manager.php

См. документацию.

<?php
 
namespace Bitrix\Sender\Security\Role;
 
use Bitrix\Main\Loader;
use Bitrix\Main\Application;
use Bitrix\Main\ArgumentException;
use Bitrix\Main\Entity\AddResult;
use Bitrix\Main\Localization\Loc;
use Bitrix\Sender\Access\Role\RoleTable;
use Bitrix\Sender\Internals\Model;
 
use Bitrix\Bitrix24\Feature;
 
Loc::loadMessages(__FILE__);

class Manager
{
    protected static $userRoles = []; // 'USER_ID' => 'ROLE_ID'

    public static function clearMenuCache()
    {
        Application::getInstance()->getTaggedCache()->clearByTag('bitrix:menu');
    }

    public static function canUse()
    {
        if(!Loader::includeModule('bitrix24'))
        {
            return true;
        }
 
        return Feature::isFeatureEnabled('sender_security');
    }

    public static function getTrialText()
    {
        return Loc::getMessage('SENDER_SECURITY_ROLE_MANAGER_TRIAL_TEXT_NEW');
    }

    public static function getRoleList(array $parameters = [])
    {
        return RoleTable::getList($parameters);
    }

    public static function getAccessList(array $parameters = [])
    {
        return Model\Role\AccessTable::getList($parameters);
    }

    public static function setAccessCodes(array $list = [])
    {
        self::clearMenuCache();
        Model\Role\AccessTable::truncate();
        foreach ($list as $item)
        {
            $result = Model\Role\AccessTable::add(array(
                'ROLE_ID' => $item['ROLE_ID'],
                'ACCESS_CODE' => $item['ACCESS_CODE']
            ));
            if(!$result->isSuccess())
            {
                return $result;
            }
        }
 
        return new AddResult();
    }

    public static function getRolesByUserId($userId)
    {
        if(isset(self::$userRoles[$userId]))
            return self::$userRoles[$userId];
 
        $result = [];
        $userAccessCodes = \CAccess::getUserCodesArray($userId);
 
        if(!is_array($userAccessCodes) || count($userAccessCodes) === 0)
            return [];
 
        $cursor = Model\Role\AccessTable::getList([
            'filter' => [
                '=ACCESS_CODE' => $userAccessCodes
            ]
        ]);
 
        while($row = $cursor->fetch())
        {
            $result[] = $row['ROLE_ID'];
        }
 
        self::$userRoles[$userId] = $result;
        return $result;
    }

    public static function getRolePermissions($roleId)
    {
        $result = [];
        $list = Model\Role\PermissionTable::getList(['filter' => ['=ROLE_ID' => $roleId]]);
        foreach ($list as $row)
        {
            $result[$row['ENTITY']][$row['ACTION']] = $row['PERMISSION'];
        }
 
        return Permission::normalize($result);
    }

    public static function setRolePermissions($roleId = null, array $roleFields = [], array $permissions)
    {
        $roleId = (int) $roleId;
        if ($roleId <= 0 && empty($roleFields))
        {
            throw new ArgumentException('Role id should be greater than zero', 'roleId');
        }
 
        if(RoleTable::getRowById($roleId))
        {
            if (!empty($roleFields))
            {
                $result = RoleTable::update($roleId, $roleFields);
                if (!$result->isSuccess())
                {
                    return $result;
                }
            }
        }
        else
        {
            $result = RoleTable::add($roleFields);
            if (!$result->isSuccess())
            {
                return $result;
            }
 
            $roleId = $result->getId();
        }
 
        $normalizedPermissions = Permission::normalize($permissions);
        Model\Role\PermissionTable::deleteByRoleId($roleId);
        foreach ($normalizedPermissions as $entity => $actions)
        {
            foreach ($actions as $action => $permission)
            {
                $result = Model\Role\PermissionTable::add(array(
                    'ROLE_ID' => $roleId,
                    'ENTITY' => $entity,
                    'ACTION' => $action,
                    'PERMISSION' => $permission
                ));
                if (!$result->isSuccess())
                {
                    return $result;
                }
            }
        }
 
        self::clearMenuCache();
        $result = new AddResult();
        $result->setId($roleId);
        return $result;
    }

    public static function deleteRole($roleId)
    {
        Model\Role\PermissionTable::deleteByRoleId($roleId);
        Model\Role\AccessTable::deleteByRoleId($roleId);
        RoleTable::delete($roleId);
        self::clearMenuCache();
    }

    public static function installRolesAgent()
    {
        self::installRoles();
        return '';
    }

    public static function installRoles()
    {
        $roleRow = RoleTable::getRow([]);
        if($roleRow)
        {
            return;
        }
 
 
        $defaultRoles = array(
            'ADMIN' => array(
                'NAME' => Loc::getMessage('SENDER_SECURITY_ROLE_MANAGER_INSTALLER_ADMIN'),
                'PERMISSIONS' => array(
                    Permission::ENTITY_AD => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_RC => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_LETTER => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_SEGMENT => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_BLACKLIST => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_SETTINGS => array(
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                )
            ),
            'MANAGER' => array(
                'NAME' => Loc::getMessage('SENDER_SECURITY_ROLE_MANAGER_INSTALLER_MANAGER'),
                'PERMISSIONS' => array(
                    Permission::ENTITY_AD => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_RC => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_LETTER => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_SEGMENT => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_NONE,
                    ),
                    Permission::ENTITY_BLACKLIST => array(
                        Permission::ACTION_VIEW => Permission::PERMISSION_ANY,
                        Permission::ACTION_MODIFY => Permission::PERMISSION_ANY,
                    ),
                    Permission::ENTITY_SETTINGS => array(
                        Permission::ACTION_MODIFY => Permission::PERMISSION_NONE,
                    ),
                )
            )
        );
 
        $roleIds = array();
        foreach ($defaultRoles as $roleCode => $role)
        {
            $addResult = RoleTable::add(array(
                'NAME' => $role['NAME'],
                'XML_ID' => $roleCode,
            ));
 
            $roleId = $addResult->getId();
            if ($roleId)
            {
                $roleIds[$roleCode] = $roleId;
                Manager::setRolePermissions($roleId, [], $role['PERMISSIONS']);
            }
        }
 
        if (isset($roleIds['ADMIN']))
        {
            Model\Role\AccessTable::add(array(
                'ROLE_ID' => $roleIds['ADMIN'],
                'ACCESS_CODE' => 'G1'
            ));
        }
        if (isset($roleIds['MANAGER']) && Loader::includeModule('intranet'))
        {
            $departmentTree = \CIntranetUtils::getDeparmentsTree();
            $rootDepartment = (int)$departmentTree[0][0];
 
            if ($rootDepartment > 0)
            {
                Model\Role\AccessTable::add(array(
                    'ROLE_ID' => $roleIds['MANAGER'],
                    'ACCESS_CODE' => 'DR'.$rootDepartment
                ));
            }
        }
    }
}