silverstripe / silverstripe-framework

src/Security/PermissionRoleCode.php

<?php

namespace SilverStripe\Security;

use SilverStripe\ORM\DataObject;
use SilverStripe\Security\PermissionRole;

/**
 * A PermissionRoleCode represents a single permission code assigned to a {@link PermissionRole}.
 *
 * @property string Code
 * @property int RoleID
 * @method PermissionRole Role()
 */
class PermissionRoleCode extends DataObject
{
    private static $db = array(

The private property $db is not used, and could be removed.

        "Code" => "Varchar",
    );

    private static $has_one = array(

The private property $has_one is not used, and could be removed.

        "Role" => PermissionRole::class,
    );

    private static $table_name = "PermissionRoleCode";

The private property $table_name is not used, and could be removed.

    public function validate()
    {
        $result = parent::validate();

        // Check that new code doesn't increase privileges, unless an admin is editing.
        $privilegedCodes = Permission::config()->privileged_permissions;

The property privileged_permissions does not exist on SilverStripe\Core\Config\Config_ForClass. Since you implemented __get, consider adding a @property annotation.

        if ($this->Code
            && in_array($this->Code, $privilegedCodes)
            && !Permission::check('ADMIN')
        ) {
            $result->addError(
                _t(
                    __CLASS__ . '.PermsError',
                    'Can\'t assign code "{code}" with privileged permissions (requires ADMIN access)',
                    ['code' => $this->Code]
                )
            );
        }

        return $result;
    }

    public function canCreate($member = null, $context = array())
    {
        return Permission::check('APPLY_ROLES', 'any', $member);
    }

    public function canEdit($member = null)
    {
        return Permission::check('APPLY_ROLES', 'any', $member);
    }

    public function canDelete($member = null)
    {
        return Permission::check('APPLY_ROLES', 'any', $member);
    }
}