Code Coverage |
||||||||||
Lines |
Functions and Methods |
Classes and Traits |
||||||||
| Total | |
100.00% |
9 / 9 |
|
100.00% |
2 / 2 |
CRAP | |
100.00% |
1 / 1 |
| RequestSignAuthorizationService | |
100.00% |
9 / 9 |
|
100.00% |
2 / 2 |
3 | |
100.00% |
1 / 1 |
| __construct | |
100.00% |
1 / 1 |
|
100.00% |
1 / 1 |
1 | |||
| canRequestSign | |
100.00% |
8 / 8 |
|
100.00% |
1 / 1 |
2 | |||
| 1 | <?php |
| 2 | |
| 3 | declare(strict_types=1); |
| 4 | /** |
| 5 | * SPDX-FileCopyrightText: 2026 LibreCode coop and contributors |
| 6 | * SPDX-License-Identifier: AGPL-3.0-or-later |
| 7 | */ |
| 8 | |
| 9 | namespace OCA\Libresign\Service\Policy; |
| 10 | |
| 11 | use OCA\Libresign\Service\Policy\Provider\RequestSignGroups\RequestSignGroupsPolicy; |
| 12 | use OCA\Libresign\Service\Policy\Provider\RequestSignGroups\RequestSignGroupsPolicyValue; |
| 13 | use OCP\IGroupManager; |
| 14 | use OCP\IUser; |
| 15 | |
| 16 | class RequestSignAuthorizationService { |
| 17 | public function __construct( |
| 18 | private PolicyService $policyService, |
| 19 | private IGroupManager $groupManager, |
| 20 | ) { |
| 21 | } |
| 22 | |
| 23 | /** |
| 24 | * Check if a user is authorized to create signature requests. |
| 25 | * |
| 26 | * This evaluates the delegated RBAC policy 'groups_request_sign' which controls |
| 27 | * which groups are authorized to create signature requests within the current scope. |
| 28 | * Administrators can only authorize groups they themselves belong to. |
| 29 | * |
| 30 | * @param IUser|null $user The user to check (typically current user) |
| 31 | * @return bool True if user belongs to at least one authorized requester group |
| 32 | */ |
| 33 | public function canRequestSign(?IUser $user = null): bool { |
| 34 | if (!$user instanceof IUser) { |
| 35 | return false; |
| 36 | } |
| 37 | |
| 38 | $resolvedPolicy = $this->policyService->resolveForUser(RequestSignGroupsPolicy::KEY, $user); |
| 39 | $userGroups = $this->groupManager->getUserGroupIds($user); |
| 40 | |
| 41 | return RequestSignGroupsPolicyValue::canUserGroupsRequestSign( |
| 42 | $resolvedPolicy->getEffectiveValue(), |
| 43 | $userGroups, |
| 44 | ); |
| 45 | } |
| 46 | } |