Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IndAss: add permissions (create/publish records) #65

Draft
wants to merge 1 commit into
base: release_9
Choose a base branch
from
Draft

IndAss: add permissions (create/publish records) #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 20 additions & 10 deletions .../IndividualAssessment/classes/AccessControl/class.ilIndividualAssessmentAccessHandler.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,11 @@ class ilIndividualAssessmentAccessHandler implements IndividualAssessmentAccessH
{
public const DEFAULT_ROLE = 'il_iass_member';

public const RBAC_OP_CREATE_RECORDS = 'create_records';
public const ORGU_OP_CREATE_RECORDS = 'ou_create_records';
public const RBAC_OP_PUBLISH_RECORDS = 'publish_records';
public const ORGU_OP_PUBLISH_RECORDS = 'ou_publish_records';

protected ilObjIndividualAssessment $iass;
protected ilAccessHandler $handler;
protected ilRbacAdmin $admin;
Expand All @@ -50,7 +55,7 @@ public function __construct(
*/
public function checkRBACAccessToObj(string $operation): bool
{
if($this->simulateMember()) {
if ($this->simulateMember()) {
return $this->checkMemberRoleForPermission($operation);
} else {
return $this->isSystemAdmin() ||
Expand All @@ -72,6 +77,7 @@ public function checkRBACOrPositionAccessToObj(string $operation)
);
}

/*
if ($operation == "write_learning_progress") {
return $this->handler->checkRbacOrPositionPermissionAccess(
// This feels super odd, but this is actually ok because we do not have
Expand All @@ -82,6 +88,7 @@ public function checkRBACOrPositionAccessToObj(string $operation)
$this->iass->getRefId()
);
}
*/

throw new \LogicException("Unknown rbac/position-operation: $operation");
}
Expand All @@ -100,13 +107,13 @@ protected function checkMemberRoleForPermission(string $operation): bool
$this->review->getParentRoleIds($ref_id),
static fn(array $role): bool => str_starts_with($role['title'], 'il_crs_member_')
);
if($roles === []) {
if ($roles === []) {
return false;
}
$role = array_shift($roles);
$active_ops = $this->review->getActiveOperationsOfRole($ref_id, $role['rol_id']);
foreach($active_ops as $op) {
if($this->review->getOperation($op)['operation'] === $operation) {
foreach ($active_ops as $op) {
if ($this->review->getOperation($op)['operation'] === $operation) {
return true;
}
}
Expand Down Expand Up @@ -189,19 +196,22 @@ public function mayViewAllUsers(): bool

public function mayGradeAnyUser(): bool
{
return $this->checkRBACOrPositionAccessToObj('write_learning_progress');
//return $this->checkRBACOrPositionAccessToObj('write_learning_progress');
return $this->handler->checkRbacOrPositionPermissionAccess(
self::RBAC_OP_CREATE_RECORDS,
self::ORGU_OP_CREATE_RECORDS,
$this->iass->getRefId()
);

}

public function mayGradeUser(int $user_id): bool
{
return
(count(
$this->handler->filterUserIdsByRbacOrPositionOfCurrentUser(
// This feels super odd, but this is actually ok because we do not have
// a dedicated RBAC permission to write_learning_progress.
// See: https://mantis.ilias.de/view.php?id=36056#c89865
"read_learning_progress",
"write_learning_progress",
self::RBAC_OP_CREATE_RECORDS,
self::ORGU_OP_CREATE_RECORDS,
$this->iass->getRefId(),
[$user_id]
)
Expand Down
43 changes: 41 additions & 2 deletions Modules/IndividualAssessment/classes/Setup/class.ilIndividualAssessmentSetupAgent.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,9 +54,16 @@ public function getInstallObjective(Setup\Config $config = null): Setup\Objectiv
*/
public function getUpdateObjective(Setup\Config $config = null): Setup\Objective
{
return new ilDatabaseUpdateStepsExecutedObjective(
new ilIndividualAssessmentRectifyMembersTableDBUpdateSteps()
return new Setup\ObjectiveCollection(
'Indivial Asessment',
true,
new ilDatabaseUpdateStepsExecutedObjective(
new ilIndividualAssessmentRectifyMembersTableDBUpdateSteps(),
),
...$this->getPermissionObjectives()
);


}

/**
Expand All @@ -82,4 +89,36 @@ public function getMigrations(): array
{
return [];
}


protected function getPermissionObjectives(): array
{
return [
new ilAccessCustomRBACOperationAddedObjective(
ilIndividualAssessmentAccessHandler::RBAC_OP_CREATE_RECORDS,
"Create Records for Users",
"object",
9010,
["iass"]
),
new \ilOrgUnitOperationRegisteredObjective(
ilIndividualAssessmentAccessHandler::ORGU_OP_CREATE_RECORDS,
'Create Records for Users',
ilOrgUnitOperationContext::CONTEXT_IASS
),
new ilAccessCustomRBACOperationAddedObjective(
ilIndividualAssessmentAccessHandler::RBAC_OP_PUBLISH_RECORDS,
"Publish Records",
"object",
9020,
["iass"]
),
new \ilOrgUnitOperationRegisteredObjective(
ilIndividualAssessmentAccessHandler::ORGU_OP_PUBLISH_RECORDS,
'Publish Records',
ilOrgUnitOperationContext::CONTEXT_IASS
)
];
}

}
18 changes: 5 additions & 13 deletions Modules/IndividualAssessment/classes/class.ilIndividualAssessmentMemberGUI.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ protected function downloadFile(): void
{
$identifier = $this->getMember()->getGrading()->getFile();
$resource_id = $this->irss->manage()->find($identifier);
if($resource_id) {
if ($resource_id) {
$this->irss->consume()->download($resource_id)->run();
}
}
Expand Down Expand Up @@ -353,7 +353,7 @@ protected function getUploadResult(): HandlerResult
protected function getRemoveResult(string $identifier): HandlerResult
{
$resource_id = $this->irss->manage()->find($identifier);
if($resource_id) {
if ($resource_id) {
$this->irss->manage()->remove($resource_id, $this->stakeholder);
$status = HandlerResult::STATUS_OK;
$message = $this->lng->txt('iass_file_deleted');
Expand All @@ -368,7 +368,7 @@ protected function getRemoveResult(string $identifier): HandlerResult
public function getInfoResult(string $identifier): ?FileInfoResult
{
$resource_id = $this->irss->manage()->find($identifier);
if(! $resource_id) {
if (! $resource_id) {
return null;
}
$resource = $this->irss->manage()->getResource($resource_id);
Expand All @@ -388,7 +388,7 @@ public function getInfoForExistingFiles(array $file_ids): array
$file_ids = array_filter($file_ids, fn($id) => $id !== "");
return array_map(function ($id) {
$resource_id = $this->irss->manage()->find($identifier);
if(! $resource_id) {
if (! $resource_id) {
return null;
}
$resource = $this->irss->manage()->getResource($resource_id);
Expand Down Expand Up @@ -510,7 +510,7 @@ protected function userMayGrade(): bool
{
return
$this->getAccessHandler()->isSystemAdmin() ||
(!$this->targetWasEditedByOtherUser($this->getMember()) && $this->getAccessHandler()->mayGradeUser($this->getMember()->id()))
($this->getAccessHandler()->mayGradeUser($this->getMember()->id()))
;
}

Expand All @@ -524,14 +524,6 @@ protected function userMayAmend(): bool
return $this->getAccessHandler()->mayAmendAllUsers();
}

protected function targetWasEditedByOtherUser(ilIndividualAssessmentMember $member): bool
{
return
(int) $member->examinerId() !== $this->user->getId() &&
0 !== (int) $member->examinerId()
;
}

protected function isFinalized(): bool
{
return $this->getMember()->finalized();
Expand Down
12 changes: 8 additions & 4 deletions lang/ilias_de.lang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10407,7 +10407,7 @@ iass#:#iass_amend_saved#:#Geänderte Prüfungsdaten wurden gespeichert.
iass#:#iass_assessment_not_completed#:#Noch nicht abgeschlossen
iass#:#iass_cancel#:#Abbrechen
iass#:#iass_changed_by#:#Nachträglich geändert
iass#:#iass_confirm_finalize#:#Abschließen
iass#:#iass_confirm_finalize#:#Abschließen und veröffentlichen
iass#:#iass_consultation_hours#:#Sprechstunden
iass#:#iass_contact#:#Name
iass#:#iass_contact_info#:#Kontaktinformationen
Expand All @@ -10431,7 +10431,7 @@ iass#:#iass_filter_failed#:#Nur nicht bestanden
iass#:#iass_filter_finalized#:#Nur bestandene
iass#:#iass_filter_not_finalized#:#Nur nicht abgeschlossene
iass#:#iass_filter_not_started#:#Nur nicht bewertete
iass#:#iass_finalize#:#Abschließen
iass#:#iass_finalize#:#Abschließen und veröffentlichen
iass#:#iass_finalize_info#:#Die Individuelle Bewertung wird abgeschlossen.
iass#:#iass_finalize_user_qst#:#Soll die Bewertung des Teilnehmers wirklich final abgeschlossen werden? Änderungen an der Bewertung sind hinterher nicht mehr möglich.
iass#:#iass_further_field_headline#:#Detaillierte Informationen
Expand All @@ -10442,8 +10442,8 @@ iass#:#iass_internal_note_info#:#Dieser Text ist nur für Personen sichtbar, die
iass#:#iass_location#:#Ort
iass#:#iass_mails#:#E-Mail
iass#:#iass_may_not_finalize#:#Prüfung kann noch nicht abschließend bewertet werden. Bitte geben Sie eine Bewertung ab.
iass#:#iass_membership_finalized#:#Bewertung abgeschlossen.
iass#:#iass_membership_saved#:#Bewertung wurde gespeichert aber noch nicht final abgeschlossen.
iass#:#iass_membership_finalized#:#Bewertung veröffentlicht.
iass#:#iass_membership_saved#:#Bewertung wurde gespeichert aber noch nicht veröffentlicht.
iass#:#iass_mess_notification_completed#:#Sie haben die Prüfung „%s“ bestanden. Beachten Sie bitte auch die folgende Notiz zur Prüfung.
iass#:#iass_mess_notification_failed#:#Sie haben die Prüfung „%s“ leider nicht bestanden. Beachten Sie bitte auch die folgende Notiz zur Prüfung.
iass#:#iass_notify#:#Ergebnis dem Teilnehmer zugänglich machen
Expand Down Expand Up @@ -12938,6 +12938,8 @@ orgu#:#org_op_edit_individual_plan#:#Individuellen Plan bearbeiten
orgu#:#org_op_edit_submissions_grades#:#Abgaben von anderen Benutzern bearbeiten
orgu#:#org_op_manage_members#:#Mitglieder bearbeiten
orgu#:#org_op_manage_participants#:#Teilnehmer verwalten
orgu#:#org_op_ou_create_records#:#Bewertungen vornehmen
orgu#:#org_op_ou_publish_records#:#Bewertungen veröffentlichen und abschließen
orgu#:#org_op_read_employee_talk#:#Auf Gespräche lesend zugreifen
orgu#:#org_op_read_learning_progress#:#Lernfortschritt von anderen Benutzern einsehen
orgu#:#org_op_score_participants#:#Teilnehmer bewerten
Expand Down Expand Up @@ -14194,6 +14196,7 @@ rbac#:#nwss_edit_permission#:#Rechteeinstellungen in der News- und Webfeeds-Admi
rbac#:#nwss_read#:#Lesezugriff auf News- und Webfeeds-Administration
rbac#:#nwss_visible#:#News- und Webfeeds-Administration ist sichtbar
rbac#:#nwss_write#:#Einstellungen in der News- und Webfeeds-Administration bearbeiten
rbac#:#obj_records#:#Bewertungen vornehmen
rbac#:#obj_skee#:#Kompetenzbaum
rbac#:#org_op_access_results#:#Zugriff auf Ergebnisse untergeordneter Benutzer
rbac#:#org_op_edit_submissions_grades#:#Abgaben von anderen Benutzern bearbeiten
Expand Down Expand Up @@ -14278,6 +14281,7 @@ rbac#:#ps_export_member_data#:#Export von Mitgliederdaten in Gruppen und Kursen
rbac#:#ps_read#:#Lesezugriff auf Datenschutz- und Sicherheitseinstellungen
rbac#:#ps_visible#:#Datenschutz- und Sicherheitseinstellungen sind sichtbar
rbac#:#ps_write#:#Bearbeiten der Datenschutz- und Sicherheitseinstellungen erlauben
rbac#:#publish_records#:#Bewertungen veröffentlichen und abschließen
rbac#:#push_desktop_items#:#Inhalte empfehlen
rbac#:#qpl_copy#:#Fragenpool kopieren
rbac#:#qpl_delete#:#Fragenpool löschen oder verschieben
Expand Down
16 changes: 10 additions & 6 deletions lang/ilias_en.lang
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10407,7 +10407,7 @@ iass#:#iass_amend_saved#:#Amended record has been saved.
iass#:#iass_assessment_not_completed#:#Not completed yet
iass#:#iass_cancel#:#Cancel
iass#:#iass_changed_by#:#Changed after finalization
iass#:#iass_confirm_finalize#:#Finalize
iass#:#iass_confirm_finalize#:#Publish and freeze
iass#:#iass_consultation_hours#:#Consultation hours
iass#:#iass_contact#:#Name
iass#:#iass_contact_info#:#Contact information
Expand All @@ -10431,9 +10431,9 @@ iass#:#iass_filter_failed#:#Failed only
iass#:#iass_filter_finalized#:#Completed only
iass#:#iass_filter_not_finalized#:#Drafts only
iass#:#iass_filter_not_started#:#Not started only
iass#:#iass_finalize#:#Finalize
iass#:#iass_finalize_info#:#Individual Assessment will be finalized.
iass#:#iass_finalize_user_qst#:#Should the participant's status really be finalised? No changes possible thereafter.
iass#:#iass_finalize#:#Publish and freeze
iass#:#iass_finalize_info#:#Individual Assessment will be published and frozen.
iass#:#iass_finalize_user_qst#:#Should the participant's status really be published? No changes possible thereafter.
iass#:#iass_further_field_headline#:#Detailed Information
iass#:#iass_graded_by#:#Graded by
iass#:#iass_info_emails_expl#:#You may provide several addresses separated by comma.
Expand All @@ -10442,8 +10442,8 @@ iass#:#iass_internal_note_info#:#Internal notes are only visible for tutors but
iass#:#iass_location#:#Location
iass#:#iass_mails#:#E-Mail
iass#:#iass_may_not_finalize#:#Examinee may not be finalised. Please grade the user first.
iass#:#iass_membership_finalized#:#Record finalised
iass#:#iass_membership_saved#:#Record saved, not yet finalised
iass#:#iass_membership_finalized#:#Record published and frozen
iass#:#iass_membership_saved#:#Record saved, not yet published
iass#:#iass_mess_notification_completed#:#You passed the assessment <i>%s</i>. Please check the following grading record for details:
iass#:#iass_mess_notification_failed#:#You failed the assessment <i>%s</i>. Please check the following grading record for details:
iass#:#iass_notify#:#Make Result available to Participant
Expand Down Expand Up @@ -12938,6 +12938,8 @@ orgu#:#org_op_edit_individual_plan#:#Edit Individual Plan
orgu#:#org_op_edit_submissions_grades#:#Edit submissions of other users
orgu#:#org_op_manage_members#:#Manage Members
orgu#:#org_op_manage_participants#:#Manage Participants
orgu#:#org_op_ou_create_records#:#Create Records for Users
orgu#:#org_op_ou_publish_records#:#Publish and freeze Records
orgu#:#org_op_read_employee_talk#:#Read access talk appointments
orgu#:#org_op_read_learning_progress#:#View learning progress of other users
orgu#:#org_op_score_participants#:#Score Participants
Expand Down Expand Up @@ -14194,6 +14196,7 @@ rbac#:#nwss_edit_permission#:#User can change permission settings in News and We
rbac#:#nwss_read#:#User has read access to ews and Web Feeds administration
rbac#:#nwss_visible#:#News and Web Feeds administration is visible
rbac#:#nwss_write#:#User can edit settings in News and Web Feeds administration
rbac#:#obj_records#:#Create Records for Users
rbac#:#obj_skee#:#Competence Tree
rbac#:#org_op_access_results#:#Access Results of Subordinated Users
rbac#:#org_op_edit_submissions_grades#:#Edit submissions of other users
Expand Down Expand Up @@ -14278,6 +14281,7 @@ rbac#:#ps_export_member_data#:#User can export member data in courses and groups
rbac#:#ps_read#:#User has read access to Privacy/Security administration
rbac#:#ps_visible#:#Privacy/Security administration is visible
rbac#:#ps_write#:#User can edit settings in Privacy/Security administration
rbac#:#publish_records#:#Publish and freeze Records
rbac#:#push_desktop_items#:#Recommend Content
rbac#:#qpl_copy#:#User can copy question pool for tests
rbac#:#qpl_delete#:#User can move or delete question pool
Expand Down