X-Git-Url: http://git.freeside.biz/gitweb/?p=freeside.git;a=blobdiff_plain;f=rt%2Flib%2FRT%2FACL.pm;h=fb3f4011de5c0a3fafe8807e86bb5b1b5b5354d7;hp=26acbd96ceb5b4500ba2006edd962c908edcd7b1;hb=7322f2afedcc2f427e997d1535a503613a83f088;hpb=fc6209f398899f0211cfcedeb81a3cd65e04a941

diff --git a/rt/lib/RT/ACL.pm b/rt/lib/RT/ACL.pm
index 26acbd96c..fb3f4011d 100755
--- a/rt/lib/RT/ACL.pm
+++ b/rt/lib/RT/ACL.pm
@@ -2,7 +2,7 @@
 #
 # COPYRIGHT:
 #
-# This software is Copyright (c) 1996-2011 Best Practical Solutions, LLC
+# This software is Copyright (c) 1996-2016 Best Practical Solutions, LLC
 #                                          <sales@bestpractical.com>
 #
 # (Except where explicitly superseded by other copyright notices)
@@ -46,92 +46,168 @@
 #
 # END BPS TAGGED BLOCK }}}
 
-# Autogenerated by DBIx::SearchBuilder factory (by <jesse@bestpractical.com>)
-# WARNING: THIS FILE IS AUTOGENERATED. ALL CHANGES TO THIS FILE WILL BE LOST.  
-# 
-# !! DO NOT EDIT THIS FILE !!
-#
-
-use strict;
-
-
 =head1 NAME
 
-  RT::ACL -- Class Description
- 
+  RT::ACL - collection of RT ACE objects
+
 =head1 SYNOPSIS
 
-  use RT::ACL
+  use RT::ACL;
+my $ACL = RT::ACL->new($CurrentUser);
 
 =head1 DESCRIPTION
 
 
 =head1 METHODS
 
+
 =cut
 
-package RT::ACL;
 
+package RT::ACL;
 use base 'RT::SearchBuilder';
+
 use RT::ACE;
 
+sub Table { 'ACL'}
 
-sub _Init {
-    my $self = shift;
-    $self->{'table'} = 'ACL';
-    $self->{'primary_key'} = 'id';
+use strict;
+use warnings;
 
 
-    return ( $self->SUPER::_Init(@_) );
-}
 
+=head2 Next
+
+Hand out the next ACE that was found
 
-=head2 NewItem
+=cut
+
+
+
+=head2 LimitToObject $object
 
-Returns an empty new RT::ACE item
+Limit the ACL to rights for the object $object. It needs to be an RT::Record class.
 
 =cut
 
-sub NewItem {
+sub LimitToObject {
     my $self = shift;
-    return(RT::ACE->new($self->CurrentUser));
+    my $obj  = shift;
+
+    my $obj_type = ref($obj)||$obj;
+    my $obj_id = eval { $obj->id};
+
+    my $object_clause = 'possible_objects';
+    $self->_OpenParen($object_clause);
+    $self->Limit(
+        SUBCLAUSE       => $object_clause,
+        FIELD           => 'ObjectType',
+        OPERATOR        => '=',
+        VALUE           => (ref($obj)||$obj),
+        ENTRYAGGREGATOR => 'OR' # That "OR" applies to the separate objects we're searching on, not "Type Or ID"
+    );
+    if ($obj_id) {
+    $self->Limit(
+        SUBCLAUSE       => $object_clause,
+        FIELD           => 'ObjectId',
+        OPERATOR        => '=',
+        VALUE           => $obj_id,
+        ENTRYAGGREGATOR => 'AND',
+        QUOTEVALUE      => 0
+    );
+    }
+    $self->_CloseParen($object_clause);
+
 }
 
-        eval "require RT::ACL_Overlay";
-        if ($@ && $@ !~ qr{^Can't locate RT/ACL_Overlay.pm}) {
-            die $@;
-        };
 
-        eval "require RT::ACL_Vendor";
-        if ($@ && $@ !~ qr{^Can't locate RT/ACL_Vendor.pm}) {
-            die $@;
-        };
 
-        eval "require RT::ACL_Local";
-        if ($@ && $@ !~ qr{^Can't locate RT/ACL_Local.pm}) {
-            die $@;
-        };
+=head2 LimitToPrincipal { Type => undef, Id => undef, IncludeGroupMembership => undef }
+
+Limit the ACL to the principal with PrincipalId Id and PrincipalType Type
+
+Id is not optional.
+Type is.
 
+if IncludeGroupMembership => 1 is specified, ACEs which apply to the principal due to group membership will be included in the resultset.
 
 
+=cut
 
-=head1 SEE ALSO
+sub LimitToPrincipal {
+    my $self = shift;
+    my %args = ( Type                   => undef,
+                 Id                     => undef,
+                 IncludeGroupMembership => undef,
+                 @_
+               );
+    if ( $args{'IncludeGroupMembership'} ) {
+        my $cgm = $self->NewAlias('CachedGroupMembers');
+        $self->Join( ALIAS1 => 'main',
+                     FIELD1 => 'PrincipalId',
+                     ALIAS2 => $cgm,
+                     FIELD2 => 'GroupId'
+                   );
+        $self->Limit( ALIAS => $cgm,
+                      FIELD => 'Disabled',
+                      VALUE => 0 );
+        $self->Limit( ALIAS           => $cgm,
+                      FIELD           => 'MemberId',
+                      OPERATOR        => '=',
+                      VALUE           => $args{'Id'},
+                      ENTRYAGGREGATOR => 'OR'
+                    );
+    } else {
+        if ( defined $args{'Type'} ) {
+            $self->Limit( FIELD           => 'PrincipalType',
+                          OPERATOR        => '=',
+                          VALUE           => $args{'Type'},
+                          ENTRYAGGREGATOR => 'OR'
+                        );
+        }
+
+        # if the principal id points to a user, we really want to point
+        # to their ACL equivalence group. The machinations we're going through
+        # lead me to start to suspect that we really want users and groups
+        # to just be the same table. or _maybe_ that we want an object db.
+        my $princ = RT::Principal->new( RT->SystemUser );
+        $princ->Load( $args{'Id'} );
+        if ( $princ->PrincipalType eq 'User' ) {
+            my $group = RT::Group->new( RT->SystemUser );
+            $group->LoadACLEquivalenceGroup($princ);
+            $args{'Id'} = $group->PrincipalId;
+        }
+        $self->Limit( FIELD           => 'PrincipalId',
+                      OPERATOR        => '=',
+                      VALUE           => $args{'Id'},
+                      ENTRYAGGREGATOR => 'OR'
+                    );
+    }
+}
 
-This class allows "overlay" methods to be placed
-into the following files _Overlay is for a System overlay by the original author,
-_Vendor is for 3rd-party vendor add-ons, while _Local is for site-local customizations.  
 
-These overlay files can contain new subs or subs to replace existing subs in this module.
 
-Each of these files should begin with the line 
 
-   no warnings qw(redefine);
+sub AddRecord {
+    my $self = shift;
+    my ($record) = @_;
 
-so that perl does not kick and scream when you redefine a subroutine or variable in your overlay.
+    # Short-circuit having to load up the ->Object
+    return $self->SUPER::AddRecord( $record )
+        if $record->CurrentUser->PrincipalObj->Id == RT->SystemUser->Id;
 
-RT::ACL_Overlay, RT::ACL_Vendor, RT::ACL_Local
+    my $obj = $record->Object;
+    return unless $self->CurrentUser->HasRight( Right  => 'ShowACL',
+                                                Object => $obj )
+               or $self->CurrentUser->HasRight( Right  => 'ModifyACL',
+                                                Object => $obj );
 
-=cut
+    return $self->SUPER::AddRecord( $record );
+}
+
+# The singular of ACL is ACE.
+sub _SingularClass { "RT::ACE" }
 
+RT::Base->_ImportOverlays();
 
 1;