PrivilegeManager
in package
Queries the user's RBAC privileges over the shared `cms_system_user_role*` tables.
Uses the DBAL connection directly (set-based, no ORM hydration) because the queries are purely
read-only ("does any of the user's roles allow the key?"). The admin entry key is :Admin
(see canAccessAdmin()).
All methods are fail-closed: any DB error is logged through Tracy and denied (false or an empty array), so an error can never grant access by accident.
Table of Contents
Constants
- ADMIN_ACCESS_KEY : mixed = ':Admin'
Properties
- $connection : Connection
- $privilegeCache : array<int, array<int, string>>
Methods
- __construct() : mixed
- canAccessAdmin() : bool
- Returns whether the user has the admin entry privilege (key `:Admin`).
- getUserPrivileges() : array<int, string>
- Loads all privilege keys where the user has `allowed = true` through at least one of the user's roles.
- hasPrivilege() : bool
- Returns true when at least one of the user's roles has `allowed = true` for the key.
Constants
ADMIN_ACCESS_KEY
public
mixed
ADMIN_ACCESS_KEY
= ':Admin'
Properties
$connection read-only
private
Connection
$connection
$privilegeCache
private
array<int, array<int, string>>
$privilegeCache
= []
per-request cache of privilege keys by user id
Methods
__construct()
public
__construct(Connection $connection) : mixed
Parameters
- $connection : Connection
canAccessAdmin()
Returns whether the user has the admin entry privilege (key `:Admin`).
public
canAccessAdmin(int $userId) : bool
Parameters
- $userId : int
Return values
boolgetUserPrivileges()
Loads all privilege keys where the user has `allowed = true` through at least one of the user's roles.
public
getUserPrivileges(int $userId) : array<int, string>
Parameters
- $userId : int
Return values
array<int, string>hasPrivilege()
Returns true when at least one of the user's roles has `allowed = true` for the key.
public
hasPrivilege(int $userId, string $key) : bool
Parameters
- $userId : int
- $key : string