From e9fedf3e5cd63aea4da7a71f6647ee427c62fa49 Mon Sep 17 00:00:00 2001
From: Frederic Guillot <fred@kanboard.net>
Date: Sat, 5 Dec 2015 20:31:27 -0500
Subject: Rewrite of the authentication and authorization system

---
 app/Template/user/create_local.php  | 21 +++++++++++----------
 app/Template/user/create_remote.php | 23 ++++++++++++-----------
 app/Template/user/edit.php          | 14 +++++++-------
 app/Template/user/external.php      |  6 +++---
 app/Template/user/index.php         | 10 +++-------
 app/Template/user/layout.php        |  2 +-
 app/Template/user/sessions.php      |  2 +-
 app/Template/user/show.php          |  2 +-
 app/Template/user/sidebar.php       |  6 +++---
 9 files changed, 42 insertions(+), 44 deletions(-)

(limited to 'app/Template/user')

diff --git a/app/Template/user/create_local.php b/app/Template/user/create_local.php
index 6e6ca6ac..38bd7836 100644
--- a/app/Template/user/create_local.php
+++ b/app/Template/user/create_local.php
@@ -12,34 +12,35 @@
 
         <div class="form-column">
             <?= $this->form->label(t('Username'), 'username') ?>
-            <?= $this->form->text('username', $values, $errors, array('autofocus', 'required', 'maxlength="50"')) ?><br/>
+            <?= $this->form->text('username', $values, $errors, array('autofocus', 'required', 'maxlength="50"')) ?>
 
             <?= $this->form->label(t('Name'), 'name') ?>
-            <?= $this->form->text('name', $values, $errors) ?><br/>
+            <?= $this->form->text('name', $values, $errors) ?>
 
             <?= $this->form->label(t('Email'), 'email') ?>
-            <?= $this->form->email('email', $values, $errors) ?><br/>
+            <?= $this->form->email('email', $values, $errors) ?>
 
             <?= $this->form->label(t('Password'), 'password') ?>
-            <?= $this->form->password('password', $values, $errors, array('required')) ?><br/>
+            <?= $this->form->password('password', $values, $errors, array('required')) ?>
 
             <?= $this->form->label(t('Confirmation'), 'confirmation') ?>
-            <?= $this->form->password('confirmation', $values, $errors, array('required')) ?><br/>
+            <?= $this->form->password('confirmation', $values, $errors, array('required')) ?>
         </div>
 
         <div class="form-column">
             <?= $this->form->label(t('Add project member'), 'project_id') ?>
-            <?= $this->form->select('project_id', $projects, $values, $errors) ?><br/>
+            <?= $this->form->select('project_id', $projects, $values, $errors) ?>
 
             <?= $this->form->label(t('Timezone'), 'timezone') ?>
-            <?= $this->form->select('timezone', $timezones, $values, $errors) ?><br/>
+            <?= $this->form->select('timezone', $timezones, $values, $errors) ?>
 
             <?= $this->form->label(t('Language'), 'language') ?>
-            <?= $this->form->select('language', $languages, $values, $errors) ?><br/>
+            <?= $this->form->select('language', $languages, $values, $errors) ?>
+
+            <?= $this->form->label(t('Role'), 'role') ?>
+            <?= $this->form->select('role', $roles, $values, $errors) ?>
 
             <?= $this->form->checkbox('notifications_enabled', t('Enable email notifications'), 1, isset($values['notifications_enabled']) && $values['notifications_enabled'] == 1 ? true : false) ?>
-            <?= $this->form->checkbox('is_admin', t('Administrator'), 1, isset($values['is_admin']) && $values['is_admin'] == 1 ? true : false) ?>
-            <?= $this->form->checkbox('is_project_admin', t('Project Administrator'), 1, isset($values['is_project_admin']) && $values['is_project_admin'] == 1 ? true : false) ?>
         </div>
 
         <div class="form-actions">
diff --git a/app/Template/user/create_remote.php b/app/Template/user/create_remote.php
index 49d1548c..1cc560cd 100644
--- a/app/Template/user/create_remote.php
+++ b/app/Template/user/create_remote.php
@@ -12,37 +12,38 @@
 
         <div class="form-column">
             <?= $this->form->label(t('Username'), 'username') ?>
-            <?= $this->form->text('username', $values, $errors, array('autofocus', 'required', 'maxlength="50"')) ?><br/>
+            <?= $this->form->text('username', $values, $errors, array('autofocus', 'required', 'maxlength="50"')) ?>
 
             <?= $this->form->label(t('Name'), 'name') ?>
-            <?= $this->form->text('name', $values, $errors) ?><br/>
+            <?= $this->form->text('name', $values, $errors) ?>
 
             <?= $this->form->label(t('Email'), 'email') ?>
-            <?= $this->form->email('email', $values, $errors) ?><br/>
+            <?= $this->form->email('email', $values, $errors) ?>
 
             <?= $this->form->label(t('Google Id'), 'google_id') ?>
-            <?= $this->form->text('google_id', $values, $errors) ?><br/>
+            <?= $this->form->text('google_id', $values, $errors) ?>
 
             <?= $this->form->label(t('Github Id'), 'github_id') ?>
-            <?= $this->form->text('github_id', $values, $errors) ?><br/>
+            <?= $this->form->text('github_id', $values, $errors) ?>
 
             <?= $this->form->label(t('Gitlab Id'), 'gitlab_id') ?>
-            <?= $this->form->text('gitlab_id', $values, $errors) ?><br/>
+            <?= $this->form->text('gitlab_id', $values, $errors) ?>
         </div>
 
         <div class="form-column">
             <?= $this->form->label(t('Add project member'), 'project_id') ?>
-            <?= $this->form->select('project_id', $projects, $values, $errors) ?><br/>
+            <?= $this->form->select('project_id', $projects, $values, $errors) ?>
 
             <?= $this->form->label(t('Timezone'), 'timezone') ?>
-            <?= $this->form->select('timezone', $timezones, $values, $errors) ?><br/>
+            <?= $this->form->select('timezone', $timezones, $values, $errors) ?>
 
             <?= $this->form->label(t('Language'), 'language') ?>
-            <?= $this->form->select('language', $languages, $values, $errors) ?><br/>
+            <?= $this->form->select('language', $languages, $values, $errors) ?>
+
+            <?= $this->form->label(t('Role'), 'role') ?>
+            <?= $this->form->select('role', $roles, $values, $errors) ?>
 
             <?= $this->form->checkbox('notifications_enabled', t('Enable email notifications'), 1, isset($values['notifications_enabled']) && $values['notifications_enabled'] == 1 ? true : false) ?>
-            <?= $this->form->checkbox('is_admin', t('Administrator'), 1, isset($values['is_admin']) && $values['is_admin'] == 1 ? true : false) ?>
-            <?= $this->form->checkbox('is_project_admin', t('Project Administrator'), 1, isset($values['is_project_admin']) && $values['is_project_admin'] == 1 ? true : false) ?>
             <?= $this->form->checkbox('disable_login_form', t('Disallow login form'), 1, isset($values['disable_login_form']) && $values['disable_login_form'] == 1) ?>
         </div>
 
diff --git a/app/Template/user/edit.php b/app/Template/user/edit.php
index cd10b2ab..1a7fb430 100644
--- a/app/Template/user/edit.php
+++ b/app/Template/user/edit.php
@@ -8,23 +8,23 @@
     <?= $this->form->hidden('id', $values) ?>
 
     <?= $this->form->label(t('Username'), 'username') ?>
-    <?= $this->form->text('username', $values, $errors, array('required', $values['is_ldap_user'] == 1 ? 'readonly' : '', 'maxlength="50"')) ?><br/>
+    <?= $this->form->text('username', $values, $errors, array('required', $values['is_ldap_user'] == 1 ? 'readonly' : '', 'maxlength="50"')) ?>
 
     <?= $this->form->label(t('Name'), 'name') ?>
-    <?= $this->form->text('name', $values, $errors) ?><br/>
+    <?= $this->form->text('name', $values, $errors) ?>
 
     <?= $this->form->label(t('Email'), 'email') ?>
-    <?= $this->form->email('email', $values, $errors) ?><br/>
+    <?= $this->form->email('email', $values, $errors) ?>
 
     <?= $this->form->label(t('Timezone'), 'timezone') ?>
-    <?= $this->form->select('timezone', $timezones, $values, $errors) ?><br/>
+    <?= $this->form->select('timezone', $timezones, $values, $errors) ?>
 
     <?= $this->form->label(t('Language'), 'language') ?>
-    <?= $this->form->select('language', $languages, $values, $errors) ?><br/>
+    <?= $this->form->select('language', $languages, $values, $errors) ?>
 
     <?php if ($this->user->isAdmin()): ?>
-        <?= $this->form->checkbox('is_admin', t('Administrator'), 1, isset($values['is_admin']) && $values['is_admin'] == 1) ?>
-        <?= $this->form->checkbox('is_project_admin', t('Project Administrator'), 1, isset($values['is_project_admin']) && $values['is_project_admin'] == 1) ?>
+        <?= $this->form->label(t('Role'), 'role') ?>
+        <?= $this->form->select('role', $roles, $values, $errors) ?>
     <?php endif ?>
 
     <div class="form-actions">
diff --git a/app/Template/user/external.php b/app/Template/user/external.php
index 7a42f38e..8b1d3c46 100644
--- a/app/Template/user/external.php
+++ b/app/Template/user/external.php
@@ -10,7 +10,7 @@
         <?php if (empty($user['google_id'])): ?>
             <?= $this->url->link(t('Link my Google Account'), 'oauth', 'google', array(), true) ?>
         <?php else: ?>
-            <?= $this->url->link(t('Unlink my Google Account'), 'oauth', 'unlink', array('backend' => 'google'), true) ?>
+            <?= $this->url->link(t('Unlink my Google Account'), 'oauth', 'unlink', array('backend' => 'Google'), true) ?>
         <?php endif ?>
     <?php else: ?>
         <?= empty($user['google_id']) ? t('No account linked.') : t('Account linked.') ?>
@@ -26,7 +26,7 @@
         <?php if (empty($user['github_id'])): ?>
             <?= $this->url->link(t('Link my Github Account'), 'oauth', 'github', array(), true) ?>
         <?php else: ?>
-            <?= $this->url->link(t('Unlink my Github Account'), 'oauth', 'unlink', array('backend' => 'github'), true) ?>
+            <?= $this->url->link(t('Unlink my Github Account'), 'oauth', 'unlink', array('backend' => 'Github'), true) ?>
         <?php endif ?>
     <?php else: ?>
         <?= empty($user['github_id']) ? t('No account linked.') : t('Account linked.') ?>
@@ -42,7 +42,7 @@
         <?php if (empty($user['gitlab_id'])): ?>
             <?= $this->url->link(t('Link my Gitlab Account'), 'oauth', 'gitlab', array(), true) ?>
         <?php else: ?>
-            <?= $this->url->link(t('Unlink my Gitlab Account'), 'oauth', 'unlink', array('backend' => 'gitlab'), true) ?>
+            <?= $this->url->link(t('Unlink my Gitlab Account'), 'oauth', 'unlink', array('backend' => 'Gitlab'), true) ?>
         <?php endif ?>
     <?php else: ?>
         <?= empty($user['gitlab_id']) ? t('No account linked.') : t('Account linked.') ?>
diff --git a/app/Template/user/index.php b/app/Template/user/index.php
index 7c6ecc1e..cb7416d6 100644
--- a/app/Template/user/index.php
+++ b/app/Template/user/index.php
@@ -1,6 +1,6 @@
 <section id="main">
     <div class="page-header">
-        <?php if ($this->user->isAdmin()): ?>
+        <?php if ($this->user->hasAccess('user', 'create')): ?>
         <ul>
             <li><i class="fa fa-plus fa-fw"></i><?= $this->url->link(t('New local user'), 'user', 'create') ?></li>
             <li><i class="fa fa-plus fa-fw"></i><?= $this->url->link(t('New remote user'), 'user', 'create', array('remote' => 1)) ?></li>
@@ -18,8 +18,7 @@
                 <th><?= $paginator->order(t('Username'), 'username') ?></th>
                 <th><?= $paginator->order(t('Name'), 'name') ?></th>
                 <th><?= $paginator->order(t('Email'), 'email') ?></th>
-                <th><?= $paginator->order(t('Administrator'), 'is_admin') ?></th>
-                <th><?= $paginator->order(t('Project Administrator'), 'is_project_admin') ?></th>
+                <th><?= $paginator->order(t('Role'), 'role') ?></th>
                 <th><?= $paginator->order(t('Two factor authentication'), 'twofactor_activated') ?></th>
                 <th><?= $paginator->order(t('Notifications'), 'notifications_enabled') ?></th>
                 <th><?= $paginator->order(t('Account type'), 'is_ldap_user') ?></th>
@@ -39,10 +38,7 @@
                     <a href="mailto:<?= $this->e($user['email']) ?>"><?= $this->e($user['email']) ?></a>
                 </td>
                 <td>
-                    <?= $user['is_admin'] ? t('Yes') : t('No') ?>
-                </td>
-                <td>
-                    <?= $user['is_project_admin'] ? t('Yes') : t('No') ?>
+                    <?= $this->user->getRoleName($user['role']) ?>
                 </td>
                 <td>
                     <?= $user['twofactor_activated'] ? t('Yes') : t('No') ?>
diff --git a/app/Template/user/layout.php b/app/Template/user/layout.php
index a27f359b..1e456348 100644
--- a/app/Template/user/layout.php
+++ b/app/Template/user/layout.php
@@ -1,6 +1,6 @@
 <section id="main">
     <div class="page-header">
-        <?php if ($this->user->isAdmin()): ?>
+        <?php if ($this->user->hasAccess('user', 'create')): ?>
         <ul>
             <li><i class="fa fa-user fa-fw"></i><?= $this->url->link(t('All users'), 'user', 'index') ?></li>
             <li><i class="fa fa-plus fa-fw"></i><?= $this->url->link(t('New local user'), 'user', 'create') ?></li>
diff --git a/app/Template/user/sessions.php b/app/Template/user/sessions.php
index eabf3672..7a66c5ad 100644
--- a/app/Template/user/sessions.php
+++ b/app/Template/user/sessions.php
@@ -19,7 +19,7 @@
         <td><?= dt('%B %e, %Y at %k:%M %p', $session['expiration']) ?></td>
         <td><?= $this->e($session['ip']) ?></td>
         <td><?= $this->e($session['user_agent']) ?></td>
-        <td><?= $this->url->link(t('Remove'), 'user', 'removeSession', array('user_id' => $user['id'], 'id' => $session['id']), true) ?></td>
+        <td><?= $this->url->link(t('Remove'), 'User', 'removeSession', array('user_id' => $user['id'], 'id' => $session['id']), true) ?></td>
     </tr>
     <?php endforeach ?>
     </table>
diff --git a/app/Template/user/show.php b/app/Template/user/show.php
index 220ad87e..89c6b36b 100644
--- a/app/Template/user/show.php
+++ b/app/Template/user/show.php
@@ -11,7 +11,7 @@
     <h2><?= t('Security') ?></h2>
 </div>
 <ul class="listing">
-    <li><?= t('Group:') ?> <strong><?= $user['is_admin'] ? t('Administrator') : ($user['is_project_admin'] ? t('Project Administrator') : t('Regular user')) ?></strong></li>
+    <li><?= t('Role:') ?> <strong><?= $this->user->getRoleName($user['role']) ?></strong></li>
     <li><?= t('Account type:') ?> <strong><?= $user['is_ldap_user'] ? t('Remote') : t('Local') ?></strong></li>
     <li><?= $user['twofactor_activated'] == 1 ? t('Two factor authentication enabled') :  t('Two factor authentication disabled') ?></li>
 </ul>
diff --git a/app/Template/user/sidebar.php b/app/Template/user/sidebar.php
index 167c8054..011994b9 100644
--- a/app/Template/user/sidebar.php
+++ b/app/Template/user/sidebar.php
@@ -41,7 +41,7 @@
                 <li <?= $this->app->getRouterController() === 'twofactor' && $this->app->getRouterAction() === 'index' ? 'class="active"' : '' ?>>
                     <?= $this->url->link(t('Two factor authentication'), 'twofactor', 'index', array('user_id' => $user['id'])) ?>
                 </li>
-            <?php elseif ($this->user->isAdmin() && $user['twofactor_activated'] == 1): ?>
+            <?php elseif ($this->user->hasAccess('twofactor', 'disable') && $user['twofactor_activated'] == 1): ?>
                 <li <?= $this->app->getRouterController() === 'twofactor' && $this->app->getRouterAction() === 'disable' ? 'class="active"' : '' ?>>
                     <?= $this->url->link(t('Two factor authentication'), 'twofactor', 'disable', array('user_id' => $user['id'])) ?>
                 </li>
@@ -61,7 +61,7 @@
             </li>
         <?php endif ?>
 
-        <?php if ($this->user->isAdmin()): ?>
+        <?php if ($this->user->hasAccess('user', 'authentication')): ?>
             <li <?= $this->app->getRouterController() === 'user' && $this->app->getRouterAction() === 'authentication' ? 'class="active"' : '' ?>>
                 <?= $this->url->link(t('Edit Authentication'), 'user', 'authentication', array('user_id' => $user['id'])) ?>
             </li>
@@ -69,7 +69,7 @@
 
         <?= $this->hook->render('template:user:sidebar:actions', array('user' => $user)) ?>
 
-        <?php if ($this->user->isAdmin() && ! $this->user->isCurrentUser($user['id'])): ?>
+        <?php if ($this->user->hasAccess('user', 'remove') && ! $this->user->isCurrentUser($user['id'])): ?>
             <li <?= $this->app->getRouterController() === 'user' && $this->app->getRouterAction() === 'remove' ? 'class="active"' : '' ?>>
                 <?= $this->url->link(t('Remove'), 'user', 'remove', array('user_id' => $user['id'])) ?>
             </li>
-- 
cgit v1.2.3