MyArtJaub\Webtrees\Http\Middleware\AuthTreePreference

Complexity

Total Complexity

6

Size/Duplication

Total Lines	40
Duplicated Lines	0 %

Importance

Changes	1
Bugs	0	Features	0

1 Method

Rating	Name	Duplication	Size	Complexity
A	process()	0	34	6

<?php

/**
 * webtrees-lib: MyArtJaub library for webtrees
 *
 * @package MyArtJaub\Webtrees
 * @subpackage Certificates
 * @author Jonathan Jaubart <dev@jaubart.com>
 * @copyright Copyright (c) 2021, Jonathan Jaubart
 * @license http://www.gnu.org/licenses/gpl.html GNU General Public License, version 3
 */

declare(strict_types=1);

namespace MyArtJaub\Webtrees\Http\Middleware;

use Fig\Http\Message\RequestMethodInterface;
use Fisharebest\Webtrees\Auth;
use Fisharebest\Webtrees\Tree;
use Fisharebest\Webtrees\User;
use Fisharebest\Webtrees\Exceptions\HttpAccessDeniedException;
use Fisharebest\Webtrees\Http\RequestHandlers\LoginPage;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

/**
 * Middleware to restrict access based on a Tree preference.
 */
class AuthTreePreference implements MiddlewareInterface
{
    /**
     * {@inheritDoc}
     * @see \Psr\Http\Server\MiddlewareInterface::process()
     */
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        $tree = $request->getAttribute('tree');
        assert($tree instanceof Tree);
        /** @var Tree $tree */

        $route = $request->getAttribute('route');
        assert($route instanceof \Aura\Router\Route);
        /** @var \Aura\Router\Route $route */

        $user = $request->getAttribute('user');

        $permission_preference = $route->extras['permission_preference'] ?? '';
        $permission_level = $permission_preference === '' ? '' : $tree->getPreference($permission_preference);

        // Permissions are configured
        if (is_numeric($permission_level)) {
            // Logged in with the correct role?
            if (Auth::accessLevel($tree, $user) <= (int) $permission_level) {
                    return $handler->handle($request);
            }

            // Logged in, but without the correct role?
            if ($user instanceof User) {
                throw new HttpAccessDeniedException();
            }
        }

        // Permissions no configured, or not logged in
        if ($request->getMethod() === RequestMethodInterface::METHOD_POST) {
            throw new HttpAccessDeniedException();
        }

        return redirect(route(LoginPage::class, ['tree' => $tree->name(), 'url' => $request->getUri()]));
    }
}