github-mirror/framework
2
0
Fork 0
mirror of https://github.com/flarum/framework.git synced 2025-01-31 10:56:48 +08:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Remove deprecated policy and visibility scoping events

Browse Source
This commit is contained in:
Alexander Skvortsov 2021-01-20 12:13:40 -05:00
parent c887093e67
commit 54fd02e839
7 changed files with 25 additions and 220 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
framework/core/src/Database/ScopeVisibilityTrait.php
View File

@ -9,7 +9,6 @@
namespace Flarum\Database;
use Flarum\Event\ScopeModelVisibility;
use Flarum\User\User;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Support\Arr;
@ -41,11 +40,6 @@ trait ScopeVisibilityTrait
*/
public function scopeWhereVisibleTo(Builder $query, User $actor, string $ability = 'view')
{
/**
* @deprecated beta 15, remove beta 15
*/
static::$dispatcher->dispatch(new ScopeModelVisibility($query, $actor, $ability));
foreach (array_reverse(array_merge([static::class], class_parents($this))) as $class) {
foreach (Arr::get(static::$visibilityScopers, "$class.*", []) as $listener) {
$listener($actor, $query, $ability);

45
framework/core/src/Event/GetPermission.php
View File

@ -1,45 +0,0 @@
<?php
/*
* This file is part of Flarum.
*
* For detailed copyright and license information, please view the
* LICENSE file that was distributed with this source code.
*/
namespace Flarum\Event;
use Flarum\User\User;
/**
* @deprecated beta 15, remove beta 16
*/
class GetPermission
{
/**
* @var User
*/
public $actor;
/**
* @var string
*/
public $ability;
/**
* @var mixed
*/
public $model;
/**
* @param User $actor
* @param string $ability
* @param mixed $model
*/
public function __construct(User $actor, $ability, $model)
{
$this->actor = $actor;
$this->ability = $ability;
$this->model = $model;
}
}

49
framework/core/src/Event/ScopeModelVisibility.php
View File

@ -1,49 +0,0 @@
<?php
/*
* This file is part of Flarum.
*
* For detailed copyright and license information, please view the
* LICENSE file that was distributed with this source code.
*/
namespace Flarum\Event;
use Flarum\User\User;
use Illuminate\Database\Eloquent\Builder;
/**
* The `ScopeModelVisibility` event allows constraints to be applied in a query
* to fetch a model, effectively scoping that model's visibility to the user.
*
* @deprecated beta 15, remove beta 16
*/
class ScopeModelVisibility
{
/**
* @var Builder
*/
public $query;
/**
* @var User
*/
public $actor;
/**
* @var string
*/
public $ability;
/**
* @param Builder $query
* @param User $actor
* @param string $ability
*/
public function __construct(Builder $query, User $actor, $ability)
{
$this->query = $query;
$this->actor = $actor;
$this->ability = $ability;
}
}

73
framework/core/src/User/AbstractPolicy.php
View File

@ -1,73 +0,0 @@
<?php
/*
* This file is part of Flarum.
*
* For detailed copyright and license information, please view the
* LICENSE file that was distributed with this source code.
*/
namespace Flarum\User;
use Flarum\Event\GetPermission;
use Flarum\Event\ScopeModelVisibility;
use Illuminate\Contracts\Events\Dispatcher;
abstract class AbstractPolicy
{
/**
* @var string
*/
protected $model;
/**
* @param Dispatcher $events
*/
public function subscribe(Dispatcher $events)
{
$events->listen(GetPermission::class, [$this, 'getPermission']);
$events->listen(ScopeModelVisibility::class, [$this, 'scopeModelVisibility']);
}
/**
* @param GetPermission $event
* @return bool|void
*/
public function getPermission(GetPermission $event)
{
if (! $event->model instanceof $this->model && $event->model !== $this->model) {
return;
}
if (method_exists($this, $event->ability)) {
$result = call_user_func_array([$this, $event->ability], [$event->actor, $event->model]);
if (! is_null($result)) {
return $result;
}
}
if (method_exists($this, 'can')) {
return call_user_func_array([$this, 'can'], [$event->actor, $event->ability, $event->model]);
}
}
/**
* @param ScopeModelVisibility $event
* @deprecated beta 15, remove beta 16
*/
public function scopeModelVisibility(ScopeModelVisibility $event)
{
if ($event->query->getModel() instanceof $this->model) {
if (substr($event->ability, 0, 4) === 'view') {
$method = 'find'.substr($event->ability, 4);
if (method_exists($this, $method)) {
call_user_func_array([$this, $method], [$event->actor, $event->query]);
}
} elseif (method_exists($this, 'findWithPermission')) {
call_user_func_array([$this, 'findWithPermission'], [$event->actor, $event->query, $event->ability]);
}
}
}
}

27
framework/core/src/User/Access/Gate.php
View File

@ -10,10 +10,8 @@
namespace Flarum\User\Access;
use Flarum\Database\AbstractModel;
use Flarum\Event\GetPermission;
use Flarum\User\User;
use Illuminate\Contracts\Container\Container;
use Illuminate\Contracts\Events\Dispatcher;
use Illuminate\Support\Arr;
class Gate
@ -30,11 +28,6 @@ class Gate
*/
protected $container;
/**
* @var Dispatcher
*/
protected $events;
/**
* @var array
*/
@ -46,12 +39,12 @@ class Gate
protected $policies;
/**
* @param Dispatcher $events
* @param Container $container
* @param array $policyClasses
*/
public function __construct(Container $container, Dispatcher $events, array $policyClasses)
public function __construct(Container $container, array $policyClasses)
{
$this->container = $container;
$this->events = $events;
$this->policyClasses = $policyClasses;
}
@ -88,20 +81,6 @@ class Gate
}
}
// START OLD DEPRECATED SYSTEM
// Fire an event so that core and extension modelPolicies can hook into
// this permission query and explicitly grant or deny the
// permission.
$allowed = $this->events->until(
new GetPermission($actor, $ability, $model)
);
if (! is_null($allowed)) {
return $allowed;
}
// END OLD DEPRECATED SYSTEM
// If no policy covered this permission query, we will only grant
// the permission if the actor's groups have it. Otherwise, we will
// not allow the user to perform this action.

23
framework/core/tests/integration/api/discussions/ShowTest.php
View File

@ -118,29 +118,6 @@ class ShowTest extends TestCase
$this->assertEquals(2, Arr::get($json, 'data.relationships.posts.data.0.id'));
}
/**
* @test
*/
public function when_allowed_guests_can_see_hidden_posts()
{
/** @var Dispatcher $events */
$events = $this->app()->getContainer()->make(Dispatcher::class);
$events->listen(ScopeModelVisibility::class, function (ScopeModelVisibility $event) {
if ($event->ability === 'hidePosts') {
$event->query->whereRaw('1=1');
}
});
$response = $this->send(
$this->request('GET', '/api/discussions/4')
);
$json = json_decode($response->getBody()->getContents(), true);
$this->assertEquals(2, Arr::get($json, 'data.relationships.posts.data.0.id'));
}
/**
* @test
*/

22
framework/core/tests/integration/extenders/ModelVisibilityTest.php
View File

@ -18,6 +18,7 @@ use Flarum\Tests\integration\RetrievesAuthorizedUsers;
use Flarum\Tests\integration\TestCase;
use Flarum\User\User;
use Illuminate\Database\Eloquent\Builder;
use Illuminate\Support\Arr;
class ModelVisibilityTest extends TestCase
{
@ -46,6 +47,27 @@ class ModelVisibilityTest extends TestCase
]);
}
/**
* @test
*/
public function when_allowed_guests_can_see_hidden_posts()
{
$this->extend(
(new Extend\ModelVisibility(CommentPost::class))
->scope(function (User $user, Builder $query) {
$query->whereRaw('1=1');
}, 'hidePosts')
);
$response = $this->send(
$this->request('GET', '/api/discussions/2')
);
$json = json_decode($response->getBody()->getContents(), true);
$this->assertEquals(1, Arr::get($json, 'data.relationships.posts.data.0.id'));
}
/**
* @test
*/