82 lines
2.2 KiB
PHP
82 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Auth;
|
|
|
|
use App\Services\Database\Connection;
|
|
use PDO;
|
|
|
|
class RBAC
|
|
{
|
|
private PDO $pdo;
|
|
private array $permissionCache = [];
|
|
|
|
public function __construct(Connection $connection)
|
|
{
|
|
$this->pdo = $connection->getPdo();
|
|
}
|
|
|
|
/**
|
|
* Check if a user has a specific permission.
|
|
*/
|
|
public function hasPermission(int $userId, string $permissionCode): bool
|
|
{
|
|
$permissions = $this->getUserPermissions($userId);
|
|
return in_array($permissionCode, $permissions);
|
|
}
|
|
|
|
/**
|
|
* Get all unique permissions code associated with the user's roles.
|
|
*/
|
|
public function getUserPermissions(int $userId): array
|
|
{
|
|
if (isset($this->permissionCache[$userId])) {
|
|
return $this->permissionCache[$userId];
|
|
}
|
|
|
|
$sql = "SELECT DISTINCT p.code
|
|
FROM permissions p
|
|
JOIN role_permissions rp ON p.id = rp.permission_id
|
|
JOIN user_roles ur ON rp.role_id = ur.role_id
|
|
WHERE ur.user_id = :user_id";
|
|
|
|
$stmt = $this->pdo->prepare($sql);
|
|
$stmt->execute(['user_id' => $userId]);
|
|
|
|
$permissions = $stmt->fetchAll(PDO::FETCH_COLUMN);
|
|
$permissions = $permissions ?: [];
|
|
|
|
$this->permissionCache[$userId] = $permissions;
|
|
|
|
return $permissions;
|
|
}
|
|
|
|
/**
|
|
* Get user roles.
|
|
*/
|
|
public function getUserRoles(int $userId): array
|
|
{
|
|
$sql = "SELECT r.code
|
|
FROM roles r
|
|
JOIN user_roles ur ON r.id = ur.role_id
|
|
WHERE ur.user_id = :user_id";
|
|
|
|
$stmt = $this->pdo->prepare($sql);
|
|
$stmt->execute(['user_id' => $userId]);
|
|
|
|
$roles = $stmt->fetchAll(PDO::FETCH_COLUMN);
|
|
return $roles ?: [];
|
|
}
|
|
|
|
/**
|
|
* Assign a role to a user.
|
|
*/
|
|
public function assignRoleToUser(int $userId, int $roleId): void
|
|
{
|
|
$stmt = $this->pdo->prepare("INSERT IGNORE INTO user_roles (user_id, role_id) VALUES (?, ?)");
|
|
$stmt->execute([$userId, $roleId]);
|
|
|
|
// Invalidate in-memory permission cache for this user
|
|
unset($this->permissionCache[$userId]);
|
|
}
|
|
}
|