going through
196 # lead me to start to suspect that we really want users and groups
197 # to just be the same table. or _maybe_ that we want an object db.
198 my $princ = RT::Principal->new($RT::SystemUser);
199 $princ->Load($args{'Id'});
200 if ($princ->PrincipalType eq 'User') {
201 my $group = RT::Group->new($RT::SystemUser);
202 $group->LoadACLEquivalenceGroup($princ);
203 $args{'Id'} = $group->PrincipalId;
205 $self->Limit( FIELD => 'PrincipalId',
207 VALUE => $args{'Id'},
208 ENTRYAGGREGATOR => 'OR' );
216 # {{{ ExcludeDelegatedRights
218 =head2 ExcludeDelegatedRights
220 Don't list rights which have been delegated.
224 sub ExcludeDelegatedRights {
226 $self->DelegatedBy(Id => 0);
227 $self->DelegatedFrom(Id => 0);
233 =head2 DelegatedBy { Id => undef }
235 Limit the ACL to rights delegated by the principal whose Principal Id is
249 FIELD => 'DelegatedBy',
251 VALUE => $args{'Id'},
252 ENTRYAGGREGATOR => 'OR'
261 =head2 DelegatedFrom { Id => undef }
263 Limit the ACL to rights delegate from the ACE which has the Id specified
275 $self->Limit(FIELD => 'DelegatedFrom', OPERATOR=> '=', VALUE => $args{'Id'}, ENTRYAGGREGATOR => 'OR');
286 my $ACE = $self->SUPER::Next();
287 if ( ( defined($ACE) ) and ( ref($ACE) ) ) {
289 if ( $self->CurrentUser->HasRight( Right => 'ShowACL',
290 Object => $ACE->Object )
291 or $self->CurrentUser->HasRight( Right => 'ModifyACL',
292 Object => $ACE->Object )
297 #If the user doesn't have the right to show this ACE
299 return ( $self->Next() );
303 #if there never was any ACE
314 #wrap around _DoSearch so that we can build the hash of returned
318 # $RT::Logger->debug("Now in ".$self."->_DoSearch");
319 my $return = $self->SUPER::_DoSearch(@_);
320 # $RT::Logger->debug("In $self ->_DoSearch. return from SUPER::_DoSearch was $return");
321 if ( $self->{'must_redo_search'} ) {
323 "_DoSearch is not so successful as it still needs redo search, won't call _BuildHash"
333 #Build a hash of this ACL's entries.
337 while (my $entry = $self->Next) {
338 my $hashkey = join '-', map $entry->__Value( $_ ),
339 qw(ObjectType ObjectId RightName PrincipalId PrincipalType);
341 $self->{'as_hash'}->{"$hashkey"} =1;
356 my %args = ( RightScope => undef,
357 RightAppliesTo => undef,
359 PrincipalId => undef,
360 PrincipalType => undef,
363 #if we haven't done the search yet, do it now.
366 if ($self->{'as_hash'}->{ $args{'RightScope'} . "-" .
367 $args{'RightAppliesTo'} . "-" .
368 $args{'RightName'} . "-" .
369 $args{'PrincipalId'} . "-" .
370 $args{'PrincipalType'}