rights.php

<?php
namespace Bitrix\Landing;
 
use \Bitrix\Landing\Internals\RightsTable;
use \Bitrix\Main\Localization\Loc;
use \Bitrix\Main\UserAccessTable;
 
Loc::loadMessages(__FILE__);
 
class Rights
{
    const ENTITY_TYPE_SITE = 'S';
 
    const ACCESS_TYPES = [
        'denied' => 'denied',
        'read' => 'read',
        'edit' => 'edit',
        'sett' => 'sett',
        'public' => 'public',
        'delete' => 'delete'
    ];
 
    const ADDITIONAL_RIGHTS = [
        'menu24' => 'menu24',//show in main menu of Bitrix24
        'admin' => 'admin',//admin rights
        'create' => 'create',//can create new sites
        'unexportable' => 'unexportable',
        'knowledge_menu24' => 'knowledge_menu24',// show Knowledge in main menu of Bitrix24
        'knowledge_admin' => 'knowledge_admin',//admin rights
        'knowledge_create' => 'knowledge_create',//can create new Knowledge base
        'knowledge_unexportable' => 'knowledge_unexportable',
        'knowledge_extension' => 'knowledge_extension',
        'group_create' => 'group_create',//can create new social network group base
        'group_admin' => 'group_admin',//admin rights
        'group_menu24' => 'group_menu24',// show group in main menu of Bitrix24
        'group_unexportable' => 'group_unexportable',
    ];
 
    const SET_PREFIX = [
        'knowledge',
        'group',
    ];
 
    const REVERSE_RIGHTS = [
        'unexportable',
        'knowledge_unexportable',
        'group_unexportable',
    ];
 
    protected static $allowedSites = [];
 
    protected static $available = true;
 
    protected static $globalAvailable = true;
 
    protected static $userId = null;
 
    public static function setOff()
    {
        self::$available = false;
    }
 
    public static function setOn()
    {
        self::$available = true;
    }
 
    public static function setGlobalOff()
    {
        self::$globalAvailable = false;
    }
 
    public static function setGlobalOn()
    {
        self::$globalAvailable = true;
    }
 
    public static function isOn()
    {
        if (
            defined('LANDING_DISABLE_RIGHTS') &&
            LANDING_DISABLE_RIGHTS === true
        )
        {
            return false;
        }
        if (!self::$globalAvailable)
        {
            return false;
        }
        return self::$available;
    }
 
    public static function isAdmin()
    {
        if (self::hasAdditionalRight(self::ADDITIONAL_RIGHTS['admin'], null, false, true))
        {
            return true;
        }
        return Manager::isAdmin();
    }
 
    public static function getAllowedSites(): array
    {
        return self::$allowedSites;
    }
 
    public static function setContextUserId(int $uid): void
    {
        self::$userId = $uid;
    }
 
    public static function clearContextUserId(): void
    {
        self::$userId = null;
    }
 
    public static function getContextUserId(): int
    {
        if (!self::$userId)
        {
            self::$userId = Manager::getUserId();
        }
        return self::$userId;
    }
 
    protected static function isFeatureOn()
    {
        return Manager::checkFeature(
            Manager::FEATURE_PERMISSIONS_AVAILABLE
        );
    }
 
    public static function getAccessTasks()
    {
        static $tasks = [];
 
        if (empty($tasks))
        {
            $res = \CTask::getList(
                ['LETTER' => 'ASC'],
                ['MODULE_ID' => 'landing']
            );
            while ($row = $res->fetch())
            {
                $row['NAME'] = mb_substr($row['NAME'], 14);
                $tasks[$row['ID']] = $row;
            }
        }
 
        return $tasks;
    }
 
    public static function getAccessTasksReferences()
    {
        static $tasks = [];
 
        if (empty($tasks))
        {
            foreach (self::getAccessTasks() as $accessTask)
            {
                $tasks[$accessTask['NAME']] = $accessTask['ID'];
            }
        }
 
        return $tasks;
    }
 
    protected static function removeData($entityId, $entityType)
    {
        if (self::isFeatureOn())
        {
            $res = RightsTable::getList([
                'select' => [
                    'ID'
                ],
                'filter' => [
                    'ENTITY_ID' => $entityId,
                    '=ENTITY_TYPE' => $entityType
                ]
            ]);
            while ($row = $res->fetch())
            {
                RightsTable::delete($row['ID']);
            }
        }
    }
 
    public static function removeDataForSite($siteId)
    {
        self::removeData(
            $siteId,
            self::ENTITY_TYPE_SITE
        );
    }
 
    protected static function getData($entityId, $entityType, array $preDefined = [])
    {
        static $access = null;
        $items = [];
        $codes = [];
 
        if ($access === null)
        {
            $access = new \CAccess;
        }
 
        // filter (with predefined_
        $filter = [
            'ENTITY_ID' => $entityId,
            '=ENTITY_TYPE' => $entityType
        ];
        if ($preDefined)
        {
            $filter['=ACCESS_CODE'] = array_keys($preDefined);
        }
 
        // main query
        $res = RightsTable::getList([
            'select' => [
                'TASK_ID',
                'ACCESS_CODE'
            ],
            'filter' => $filter
        ]);
        while ($row = $res->fetch())
        {
            $codes[] = $row['ACCESS_CODE'];
            if (!isset($items[$row['ACCESS_CODE']]))
            {
                $row['TASK_ID'] = [$row['TASK_ID']];
                $items[$row['ACCESS_CODE']] = $row;
            }
            else
            {
                $items[$row['ACCESS_CODE']]['TASK_ID'][] = $row['TASK_ID'];
            }
            if (isset($preDefined[$row['ACCESS_CODE']]))
            {
                unset($preDefined[$row['ACCESS_CODE']]);
            }
        }
 
        $items = array_values($items);
 
        // fill with predefined
        foreach ($preDefined as $accessCode => $rightCode)
        {
            $items[] = [
                'TASK_ID' => $rightCode,
                'ACCESS_CODE' => $accessCode
            ];
            $codes[] = $accessCode;
        }
 
        // get titles
        if ($items)
        {
            $codesNames  = $access->getNames($codes);
            foreach ($items as &$item)
            {
                if (isset($codesNames[$item['ACCESS_CODE']]))
                {
                    $item['ACCESS_PROVIDER'] = (
                                isset($codesNames[$item['ACCESS_CODE']]['provider']) &&
                                $codesNames[$item['ACCESS_CODE']]['provider']
                            )
                        ? $codesNames[$item['ACCESS_CODE']]['provider']
                        : '';
                    $item['ACCESS_NAME'] = isset($codesNames[$item['ACCESS_CODE']]['name'])
                        ? $codesNames[$item['ACCESS_CODE']]['name']
                        : $item['ACCESS_CODE'];
                }
            }
            unset($item);
        }
 
        return $items;
    }
 
    public static function getDataForSite($siteId, array $preDefined = [])
    {
        return self::getData(
            $siteId,
            self::ENTITY_TYPE_SITE,
            $preDefined
        );
    }
 
    protected static function getOperations($entityId, $entityType)
    {
        // full access for allowed sites
        if (
            $entityType == self::ENTITY_TYPE_SITE &&
            in_array($entityId, self::$allowedSites)
        )
        {
            $types = self::ACCESS_TYPES;
            unset($types[self::ACCESS_TYPES['delete']]);
            return array_values($types);
        }
 
        // check scoped method
        if (
            $entityType == self::ENTITY_TYPE_SITE
            && !is_array($entityId) && $entityId > 0
        )
        {
            $scopeOperationsSite = Site\Type::getOperationsForSite($entityId);
            if ($scopeOperationsSite !== null)
            {
                return array_values($scopeOperationsSite);
            }
        }
 
        $operations = [];
        $operationsDefault = [];
        $wasChecked = false;
        $uid = self::getContextUserId();
        $extendedMode = self::isExtendedMode();
 
        // full access for admin
        if (
            $uid &&
            self::isOn() &&
            !self::isAdmin() &&
            self::isFeatureOn() &&
            self::exist()
        )
        {
            $wasChecked = true;
            $entityIdFilter = $entityId;
            if (is_array($entityIdFilter))
            {
                $entityIdFilter[] = 0;
            }
            else
            {
                $entityIdFilter = [
                    $entityIdFilter, 0
                ];
            }
            $filter = [
                'ENTITY_ID' => $entityIdFilter,
                '=ENTITY_TYPE' => $entityType,
                'USER_ACCESS.USER_ID' => $uid,
                '!TASK_OPERATION.OPERATION.NAME' => false
            ];
            if ($extendedMode)
            {
                $filter['ROLE_ID'] = 0;
            }
            else
            {
                $filter['ROLE_ID'] = Role::getExpectedRoleIds();
            }
            $res = RightsTable::getList(
                [
                    'select' => [
                        'ENTITY_ID',
                        'OPERATION_NAME' => 'TASK_OPERATION.OPERATION.NAME'
                    ],
                    'filter' => $filter
                ]
            );
            while ($row = $res->fetch())
            {
                if ($row['ENTITY_ID'] == 0)
                {
                    $operationsDefault[] = mb_substr($row['OPERATION_NAME'], 8);
                    continue;
                }
                if (!isset($operations[$row['ENTITY_ID']]))
                {
                    $operations[$row['ENTITY_ID']] = array();
                }
                $operations[$row['ENTITY_ID']][] = mb_substr($row['OPERATION_NAME'], 8);
                $operations[$row['ENTITY_ID']] = array_unique($operations[$row['ENTITY_ID']]);
            }
        }
 
        // set full rights, if rights are empty
        foreach ((array) $entityId as $id)
        {
            if (!isset($operations[$id]))
            {
                if ($wasChecked && !$extendedMode)
                {
                    $operations[$id] = !empty($operationsDefault)
                        ? $operationsDefault
                        : [self::ACCESS_TYPES['denied']];
                }
                else
                {
                    $operations[$id] = array_values(self::ACCESS_TYPES);
                }
            }
        }
 
        return is_array($entityId)
                ? $operations
                : $operations[$entityId];
    }
 
    public static function getOperationsForSite($siteId): array
    {
        if (
            is_array($siteId) ||
            $siteId == 0 ||
            Site::ping($siteId, true)
        )
        {
            return self::getOperations(
                $siteId,
                self::ENTITY_TYPE_SITE
            );
        }
        else
        {
            return [];
        }
    }
 
    public static function hasAccessForSite($siteId, $accessType, $deleted = false)
    {
        static $operations = [];
        $siteId = intval($siteId);
 
        if (!is_string($accessType))
        {
            return false;
        }
 
        if (!isset($operations[$siteId]))
        {
            if ($siteId === 0 || !self::isOn() || Site::ping($siteId, $deleted))
            {
                $operations[$siteId] = self::getOperations(
                    $siteId,
                    self::ENTITY_TYPE_SITE
                );
            }
            else
            {
                $operations[$siteId] = [];
            }
        }
 
        return in_array($accessType, $operations[$siteId]);
    }
 
    public static function hasAccessForLanding($landingId, $accessType)
    {
        static $operations = [];
        $landingId = intval($landingId);
 
        if (!is_string($accessType))
        {
            return false;
        }
 
        if (!isset($operations[$landingId]))
        {
            $site = Landing::getList([
                'select' => [
                    'SITE_ID'
                ],
                'filter' => [
                    'ID' => $landingId,
                    '=SITE.DELETED' => ['Y', 'N'],
                    '=DELETED' => ['Y', 'N']
                ]
            ])->fetch();
 
            if ($site)
            {
                $operations[$landingId] = self::getOperations(
                    $site['SITE_ID'],
                    self::ENTITY_TYPE_SITE
                );
            }
            else
            {
                $operations[$landingId] = [];
            }
        }
 
        return in_array($accessType, $operations[$landingId]);
    }
 
    protected static function setOperations($entityId, $entityType, array $rights = [])
    {
        if (!self::isFeatureOn())
        {
            return false;
        }
 
        $tasks = self::getAccessTasksReferences();
        $entityId = intval($entityId);
 
        self::removeData(
            $entityId,
            $entityType
        );
 
        // add new rights
        foreach ($rights as $accessCode => $rightCodes)
        {
            $rightCodes = (array) $rightCodes;
            if (in_array(self::ACCESS_TYPES['denied'], $rightCodes))
            {
                $rightCodes = [self::ACCESS_TYPES['denied']];
            }
            else if (!in_array(self::ACCESS_TYPES['read'], $rightCodes))
            {
                $rightCodes[] = self::ACCESS_TYPES['read'];
            }
 
            foreach ($rightCodes as $rightCode)
            {
                if (isset($tasks[$rightCode]))
                {
                    RightsTable::add([
                        'ENTITY_ID' => $entityId,
                        'ENTITY_TYPE' => $entityType,
                        'TASK_ID' => $tasks[$rightCode],
                        'ACCESS_CODE' => $accessCode
                    ]);
                }
            }
        }
 
        return true;
    }
 
    public static function setOperationsForSite($siteId, array $rights = [])
    {
        $siteId = intval($siteId);
 
        if ($siteId == 0 || Site::ping($siteId))
        {
            return self::setOperations(
                $siteId,
                self::ENTITY_TYPE_SITE,
                $rights
            );
        }
        else
        {
            return false;
        }
    }
 
    protected static function exist()
    {
        static $exist = null;
 
        if ($exist === null)
        {
            $type = Site\Type::getCurrentScopeId();
            $res = RightsTable::getList([
                'select' => [
                    'ID'
                ],
                'filter' => $type
                        ? ['=ROLE.TYPE' => $type]
                        : [],
                'limit' => 1
            ]);
            $exist = (bool) $res->fetch();
        }
 
        return $exist;
    }
 
    public static function getAccessFilter(array $additionalFilterOr = [])
    {
        $filter = [];
 
        if (
            self::isOn() &&
            !self::isAdmin() &&
            self::isFeatureOn() &&
            self::exist()
        )
        {
            $tasks = self::getAccessTasksReferences();
            $extendedRights = self::isExtendedMode();
            $uid = self::getContextUserId();
 
            if ($extendedRights)
            {
                $filter[] = [
                    'LOGIC' => 'OR',
                    [
                        '!RIGHTS.TASK_ID' => $tasks[Rights::ACCESS_TYPES['denied']],
                        'RIGHTS.USER_ACCESS.USER_ID' => $uid
                    ],
                    [
                        '=RIGHTS.TASK_ID' => null
                    ],
                    $additionalFilterOr
                ];
            }
            else
            {
                if ($additionalFilterOr)
                {
                    $filter[] = [
                        'LOGIC' => 'OR',
                        [
                            '!RIGHTS.TASK_ID' => $tasks[Rights::ACCESS_TYPES['denied']],
                            'RIGHTS.USER_ACCESS.USER_ID' => $uid
                        ],
                        $additionalFilterOr
                    ];
                }
                else
                {
                    $filter['RIGHTS.USER_ACCESS.USER_ID'] = $uid;
                    $filter['!RIGHTS.TASK_ID'] = $tasks[Rights::ACCESS_TYPES['denied']];
                }
            }
        }
 
        return $filter;
    }
 
    public static function isExtendedMode()
    {
        if (Manager::isB24())
        {
            return Manager::getOption('rights_extended_mode', 'N') == 'Y';
        }
        else
        {
            return true;
        }
    }
 
    public static function switchMode()
    {
        if (self::isFeatureOn())
        {
            $current = Manager::getOption('rights_extended_mode', 'N');
            $current = ($current == 'Y') ? 'N' : 'Y';
            Manager::setOption('rights_extended_mode', $current);
        }
    }
 
    public static function refreshAdditionalRights(array $additionalRights = [])
    {
        if (!self::isFeatureOn())
        {
            return;
        }
 
        $rights = [];
        foreach (self::ADDITIONAL_RIGHTS as $right)
        {
            $rights[$right] = [];
        }
 
        // get additional from all roles
        $res = Role::getList([
            'select' => [
                'ID', 'ACCESS_CODES', 'ADDITIONAL_RIGHTS'
            ]
        ]);
        while ($row = $res->fetch())
        {
            $row['ACCESS_CODES'] = (array) $row['ACCESS_CODES'];
            $row['ADDITIONAL_RIGHTS'] = (array) $row['ADDITIONAL_RIGHTS'];
            foreach ($row['ADDITIONAL_RIGHTS'] as $right)
            {
                if (isset($rights[$right]))
                {
                    $rights[$right][$row['ID']] = $row['ACCESS_CODES'];
                }
            }
        }
 
        // refresh options
        foreach ($rights as $code => $right)
        {
            // gets current from option
            $option = Manager::getOption('access_codes_' . $code, '');
            $option = unserialize($option, ['allowed_classes' => false]);
            if (isset($option[0]))
            {
                $right[0] = $option[0];
            }
 
            // rewrite some rights, if need
            if (
                isset($additionalRights[$code]) &&
                is_array($additionalRights[$code])
            )
            {
                foreach ($additionalRights[$code] as $i => $accCodes)
                {
                    $right[$i] = (array) $accCodes;
                }
            }
 
            // set new rights in option
            Manager::setOption('access_codes_' . $code, $right ? serialize($right) : '');
 
            // clear menu cache
            if (Manager::isB24())
            {
                Manager::getCacheManager()->clearByTag(
                    'bitrix24_left_menu'
                );
                Manager::getCacheManager()->cleanDir(
                    'menu'
                );
                \CBitrixComponent::clearComponentCache(
                    'bitrix:menu'
                );
            }
        }
    }
 
    public static function setAdditionalRightExtended($code, array $accessCodes = [])
    {
        if (!is_string($code))
        {
            return;
        }
        self::refreshAdditionalRights([
            $code => [
                0 => $accessCodes
            ]
        ]);
    }
 
    public static function getAdditionalRightExtended($code)
    {
        static $access = null;
        $return = [];
 
        if (!is_string($code))
        {
            return $return;
        }
        if ($access === null)
        {
            $access = new \CAccess;
        }
 
        $option = Manager::getOption('access_codes_' . $code, '');
        $option = unserialize($option, ['allowed_classes' => false]);
        $accessCodes = isset($option[0]) ? (array)$option[0] : [];
        $codesNames  = $access->getNames($accessCodes);
 
        foreach ($accessCodes as $code)
        {
            if (isset($codesNames[$code]))
            {
                $provider = (
                    isset($codesNames[$code]['provider']) &&
                    $codesNames[$code]['provider']
                )
                    ? $codesNames[$code]['provider']
                    : '';
                $name = isset($codesNames[$code]['name'])
                    ? $codesNames[$code]['name']
                    : $code;
                $return[$code] = [
                    'CODE' => $code,
                    'PROVIDER' => $provider,
                    'NAME' => $name
                ];
            }
        }
 
        return $return;
    }
 
    public static function getAdditionalRightsLabels()
    {
        $rights = [];
 
        $type = Site\Type::getCurrentScopeId();
 
        foreach (self::ADDITIONAL_RIGHTS as $right)
        {
            if (mb_strpos($right, '_') > 0)
            {
                [$prefix, ] = explode('_', $right);
                $prefix = mb_strtoupper($prefix);
                if ($prefix != $type)
                {
                    continue;
                }
            }
            else if ($type !== null)
            {
                continue;
            }
            $rights[$right] = Loc::getMessage('LANDING_RIGHTS_R_'.mb_strtoupper($right));
        }
 
        return $rights;
    }
 
    protected static function hasExtraRights(): bool
    {
        // has context user access to crm forms
        if (\Bitrix\Main\Loader::includeModule('crm'))
        {
            $access = new \CCrmPerms(self::getContextUserId());
            if (!$access->havePerm('WEBFORM', BX_CRM_PERM_NONE, 'WRITE'))
            {
                // grant access to crm forms sites
                $res = Site::getList([
                    'select' => [
                        'ID'
                    ],
                    'filter' => [
                        'CODE' => '/' . Site\Type::PSEUDO_SCOPE_CODE_FORMS . '%',
                        '=SPECIAL' => 'Y',
                        'CHECK_PERMISSIONS' => 'N'
                    ]
                ]);
                while ($row = $res->fetch())
                {
                    self::$allowedSites[] = $row['ID'];
                }
 
                return true;
            }
        }
        return false;
    }
 
    public static function hasAdditionalRight($code, $type = null, bool $checkExtraRights = false, bool $strict = false)
    {
        static $options = [];
 
        if ($checkExtraRights && self::hasExtraRights())
        {
            return true;
        }
 
        if (!is_string($code))
        {
            return false;
        }
        if ($type === null)
        {
            $type = Site\Type::getCurrentScopeId();
        }
 
        if ($type !== null)
        {
            $type = mb_strtolower($type);
            //@todo: hotfix for group right
            if ($type == Site\Type::SCOPE_CODE_GROUP)
            {
                return true;
            }
            $code = $type . '_' . $code;
        }
 
        if (array_key_exists($code, self::ADDITIONAL_RIGHTS))
        {
            if (!self::isFeatureOn())
            {
                return true;
            }
 
            if (!self::getContextUserId())
            {
                return false;
            }
 
            if (Manager::isAdmin())
            {
                if (in_array($code, self::REVERSE_RIGHTS))
                {
                    return false;
                }
                return true;
            }
 
            $accessCodes = [];
            if (!isset($options[$code]))
            {
                $options[$code] = Manager::getOption('access_codes_' . $code, '');
                $options[$code] = unserialize($options[$code], ['allowed_classes' => false]);
            }
            $option = $options[$code];
 
            if (!is_array($option) && !$strict)
            {
                return true;
            }
 
            if (empty($option))
            {
                return false;
            }
 
            if (self::isExtendedMode())
            {
                if (isset($option[0]) && is_array($option[0]))
                {
                    $accessCodes = $option[0];
                }
            }
            else
            {
                if (isset($option[0]))
                {
                    unset($option[0]);
                }
                foreach ($option as $roleAccess)
                {
                    $accessCodes = array_merge($accessCodes, (array)$roleAccess);
                }
                $accessCodes = array_unique($accessCodes);
            }
 
            if ($accessCodes)
            {
                static $accessCodesStatic = [];
 
                sort($accessCodes);
                $accessCodesStr = implode('|', $accessCodes);
 
                if (array_key_exists($accessCodesStr, $accessCodesStatic))
                {
                    return $accessCodesStatic[$accessCodesStr];
                }
 
                $res = UserAccessTable::getList([
                    'select' => [
                        'USER_ID'
                    ],
                    'filter' => [
                        '=ACCESS_CODE' => $accessCodes,
                        'USER_ID' => self::getContextUserId()
                    ]
                ]);
                $accessCodesStatic[$accessCodesStr] = (boolean)$res->fetch();
                return $accessCodesStatic[$accessCodesStr];
            }
 
            return false;
        }
 
        return false;
    }
}