# Copyright (C) 2012-2024 Zammad Foundation, https://zammad-foundation.org/ class Role < ApplicationModel include HasDefaultModelUserRelations include CanBeImported include HasActivityStreamLog include ChecksClientNotification include ChecksHtmlSanitized include HasGroups include HasCollectionUpdate include Role::Assets has_and_belongs_to_many :users, after_add: :cache_update, after_remove: :cache_update has_and_belongs_to_many :permissions, before_add: %i[validate_agent_limit_by_permission validate_permissions], after_add: %i[cache_update cache_add_kb_permission], before_remove: :last_admin_check_by_permission, after_remove: %i[cache_update cache_remove_kb_permission] validates :name, presence: true, uniqueness: { case_sensitive: false } store :preferences has_many :knowledge_base_permissions, class_name: 'KnowledgeBase::Permission', dependent: :destroy before_save :cleanup_groups_if_not_agent before_create :check_default_at_signup_permissions before_update :last_admin_check_by_attribute, :validate_agent_limit_by_attributes, :check_default_at_signup_permissions # workflow checks should run after before_create and before_update callbacks include ChecksCoreWorkflow core_workflow_screens 'create', 'edit' # ignore Users because this will lead to huge # results for e.g. the Customer role association_attributes_ignored :users activity_stream_permission 'admin.role' validates :note, length: { maximum: 250 } sanitized_html :note =begin grant permission to role role.permission_grant('permission.key') =end def permission_grant(key) permission = Permission.lookup(name: key) raise "Invalid permission #{key}" if !permission return true if permission_ids.include?(permission.id) self.permission_ids = permission_ids.push permission.id # rubocop:disable Style/RedundantSelfAssignment true end =begin revoke permission of role role.permission_revoke('permission.key') =end def permission_revoke(key) permission = Permission.lookup(name: key) raise "Invalid permission #{key}" if !permission return true if permission_ids.exclude?(permission.id) self.permission_ids = self.permission_ids -= [permission.id] true end =begin get signup roles Role.signup_roles returns [role1, role2, ...] =end def self.signup_roles Role.where(active: true, default_at_signup: true) end =begin get signup role ids Role.signup_role_ids returns [role1, role2, ...] =end def self.signup_role_ids signup_roles.map(&:id) end =begin get all roles with permission roles = Role.with_permissions('admin.session') get all roles with permission "admin.session" or "ticket.agent" roles = Role.with_permissions(['admin.session', 'ticket.agent']) returns [role1, role2, ...] =end def self.with_permissions(keys) permission_ids = Role.permission_ids_by_name(keys) Role.joins(:permissions_roles).joins(:permissions).where( 'permissions_roles.permission_id IN (?) AND roles.active = ? AND permissions.active = ?', permission_ids, true, true ).distinct end =begin check if roles is with permission role = Role.find(123) role.with_permission?('admin.session') get if role has permission of "admin.session" or "ticket.agent" role.with_permission?(['admin.session', 'ticket.agent']) returns true | false =end def with_permission?(keys) permission_ids = Role.permission_ids_by_name(keys) return true if Role.joins(:permissions_roles).joins(:permissions).where( 'roles.id = ? AND permissions_roles.permission_id IN (?) AND permissions.active = ?', id, permission_ids, true ).distinct.count.nonzero? false end def self.permission_ids_by_name(keys) Array(keys).each_with_object([]) do |key, result| ::Permission.with_parents(key).each do |local_key| permission = ::Permission.lookup(name: local_key) next if !permission result.push permission.id end end end private def validate_permissions(permission) Rails.logger.debug { "self permission: #{permission.id}" } raise "Permission #{permission.name} is disabled" if permission.preferences[:disabled] permission.preferences[:not] &.find { |name| name.in?(permissions.map(&:name)) } &.tap { |conflict| raise "Permission #{permission} conflicts with #{conflict}" } permissions.find { |p| p.preferences[:not]&.include?(permission.name) } &.tap { |conflict| raise "Permission #{permission} conflicts with #{conflict}" } end def last_admin_check_by_attribute return true if !will_save_change_to_attribute?('active') return true if active != false return true if !with_permission?(['admin', 'admin.user']) raise Exceptions::UnprocessableEntity, __('At least one user needs to have admin permissions.') if last_admin_check_admin_count < 1 true end def last_admin_check_by_permission(permission) return true if Setting.get('import_mode') return true if permission.name != 'admin' && permission.name != 'admin.user' raise Exceptions::UnprocessableEntity, __('At least one user needs to have admin permissions.') if last_admin_check_admin_count < 1 true end def last_admin_check_admin_count admin_role_ids = Role.joins(:permissions).where(permissions: { name: ['admin', 'admin.user'], active: true }, roles: { active: true }).where.not(id: id).pluck(:id) User.joins(:roles).where(roles: { id: admin_role_ids }, users: { active: true }).distinct.count end def validate_agent_limit_by_attributes return true if Setting.get('system_agent_limit').blank? return true if !will_save_change_to_attribute?('active') return true if active != true return true if !with_permission?('ticket.agent') ticket_agent_role_ids = Role.joins(:permissions).where(permissions: { name: 'ticket.agent', active: true }, roles: { active: true }).pluck(:id) currents = User.joins(:roles).where(roles: { id: ticket_agent_role_ids }, users: { active: true }).distinct.pluck(:id) news = User.joins(:roles).where(roles: { id: id }, users: { active: true }).distinct.pluck(:id) count = currents.concat(news).uniq.count raise Exceptions::UnprocessableEntity, __('Agent limit exceeded, please check your account settings.') if count > Setting.get('system_agent_limit').to_i true end def validate_agent_limit_by_permission(permission) return true if Setting.get('system_agent_limit').blank? return true if active != true return true if permission.active != true return true if permission.name != 'ticket.agent' ticket_agent_role_ids = Role.joins(:permissions).where(permissions: { name: 'ticket.agent' }, roles: { active: true }).pluck(:id) ticket_agent_role_ids.push(id) count = User.joins(:roles).where(roles: { id: ticket_agent_role_ids }, users: { active: true }).distinct.count raise Exceptions::UnprocessableEntity, __('Agent limit exceeded, please check your account settings.') if count > Setting.get('system_agent_limit').to_i true end def check_default_at_signup_permissions return true if !default_at_signup forbidden_permissions = permissions.reject(&:allow_signup) return true if forbidden_permissions.blank? raise Exceptions::UnprocessableEntity, "Cannot set default at signup when role has #{forbidden_permissions.join(', ')} permissions." end def cache_add_kb_permission(permission) return if !permission.name.starts_with? 'knowledge_base.' return if !KnowledgeBase.granular_permissions? KnowledgeBase::Category.all.each(&:touch) end def cache_remove_kb_permission(permission) return if !permission.name.starts_with? 'knowledge_base.' return if !KnowledgeBase.granular_permissions? has_editor = permissions.where(name: 'knowledge_base.editor').any? has_reader = permissions.where(name: 'knowledge_base.reader').any? KnowledgeBase::Permission .where(role: self) .each do |elem| if !has_editor && !has_reader elem.destroy! elsif !has_editor && has_reader elem.update!(access: 'reader') if elem.access == 'editor' end end KnowledgeBase::Category.all.each(&:touch) end def cleanup_groups_if_not_agent # #with_permissions? SQL-based check does not work on to-be-saved permissions # using application-side check instead return if permissions.any? { |elem| elem.name == 'ticket.agent' } groups.clear end end