diff --git a/backend/src/controllers/Permissions.php b/backend/src/controllers/Permissions.php new file mode 100644 index 0000000..6c7fbdc --- /dev/null +++ b/backend/src/controllers/Permissions.php @@ -0,0 +1,44 @@ +logger = $c->logger; + $this->c = $c; + } + + public function getList(Request $req, Response $res, array $args) + { + $ac = new \Operations\AccessControl($this->c); + if (!$ac->isAdmin($req->getAttribute('userId'))) { + $this->logger->info('Non admin user tries to get permissions'); + return $res->withJson(['error' => 'You must be admin to use this feature'], 403); + } + + $paging = new \Utils\PagingInfo($req->getQueryParam('page'), $req->getQueryParam('pagesize')); + $user = intval($args['user']); + + $permissions = new \Operations\Permissions($this->c); + + $results = $permissions->getPermissions($paging, $user); + + return $res->withJson([ + 'paging' => $paging->toArray(), + 'results' => $results + ], 200); + } +} diff --git a/backend/src/operations/Permissions.php b/backend/src/operations/Permissions.php new file mode 100644 index 0000000..9664c72 --- /dev/null +++ b/backend/src/operations/Permissions.php @@ -0,0 +1,68 @@ +logger = $c->logger; + $this->db = $c->db; + $this->c = $c; + } + + /** + * Get a list of permissions + * + * @param $pi PageInfo object, which is also updated with total page number + * @param $userId Id of the user for which the permissions should be retrieved + * + * @return array Array with matching permissions + */ + public function getPermissions(\Utils\PagingInfo &$pi, int $userId) : array + { + //Count elements + if ($pi->pageSize === null) { + $pi->totalPages = 1; + } else { + $query = $this->db->prepare('SELECT COUNT(*) AS total FROM permissions WHERE user_id=:userId'); + + $query->bindValue(':userId', $userId, \PDO::PARAM_INT); + + $query->execute(); + $record = $query->fetch(); + + $pi->totalPages = ceil($record['total'] / $pi->pageSize); + } + + $pageStr = \Services\Database::makePagingString($pi); + + $query = $this->db->prepare(' + SELECT P.domain_id as domainId,D.name as domainName FROM permissions P + LEFT OUTER JOIN domains D ON D.id=P.domain_id + WHERE P.user_id=:userId' + . $pageStr); + + $query->bindValue(':userId', $userId, \PDO::PARAM_INT); + + $query->execute(); + + $data = $query->fetchAll(); + + return $data; + } +} diff --git a/backend/src/public/index.php b/backend/src/public/index.php index feadcd1..87ee951 100644 --- a/backend/src/public/index.php +++ b/backend/src/public/index.php @@ -47,6 +47,8 @@ $app->group('/v1', function () { $this->delete('/records/{recordId}/credentials/{credentialId}', '\Controllers\Credentials:delete'); $this->get('/records/{recordId}/credentials/{credentialId}', '\Controllers\Credentials:getSingle'); $this->put('/records/{recordId}/credentials/{credentialId}', '\Controllers\Credentials:put'); + + $this->get('/users/{user}/permissions', '\Controllers\Permissions:getList'); })->add('\Middlewares\Authentication'); }); diff --git a/backend/test/tests/permissions.js b/backend/test/tests/permissions.js new file mode 100644 index 0000000..f45c189 --- /dev/null +++ b/backend/test/tests/permissions.js @@ -0,0 +1,47 @@ +const test = require('../testlib'); + +test.run(async function () { + await test('admin', async function (assert, req) { + //Test paging + var res = await req({ + url: '/users/2/permissions?pagesize=1&page=2', + method: 'get' + }); + + assert.equal(res.status, 200, 'Status should be OK'); + assert.equal(res.data.paging, { + page: 2, + total: 2, + pagesize: 1 + }, 'Paging data fail for ' + res.config.url); + assert.equal(res.data.results.length, 1, "Should be 1 results."); + + var res = await req({ + url: '/users/2/permissions', + method: 'get' + }); + + assert.equal(res.status, 200, 'Get of permissions should be OK'); + assert.equal(res.data.results, [ + { + domainId: '1', + domainName: 'example.com' + }, + { + domainId: '2', + domainName: 'slave.example.net' + } + ], 'Get permissions result fail'); + + + }); + + await test('user', async function (assert, req) { + var res = await req({ + url: '/users/2/permissions', + method: 'get' + }); + + assert.equal(res.status, 403, 'Get of permissions should fail for user.'); + }); +}); \ No newline at end of file