PHP PhabricatorSpacesNamespaceQuery::getViewerSpaces方法代码示例

 private function appendSpaceInformation(AphrontDialogView $dialog, PhabricatorPolicyInterface $object, PhabricatorPolicy $policy, $capability)
 {
     $viewer = $this->getViewer();
     if (!$object instanceof PhabricatorSpacesInterface) {
         return;
     }
     if (!PhabricatorSpacesNamespaceQuery::getSpacesExist($viewer)) {
         return;
     }
     // NOTE: We're intentionally letting users through here, even if they only
     // have access to one space. The intent is to help users in "space jail"
     // understand who objects they create are visible to:
     $space_phid = PhabricatorSpacesNamespaceQuery::getObjectSpacePHID($object);
     $handles = $viewer->loadHandles(array($space_phid));
     $doc_href = PhabricatorEnv::getDoclink('Spaces User Guide');
     $dialog->appendParagraph(array(pht('This object is in %s, and can only be seen or edited by users with ' . 'access to view objects in the space.', $handles[$space_phid]->renderLink()), ' ', phutil_tag('strong', array(), phutil_tag('a', array('href' => $doc_href, 'target' => '_blank'), pht('Learn More')))));
     $spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces($viewer);
     $space = idx($spaces, $space_phid);
     if (!$space) {
         return;
     }
     $space_policies = PhabricatorPolicyQuery::loadPolicies($viewer, $space);
     $space_policy = idx($space_policies, PhabricatorPolicyCapability::CAN_VIEW);
     if (!$space_policy) {
         return;
     }
     $space_explanation = PhabricatorPolicy::getPolicyExplanation($viewer, $space_policy->getPHID());
     $items = array();
     $items[] = $space_explanation;
     foreach ($items as $key => $item) {
         $items[$key] = phutil_tag('li', array(), $item);
     }
     $dialog->appendParagraph(pht('Users who can see objects in this space:'));
     $dialog->appendChild(phutil_tag('ul', array(), $items));
     $view_capability = PhabricatorPolicyCapability::CAN_VIEW;
     if ($capability == $view_capability) {
         $stronger = $space_policy->isStrongerThan($policy);
         if ($stronger) {
             $dialog->appendParagraph(pht('The space this object is in has a more restrictive view ' . 'policy ("%s") than the object does ("%s"), so the space\'s ' . 'view policy is shown as a hint instead of the object policy.', $space_policy->getShortName(), $policy->getShortName()));
         }
     }
     $dialog->appendParagraph(pht('After a user passes space policy checks, they must still pass ' . 'object policy checks.'));
 }

 private function buildSpaceSection(PhabricatorPolicyInterface $object, PhabricatorPolicy $policy, $capability)
 {
     $viewer = $this->getViewer();
     if (!$object instanceof PhabricatorSpacesInterface) {
         return null;
     }
     if (!PhabricatorSpacesNamespaceQuery::getSpacesExist($viewer)) {
         return null;
     }
     $space_phid = PhabricatorSpacesNamespaceQuery::getObjectSpacePHID($object);
     $spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces($viewer);
     $space = idx($spaces, $space_phid);
     if (!$space) {
         return null;
     }
     $space_policies = PhabricatorPolicyQuery::loadPolicies($viewer, $space);
     $space_policy = idx($space_policies, PhabricatorPolicyCapability::CAN_VIEW);
     if (!$space_policy) {
         return null;
     }
     $doc_href = PhabricatorEnv::getDoclink('Spaces User Guide');
     $capability_name = $this->getCapabilityName($capability);
     $space_section = id(new PHUIPolicySectionView())->setViewer($viewer)->setIcon('fa-th-large bluegrey')->setHeader(pht('Space'))->setDocumentationLink(pht('Spaces Documentation'), $doc_href)->appendList(array(array(phutil_tag('strong', array(), pht('Space:')), ' ', $viewer->renderHandle($space_phid)->setAsTag(true)), array(phutil_tag('strong', array(), pht('%s:', $capability_name)), ' ', $space_policy->getShortName())))->appendParagraph(pht('This object is in %s and can only be seen or edited by users ' . 'with access to view objects in the space.', $viewer->renderHandle($space_phid)));
     $space_explanation = PhabricatorPolicy::getPolicyExplanation($viewer, $space_policy->getPHID());
     $items = array();
     $items[] = $space_explanation;
     $space_section->appendParagraph(pht('Users who can see objects in this space:'))->appendList($items);
     $view_capability = PhabricatorPolicyCapability::CAN_VIEW;
     if ($capability == $view_capability) {
         $stronger = $space_policy->isStrongerThan($policy);
         if ($stronger) {
             $space_section->appendHint(pht('The space this object is in has a more restrictive view ' . 'policy ("%s") than the object does ("%s"), so the space\'s ' . 'view policy is shown as a hint instead of the object policy.', $space_policy->getShortName(), $policy->getShortName()));
         }
     }
     $space_section->appendHint(pht('After a user passes space policy checks, they must still pass ' . 'object policy checks.'));
     return $space_section;
 }

//.........这里部分代码省略.........
             return $this->delegateToController($controller);
         }
         if ($user->getIsDisabled()) {
             $controller = new PhabricatorDisabledUserController();
             return $this->delegateToController($controller);
         }
     }
     $auth_class = 'PhabricatorAuthApplication';
     $auth_application = PhabricatorApplication::getByClass($auth_class);
     // Require partial sessions to finish login before doing anything.
     if (!$this->shouldAllowPartialSessions()) {
         if ($user->hasSession() && $user->getSession()->getIsPartial()) {
             $login_controller = new PhabricatorAuthFinishController();
             $this->setCurrentApplication($auth_application);
             return $this->delegateToController($login_controller);
         }
     }
     // Check if the user needs to configure MFA.
     $need_mfa = $this->shouldRequireMultiFactorEnrollment();
     $have_mfa = $user->getIsEnrolledInMultiFactor();
     if ($need_mfa && !$have_mfa) {
         // Check if the cache is just out of date. Otherwise, roadblock the user
         // and require MFA enrollment.
         $user->updateMultiFactorEnrollment();
         if (!$user->getIsEnrolledInMultiFactor()) {
             $mfa_controller = new PhabricatorAuthNeedsMultiFactorController();
             $this->setCurrentApplication($auth_application);
             return $this->delegateToController($mfa_controller);
         }
     }
     if ($this->shouldRequireLogin()) {
         // This actually means we need either:
         //   - a valid user, or a public controller; and
         //   - permission to see the application; and
         //   - permission to see at least one Space if spaces are configured.
         $allow_public = $this->shouldAllowPublic() && PhabricatorEnv::getEnvConfig('policy.allow-public');
         // If this controller isn't public, and the user isn't logged in, require
         // login.
         if (!$allow_public && !$user->isLoggedIn()) {
             $login_controller = new PhabricatorAuthStartController();
             $this->setCurrentApplication($auth_application);
             return $this->delegateToController($login_controller);
         }
         if ($user->isLoggedIn()) {
             if ($this->shouldRequireEmailVerification()) {
                 if (!$user->getIsEmailVerified()) {
                     $controller = new PhabricatorMustVerifyEmailController();
                     $this->setCurrentApplication($auth_application);
                     return $this->delegateToController($controller);
                 }
             }
         }
         // If Spaces are configured, require that the user have access to at
         // least one. If we don't do this, they'll get confusing error messages
         // later on.
         $spaces = PhabricatorSpacesNamespaceQuery::getSpacesExist();
         if ($spaces) {
             $viewer_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces($user);
             if (!$viewer_spaces) {
                 $controller = new PhabricatorSpacesNoAccessController();
                 return $this->delegateToController($controller);
             }
         }
         // If the user doesn't have access to the application, don't let them use
         // any of its controllers. We query the application in order to generate
         // a policy exception if the viewer doesn't have permission.
         $application = $this->getCurrentApplication();
         if ($application) {
             id(new PhabricatorApplicationQuery())->setViewer($user)->withPHIDs(array($application->getPHID()))->executeOne();
         }
     }
     if (!$this->shouldAllowLegallyNonCompliantUsers()) {
         $legalpad_class = 'PhabricatorLegalpadApplication';
         $legalpad = id(new PhabricatorApplicationQuery())->setViewer($user)->withClasses(array($legalpad_class))->withInstalled(true)->execute();
         $legalpad = head($legalpad);
         $doc_query = id(new LegalpadDocumentQuery())->setViewer($user)->withSignatureRequired(1)->needViewerSignatures(true);
         if ($user->hasSession() && !$user->getSession()->getIsPartial() && !$user->getSession()->getSignedLegalpadDocuments() && $user->isLoggedIn() && $legalpad) {
             $sign_docs = $doc_query->execute();
             $must_sign_docs = array();
             foreach ($sign_docs as $sign_doc) {
                 if (!$sign_doc->getUserSignature($user->getPHID())) {
                     $must_sign_docs[] = $sign_doc;
                 }
             }
             if ($must_sign_docs) {
                 $controller = new LegalpadDocumentSignController();
                 $this->getRequest()->setURIMap(array('id' => head($must_sign_docs)->getID()));
                 $this->setCurrentApplication($legalpad);
                 return $this->delegateToController($controller);
             } else {
                 $engine = id(new PhabricatorAuthSessionEngine())->signLegalpadDocuments($user, $sign_docs);
             }
         }
     }
     // NOTE: We do this last so that users get a login page instead of a 403
     // if they need to login.
     if ($this->shouldRequireAdmin() && !$user->getIsAdmin()) {
         return new Aphront403Response();
     }
 }

 private function renderPolicyProperty(PhabricatorPolicyInterface $object)
 {
     $viewer = $this->getUser();
     $policies = PhabricatorPolicyQuery::loadPolicies($viewer, $object);
     $view_capability = PhabricatorPolicyCapability::CAN_VIEW;
     $policy = idx($policies, $view_capability);
     if (!$policy) {
         return null;
     }
     // If an object is in a Space with a strictly stronger (more restrictive)
     // policy, we show the more restrictive policy. This better aligns the
     // UI hint with the actual behavior.
     // NOTE: We'll do this even if the viewer has access to only one space, and
     // show them information about the existence of spaces if they click
     // through.
     $use_space_policy = false;
     if ($object instanceof PhabricatorSpacesInterface) {
         $space_phid = PhabricatorSpacesNamespaceQuery::getObjectSpacePHID($object);
         $spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces($viewer);
         $space = idx($spaces, $space_phid);
         if ($space) {
             $space_policies = PhabricatorPolicyQuery::loadPolicies($viewer, $space);
             $space_policy = idx($space_policies, $view_capability);
             if ($space_policy) {
                 if ($space_policy->isStrongerThan($policy)) {
                     $policy = $space_policy;
                     $use_space_policy = true;
                 }
             }
         }
     }
     $container_classes = array();
     $container_classes[] = 'policy-header-callout';
     $phid = $object->getPHID();
     // If we're going to show the object policy, try to determine if the object
     // policy differs from the default policy. If it does, we'll call it out
     // as changed.
     if (!$use_space_policy) {
         $default_policy = PhabricatorPolicyQuery::getDefaultPolicyForObject($viewer, $object, $view_capability);
         if ($default_policy) {
             if ($default_policy->getPHID() != $policy->getPHID()) {
                 $container_classes[] = 'policy-adjusted';
                 if ($default_policy->isStrongerThan($policy)) {
                     // The policy has strictly been weakened. For example, the
                     // default might be "All Users" and the current policy is "Public".
                     $container_classes[] = 'policy-adjusted-weaker';
                 } else {
                     if ($policy->isStrongerThan($default_policy)) {
                         // The policy has strictly been strengthened, and is now more
                         // restrictive than the default. For example, "All Users" has
                         // been replaced with "No One".
                         $container_classes[] = 'policy-adjusted-stronger';
                     } else {
                         // The policy has been adjusted but not strictly strengthened
                         // or weakened. For example, "Members of X" has been replaced with
                         // "Members of Y".
                         $container_classes[] = 'policy-adjusted-different';
                     }
                 }
             }
         }
     }
     $icon = id(new PHUIIconView())->setIcon($policy->getIcon() . ' bluegrey');
     $link = javelin_tag('a', array('class' => 'policy-link', 'href' => '/policy/explain/' . $phid . '/' . $view_capability . '/', 'sigil' => 'workflow'), $policy->getShortName());
     return phutil_tag('span', array('class' => implode(' ', $container_classes)), array($icon, $link));
 }

 private function validateSpaceTransactions(PhabricatorLiskDAO $object, array $xactions, $transaction_type)
 {
     $errors = array();
     $actor = $this->getActor();
     $has_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpacesExist($actor);
     $actor_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces($actor);
     $active_spaces = PhabricatorSpacesNamespaceQuery::getViewerActiveSpaces($actor);
     foreach ($xactions as $xaction) {
         $space_phid = $xaction->getNewValue();
         if ($space_phid === null) {
             if (!$has_spaces) {
                 // The install doesn't have any spaces, so this is fine.
                 continue;
             }
             // The install has some spaces, so every object needs to be put
             // in a valid space.
             $errors[] = new PhabricatorApplicationTransactionValidationError($transaction_type, pht('Invalid'), pht('You must choose a space for this object.'), $xaction);
             continue;
         }
         // If the PHID isn't `null`, it needs to be a valid space that the
         // viewer can see.
         if (empty($actor_spaces[$space_phid])) {
             $errors[] = new PhabricatorApplicationTransactionValidationError($transaction_type, pht('Invalid'), pht('You can not shift this object in the selected space, because ' . 'the space does not exist or you do not have access to it.'), $xaction);
         } else {
             if (empty($active_spaces[$space_phid])) {
                 // It's OK to edit objects in an archived space, so just move on if
                 // we aren't adjusting the value.
                 $old_space_phid = $this->getTransactionOldValue($object, $xaction);
                 if ($space_phid == $old_space_phid) {
                     continue;
                 }
                 $errors[] = new PhabricatorApplicationTransactionValidationError($transaction_type, pht('Archived'), pht('You can not shift this object into the selected space, because ' . 'the space is archived. Objects can not be created inside (or ' . 'moved into) archived spaces.'), $xaction);
             }
         }
     }
     return $errors;
 }

 /**
  * Constrain the query to include only results in valid Spaces.
  *
  * This method builds part of a WHERE clause which considers the spaces the
  * viewer has access to see with any explicit constraint on spaces added by
  * @{method:withSpacePHIDs}.
  *
  * @param AphrontDatabaseConnection Database connection.
  * @return string Part of a WHERE clause.
  * @task spaces
  */
 private function buildSpacesWhereClause(AphrontDatabaseConnection $conn)
 {
     $object = $this->newResultObject();
     if (!$object) {
         return null;
     }
     if (!$object instanceof PhabricatorSpacesInterface) {
         return null;
     }
     $viewer = $this->getViewer();
     // If we have an omnipotent viewer and no formal space constraints, don't
     // emit a clause. This primarily enables older migrations to run cleanly,
     // without fataling because they try to match a `spacePHID` column which
     // does not exist yet. See T8743, T8746.
     if ($viewer->isOmnipotent()) {
         if ($this->spaceIsArchived === null && $this->spacePHIDs === null) {
             return null;
         }
     }
     $space_phids = array();
     $include_null = false;
     $all = PhabricatorSpacesNamespaceQuery::getAllSpaces();
     if (!$all) {
         // If there are no spaces at all, implicitly give the viewer access to
         // the default space.
         $include_null = true;
     } else {
         // Otherwise, give them access to the spaces they have permission to
         // see.
         $viewer_spaces = PhabricatorSpacesNamespaceQuery::getViewerSpaces($viewer);
         foreach ($viewer_spaces as $viewer_space) {
             if ($this->spaceIsArchived !== null) {
                 if ($viewer_space->getIsArchived() != $this->spaceIsArchived) {
                     continue;
                 }
             }
             $phid = $viewer_space->getPHID();
             $space_phids[$phid] = $phid;
             if ($viewer_space->getIsDefaultNamespace()) {
                 $include_null = true;
             }
         }
     }
     // If we have additional explicit constraints, evaluate them now.
     if ($this->spacePHIDs !== null) {
         $explicit = array();
         $explicit_null = false;
         foreach ($this->spacePHIDs as $phid) {
             if ($phid === null) {
                 $space = PhabricatorSpacesNamespaceQuery::getDefaultSpace();
             } else {
                 $space = idx($all, $phid);
             }
             if ($space) {
                 $phid = $space->getPHID();
                 $explicit[$phid] = $phid;
                 if ($space->getIsDefaultNamespace()) {
                     $explicit_null = true;
                 }
             }
         }
         // If the viewer can see the default space but it isn't on the explicit
         // list of spaces to query, don't match it.
         if ($include_null && !$explicit_null) {
             $include_null = false;
         }
         // Include only the spaces common to the viewer and the constraints.
         $space_phids = array_intersect_key($space_phids, $explicit);
     }
     if (!$space_phids && !$include_null) {
         if ($this->spacePHIDs === null) {
             throw new PhabricatorEmptyQueryException(pht('You do not have access to any spaces.'));
         } else {
             throw new PhabricatorEmptyQueryException(pht('You do not have access to any of the spaces this query ' . 'is constrained to.'));
         }
     }
     $alias = $this->getPrimaryTableAlias();
     if ($alias) {
         $col = qsprintf($conn, '%T.spacePHID', $alias);
     } else {
         $col = 'spacePHID';
     }
     if ($space_phids && $include_null) {
         return qsprintf($conn, '(%Q IN (%Ls) OR %Q IS NULL)', $col, $space_phids, $col);
     } else {
         if ($space_phids) {
             return qsprintf($conn, '%Q IN (%Ls)', $col, $space_phids);
         } else {
             return qsprintf($conn, '%Q IS NULL', $col);
//.........这里部分代码省略.........