ezsystems / ezpublish-kernel

     * @param \eZ\Publish\API\Repository\Values\User\UserGroup $userGroup

     * @param \eZ\Publish\API\Repository\Values\User\Limitation\RoleLimitation $roleLimitation an optional role limitation (which is either a subtree limitation or section limitation)

     */

    public function assignRoleToUserGroup(APIRole $role, UserGroup $userGroup, RoleLimitation $roleLimitation = null)

    {

        if ($this->permissionResolver->canUser('role', 'assign', $userGroup, [$role]) !== true) {

            throw new UnauthorizedException('role', 'assign');

        }

        if ($roleLimitation === null) {

            $limitation = null;

        } else {

            $limitationValidationErrors = $this->limitationService->validateLimitation($roleLimitation);

            if (!empty($limitationValidationErrors)) {

                throw new LimitationValidationException($limitationValidationErrors);

            }

            $limitation = [$roleLimitation->getIdentifier() => $roleLimitation->limitationValues];

        }

        // Check if objects exists

        $spiRole = $this->userHandler->loadRole($role->id);

        $loadedUserGroup = $this->repository->getUserService()->loadUserGroup($userGroup->id);

        $limitation = $this->checkAssignmentAndFilterLimitationValues($loadedUserGroup->id, $spiRole, $limitation);

        $this->repository->beginTransaction();

        try {

            $this->userHandler->assignRole(

                $loadedUserGroup->id,

                $spiRole->id,

                $limitation

            );

            $this->repository->commit();

        } catch (Exception $e) {

            $this->repository->rollback();

            throw $e;

        }

    }

    /**

     * Assigns a role to the given user.

     * @param \eZ\Publish\API\Repository\Values\User\User $user

     * @param \eZ\Publish\API\Repository\Values\User\Limitation\RoleLimitation $roleLimitation an optional role limitation (which is either a subtree limitation or section limitation)

     */

    public function assignRoleToUser(APIRole $role, User $user, RoleLimitation $roleLimitation = null)

    {

        if ($this->permissionResolver->canUser('role', 'assign', $user, [$role]) !== true) {

            throw new UnauthorizedException('role', 'assign');

        }

        if ($roleLimitation === null) {

            $limitation = null;

        } else {

            $limitationValidationErrors = $this->limitationService->validateLimitation($roleLimitation);

            if (!empty($limitationValidationErrors)) {

                throw new LimitationValidationException($limitationValidationErrors);

            }

            $limitation = [$roleLimitation->getIdentifier() => $roleLimitation->limitationValues];

        }

        // Check if objects exists

        $spiRole = $this->userHandler->loadRole($role->id);

        $spiUser = $this->userHandler->load($user->id);

        $limitation = $this->checkAssignmentAndFilterLimitationValues($spiUser->id, $spiRole, $limitation);

        $this->repository->beginTransaction();

        try {

            $this->userHandler->assignRole(

                $spiUser->id,

                $spiRole->id,

                $limitation

            );

            $this->repository->commit();

        } catch (Exception $e) {

            $this->repository->rollback();

            throw $e;

        }

    }

    /**

     * Removes the given role assignment.