snap2/perm/SnapPermission.php5

<?php

final class SnapPermission extends SnapObject {
    const USER_ADMIN = 'ADMIN';
    const USER_RESTORE = 'RESTORE';
    const USER_DESTROY = 'DESTROY';

    const ACCESS_DEFAULT_DENY = 0;
    const ACCESS_GROUP_ALLOW = 1;
    const ACCESS_GROUP_DENY = 2;
    const ACCESS_USER_ALLOW = 3;
    const ACCESS_USER_DENY = 4;
    const ACCESS_RESTORE = 5;
    const ACCESS_DESTROY = 6;
    const ACCESS_ADMIN = 7;

    const CAP_DEFAULT = 'DEFAULT';
    const CAP_ALLOW = 'ALLOW';
    const CAP_DENY = 'DENY';

    private static $SPECIAL_USERS = null;

    private $updateTransaction = null;

    private static $BS = array(
        self::CAP_DEFAULT => array(
            'perm_and' => '0',
            'perm_or' => '0',
            'mask_and' => '0',
            'mask_or' => '0'
        ),
        self::CAP_ALLOW => array(
            'perm_and' => '1',
            'perm_or' => '1',
            'mask_and' => '1',
            'mask_or' => '1'
        ),
        self::CAP_DENY => array(
            'perm_and' => '0',
            'perm_or' => '0',
            'mask_and' => '1',
            'mask_or' => '1'
        ),
        99 => array(
            'perm_and' => '1',
            'perm_or' => '0',
            'mask_and' => '1',
            'mask_or' => '0'
        )
    );

    public function __construct($file) {
        $fields = array('file' => true, 'fileType' => true, 'permObjects' => true,
                        'parties' => array($this, 'loadParties'), 'cache' => true);
        parent::__construct('Permission', $fields, array());

        $fileObj = self::convertReference($file, 'File');
        if($fileObj == null || !$fileObj instanceof SnapFile) {
            $this->setError('Invalid file given to permission object!');
            $this->setValid(false);
        }
        else {
            $this->set('file', $fileObj);
            $this->set('fileType', $fileObj->getType());
            $this->set('permObjects', array());
            $this->set('cache', array());
        }
    }

    protected function populate() {
        $this->setValid(true);
        return true;
    }

    protected function loadParties() {
        $query = 'SELECT uid FROM ' . $this->get('fileType') . 'UserPermission WHERE '
            . strtolower($this->get('fileType')) . 'Id = ' . $this->get('file')->getId()
            . ' GROUP BY uid';
        if(!SnapDBI::query($query)) {
            $this->setError('Error during query');
            return false;
        }
        $parties = array('users' => array(), 'groups' => array());
        while($row = SnapDBI::getRow())
            $parties['users'][] = $row['uid'];
        SnapDBI::freeResult();

        $query = 'SELECT gid FROM ' . $this->get('fileType') . 'GroupPermission WHERE '
            . strtolower($this->get('fileType')) . 'Id = ' . $this->get('file')->getId()
            . ' GROUP BY gid';
        if(!SnapDBI::query($query)) {
            $this->setError('Error during query');
            return false;
        }
        while($row = SnapDBI::getRow())
            $parties['groups'][] = $row['gid'];
        SnapDBI::freeResult();

        $this->set('parties', $parties);
        return true;
    }

    private function getUserKey($uid) {
        $file = $this->get('file');
        $key = 'U:' . $uid . ';' . substr($file->getType(), 0, 1) . ':' . $file->getId();
        return $key;
    }

    protected function getGroupKey($gid) {
        $file = $this->get('file');
        $key = 'G:' . $gid . ';' . substr($file->getType(), 0, 1) . ':' . $file->getId();
        return $key;
    }

    protected function getUserPermObject($uid) {
        $permObjects = $this->get('permObjects');
        $fileObj = $this->get('file');
        $key = $this->getUserKey($uid);
        if(array_key_exists($key, $permObjects))
            return $permObjects[$key][0];

        $objType = 'Snap' . $fileObj->getType() . 'UserPermission';
        $perm = call_user_func(array($objType, 'retrieve'), $fileObj->getId(), $uid);

        $permObjects[$key] = array($perm);
        $this->set('permObjects', $permObjects);

        return $perm;
    }

    protected function getGroupPermObject($gid) {
        $permObjects = $this->get('permObjects');
        $fileObj = $this->get('file');
        $key = $this->getGroupKey($gid);
        if(array_key_exists($key, $permObjects))
            return $permObjects[$key];

        $objType = 'Snap' . $fileObj->getType() . 'GroupPermission';
        $perm = call_user_func(array($objType, 'retrieve'), $fileObj->getId(), $gid);

        $permObjects[$key] = $perm;
        $this->set('permObjects', $permObjects);

        return $perm;
    }

    protected function getGroupPermObjects($uid) {
        $key = $this->getUserKey($uid);
        if(!isset($permObjects[$key]))
            $this->getUserPermObject($uid);

        $permObjects = $this->get('permObjects');
        $fileObj = $this->get('file');
        if(array_key_exists($key, $permObjects) && array_key_exists('groups', $permObjects[$key]))
            return $permObjects[$key]['groups'];

        $objType = 'Snap' . $fileObj->getType() . 'GroupPermission';
        $perms = call_user_func(array($objType, 'getGroupPermissionsForUser'), $fileObj->getId(), $uid);

        $permObjects[$key]['groups'] = $perms;
        $this->set('permObjects', $permObjects);

        return $perms;
    }

    protected function getCachedAccess($cap, $uid = '') {
        if($uid == '')
            $uid = Snap2::getCurrentUser();

        $cacheObjects = $this->get('cache');
        if(!isset($cacheObjects[$uid])) {
            $cacheObjects[$uid] = SnapPermissionCache::retrieve($this->get('fileType'), $this->get('file')->getId(), $uid);
//          new SnapPermissionCache($this->get('fileType'), $this->get('file')->getId(), $uid);
            $this->set('cache', $cacheObjects);
        }

        $access = $cacheObjects[$uid]->getEA($cap);
        return $access;
    }

    public function mayChangePermission($uid = '') {
        if(!$this->checkValid()) return false;

        if(self::isSpecialUser($uid) === 'ADMIN')
            return true;

        if(!$this->has('Change' . $this->get('fileType') . 'Permission', $uid))
            return false;

        return true;
    }

    public function canChangePermission() {
        if(!$this->checkValid()) return false;

        $file = $this->get('file');

        if($file->getType() == 'Directory' && $file->getId() == Snap2::DELETED_DIR_ID) {
            $this->setReason('You cannot change permissions on the root or DELETED directories');
            return false;
        }

        if($file->isCanonChildOf(Snap2::DELETED_DIR_ID)) {
            $this->setReason('You cannot change the permission of objects in /DELETED/');
            return false;
        }

        if(!$this->mayChangePermission()) {
            $this->setReason('Permission denied');
            return false;
        }

        return true;
    }

    private function hasImpl($cap, $uid) {
        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        $userObj = $this->getUserPermObject($uid);
        if(!$userObj || $userObj->getCapability($cap) == self::CAP_DEFAULT) {
            $groupObjects = $this->getGroupPermObjects($uid);
            $highest = 0;
            foreach($groupObjects as $gr) {
                switch($gr->getCapability($cap)) {
                    case self::CAP_DEFAULT:
                        break;
                    case self::CAP_ALLOW:
                        if($highest < 1)
                            $highest = 1;
                        break;
                    case self::CAP_DENY:
                        $highest = 2;
                        break;
                }
            }
            if($highest == 1)
                return true;
            else
                return false;
        }
        else if($userObj && $userObj->getCapability($cap) == self::CAP_ALLOW) {
            return true;
        }
        else {
            return false;
        }
    }

    private function saveToCache($caps, $uid) {
        $cobjects = $this->get('cache');
        $cacheObj = $cobjects[$uid];

        foreach($caps as $cap) {
            $access = $this->hasImpl($cap, $uid);
            $cacheObj->setEA($cap, $access);
        }

        $cacheObj->commit();
    }

    public function has($cap, $uid = '') {
        if(!$this->checkValid()) return false;

        $caps = SnapPermission::getCapabilities($this->get('fileType'));

        if(!in_array($cap, $caps)) {
            $this->setError('Invalid capability \'' . $cap . '\'');
            return false;
        }

        if($uid == '') {
            $uid = Snap2::getCurrentUser();
            if($uid === false) {
                $this->setError('No current user!');
                return false;
            }
        }

        $cachedAccess = $this->getCachedAccess($cap, $uid);
        if($cachedAccess !== null)
            return $cachedAccess;

        $this->saveToCache($caps, $uid);
        $cachedAccess = $this->getCachedAccess($cap, $uid);
        if($cachedAccess !== null)
            return $cachedAccess;

        return $this->hasImpl($cap, $uid);
    }

    public function hasEx($cap, $uid = '') {
        if(!$this->checkValid()) return array(false, 'N/A');

        $caps = SnapPermission::getCapabilities($this->get('fileType'));

        if(!in_array($cap, $caps)) {
            $this->setError('Invalid capability \'' . $cap . '\'');
            return array(false, false);
        }

        if($uid == '') {
            $uid = Snap2::getCurrentUser();
            if($uid === false) {
                $this->setError('No current user!');
                return array(false, false);
            }
        }

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return array(self::ACCESS_ADMIN, false);

        $userObj = $this->getUserPermObject($uid);
        if(!$userObj || $userObj->getCapability($cap) == self::CAP_DEFAULT) {
            $groupObjects = $this->getGroupPermObjects($uid);
            $highest = 0;
            $highestGroup = '';
            foreach($groupObjects as $gr) {
                switch($gr->getCapability($cap)) {
                    case self::CAP_DEFAULT:
                        break;
                    case self::CAP_ALLOW:
                        if($highest <= 1) {
                            $highestGroup = $gr->getOwnerId();
                            $highest = 1;
                        }
                        break;
                    case self::CAP_DENY:
                        $highest = 2;
                        $highestGroup = $gr->getOwnerId();
                        break;
                }
            }
            switch($highest) {
                case 0:
                    return array(self::ACCESS_DEFAULT_DENY, false);
                case 1:
                    return array(self::ACCESS_GROUP_ALLOW, $highestGroup);
                case 2:
                    return array(self::ACCESS_GROUP_DENY, $highestGroup);
            }
        }
        else if($userObj) {
            switch($userObj->getCapability($cap)) {
                case self::CAP_ALLOW:
                    return array(self::ACCESS_USER_ALLOW, false);
                case self::CAP_DENY:
                    return array(self::ACCESS_USER_DENY, false);
                default:
                    return array(self::ACCESS_DEFAULT_DENY, false);
            }
        }
        else {
            return array(self::ACCESS_DEFAULT_DENY, false);
        }
    }

    public function getUserAccess($cap, $uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '') {
            $uid = Snap2::getCurrentUser();
            if(!$uid) {
                $this->setError('No current user!');
                return false;
            }
        }

        $userObj = $this->getUserPermObject($uid);
        if(!$userObj)
            return self::ACCESS_DEFAULT_DENY;
        switch($userObj->getCapability($cap)) {
            case self::CAP_ALLOW: return self::ACCESS_USER_ALLOW;
            case self::CAP_DENY: return self::ACCESS_USER_DENY;
            default: return self::ACCESS_DEFAULT_DENY;
        }
    }

    public function getGroupAccess($cap, $gid) {
        if(!$this->checkValid()) return false;

        $groupObj = $this->getGroupPermObject($gid);
        if(!$groupObj)
            return self::ACCESS_DEFAULT_DENY;
        switch($groupObj->getCapability($cap)) {
            case self::CAP_ALLOW: return self::ACCESS_GROUP_ALLOW;
            case self::CAP_DENY: return self::ACCESS_GROUP_DENY;
            default: return self::ACCESS_DEFAULT_DENY;
        }
    }

    public function getGroupsAccess($cap, $uid = '') {
        // effective access for all groups a user belongs to
        if(!$this->checkValid()) return array(false, false);

        if($uid == '') {
            $uid = Snap2::getCurrentUser();
            if(!$uid) {
                $this->setError('No current user!');
                return array(false, false);
            }
        }

        $groupObjects = $this->getGroupPermObjects($uid);
        $highest = 0;
        $highestGroup = '';
        foreach($groupObjects as $gr) {
            switch($gr->getCapability($cap)) {
                case self::CAP_DEFAULT:
                    break;
                case self::CAP_ALLOW:
                    if($highest <= 1) {
                        $highestGroup = $gr->getOwnerId();
                        $highest = 1;
                    }
                    break;
                case self::CAP_DENY:
                    $highest = 2;
                    $highestGroup = $gr->getOwnerId();
                    break;
            }
        }
        switch($highest) {
            case 0:
                return array(self::ACCESS_DEFAULT_DENY, false);
            case 1:
                return array(self::ACCESS_GROUP_ALLOW, $highestGroup);
            case 2:
                return array(self::ACCESS_GROUP_DENY, $highestGroup);
        }
    }


    public function setUserAccess($cap, $access, $uid = '') {
        if(!$this->checkValid()) return false;

        if(!$this->canChangePermission()) {
            $this->setError('Failed to set access: ' . $this->getReason());
            return false;
        }

        if($uid == '') {
            $uid = Snap2::getCurrentUser();
            if(!$uid) {
                $this->setError('No current user!');
                return false;
            }
        }

        if($this->updateTransaction == null)
            $this->updateTransaction = array('users' => array(), 'groups' => array());
        if(!isset($this->updateTransaction['users'][$uid]))
            $this->updateTransaction['users'][$uid] = array();

        $this->updateTransaction['users'][$uid][$cap] = $access;
        return true;
    }

    public function setGroupAccess($cap, $access, $gid) {
        if(!$this->checkValid()) return false;

        if(!$this->canChangePermission()) {
            $this->setError('Failed to set access: ' . $this->getReason());
            return false;
        }

        if($this->updateTransaction == null)
            $this->updateTransaction = array('users' => array(), 'groups' => array());
        if(!isset($this->updateTransaction['groups'][$gid]))
            $this->updateTransaction['groups'][$gid] = array();

        $this->updateTransaction['groups'][$gid][$cap] = $access;
        return true;
    }

    public function revokeUser($uid = '') {
        if(!$this->checkValid()) return false;

        if(!$this->canChangePermission()) {
            $this->setError('Failed to revoke access: ' . $this->getReason());
            return false;
        }

        if($uid == '') {
            $uid = Snap2::getCurrentUser();
            if(!$uid) {
                $this->setError('No current user!');
                return false;
            }
        }

        if($this->updateTransaction == null)
            $this->updateTransaction = array('users' => array(), 'groups' => array());
        if(!isset($this->updateTransaction['users'][$uid]))
            $this->updateTransaction['users'][$uid] = array();

        $capabilities = SnapPermissionObject::getCapabilities($this->get('fileType'));
        foreach($capabilities as $c)
            $this->updateTransaction['users'][$uid][$c] = self::CAP_DEFAULT;

        return true;
    }

    public function revokeGroup($gid) {
        if(!$this->checkValid()) return false;

        if(!$this->canChangePermission()) {
            $this->setError('Failed to revoke access: ' . $this->getReason());
            return false;
        }

        if($this->updateTransaction == null)
            $this->updateTransaction = array('users' => array(), 'groups' => array());
        if(!isset($this->updateTransaction['groups'][$gid]))
            $this->updateTransaction['groups'][$gid] = array();

        $capabilities = SnapPermissionObject::getCapabilities($this->get('fileType'));
        foreach($capabilities as $c)
            $this->updateTransaction['groups'][$gid][$c] = self::CAP_DEFAULT;

        return true;
    }

    public function commit($cascade = false) {
        if(!$this->canChangePermission()) {
            $this->setError('Failed to commit permission changes: ' . $this->getReason());
            return false;
        }

        if(!$this->updateTransaction) {
            $this->setWarning('Empty transaction; not committing anything to DB');
            return true;
        }

        // disable the cache temporarily
        // and clear out any permission objects
        SnapCache::clearObjectCache('DirectoryUserPermission');
        SnapCache::clearObjectCache('DirectoryGroupPermission');
        SnapCache::clearObjectCache('ResourceUserPermission');
        SnapCache::clearObjectCache('ResourceGroupPermission');
        $permObjects = SnapCache::getObjectCache('Permission');
        foreach($permObjects as $p)
            $p->clearPermObjects();

        $oldEnable = SnapCache::usingCache();
        SnapCache::setEnableCache(false, false);

        $file = $this->get('file');
        $committed = array();
        SnapDBI::startTransaction();
        if(!$this->doCommit($file->getId(), $file->getType(), $this->updateTransaction, $cascade, $committed)) {
            SnapDBI::cancelTransaction();
            SnapCache::setEnableCache($oldEnable, false);
            $this->setError('failed to doCommit');
            return false;
        }
        $query = 'DELETE FROM ResourceUserPermission WHERE defaultMask = 0 AND permission = 0';
        SnapDBI::query($query);
        $query = 'DELETE FROM ResourceGroupPermission WHERE defaultMask = 0 AND permission = 0';
        SnapDBI::query($query);
        $query = 'DELETE FROM DirectoryUserPermission WHERE defaultMask = 0 AND permission = 0';
        SnapDBI::query($query);
        $query = 'DELETE FROM DirectoryGroupPermission WHERE defaultMask = 0 AND permission = 0';
        SnapDBI::query($query);
        SnapDBI::commitTransaction();

        $this->updateTransaction = null;
        SnapCache::setEnableCache($oldEnable, false);
        return true;
    }

    private function doCommit($parentId, $type, $updateTransaction, $cascade, &$committed) {
        $curUid = Snap2::getCurrentUser();

        /* Mode of Operation:
         *
         * Each row in the relevant permission table has two columns that deal with permissions:
         * permission and defaultMask.  The former is a bit string and for each bit in the string,
         * a 1 indicates the permission is granted, a 0 means it is denied.  The latter is also
         * a bit string and for each bit in the string, a 1 means look at the permission field for
         * an explicity allow or deny (1 or 0) and a 0 means default deny (for groups) or defer to
         * group permissions (for users).
         *
         * In order to change permissions, we use two mask strings that are ANDed and ORed onto the
         * current permission and defaultMask values in the database to produce the new permission
         * information.  One string is called $*_andBS and the other is $*_orBS.  The $*_andBS will be
         * ANDed with the existing permission/defaultMask field as a mask where a 1 bit indicates that
         * the corresponding bit in permission/defaultMask is to remain unchanged, or will be set to 1
         * via the $*_orBS string.  If the bit is a zero, then the corresponding bit in permission/defaultMask
         * is cleared.  The $*_orBS string has one bits where a bit is to be set in permission/defaultMask
         * and zero otherwise.
         *
         * So, to set a bit in the permission field to 1, we would set the corresponding bit in $perm_andBS
         * to 1 (because we want to keep the field unchanged or set it to 1) and in $perm_orBS we would also
         * set a 1 bit.  If we wanted to clear a bit in the permission field, we would set the bit $perm_andBS
         * to 0 and $perm_orBS to 0 as well, although it doesn't matter.  For the four possible cases (set deny,
         * set allow, set default or leave unchanged), there is a table self::$BS, which is indexed to get the
         * appropriate bit patterns.
         *
         * We use a INSERT INTO ... ON DUPLICATE KEY UPDATE to avoid having to do a readback from the database
         * to determine if there is already an entry in the table (and from there to determine whether to do
         * an INSERT or UPDATE).  The whole statement is effectively a INSERT or UPDATE depending on whether
         * there is already a row in the table for the given directory/resource and uid/gid.
         */
        $typeIdName = strtolower($type) . 'Id';
        $caps = self::getCapabilities($type);
        foreach($updateTransaction['users'] as $uid => $info) {
            // initialize the bit strings to suitable masks that would otherwise not change any permissions
            $perm_andBS = str_repeat('1', 32);
            $perm_orBS = str_repeat('0', 32);
            $mask_andBS = str_repeat('1', 32);
            $mask_orBS = str_repeat('0', 32);
            foreach($caps as $id => $cap) {
                if(isset($info[$cap]))
                    $status = $info[$cap];
                else
                    $status = 99; // don't change
                if(!SnapPermissionObject::isCapabilityForType($type, $cap))
                    continue;
                $i = 32 - $id;
                $perm_andBS[$i] = self::$BS[$status]['perm_and'];
                $perm_orBS[$i] = self::$BS[$status]['perm_or'];
                $mask_andBS[$i] = self::$BS[$status]['mask_and'];
                $mask_orBS[$i] = self::$BS[$status]['mask_or'];
            }
            $query = <<<END_QUERY
INSERT INTO ${type}UserPermission (uid, $typeIdName, permission, defaultMask) VALUES
    ('$uid', '$parentId', 0 & b'$perm_andBS' | b'$perm_orBS', 0 & b'$mask_andBS' | b'$mask_orBS')
    ON DUPLICATE KEY UPDATE permission = permission & b'$perm_andBS' | b'$perm_orBS',
                            defaultMask = defaultMask & b'$mask_andBS' | b'$mask_orBS'
END_QUERY;
            if(!SnapDBI::query($query)) {
                SnapDBI::cancelTransaction();
                return false;
            }
        }

        /* Need to clear out EA cache entries.
         * Since we know the user and the object, we only need to clear out one entry, resulting
         * in less cache trashing.
         */
        if(count($updateTransaction['users']) > 0)
            SnapPermissionCache::clearCache($type, $parentId, $uid);

        foreach($updateTransaction['groups'] as $gid => $info) {
            $perm_andBS = str_repeat('1', 32);
            $perm_orBS = str_repeat('0', 32);
            $mask_andBS = str_repeat('1', 32);
            $mask_orBS = str_repeat('0', 32);
            foreach($caps as $id => $cap) {
                if(isset($info[$cap]))
                    $status = $info[$cap];
                else
                    $status = 99; // don't change
                if(!SnapPermissionObject::isCapabilityForType($type, $cap))
                    continue;
                $i = 32 - $id;
                $perm_andBS[$i] = self::$BS[$status]['perm_and'];
                $perm_orBS[$i] = self::$BS[$status]['perm_or'];
                $mask_andBS[$i] = self::$BS[$status]['mask_and'];
                $mask_orBS[$i] = self::$BS[$status]['mask_or'];
            }
            $query = <<<END_QUERY
INSERT INTO ${type}GroupPermission (gid, $typeIdName, permission, defaultMask) VALUES
    ('$gid', '$parentId', 0 & b'$perm_andBS' | b'$perm_orBS', 0 & b'$mask_andBS' | b'$mask_orBS')
    ON DUPLICATE KEY UPDATE permission = permission & b'$perm_andBS' | b'$perm_orBS',
                            defaultMask = defaultMask & b'$mask_andBS' | b'$mask_orBS'
END_QUERY;
            if(!SnapDBI::query($query)) {
                SnapDBI::cancelTransaction();
                return false;
            }
        }

        /* Need to clear out all cached effective permissions in the EA cache.
         * Since it would be wasteful to determine all the users that would be affected
         * by the relevant groups, we just clear all entries for this file and let
         * them be lazily rebuilt later.
         */
        if(count($updateTransaction['groups']) > 0)
            SnapPermissionCache::clearCache($type, $parentId);

        $committed[$parentId . $type] = true;

        /* To save the overhead of using PHP methods to list children, we use
         * nonce-queries to get a listing of children of this object and then recursively
         * call this method on each child
         */
        if($type == 'Directory' && $cascade) {
            $query = 'SELECT childId FROM DirectoryLink WHERE parentId = ' . $parentId;
            if(($result = SnapDBI::query($query, true)) === false)
                return false;
            foreach($result as $row) {
                if(isset($committed[$row['childId'] . 'Directory']))
                    continue;
                $ret = $this->doCommit($row['childId'], 'Directory', $updateTransaction, true, $committed);
                if(!$ret)
                    return false;
            }
            $query = 'SELECT childId FROM ResourceLink WHERE parentId = ' . $parentId;
            if(($result = SnapDBI::query($query, true)) === false)
                return false;
            foreach($result as $row) {
                if(isset($committed[$row['childId'] . 'Resource']))
                    continue;
                $ret = $this->doCommit($row['childId'], 'Resource', $updateTransaction, true, $committed);
                if(!$ret)
                    return false;
            }
        }

        return true;
    }

    protected function clearPermObjects() {
        $this->set('permObjects', array());
        $this->set('cache', array());
    }

    public function cancel() {
        $this->updateTransaction = null;
        return true;
    }

    /*
     * General Permission Functions
     *
     * These only check permissions, they do not determine if some other constraint fails.  Use the 'canXxx' methods from
     * SnapFile, SnapDirectory and SnapResource instead to find out about those constraints.  Those methods call the 'mayXxx'
     * methods, so you should use one or the other to avoid unnecessary overhead.
     */

    // Apply to SnapFile

    public function mayLinkTo($to, $uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        $toObj = self::convertReference($to, 'Directory');
        if(!$toObj) {
            $this->setError('Invalid Snap reference');
            return false;
        }

        if($toObj->getPermission()->has('Create' . $this->get('file')->getType(), $uid))
            return true;

        return false;
    }

    public function mayUnlinkFrom($from, $uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        $fromObj = self::convertReference($from, 'Directory');
        if(!$fromObj) {
            $this->setError('Invalid Snap reference');
            return false;
        }

        if($fromObj->getPermission()->has('Delete' . $this->get('file')->getType(), $uid))
            return true;

        return false;
    }

    public function mayRenameAt($at, $uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        $atObj = self::convertReference($at, 'Directory');
        if(!$atObj) {
            $this->setError('Invalid Snap reference');
            return false;
        }

        if($atObj->getPermission()->has('RenameFile', $uid))
            return true;

        return false;
    }

    public function maySetCanonicalParent($newParent, $uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        $newParentObj = self::convertReference($newParent, 'Directory');
        if(!$newParentObj) {
            $this->setError('Invalid Snap reference');
            return false;
        }

        $file = $this->get('file');
        $type = $file->getType();
        $oldParent = $file->getCanonicalParent();
        if($oldParent == null) {
            $this->setError('Internal Snap error: canonical parent is null, but we are not root or DELETED');
            return false;
        }

        if($oldParent->getPermission()->has('MoveFile', $uid) &&
            $newParentObj->getPermission()->has('MoveFile', $uid))
            return true;

        return false;
    }

    public function mayMove($newParent, $uid = '') {
        return $this->maySetCanonicalParent($newParent, $uid);
    }

    public function mayDelete($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;
            
        $fileType = $this->get('file')->getType();
        
        if ($fileType == 'Resource'){
            if($this->has('DeleteUnlink'. $fileType, $uid))
                return true;
        }
        
        if ($fileType == 'Directory'){
            if($this->has('Delete'. $fileType, $uid))
                return true;
        }

        return false;
    }

    public function mayRestore($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_RESTORE, $uid)
            || self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        return false;
    }

    public function mayDestroy($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_DESTROY, $uid)
            || self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        return false;
    }

    public function mayReorderIn($in, $uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        $inObj = self::convertReference($in, 'Directory');
        if(!$inObj) {
            $this->setError('Invalid Snap reference');
            return false;
        }

        if($inObj->getPermission()->has('ReorderFile', $uid))
            return true;

        return false;
    }

    public function mayReorderFiles($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('ReorderFile', $uid))
            return true;

        return false;
    }

    public function mayRenameFiles($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('RenameFile', $uid))
            return true;

        return false;
    }

    public function mayChangeMetadata($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('ChangeFileMetadata', $uid))
            return true;

        return false;
    }

    // Apply to SnapDirectory

    public function mayCreateDirectory($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('CreateDirectory', $uid))
            return true;

        return false;
    }

    public function mayCreateResource($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('CreateResource', $uid))
            return true;

        return false;
    }

    // Apply to SnapResource

    public function mayCreateVersion($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('CreateVersion', $uid))
            return true;

        return false;
    }

    // Apply to SnapVersion

    public function mayUpdate($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('UpdateVersion', $uid))
            return true;

        return false;
    }

    public function maySubmit($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('SubmitVersion', $uid))
            return true;

        return false;
    }

    public function mayApproveForDev($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('ApproveVersionDev', $uid))
            return true;

        return false;
    }

    public function mayApproveForLive($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('ApproveVersionLive', $uid))
            return true;

        return false;
    }

    public function mayDefunct($status, $uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        switch($status) {
            case SnapVersion::STATUS_PRIVATE:
                if($this->has('UpdateVersion', $uid) &&
                    $this->has('DefunctVersion', $uid))
                    return true;
                break;
            case SnapVersion::STATUS_PENDING:
                if($this->has('SubmitVersion', $uid) &&
                    $this->has('DefunctVersion', $uid))
                    return true;
                break;
            case SnapVersion::STATUS_DEV:
                if($this->has('ApproveVersionDev', $uid) &&
                    $this->has('DefunctVersion', $uid))
                    return true;
                break;
            case SnapVersion::STATUS_LIVE:
                if($this->has('ApproveVersionLive', $uid) &&
                    $this->has('DefunctVersion', $uid))
                    return true;
                break;
        }

        return false;
    }

    public function mayDestroyVersion($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid)
            || self::isSpecialUser(self::USER_DESTROY, $uid))
            return true;

        if($this->has('DestroyVersion', $uid))
            return true;

        return false;
    }

    public function mayDeny($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('DenyVersion', $uid))
            return true;

        return false;
    }

    public function maySteal($uid = '') {
        if(!$this->checkValid()) return false;

        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::isSpecialUser(self::USER_ADMIN, $uid))
            return true;

        if($this->has('StealVersion', $uid))
            return true;

        return false;
    }

    /*
     * Special privileges (static methods)
     */

    public static function isSpecialUser($role, $uid = '') {
        if($uid == '')
            $uid = Snap2::getCurrentUser();

        if(self::$SPECIAL_USERS == null)
            self::loadSpecialUsers();

        return isset(self::$SPECIAL_USERS[$uid][$role]);
    }

    public static function listSpecialUsers() {
        if(self::$SPECIAL_USERS == null)
            self::loadSpecialUsers();

        return self::$SPECIAL_USERS;
    }

    public static function grantPrivilege($role, $uid) {
        if(self::$SPECIAL_USERS == null)
            self::loadSpecialUsers();

        if(!isset(self::$SPECIAL_USERS[Snap2::getCurrentUser()][self::USER_ADMIN])) {
            self::setStaticError('You do not have the privilege to grant other users privileges');
            return false;
        }

        if($role != self::USER_ADMIN && $role != self::USER_DESTROY && $role != self::USER_RESTORE) {
            self::setStaticError('Invalid role');
            return false;
        }

        if(isset(self::$SPECIAL_USERS[$uid][$role]))
            return true;

        SnapCache::clearObjectCache('DirectoryUserPermission');
        SnapCache::clearObjectCache('DirectoryGroupPermission');
        SnapCache::clearObjectCache('ResourceUserPermission');
        SnapCache::clearObjectCache('ResourceGroupPermission');
        $permObjects = SnapCache::getObjectCache('Permission');
        foreach($permObjects as $p)
            $p->clearPermObjects();

        SnapDBI::startTransaction();
        $query = "INSERT INTO SpecialUsers (uid, role) VALUES ('$uid', '$role')";
        if(!SnapDBI::query($query)) {
            SnapDBI::cancelTransaction();
            self::setStaticError('Invalid query');
            return false;
        }
        SnapPermissionCache::clearAll();
        SnapDBI::commitTransaction();

        if(!isset(self::$SPECIAL_USERS[$uid]))
            self::$SPECIAL_USERS[$uid] = array();
        self::$SPECIAL_USERS[$uid][$role] = true;

        return true;
    }

    public static function revokePrivilege($role, $uid) {
        if(self::$SPECIAL_USERS == null)
            self::loadSpecialUsers();

        if(!isset(self::$SPECIAL_USERS[Snap2::getCurrentUser()][self::USER_ADMIN])) {
            self::setStaticError('You do not have the privilege to grant other users privileges');
            return false;
        }

        if($uid == Snap2::getCurrentUser() && $role == self::USER_ADMIN) {
            self::setStaticError('You cannot revoke your own admin privileges');
            return false;
        }

        if($role != self::USER_ADMIN && $role != self::USER_DESTROY && $role != self::USER_RESTORE) {
            self::setStaticError('Invalid role');
            return false;
        }

        if(!isset(self::$SPECIAL_USERS[$uid][$role]))
            return true;

        SnapCache::clearObjectCache('DirectoryUserPermission');
        SnapCache::clearObjectCache('DirectoryGroupPermission');
        SnapCache::clearObjectCache('ResourceUserPermission');
        SnapCache::clearObjectCache('ResourceGroupPermission');
        $permObjects = SnapCache::getObjectCache('Permission');
        foreach($permObjects as $p)
            $p->clearPermObjects();

        SnapDBI::startTransaction();
        $query = "DELETE FROM SpecialUsers WHERE uid = '$uid' AND role = '$role'";
        if(!SnapDBI::query($query)) {
            SnapDBI::cancelTransaction();
            self::setStaticError('Invalid query');
            return false;
        }
        SnapPermissionCache::clearAll();
        SnapDBI::commitTransaction();

        unset(self::$SPECIAL_USERS[$uid][$role]);

        return true;
    }

    private static function loadSpecialUsers() {
        $query = "SELECT uid, role FROM SpecialUsers";
        if(!SnapDBI::query($query)) {
            self::setStaticError('Failed to load special users');
            return false;
        }

        self::$SPECIAL_USERS = array();
        $numRows = SnapDBI::getNumRows();
        for($i = 0; $i < $numRows; $i++) {
            $row = SnapDBI::getRow();
            if(isset(self::$SPECIAL_USERS[$row['uid']]))
                self::$SPECIAL_USERS[$row['uid']][$row['role']] = true;
            else
                self::$SPECIAL_USERS[$row['uid']] = array($row['role'] => true);
        }
        SnapDBI::freeResult();

        return true;
    }

    public static function getCapabilities($type) {
        return SnapPermissionObject::getCapabilities($type);
    }

    public static function getCapabilityDescriptions($type) {
        return SnapPermissionObject::getCapabilityDescriptions($type);
    }
}

?>

---