<?php
// $Id$

/**
 * @file
 * Makes sure no user that is not being referenced by any user reference field in the node
 * or a field from this node (from CCK) can access this node or is able to see it in any
 * overview/view/node listing
 */

/**
 * Implementation of hook_access().
 *
 * Node modules may implement node_access() to determine the operations
 * users may perform on nodes. This example uses a very common access pattern.
 */
function acl_example_nodeapi(&$node, $op, $a3 = NULL, $a4 = NULL) {
  switch ($op) {
    case 'update':
    case 'insert':
      if ($node->type == 'department') {
        //dsm($node);
        if ($acl_id = acl_get_id_by_name('acl_example', $node->nid)) {
          //we start of with a clean slate. We don't want strange users to be kept in the system
          //since we only add users once in a while this does not impact user performance
          acl_delete_acl($acl_id);
          //we do not have a function that allows us to remove all users at once so this is a good future option
        }
        //we create an ACL that we will use on every file or node that is in someway attached to this node
        //we decide to name it to the id of the node since the name of the node can change in an other phase.
        //dsm('creating a new acl for '.$node->nid);
        $acl_id = acl_create_new_acl('acl_example', $node->nid);
        //get all the users from our user references
        foreach ($node->field_worker as $worker) {
          $users[] = $worker['uid'];
        }
        //get all the users from our user references
        foreach ($node->field_editor as $editor) {
          $users[] = $editor['uid'];
        }
        //get all the users from our user references
        foreach ($node->field_boss as $boss) {
          $users[] = $boss['uid'];
        }
        //get all the users from our user references
        foreach ($node->field_coordinator as $coordinator) {
          $users[] = $coordinator['uid'];
        }
        //dsm($users);
        //make our array unique
        $users = array_unique($users);
        //assign these users to the ACL
        foreach ($users as $uid) {
          acl_add_user($acl_id, $uid);
        }
        //assign the ACL to the department (View Yes, Write No, Delete No)
        acl_node_add_acl($node->nid, $acl_id, 1, 0, 0, 5);
        //assign the ACL to all the referenced nodes by crossreference tables
        //get all the nodes from our news references
        foreach ($node->field_referenced_news as $noderef) {
          $nodes[] = $noderef['nid'];
        }
        //make our array unique
        $nodes = array_unique($nodes);
        //assign the ACL to the nodes (View Yes, Write No, Delete No)
        foreach ($nodes as $nid) {
        acl_node_add_acl($nid, $acl_id, 1, 0, 0, 5);
        }
      }
      //personal profile access rules
      //if we are going to update/insert a new personal profile field
      //then we should make sure people from the RRHH department can read it
      //this already happens with content access GUI so not in code
      //BUT the coordinator and the boss of the department where the user
      //is situated in should be able to access this information
      if ($node->type == 'private_profile') {
        //get the departments of the user
        //dsm($node);
        //is he a worker somewhere?
        $query = 'SELECT nid FROM {content_field_worker} WHERE field_worker_uid = %d';
        $departments_worker = db_fetch_array(db_query($query, $node->uid));
        if (!$departments_worker) {
          $departments_worker = array();
        }
        //dsm($departments_worker);
        //is he an editor somewhere?
        $query = 'SELECT nid FROM {content_field_editor} WHERE field_editor_uid = %d';
        $departments_editor = db_fetch_array(db_query($query, $node->uid));
        if (!$departments_editor) {
          $departments_editor = array();
        }
        //dsm($departments_editor);
        //is he a boss or coordinator somewhere?
        $query = 'SELECT nid FROM {content_type_department} WHERE field_coordinator_uid = %d OR field_boss_uid = %d';
        $departments_boss = db_fetch_array(db_query($query, $node->uid));
        if (!$departments_boss) {
          $departments_boss = array();
        }
        //dsm($departments_boss);
        //merge them together and get a consistent view of departments
        $departments = array_merge($departments_worker, $departments_editor, $departments_boss);
        $departments = array_unique($departments);
        //dsm(implode($departments));
        $department_list = implode($departments);

        //any idea on how to get this %s valided by coder?
        //get the coordinators and bosses of this user
        $query = 'SELECT field_boss_uid, field_coordinator_uid FROM {content_type_department} WHERE nid IN (%s)';
        $bosses = db_fetch_array(db_query($query, $department_list));
        //dsm($bosses);
        //create an ACL for this user (per user profile)
        if ($acl_id = acl_get_id_by_name('acl_example', $node->nid)) {
          //we start of with a clean slate. We don't want strange users to be kept in the system
          //since we only add users once in a while this does not impact user performance
          acl_delete_acl($acl_id);
          //we do not have a function that allows us to remove all users at once so this is a good future option
        }
        //we create an ACL that we will use on every file or node that is in someway attached to this node
        //we decide to name it to the id of the node since the name of the node can change in an other phase.
        $acl_id = acl_create_new_acl('acl_example', $node->nid);
        //add those coordinators and bosses to the ACL
        foreach ($bosses as $uid) {
          acl_add_user($acl_id, $uid);
        }
        //apply the ACL to the profile node (View Yes, Write No, Delete No, priority)
        acl_node_add_acl($node->nid, $acl_id, 1, 0, 0, 5);
      }
      //public profile rules
      //the public fields are readable by everybody?
      //if ($node->type == 'personal_profile') {
      //}
    }
}

/**
 * Used by the ACL module.
 */
function acl_example_enabled() {
  return !acl_example_disabling();
}


/**
 * Implementation of hook_disable().
 */
function acl_example_disable() {
  acl_example_disabling(TRUE);
}

/**
 * Remembers if we have disabled access.
 */
function acl_example_disabling($set = NULL) {
  static $disabling = FALSE;
  if (isset($set)) {
    $disabling = $set;
  }
  return $disabling;
}