AccessService.php

<?php
 
namespace Bitrix\Lists\Api\Service;
 
use Bitrix\Lists\Api\Response\CheckPermissionsResponse;
use Bitrix\Lists\Security\ElementRight;
use Bitrix\Lists\Security\IblockRight;
use Bitrix\Lists\Security\Right;
use Bitrix\Lists\Security\RightParam;
use Bitrix\Lists\Service\Param;
use Bitrix\Main\ArgumentException;
use Bitrix\Main\Error;
use Bitrix\Main\Localization\Loc;
 
class AccessService
{
    protected string $iBlockTypeId;
    protected int $iBlockId = 0;
    protected int $socNetGroupId = 0;
    protected int $userId;
    protected bool $isCurrentUser = false;
 
    public function __construct(int $userId, Param $param)
    {
        $param->checkRequiredInputParams(['IBLOCK_TYPE_ID', 'IBLOCK_ID', 'SOCNET_GROUP_ID']);
        if ($param->hasErrors())
        {
            $firstError = $param->getErrors()[0];
 
            throw new ArgumentException($firstError->getMessage());
        }
 
        $paramValues = $param->getParams();
        $this->iBlockTypeId = (string)$paramValues['IBLOCK_TYPE_ID'];
        if ((int)$paramValues['IBLOCK_ID'] > 0)
        {
            $this->iBlockId = (int)$paramValues['IBLOCK_ID'];
        }
        if ((int)$paramValues['SOCNET_GROUP_ID'] > 0)
        {
            $this->socNetGroupId = (int)$paramValues['SOCNET_GROUP_ID'];
        }
 
        $this->userId = $userId;
        GLOBAL $USER;
        if ($userId > 0 && $userId === (int)$USER->GetID())
        {
            $this->isCurrentUser = true;
        }
    }
 
    public function getUserId(): int
    {
        return $this->userId;
    }
 
    public function checkPermissions(): CheckPermissionsResponse
    {
        $response = new CheckPermissionsResponse();
        if ($this->userId === 0 || !$this->isCurrentUser)
        {
            return $response->addError(static::getNotSupportedUserIdError());
        }
 
        GLOBAL $USER;
        $param = new Param([
            'IBLOCK_TYPE_ID' => $this->iBlockTypeId,
            'IBLOCK_ID' => $this->iBlockId > 0 ? $this->iBlockId : false,
            'SOCNET_GROUP_ID' => $this->socNetGroupId,
        ]);
        $rightParam = new RightParam($param);
        $rightParam->setUser($USER);
 
        $right = new Right($rightParam, new IblockRight($rightParam));
 
        $response
            ->setRightParam($rightParam)
            ->setPermission($right->getPermission())
        ;
 
        if (!$right->checkPermission())
        {
            $response->addErrors($right->getErrors());
        }
 
        return $response;
    }
 
    public function checkElementPermission(
        int $elementId = 0,
        int $sectionId = 0,
        string $entityMethod = null,
        int $iBlockId = null,
    ): CheckPermissionsResponse
    {
        $response = new CheckPermissionsResponse();
        if ($this->userId === 0 || !$this->isCurrentUser)
        {
            return $response->addError(static::getNotSupportedUserIdError());
        }
 
        $iBlockId = ((int)$iBlockId > 0) ? (int)$iBlockId : $this->iBlockId;
 
        GLOBAL $USER;
        $param = new Param([
            'IBLOCK_TYPE_ID' => $this->iBlockTypeId,
            'IBLOCK_ID' => $iBlockId > 0 ? $iBlockId : false,
            'SOCNET_GROUP_ID' => $this->socNetGroupId,
        ]);
        $rightParam = new RightParam($param);
        $rightParam->setUser($USER);
        $rightParam->setEntityId($elementId);
        $rightParam->setSectionId(max($sectionId, 0));
 
        $elementRight = new ElementRight($rightParam);
        $right = new Right($rightParam, $elementRight);
 
        $response
            ->setRightParam($rightParam)
            ->setElementRight($elementRight)
            ->setPermission($right->getPermission())
        ;
 
        if (!$right->checkPermission($entityMethod ?? ''))
        {
            $response->addErrors($right->getErrors());
        }
 
        return $response;
    }
 
    public function checkIBlockPermission(int $iBlockId = null, string $entityMethod = null): CheckPermissionsResponse
    {
        $response = new CheckPermissionsResponse();
        if ($this->userId === 0 || !$this->isCurrentUser)
        {
            return $response->addError(static::getNotSupportedUserIdError());
        }
 
        $iBlockId = $iBlockId ?? $this->iBlockId;
 
        GLOBAL $USER;
        $param = new Param([
            'IBLOCK_TYPE_ID' => $this->iBlockTypeId,
            'IBLOCK_ID' => $iBlockId > 0 ? $iBlockId : false,
            'SOCNET_GROUP_ID' => $this->socNetGroupId,
        ]);
        $rightParam = new RightParam($param);
        $rightParam->setUser($USER);
 
        $iBlockRight = new IblockRight($rightParam);
        $right = new Right($rightParam, $iBlockRight);
 
        $response
            ->setRightParam($rightParam)
            ->setIBlockRight($iBlockRight)
            ->setPermission($right->getPermission())
        ;
 
        if (!$right->checkPermission($entityMethod ?? ''))
        {
            $response->addErrors($right->getErrors());
        }
 
        return $response;
    }
 
    public function checkIBlockTypePermission(string $iBlockTypeId = null): CheckPermissionsResponse
    {
        $response = new CheckPermissionsResponse();
        if ($this->userId === 0 || !$this->isCurrentUser)
        {
            return $response->addError(static::getNotSupportedUserIdError());
        }
 
        $iBlockTypeId = $iBlockTypeId ?? $this->iBlockTypeId;
 
        GLOBAL $USER;
        $param = new Param([
            'IBLOCK_TYPE_ID' => $iBlockTypeId,
            'IBLOCK_ID' => false,
            'SOCNET_GROUP_ID' => $this->socNetGroupId,
        ]);
        $rightParam = new RightParam($param);
        $rightParam->setUser($USER);
 
        $right = new Right($rightParam, new IblockRight($rightParam)); // any RightEntity
 
        $response
            ->setRightParam($rightParam)
            ->setPermission($right->getPermission())
        ;
 
        if (!$right->checkPermission())
        {
            $response->addErrors($right->getErrors());
        }
 
        return $response;
    }
 
    public function isAccessDeniedPermission(string | int $permission): bool
    {
        return $permission <= \CListPermissions::ACCESS_DENIED;
    }
 
    public function isAdminPermission(string | int $permission): bool
    {
        return $permission >= \CListPermissions::IS_ADMIN;
    }
 
    public function isCanReadPermission(string | int $permission): bool
    {
        return $permission >= \CListPermissions::CAN_READ;
    }
 
    public static function getAccessDeniedError(): Error
    {
        return new Error(Loc::getMessage('LISTS_LIB_API_ACCESS_SERVICE_ERROR_ACCESS_DENIED'));
    }
 
    protected static function getNotSupportedUserIdError(): Error
    {
        return new Error(Loc::getMessage('LISTS_LIB_API_ACCESS_SERVICE_ERROR_NOT_SUPPORTED_USER_ID'));
    }
}