1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
|
<?php
/**
* UserFrosting (http://www.userfrosting.com)
*
* @link https://github.com/userfrosting/UserFrosting
* @license https://github.com/userfrosting/UserFrosting/blob/master/licenses/UserFrosting.md (MIT License)
*/
namespace UserFrosting\Sprinkle\Account\Database\Migrations\v400;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Database\Schema\Builder;
use UserFrosting\Sprinkle\Account\Database\Models\Permission;
use UserFrosting\Sprinkle\Account\Database\Models\Role;
use UserFrosting\System\Bakery\Migration;
/**
* Permissions table migration
* Permissions now replace the 'authorize_group' and 'authorize_user' tables.
* Also, they now map many-to-many to roles.
* Version 4.0.0
*
* See https://laravel.com/docs/5.4/migrations#tables
* @extends Migration
* @author Alex Weissman (https://alexanderweissman.com)
*/
class PermissionsTable extends Migration
{
/**
* {@inheritDoc}
*/
public $dependencies = [
'\UserFrosting\Sprinkle\Account\Database\Migrations\v400\RolesTable',
'\UserFrosting\Sprinkle\Account\Database\Migrations\v400\PermissionRolesTable'
];
/**
* {@inheritDoc}
*/
public function up()
{
if (!$this->schema->hasTable('permissions')) {
$this->schema->create('permissions', function(Blueprint $table) {
$table->increments('id');
$table->string('slug')->comment('A code that references a specific action or URI that an assignee of this permission has access to.');
$table->string('name');
$table->text('conditions')->comment('The conditions under which members of this group have access to this hook.');
$table->text('description')->nullable();
$table->timestamps();
$table->engine = 'InnoDB';
$table->collation = 'utf8_unicode_ci';
$table->charset = 'utf8';
});
}
}
/**
* {@inheritDoc}
*/
public function down()
{
$this->schema->drop('permissions');
}
/**
* {@inheritDoc}
*/
public function seed()
{
// Skip this if table is not empty
if (Permission::count() == 0) {
$defaultRoleIds = [
'user' => Role::where('slug', 'user')->first()->id,
'group-admin' => Role::where('slug', 'group-admin')->first()->id,
'site-admin' => Role::where('slug', 'site-admin')->first()->id
];
// Add default permissions
$permissions = [
'create_group' => new Permission([
'slug' => 'create_group',
'name' => 'Create group',
'conditions' => 'always()',
'description' => 'Create a new group.'
]),
'create_user' => new Permission([
'slug' => 'create_user',
'name' => 'Create user',
'conditions' => 'always()',
'description' => 'Create a new user in your own group and assign default roles.'
]),
'create_user_field' => new Permission([
'slug' => 'create_user_field',
'name' => 'Set new user group',
'conditions' => "subset(fields,['group'])",
'description' => 'Set the group when creating a new user.'
]),
'delete_group' => new Permission([
'slug' => 'delete_group',
'name' => 'Delete group',
'conditions' => "always()",
'description' => 'Delete a group.'
]),
'delete_user' => new Permission([
'slug' => 'delete_user',
'name' => 'Delete user',
'conditions' => "!has_role(user.id,{$defaultRoleIds['site-admin']}) && !is_master(user.id)",
'description' => 'Delete users who are not Site Administrators.'
]),
'update_account_settings' => new Permission([
'slug' => 'update_account_settings',
'name' => 'Edit user',
'conditions' => 'always()',
'description' => 'Edit your own account settings.'
]),
'update_group_field' => new Permission([
'slug' => 'update_group_field',
'name' => 'Edit group',
'conditions' => 'always()',
'description' => 'Edit basic properties of any group.'
]),
'update_user_field' => new Permission([
'slug' => 'update_user_field',
'name' => 'Edit user',
'conditions' => "!has_role(user.id,{$defaultRoleIds['site-admin']}) && subset(fields,['name','email','locale','group','flag_enabled','flag_verified','password'])",
'description' => 'Edit users who are not Site Administrators.'
]),
'update_user_field_group' => new Permission([
'slug' => 'update_user_field',
'name' => 'Edit group user',
'conditions' => "equals_num(self.group_id,user.group_id) && !is_master(user.id) && !has_role(user.id,{$defaultRoleIds['site-admin']}) && (!has_role(user.id,{$defaultRoleIds['group-admin']}) || equals_num(self.id,user.id)) && subset(fields,['name','email','locale','flag_enabled','flag_verified','password'])",
'description' => 'Edit users in your own group who are not Site or Group Administrators, except yourself.'
]),
'uri_account_settings' => new Permission([
'slug' => 'uri_account_settings',
'name' => 'Account settings page',
'conditions' => 'always()',
'description' => 'View the account settings page.'
]),
'uri_activities' => new Permission([
'slug' => 'uri_activities',
'name' => 'Activity monitor',
'conditions' => 'always()',
'description' => 'View a list of all activities for all users.'
]),
'uri_dashboard' => new Permission([
'slug' => 'uri_dashboard',
'name' => 'Admin dashboard',
'conditions' => 'always()',
'description' => 'View the administrative dashboard.'
]),
'uri_group' => new Permission([
'slug' => 'uri_group',
'name' => 'View group',
'conditions' => 'always()',
'description' => 'View the group page of any group.'
]),
'uri_group_own' => new Permission([
'slug' => 'uri_group',
'name' => 'View own group',
'conditions' => 'equals_num(self.group_id,group.id)',
'description' => 'View the group page of your own group.'
]),
'uri_groups' => new Permission([
'slug' => 'uri_groups',
'name' => 'Group management page',
'conditions' => 'always()',
'description' => 'View a page containing a list of groups.'
]),
'uri_user' => new Permission([
'slug' => 'uri_user',
'name' => 'View user',
'conditions' => 'always()',
'description' => 'View the user page of any user.'
]),
'uri_user_in_group' => new Permission([
'slug' => 'uri_user',
'name' => 'View user',
'conditions' => "equals_num(self.group_id,user.group_id) && !is_master(user.id) && !has_role(user.id,{$defaultRoleIds['site-admin']}) && (!has_role(user.id,{$defaultRoleIds['group-admin']}) || equals_num(self.id,user.id))",
'description' => 'View the user page of any user in your group, except the master user and Site and Group Administrators (except yourself).'
]),
'uri_users' => new Permission([
'slug' => 'uri_users',
'name' => 'User management page',
'conditions' => 'always()',
'description' => 'View a page containing a table of users.'
]),
'view_group_field' => new Permission([
'slug' => 'view_group_field',
'name' => 'View group',
'conditions' => "in(property,['name','icon','slug','description','users'])",
'description' => 'View certain properties of any group.'
]),
'view_group_field_own' => new Permission([
'slug' => 'view_group_field',
'name' => 'View group',
'conditions' => "equals_num(self.group_id,group.id) && in(property,['name','icon','slug','description','users'])",
'description' => 'View certain properties of your own group.'
]),
'view_user_field' => new Permission([
'slug' => 'view_user_field',
'name' => 'View user',
'conditions' => "in(property,['user_name','name','email','locale','theme','roles','group','activities'])",
'description' => 'View certain properties of any user.'
]),
'view_user_field_group' => new Permission([
'slug' => 'view_user_field',
'name' => 'View user',
'conditions' => "equals_num(self.group_id,user.group_id) && !is_master(user.id) && !has_role(user.id,{$defaultRoleIds['site-admin']}) && (!has_role(user.id,{$defaultRoleIds['group-admin']}) || equals_num(self.id,user.id)) && in(property,['user_name','name','email','locale','roles','group','activities'])",
'description' => 'View certain properties of any user in your own group, except the master user and Site and Group Administrators (except yourself).'
])
];
foreach ($permissions as $slug => $permission) {
$permission->save();
}
// Add default mappings to permissions
$roleUser = Role::where('slug', 'user')->first();
if ($roleUser) {
$roleUser->permissions()->sync([
$permissions['update_account_settings']->id,
$permissions['uri_account_settings']->id,
$permissions['uri_dashboard']->id
]);
}
$roleSiteAdmin = Role::where('slug', 'site-admin')->first();
if ($roleSiteAdmin) {
$roleSiteAdmin->permissions()->sync([
$permissions['create_group']->id,
$permissions['create_user']->id,
$permissions['create_user_field']->id,
$permissions['delete_group']->id,
$permissions['delete_user']->id,
$permissions['update_user_field']->id,
$permissions['update_group_field']->id,
$permissions['uri_activities']->id,
$permissions['uri_group']->id,
$permissions['uri_groups']->id,
$permissions['uri_user']->id,
$permissions['uri_users']->id,
$permissions['view_group_field']->id,
$permissions['view_user_field']->id
]);
}
$roleGroupAdmin = Role::where('slug', 'group-admin')->first();
if ($roleGroupAdmin) {
$roleGroupAdmin->permissions()->sync([
$permissions['create_user']->id,
$permissions['update_user_field_group']->id,
$permissions['uri_group_own']->id,
$permissions['uri_user_in_group']->id,
$permissions['view_group_field_own']->id,
$permissions['view_user_field_group']->id
]);
}
}
}
}
|
