PermissionsLoader
in package
Core RBAC security engine for KMP permission validation.
Validates permissions through member roles, temporal boundaries, warrant requirements, and policy framework integration. Implements multi-tier caching for performance.
Tags
Table of Contents
Methods
- getApplicationPolicies() : array<string|int, mixed>
- Discover Application Policy Classes and Methods
- getMembersWithPermissionsQuery() : SelectQuery
- Get query for members with specific permission in branch context.
- getPermissions() : array<string|int, mixed>
- Get complete permissions set for member.
- getPolicies() : array<string|int, mixed>
- Get policy framework mappings for member.
- getRoles() : array<int, object>
- Get the active roles held by a member, with branch scope.
- getServicePrincipalPermissions() : array<string|int, mixed>
- Get complete permissions set for a service principal.
- getServicePrincipalPolicies() : array<string|int, mixed>
- Get policy framework mappings for a service principal.
- validPermissionClauses() : SelectQuery
- Apply comprehensive permission validation chain.
- addGrantSource() : void
- Add a grant source to an accumulated permission object.
- buildBranchScopeIds() : array<string|int, int>|null
- Build branch IDs granted by one role assignment for a permission scope.
- buildGrantSources() : array<int, object>
- Build the grant-source list for a role assignment.
- mergeGrantSources() : void
- Merge grant sources from a permission into a policy method object.
Methods
getApplicationPolicies()
Discover Application Policy Classes and Methods
public
static getApplicationPolicies() : array<string|int, mixed>
Scans application and plugin directories for policy classes and discovers their authorization methods. Returns mapping of policy classes to method arrays.
Return values
array<string|int, mixed> —Policy class to methods mapping
getMembersWithPermissionsQuery()
Get query for members with specific permission in branch context.
public
static getMembersWithPermissionsQuery(int $permissionId, int $branch_id) : SelectQuery
Reverse permission lookup - finds all members who have a permission. Respects permission scoping rules (global, branch-only, branch-and-children).
Parameters
- $permissionId : int
-
The permission ID to search for
- $branch_id : int
-
The branch context for scoped permission checking
Return values
SelectQuery —Query object ready for execution or further modification
getPermissions()
Get complete permissions set for member.
public
static getPermissions(int $memberId) : array<string|int, mixed>
Loads all permissions with role validation, temporal boundaries, and policy integration.
Results are cached with key member_permissions{memberId}.
Parameters
- $memberId : int
-
The member ID to load permissions for
Return values
array<string|int, mixed> —Associative array of permission objects indexed by permission ID
getPolicies()
Get policy framework mappings for member.
public
static getPolicies(int $id[, array<string|int, mixed>|null $branchIds = null ]) : array<string|int, mixed>
Extracts policy class/method mappings from permissions with branch scoping support.
Results are cached with key permissions_policies{memberId}.
Parameters
- $id : int
-
Member ID to get policies for
- $branchIds : array<string|int, mixed>|null = null
-
Optional array of branch IDs to filter policies by
Return values
array<string|int, mixed> —Nested array of policy classes, methods, and authorization data
getRoles()
Get the active roles held by a member, with branch scope.
public
static getRoles(int $memberId) : array<int, object>
Companion to self::getPermissions() so callers can resolve a member's
roles (and the branches each role is assigned in) through the same cached,
temporally-validated path instead of querying member_roles directly. Only
current (started, not expired) and non-revoked role assignments are returned.
Roles have no scoping rule of their own, so branch_ids lists the exact
branch(es) where the member holds the role. Use a coverage check such as
in_array($branchId, $role->branch_ids, true) to test a branch-scoped match.
Results are cached with key member_roles{memberId} in the member_permissions
config (security group), so role/permission/member-role writes invalidate them
alongside self::getPermissions().
Parameters
- $memberId : int
-
The member ID to load roles for.
Return values
array<int, object> —Role objects keyed by role ID: {id, name, branch_ids}.
getServicePrincipalPermissions()
Get complete permissions set for a service principal.
public
static getServicePrincipalPermissions(int $servicePrincipalId) : array<string|int, mixed>
Loads all permissions through ServicePrincipalRoles with role validation and
temporal boundaries. Similar to getPermissions() but for service principals.
Results are cached with key sp_permissions_{servicePrincipalId}.
Parameters
- $servicePrincipalId : int
-
The service principal ID to load permissions for
Return values
array<string|int, mixed> —Associative array of permission objects indexed by permission ID
getServicePrincipalPolicies()
Get policy framework mappings for a service principal.
public
static getServicePrincipalPolicies(int $servicePrincipalId[, array<string|int, mixed>|null $branchIds = null ]) : array<string|int, mixed>
Similar to getPolicies() but for service principals.
Results are cached with key sp_policies_{servicePrincipalId}.
Parameters
- $servicePrincipalId : int
-
Service principal ID
- $branchIds : array<string|int, mixed>|null = null
-
Optional branch IDs to filter policies
Return values
array<string|int, mixed> —Nested array of policy classes, methods, and authorization data
validPermissionClauses()
Apply comprehensive permission validation chain.
protected
static validPermissionClauses(SelectQuery $q) : SelectQuery
Core RBAC security logic validating: role temporal boundaries, membership status, background checks, age restrictions, and warrant requirements (when enabled). Used by all permission checking operations for consistent validation.
Parameters
- $q : SelectQuery
-
Base query to apply validation clauses to
Return values
SelectQuery —Query with validation chain applied
addGrantSource()
Add a grant source to an accumulated permission object.
private
static addGrantSource(object $target, string|null $entityType, int|null $entityId[, array<string|int, int>|null $branchIds = null ]) : void
Parameters
- $target : object
-
Permission or policy object receiving sources
- $entityType : string|null
-
Entity type recorded on the role assignment
- $entityId : int|null
-
Entity ID recorded on the role assignment
- $branchIds : array<string|int, int>|null = null
-
Branch IDs granted by this source, or null for global scope
buildBranchScopeIds()
Build branch IDs granted by one role assignment for a permission scope.
private
static buildBranchScopeIds(Table $branchTable, string $scopingRule, int|null $branchId) : array<string|int, int>|null
Parameters
- $branchTable : Table
-
Branch table used for descendant lookup
- $scopingRule : string
-
Permission scoping rule
- $branchId : int|null
-
Role-assignment branch ID
Return values
array<string|int, int>|null —Null means global branch scope
buildGrantSources()
Build the grant-source list for a role assignment.
private
static buildGrantSources(string|null $entityType, int|null $entityId[, array<string|int, int>|null $branchIds = null ]) : array<int, object>
Parameters
- $entityType : string|null
-
Entity type recorded on the role assignment
- $entityId : int|null
-
Entity ID recorded on the role assignment
- $branchIds : array<string|int, int>|null = null
-
Branch IDs granted by this source, or null for global scope
Return values
array<int, object>mergeGrantSources()
Merge grant sources from a permission into a policy method object.
private
static mergeGrantSources(object $target, object $permission) : void
Parameters
- $target : object
-
Policy method object receiving sources
- $permission : object
-
Permission object providing sources