[0.12] Restrict user access using Accesspoints

CHANGELOG.md

@@ -3,7 +3,9 @@ All notable changes to this project will be documented in this file.
 
 ## 0.12 - (Luxor)
 ### Added
+- Access Points (Plugins can define additional access points to restrict user access to certain parts of the plugin)
 - Plugin-System now supports custom components, e.g. attribute types
+- Plugin-System now supports PluginScopes
 - .env variable `ALLOW_FILESYSTEM_MIGRATIONS` to explcitly enable filesystem migrations
 - API endpoint for getting all entity details data in one request: GET::v1/entity/{id}/entity_detail
 ### Fixed

app/AttributeTypes/GeographyAttribute.php

@@ -42,7 +42,7 @@ public static function unserialize(mixed $data): mixed {
 
     public static function serialize(mixed $data): mixed {
         if($data instanceof Geometry) {
-            return $data;
+            return Geodata::toWKT($data);
         } else {
             return Geodata::wkb2wkt($data);
         }

app/AttributeValue.php

@@ -4,10 +4,11 @@
 
 use App\Geodata;
 use App\AttributeTypes\AttributeBase;
+use App\Exceptions\InvalidDataException;
+use Illuminate\Database\Eloquent\Model;
+use Clickbar\Magellan\Data\Geometries\Geometry;
 use App\Traits\CommentTrait;
 use App\Traits\ModerationTrait;
-use Clickbar\Magellan\Data\Geometries\Geometry;
-use Illuminate\Database\Eloquent\Model;
 use Spatie\Activitylog\Traits\LogsActivity;
 use Spatie\Activitylog\LogOptions;
 use Spatie\Searchable\Searchable;
@@ -87,6 +88,101 @@ public function getValue() {
         return AttributeBase::serializeValue($this);
     }
 
+    // [VR] Temporary solution to allow patching entities/attribute values outside of controller
+    // But this is also already fixed (in a different way) on pull/585 (0.11.2-fix-attribute-value-list-error)
+    public static function handlePatch(int $entity_id, int $attribute_id, mixed $value, string $operation, User $user, array &$added = [], array &$deleted = []) {
+        $error = null;
+        $code = 400;
+        switch($operation) {
+            case 'remove':
+                $attrval = AttributeValue::where([
+                    ['entity_id', '=', $entity_id],
+                    ['attribute_id', '=', $attribute_id],
+                ])->first();
+                if(!isset($attrval)) {
+                    $error = __('This attribute value does either not exist or is in moderation state.');
+                    break;
+                }
+                if($user->isModerated()) {
+                    $attrval->moderate('pending-delete', true);
+                } else {
+                    $deleted[$attribute_id] = $attrval;
+                    $attrval->delete();
+                }
+                break;
+
+            /**
+             * In the case when a user created the attribute, while another was visiting the
+             * page and sends an 'add' operation, and the other user also sends their changes,
+             * the application would have thrown an error, that the attribute was already created.
+             *
+             * That's why we combined the add and replace operations into one case.
+             * [SO] 29.01.2025
+             */
+            case 'add':
+            case 'replace':
+                $alreadyModerated = AttributeValue::where('entity_id', $entity_id)
+                    ->where('attribute_id', $attribute_id)
+                    ->onlyModerated()
+                    ->exists();
+
+                // Currently the logic is that a moderated state cannot be changed
+                // by a moderated user.
+                if($alreadyModerated && $user->isModerated()) {
+                    $error = __('This attribute value is in moderation state. A user with appropriate permissions has to accept or deny it first.');
+                    break;
+                }
+                $attrval = AttributeValue::firstOrNew([
+                    'entity_id' => $entity_id,
+                    'attribute_id' => $attribute_id,
+                ], [
+                    'certainty' => null
+                ]);
+                if($user->isModerated()) {
+                    $attrval = $attrval->moderate('pending', false, true);
+                    unset($attrval->comments_count);
+                }
+                break;
+            default:
+                $error = __('Unknown operation');
+        }
+
+        if($error !== null) {
+            return [
+                'message' => $error,
+                'code' => $code,
+            ];
+        }
+
+        // no further action required for deleted attribute values, continue with next patch
+        if($operation == 'remove') {
+            return false;
+        }
+
+        try {
+            $attr = Attribute::findOrFail($attribute_id);
+            $formKeyValue = AttributeValue::getFormattedKeyValue($attr->datatype, $value);
+        } catch(InvalidDataException $ide) {
+            return [
+                'message' => $ide->getMessage(),
+                'code' => 422,
+            ];
+        }
+
+        $attrval->{$formKeyValue->key} = $formKeyValue->val;
+        $attrval->user_id = $user->id;
+        $attrval->save();
+
+        // As we cannot ensure that the 'add' is correct,
+        // we use this laravel option to ensure the attribute
+        // was created and not replaced.
+        if($attrval->wasRecentlyCreated) {
+            $added[$attribute_id] = $attrval;
+        }
+
+        return false;
+    }
+
     public static function getValueFromKey($arr) {
         if(!isset($arr)) return null;
 

app/Entity.php

@@ -7,6 +7,7 @@
 use App\Exceptions\AmbiguousValueException;
 use App\Import\EntityImporter;
 use App\Traits\CommentTrait;
+use App\Traits\HasPluginScopes;
 
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
@@ -25,6 +26,7 @@ class Entity extends Model implements Searchable {
     use CommentTrait;
     use SearchableTrait;
     use LogsActivity;
+    use HasPluginScopes;
 
     /**
      * The attributes that are assignable.
@@ -98,6 +100,7 @@ public static function getSearchCols(): array {
         return array_keys(self::searchCols);
     }
 
+
     public static function getFromPath($path, $delimiter = "\\\\"): ?int {
         if(!isset($path)) {
             return null;
@@ -215,7 +218,7 @@ public static function create($fields, $entityTypeId, $user, $rootEntityId = nul
         $entity->save();
 
         // TODO workaround to get all (optional, not part of request) attributes
-        $entity = self::find($entity->id);
+        $entity = self::withoutGlobalScopes()->find($entity->id);
         AttributeBase::onCreateHandler($entity, $user);
         $entity->children_count = 0;
 
@@ -269,7 +272,7 @@ private function moveOrFail(int | null $parentId) {
         }
         return $query;
     }
-    
+
     public function move($parentId, $rank, $user) {
         if($rank == null){
             if(isset($parentId)) {

app/Http/Controllers/EntityController.php

@@ -831,15 +831,14 @@ public function patchAttributes($id, Request $request) {
             ], 403);
         }
 
-        try{
+        try {
             $entity = Entity::findOrFail($id);
         } catch(ModelNotFoundException $e) {
             return response()->json([
                 'error' => __('This entity does not exist'),
             ], 400);
         }
 
-        DB::beginTransaction();
         $addedAttributes = [];
         $removedAttributes = [];
 
@@ -851,95 +850,19 @@ public function patchAttributes($id, Request $request) {
             ], 204);
         }
 
+        DB::beginTransaction();
+
         foreach($request->request as $patch) {
             $op = $patch['op'];
             $aid = $patch['params']['aid'];
-            $error = null;
-            switch($op) {
-                case 'remove':
-                    $attrval = AttributeValue::where([
-                        ['entity_id', '=', $id],
-                        ['attribute_id', '=', $aid],
-                    ])->first();
-                    if(!isset($attrval)) {
-                        $error = __('This attribute value does either not exist or is in moderation state.');
-                        break;
-                    }
-                    if($user->isModerated()) {
-                        $attrval->moderate('pending-delete', true);
-                    } else {
-                        $removedAttributes[$aid] = $attrval;
-                        $attrval->delete();
-                    }
-                    break;
-
-                /**
-                 * In the case when a user created the attribute, while another was visiting the
-                 * page and sends an 'add' operation, and the other user also sends his changes,
-                 * the application would have thrown an error, that the attribute was already created.
-                 *
-                 * That's why we combined the add and replace operations into one case.
-                 * [SO] 29.01.2025
-                 */
-                case 'add':
-                case 'replace':
-                    $alreadyModerated = AttributeValue::where('entity_id', $id)
-                        ->where('attribute_id', $aid)
-                        ->onlyModerated()
-                        ->exists();
-
-                    // Currently the logic is that a moderated state cannot be changed
-                    // by a moderated user.
-                    if($alreadyModerated && $user->isModerated()) {
-                        $error = __('This attribute value is in moderation state. A user with appropriate permissions has to accept or deny it first.');
-                        break;
-                    }
-                    $value = $patch['value'];
-                    $attrval = AttributeValue::firstOrNew([
-                        'entity_id' => $id,
-                        'attribute_id' => $aid,
-                    ], [
-                        'certainty' => null
-                    ]);
-                    if($user->isModerated()) {
-                        $attrval = $attrval->moderate('pending', false, true);
-                        unset($attrval->comments_count);
-                    }
-                    break;
-                default:
-                    $error = __('Unknown operation');
-            }
-
-            if($error !== null) {
-                DB::rollBack();
+            // FIXME [VR]: `?? null` is only necessary, because of temporary AttributeValue::handlePatch() implementation
+            $value = $patch['value'] ?? null;
+            $error = AttributeValue::handlePatch($id, $aid, $value, $op, $user, $addedAttributes, $removedAttributes);
+            if($error !== false) {
+                DB::rollback();
                 return response()->json([
-                    'error' => $error,
-                ], 400);
-            }
-
-            // no further action required for deleted attribute values, continue with next patch
-            if($op == 'remove') {
-                continue;
-            }
-
-            try {
-                $attr = Attribute::findOrFail($aid);
-                $formKeyValue = AttributeValue::getFormattedKeyValue($attr->datatype, $value);
-            } catch(InvalidDataException $ide) {
-                return response()->json([
-                    'error' => $ide->getMessage(),
-                ], 422);
-            }
-
-            $attrval->{$formKeyValue->key} = $formKeyValue->val;
-            $attrval->user_id = $user->id;
-            $attrval->save();
-
-            // As we cannot ensure that the 'add' is correct,
-            // we use this laravel option to ensure the attribute
-            // was created and not replaced.
-            if($attrval->wasRecentlyCreated) {
-                $addedAttributes[$aid] = $attrval;
+                    'error' => $error['message'],
+            ], $error['code']);
             }
         }
 
@@ -948,7 +871,7 @@ public function patchAttributes($id, Request $request) {
         $entity->user_id = $user->id;
         if($entity->isDirty()) {
             $entity->save();
-        }else{
+        } else {
             $entity->touch();
         }
 
@@ -971,14 +894,14 @@ public function patchAttribute($id, $aid, Request $request) {
         }
         $this->validate($request, AttributeValue::patchRules);
 
-        try{
+        try {
             Entity::findOrFail($id);
         } catch(ModelNotFoundException $e) {
             return response()->json([
                 'error' => __('This entity does not exist'),
             ], 400);
         }
-        try{
+        try {
             Attribute::findOrFail($aid);
         } catch(ModelNotFoundException $e) {
             return response()->json([