Permissions Question - Record level access

[ericp-mrel]

I looked through the docs, but couldn't find anything definitive.

I am curious, does WinterCMS have a built-in way of managing permissions at the record level (row level security) so that a user can only access specific records and not all of them?

Thanks

[LukeTowers]

@ericp-mrel not built in no, I can't think of a generic approach for that which would be worth having in the core. I have however implemented it in various ways on several projects that needed it; do you have any specific questions?

[ericp-mrel]

@LukeTowers Are any of those projects you've added it to open-source by chance? I'd be curious to see how you implemented it.

Did you have to build your own permissions system / functionality for managing the record level permissions (separate from the built-in permissions system)? Or were you able to extend it somehow with this kind of functionality?

[bennothommo]

@ericp-mrel have you tried using Laravel policies? I know we don't support gates in Winter, but I've never tried policies. I'd imagine we don't have the controller helper methods they mention, but you could check the policy against the request perhaps.

[LukeTowers]

No open source projects that I can show at the moment with the record level permissions, but here's some examples (I just used the permissions system and business logic when checking the permissions to also check if the current user should have access to a particular record). Note that this example is from 2016, so I wouldn't necessarily copy it verbatim, but it gets the gist across. I then also paired it with my EasyAudit plugin ($30) to have detailed audit logs of reads / writes of sensitive information.

AuthService.php:

<?php namespace IACEA\Exchanges\Classes;

use BackendAuth;

/**
 * Class AuthService
 */
class AuthService {

    private static $user = null;

    /**
     * Gets the current user
     *
     * @param UserModel $user The user to return, defaults to the current user
     * @return UserModel $user
     */
    public static function getUser($user = null) {
        if (!is_null($user)) {
            return $user;
        }

        $user = static::$user;
        if (is_null($user)) {
            $user = BackendAuth::getUser();
            static::$user = $user;
        }

        return $user;
    }

    /**
     * Checks if a user has access to the provided permission
     *
     * @param string $permission The permission to check for access to
     * @param bool $usePrefix Prepends the 'iacea.exchanges.' prefix to the permission to check, defaults to true
     * @param UserModel $user The user to check against, defaults to the current user
     * @return bool
     */
    public static function userHasAccess(string $permission, $usePrefix = true, $user = null)
    {
        if (is_null($user)) {
            $user = static::getUser();
        }

        // If the user isn't even logged in then deny access
        if (!$user) {
            return false;
        }

        if ($usePrefix) {
            $permission = 'iacea.exchanges.' . $permission;
        }

        return $user->hasAccess($permission);
    }

    /**
     * Checks if the user can manage the provided record
     *
     * @param Model $model
     * @param UserModel $user
     * @return bool
     */
    public static function userCanManage($model, $user = null)
    {
        $canManage = false;
        $section = false;
        $recordNationId = null;
        $userNationId = (int) @static::getUser($user)->iacea_nation->id ?: 0;

        if (!$model) {
            return false;
        }

        // Load the record's nation id based on the type of record it is
        switch (get_class($model)) {
            case 'IACEA\\Exchanges\\Models\\Member':
                $section = 'members';
                $recordNationId = $model->nation_id;
                break;
            case 'IACEA\\Exchanges\\Models\\Nation':
                $section = 'nations';
                $recordNationId = $model->id;
                break;
            case 'IACEA\\Exchanges\\Models\\Participant':
                $section = 'participants';
                $recordNationId = $model->origin_nation_id;
                break;
            case 'IACEA\\Exchanges\\Models\\Programme':
                $section = 'programmes';
                $recordNationId = $model->nation_id;
                break;
        }

        // Evaluate the permissions
        $canManage = (
            // User can manage all records in this section
            static::userHasAccess($section . '.manage_all', true, $user) ||

            // User can manage their own nation's records, and this record belongs to their own nation
            (
                static::userHasAccess($section . '.manage_own', true, $user) &&
                (
                    $userNationId &&
                    ($userNationId === (int) $recordNationId)
                )
            )
        );

        return $canManage;
    }
}

Members.php

// ...
    public function run($action = null, $params = [])
    {
        $canAccess = false;
        $member = null;
        if (!empty($params[0])) {
            $member = \IACEA\Exchanges\Models\Member::find($params[0]);
        }

        switch ($action) {
            case 'index':
                $canAccess = (
                    AuthService::userHasAccess('members.manage_all') ||
                    AuthService::userHasAccess('members.manage_own') ||
                    AuthService::userHasAccess('members.view_all') ||
                    AuthService::userHasAccess('members.view_own')
                );

                // Redirect to the update screen for the user's own member profile if they can members.manage_self
                if (!$canAccess && AuthService::userHasAccess('members.manage_self')) {
                    $userMemberId = (int) @AuthService::getUser()->iacea_member_profile->id;

                    if ($userMemberId) {
                        return Redirect::to(Backend::url("iacea/exchanges/members/update/$userMemberId"));
                    }
                }
                break;

            case 'create':
                $canAccess = (
                    AuthService::userHasAccess('members.manage_all') ||
                    AuthService::userHasAccess('members.manage_own')
                );
                break;

            case 'update':
                $canAccess = AuthService::userCanManage($member);
                if (!$canAccess) {
                    if (AuthService::userHasAccess('members.manage_self')) {
                        $userMemberId = (int) @AuthService::getUser()->iacea_member_profile->id;
                        if ($userMemberId && ($userMemberId === $member->id)) {
                            $canAccess = true;
                        }
                    } elseif (AuthService::userHasAccess('members.view_all') && $member) {
                        return Redirect::to(Backend::url("iacea/exchanges/members/preview/{$member->id}"));
                    }
                }
                break;

            case 'preview':
                $canAccess = (
                    AuthService::userCanManage($member) ||
                    AuthService::userHasAccess('members.view_all')
                );

                if (!$canAccess) {
                    // Allow access if user can members.view_own and the requested member profile belongs to the user's nation
                    if (AuthService::userHasAccess('members.view_own')) {
                        $userNationId = (int) AuthService::getUser()->iacea_nation_id;
                        $memberNationId = (int) $member->nation_id;
                        if ($userNationId && ($userNationId === $memberNationId)) {
                            $canAccess = true;
                        }
                    }

                    // Redirect to the update screen if user can members.manage_self and they don't have access to any of the other actions above
                    if (AuthService::userHasAccess('members.manage_self')) {
                        $userMemberId = (int) @AuthService::getUser()->iacea_member_profile->id;

                        if ($userMemberId && ($userMemberId === $member->id)) {
                            return Redirect::to(Backend::url("iacea/exchanges/members/update/$userMemberId"));
                        }
                    }
                }
                break;
        }

        if ($canAccess) {
            return parent::run($action, $params);
        } else {
            return \Response::make(\View::make('backend::access_denied'), 403);
        }
    }
// ...