RecommendationsTablePolicy
extends BasePolicy
in package
Table-level authorization policy for Recommendations in the Awards plugin.
Implements query scoping based on user approval authority and organizational scope. Supports open recommendation submission and export authorization.
Tags
Table of Contents
Properties
- $activeApprovalWorkflowInstanceIds : array<string|int, int>|null
- Active Awards recommendation approval workflow instance IDs for this request.
- $pendingApprovalRecommendationIdsByMemberId : array<int, array<string|int, int>>
- Current approval recommendation IDs keyed by member ID.
- $workflowVisibleRecommendationIdsByMemberAndPending : array<string, array<string|int, int>>
- Current/prior workflow-visible recommendation IDs keyed by member ID and pending IDs.
Methods
- before() : bool|null
- Check if $user is a super user and can skip auth with an auto True
- canAdd() : bool
- Authorize recommendation creation (open access).
- canDelete() : bool
- Check if $user can delete RolesPermissions
- canEdit() : bool
- Check if $user can edit RolesPermissions
- canExport() : bool
- Authorize recommendation export to CSV.
- canGridData() : bool
- Check if $user can view role
- canIndex() : bool
- Check if $user can view role
- canView() : bool
- Check if $user can view RolesPermissions
- canViewPrivateNotes() : bool
- Check if $user can view hidden
- scopeIndex() : Query
- Apply authorization scoping to recommendation queries.
- _getBranchIdsForPolicy() : array<string|int, mixed>|null
- Check if $user can view hidden
- _getPermissions() : bool
- Check if $user can view hidden
- _getPolicies() : bool
- Check if $user can view hidden
- _grantSourceIncludesBranch() : bool
- Check whether a matching source grants the requested branch.
- _hasPolicy() : bool
- Check if $user can view hidden
- _hasPolicyForUrl() : bool
- Check if $user can view hidden
- _isSuperUser() : bool
- Check if $user is a super user
- _matchesGrantSource() : bool
- Check whether a policy method was granted by a compatible source entity.
- activeApprovalRecommendationIdsQuery() : Query
- Build the active approval-cycle recommendation ID subquery.
- activeApprovalWorkflowInstanceIds() : array<string|int, int>
- Return active Awards recommendation approval workflow instance IDs.
- applyActiveApprovalVisibility() : Query
- Hide active approval-cycle recommendations unless this user has workflow visibility.
- pendingApprovalRecommendationIds() : array<string|int, int>
- Return recommendation IDs where this member is a current approver.
- recommendationIdsForWorkflowInstances() : array<string|int, int>
- Map workflow instance IDs to recommendation IDs.
- workflowVisibleRecommendationIds() : array<string|int, int>
- Return recommendation IDs where this member is a current or prior workflow approver.
Properties
$activeApprovalWorkflowInstanceIds
Active Awards recommendation approval workflow instance IDs for this request.
private
array<string|int, int>|null
$activeApprovalWorkflowInstanceIds
= null
$pendingApprovalRecommendationIdsByMemberId
Current approval recommendation IDs keyed by member ID.
private
array<int, array<string|int, int>>
$pendingApprovalRecommendationIdsByMemberId
= []
$workflowVisibleRecommendationIdsByMemberAndPending
Current/prior workflow-visible recommendation IDs keyed by member ID and pending IDs.
private
array<string, array<string|int, int>>
$workflowVisibleRecommendationIdsByMemberAndPending
= []
Methods
before()
Check if $user is a super user and can skip auth with an auto True
public
before(KmpIdentityInterface $user, mixed $resource, string $action) : bool|null
Parameters
- $user : KmpIdentityInterface
-
The user.
- $resource : mixed
-
The resource.
- $action : string
-
The action.
Return values
bool|nullcanAdd()
Authorize recommendation creation (open access).
public
canAdd(KmpIdentityInterface $user, BaseEntity|Table $entity, mixed ...$optionalArgs) : bool
Parameters
- $user : KmpIdentityInterface
-
The user requesting creation access
- $entity : BaseEntity|Table
-
The target entity or table
- $optionalArgs : mixed
-
Additional authorization arguments
Return values
bool —Always true for open recommendation submission
canDelete()
Check if $user can delete RolesPermissions
public
canDelete(KmpIdentityInterface $user, BaseEntity $entity, mixed ...$optionalArgs) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
- $entity : BaseEntity
- $optionalArgs : mixed
Return values
boolcanEdit()
Check if $user can edit RolesPermissions
public
canEdit(KmpIdentityInterface $user, BaseEntity $entity, mixed ...$optionalArgs) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
- $entity : BaseEntity
- $optionalArgs : mixed
Return values
boolcanExport()
Authorize recommendation export to CSV.
public
canExport(KmpIdentityInterface $user, BaseEntity|Table $entity, mixed ...$optionalArgs) : bool
Delegates to canIndex - users who can list can export.
Parameters
- $user : KmpIdentityInterface
-
The user requesting export access
- $entity : BaseEntity|Table
-
The target entity or table
- $optionalArgs : mixed
-
Additional authorization arguments
Return values
bool —True if user has index permission
canGridData()
Check if $user can view role
public
canGridData(KmpIdentityInterface $user, BaseEntity $entity, mixed ...$optionalArgs) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
- $entity : BaseEntity
- $optionalArgs : mixed
Return values
boolcanIndex()
Check if $user can view role
public
canIndex(KmpIdentityInterface $user, BaseEntity $entity, mixed ...$optionalArgs) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
- $entity : BaseEntity
- $optionalArgs : mixed
Return values
boolcanView()
Check if $user can view RolesPermissions
public
canView(KmpIdentityInterface $user, BaseEntity|Table $entity, mixed ...$optionalArgs) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
- $entity : BaseEntity|Table
- $optionalArgs : mixed
Return values
boolcanViewPrivateNotes()
Check if $user can view hidden
public
canViewPrivateNotes(KmpIdentityInterface $user, BaseEntity $entity) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
- $entity : BaseEntity
Return values
boolscopeIndex()
Apply authorization scoping to recommendation queries.
public
scopeIndex(KmpIdentityInterface $user, Query $query) : Query
Filters recommendations by branch access and approval authority levels. Discovers approval levels from canApproveLevel* permission methods.
Parameters
- $user : KmpIdentityInterface
-
The user requesting data access
- $query : Query
-
The base query to scope
Return values
Query —The scoped query with authorization filtering
_getBranchIdsForPolicy()
Check if $user can view hidden
protected
_getBranchIdsForPolicy(KmpIdentityInterface $user, string $policyMethod) : array<string|int, mixed>|null
Parameters
- $user : KmpIdentityInterface
-
The user.
- $policyMethod : string
Return values
array<string|int, mixed>|null_getPermissions()
Check if $user can view hidden
protected
_getPermissions(KmpIdentityInterface $user) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
Return values
bool_getPolicies()
Check if $user can view hidden
protected
_getPolicies(KmpIdentityInterface $user) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
Return values
bool_grantSourceIncludesBranch()
Check whether a matching source grants the requested branch.
protected
_grantSourceIncludesBranch(object $source, int|null $branchId) : bool
Parameters
- $source : object
-
Matching grant source
- $branchId : int|null
-
Branch context for the authorization check
Return values
bool_hasPolicy()
Check if $user can view hidden
protected
_hasPolicy(KmpIdentityInterface $user, string $policyMethod, BaseEntity|Table $entity[, int|null $branchId = null ][, mixed $grantSource = null ]) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
- $policyMethod : string
- $entity : BaseEntity|Table
- $branchId : int|null = null
- $grantSource : mixed = null
Return values
bool_hasPolicyForUrl()
Check if $user can view hidden
protected
_hasPolicyForUrl(KmpIdentityInterface $user, string $policyMethod, array<string|int, mixed> $urlProps[, int|null $branchId = null ][, mixed $grantSource = null ]) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
- $policyMethod : string
- $urlProps : array<string|int, mixed>
- $branchId : int|null = null
- $grantSource : mixed = null
Return values
bool_isSuperUser()
Check if $user is a super user
protected
_isSuperUser(KmpIdentityInterface $user) : bool
Parameters
- $user : KmpIdentityInterface
-
The user.
Return values
bool_matchesGrantSource()
Check whether a policy method was granted by a compatible source entity.
protected
_matchesGrantSource(object $policyMethodData, object $grantSource[, int|null $branchId = null ]) : bool
Parameters
- $policyMethodData : object
-
Policy method authorization data
- $grantSource : object
-
Source entity being checked
- $branchId : int|null = null
-
Branch context for the authorization check
Return values
boolactiveApprovalRecommendationIdsQuery()
Build the active approval-cycle recommendation ID subquery.
private
activeApprovalRecommendationIdsQuery() : Query
Return values
QueryactiveApprovalWorkflowInstanceIds()
Return active Awards recommendation approval workflow instance IDs.
private
activeApprovalWorkflowInstanceIds() : array<string|int, int>
Return values
array<string|int, int>applyActiveApprovalVisibility()
Hide active approval-cycle recommendations unless this user has workflow visibility.
private
applyActiveApprovalVisibility(Query $query, array<string|int, int> $workflowVisibleRecommendationIds) : Query
Parameters
- $query : Query
-
Query being scoped.
- $workflowVisibleRecommendationIds : array<string|int, int>
-
Recommendation IDs visible through current/prior workflow approvals.
Return values
QuerypendingApprovalRecommendationIds()
Return recommendation IDs where this member is a current approver.
private
pendingApprovalRecommendationIds(KmpIdentityInterface $user) : array<string|int, int>
Parameters
- $user : KmpIdentityInterface
-
Authenticated member identity.
Return values
array<string|int, int>recommendationIdsForWorkflowInstances()
Map workflow instance IDs to recommendation IDs.
private
recommendationIdsForWorkflowInstances(array<string|int, int> $instanceIds) : array<string|int, int>
Parameters
- $instanceIds : array<string|int, int>
-
Workflow instance IDs.
Return values
array<string|int, int>workflowVisibleRecommendationIds()
Return recommendation IDs where this member is a current or prior workflow approver.
private
workflowVisibleRecommendationIds(KmpIdentityInterface $user, array<string|int, int> $pendingRecommendationIds) : array<string|int, int>
Parameters
- $user : KmpIdentityInterface
-
Authenticated member identity.
- $pendingRecommendationIds : array<string|int, int>
-
Recommendation IDs currently pending for the member.