diff --git a/workbench_access.install b/workbench_access.install index 3002e27..2f10523 100644 --- a/workbench_access.install +++ b/workbench_access.install @@ -134,7 +134,54 @@ function workbench_access_schema() { 'uid' => array('node' => 'nid'), ), ); - + $schema['workbench_access_permission'] = array( + 'description' => 'Stores extended permissions for Workbench Access.', + 'fields' => array( + 'id_type' => array( + 'description' => 'The foreign id table name.', + 'type' => 'varchar', + 'length' => '20', + 'not null' => TRUE, + ), + 'id' => array( + 'description' => 'The foreign id key.', + 'type' => 'int', + 'not null' => TRUE, + ), + 'access_scheme' => array( + 'description' => 'The module responsbile for this access system.', + 'type' => 'varchar', + 'length' => '40', + 'not null' => TRUE, + ), + 'access_id' => array( + 'description' => 'The section identifier. Foreign key to {workbench_access}.', + 'type' => 'varchar', + 'length' => '80', + 'not null' => TRUE, + ), + 'entity' => array( + 'description' => 'The entity type for this permission.', + 'type' => 'varchar', + 'length' => '40', + 'not null' => TRUE, + ), + 'bundle' => array( + 'description' => 'The entity bundle for this permission.', + 'type' => 'varchar', + 'length' => '80', + 'not null' => TRUE, + ), + 'permission' => array( + 'description' => 'The permission for this row.', + 'type' => 'varchar', + 'length' => '40', + 'not null' => TRUE, + ), + ), + 'primary key' => array('id_type', 'id', 'access_scheme', 'access_id', 'entity', 'bundle', 'permission'), + ); + return $schema; } @@ -298,3 +345,106 @@ function workbench_access_update_7003() { } variable_set('workbench_access_taxonomy', $new); } + +/** + * Add the extended permission table. + */ +function workbench_access_update_7004() { + $table = array( + 'description' => 'Stores extended permissions for Workbench Access.', + 'fields' => array( + 'id_type' => array( + 'description' => 'The foreign id table name.', + 'type' => 'varchar', + 'length' => '20', + 'not null' => TRUE, + ), + 'id' => array( + 'description' => 'The foreign id key.', + 'type' => 'int', + 'not null' => TRUE, + ), + 'access_scheme' => array( + 'description' => 'The module responsbile for this access system.', + 'type' => 'varchar', + 'length' => '40', + 'not null' => TRUE, + ), + 'access_id' => array( + 'description' => 'The section identifier. Foreign key to {workbench_access}.', + 'type' => 'varchar', + 'length' => '80', + 'not null' => TRUE, + ), + 'entity' => array( + 'description' => 'The entity type for this permission.', + 'type' => 'varchar', + 'length' => '40', + 'not null' => TRUE, + ), + 'bundle' => array( + 'description' => 'The entity bundle for this permission.', + 'type' => 'varchar', + 'length' => '80', + 'not null' => TRUE, + ), + 'permission' => array( + 'description' => 'The permission for this row.', + 'type' => 'varchar', + 'length' => '40', + 'not null' => TRUE, + ), + ), + 'primary key' => array('id_type', 'id', 'access_scheme', 'access_id', 'entity', 'bundle', 'permission'), + ); + db_create_table('workbench_access_permission', $table); +} + +/** + * Update permissions for all users and roles. + */ +function workbench_access_update_7005() { + $bundles = array(); + $types = node_type_get_types(); + foreach ($types as $key => $value) { + if (empty($value->disabled)) { + $bundles[] = $key; + } + } + $users = db_query("SELECT * FROM {workbench_access_user}")->FetchAll(); + $roles = db_query("SELECT * FROM {workbench_access_role}")->FetchAll(); + $insert = array(); + foreach ($users as $data) { + $insert[] = array( + 'id_type' => 'user', + 'id' => $data->uid, + 'access_scheme' => $data->access_scheme, + 'access_id' => $data->access_id, + ); + } + foreach ($roles as $data) { + $insert[] = array( + 'id_type' => 'role', + 'id' => $data->rid, + 'access_scheme' => $data->access_scheme, + 'access_id' => $data->access_id, + ); + } + $permissions = array('view', 'create', 'update', 'delete', 'preview', 'revise', 'publish'); + $items = array(); + foreach($insert as $data) { + $data['entity'] = 'node'; + foreach($bundles as $bundle) { + $data['bundle'] = $bundle; + foreach ($permissions as $permission) { + $data['permission'] = $permission; + $items[] = $data; + } + } + } + $query = db_insert('workbench_access_permission')->fields(array('id_type', 'id', 'access_scheme', 'access_id', 'entity', 'bundle', 'permission')); + foreach ($items as $record) { + $query->values($record); + } + $query->execute(); +} diff --git a/workbench_access.module b/workbench_access.module index 7cfad2c..1c7fc3f 100644 --- a/workbench_access.module +++ b/workbench_access.module @@ -630,21 +630,22 @@ function workbench_access_user_load_data($account) { $account->workbench_access_by_role[] = $data->access_id; } } + // Find advanced rules. + $permissions = db_query("SELECT bundle, permission, access_id FROM {workbench_access_permission} + WHERE (id_type = 'user' AND id = :uid) + OR (id_type = 'role' AND id IN (:roles))", + array(':uid' => $account->uid, ':roles' => array_keys($account->roles)) + )->fetchAll(); + $rules = array(); + foreach ($permissions as $perm) { + $rules[$perm->access_id][$perm->permission][] = $perm->bundle; + } foreach ($items as $item) { - if (!in_array($item->access_id, array_keys($active['tree']))) { + if (!in_array($item->access_id, array_keys($active['tree'])) || !isset($rules[$item->access_id])) { continue; } // Get the permissions for those sections. - // @TODO: complex permission handling. - $access[$item->access_id] = array( - 'view' => array('all'), - 'create' => array('all'), - 'update' => array('all'), - 'delete' => array('all'), - 'preview' => array('all'), - 'revise' => array('all'), - 'publish' => array('all'), - ); + $access[$item->access_id] = $rules[$perm->access_id]; } // Allow modules to alter the default behavior. drupal_alter('workbench_access_user', $access, $account); @@ -854,6 +855,7 @@ function workbench_access_user_section_save($uid, $access_id, $access_scheme) { $record['access_id'] = $access_id; $record['access_scheme'] = $access_scheme; drupal_write_record('workbench_access_user', $record); + workbench_access_save_extended_permissions($record, 'user'); drupal_static_reset('workbench_access_user_load_data'); $account = user_load($uid, TRUE); module_invoke_all('workbench_access_save_user', $account, $access_id, $access_scheme); @@ -881,6 +883,12 @@ function workbench_access_user_section_delete($uid, $access_id, $access_scheme) ->condition('access_scheme', $access_scheme) ->condition('uid', $uid) ->execute(); + db_delete('workbench_access_permission') + ->condition('id_type', 'user') + ->condition('access_id', $access_id) + ->condition('access_scheme', $access_scheme) + ->condition('id', $uid) + ->execute(); drupal_static_reset('workbench_access_user_load_data'); } @@ -901,6 +909,7 @@ function workbench_access_role_section_save($rid, $access_id, $access_scheme) { $record['access_id'] = $access_id; $record['access_scheme'] = $access_scheme; drupal_write_record('workbench_access_role', $record); + workbench_access_save_extended_permissions($record, 'role'); $role = user_role_load($rid, TRUE); module_invoke_all('workbench_access_save_role', $role, $access_id, $access_scheme); } @@ -927,6 +936,13 @@ function workbench_access_role_section_delete($rid, $access_id, $access_scheme) ->condition('access_scheme', $access_scheme) ->condition('rid', $rid) ->execute(); + db_delete('workbench_access_permission') + ->condition('id_type', 'role') + ->condition('access_id', $access_id) + ->condition('access_scheme', $access_scheme) + ->condition('id', $rid) + ->execute(); + } /** @@ -954,6 +970,51 @@ function workbench_access_user_role_delete($role) { } /** + * Save extended permissions to {workbench_access_permission}. + * + * @param $record + * The access record array saved for the user or role. + * @param $type + * The record type (user or role). + * @param $entity_type + * The entity type to store. Only 'node' is supported. + * @param $bundles + * The entity bundles to set rules for, in the format: + * $bundle[BUNDLE_NAME] = $permissions; + * Where $permissions is an array of the 7 supporter permissions for access + * control: view, create, update, delete, preview, revise, publish. + * If empty, all permissions will be assigned. + */ +function workbench_access_save_extended_permissions($record, $type, $entity_type = 'node', $bundles = array()) { + if (empty($bundles)) { + $bundles = array(); + $permissions = array('view', 'create', 'update', 'delete', 'preview', 'revise', 'publish'); + $types = node_type_get_types(); + foreach ($types as $key => $value) { + if (empty($value->disabled)) { + $bundles[$key] = $permissions; + } + } + } + $items = array(); + foreach($bundles as $bundle => $permissions) { + $record['id_type'] = $type; + $record['id'] = ($type == 'user') ? $record['uid'] : $record['rid']; + $record['bundle'] = $bundle; + $record['entity'] = 'node'; + foreach ($permissions as $permission) { + $record['permission'] = $permission; + $items[] = $record; + } + } + $query = db_insert('workbench_access_permission')->fields(array('id_type', 'id', 'access_scheme', 'access_id', 'entity', 'bundle', 'permission')); + foreach ($items as $value) { + $query->values($value); + } + $query->execute(); +} + +/** * Defines configuration options for the default access scheme. * * @see workbench_access_workbench_access_info()