369 lines
13 KiB
PHP
369 lines
13 KiB
PHP
<?php
|
||
|
||
declare(strict_types=1);
|
||
|
||
namespace App\Core;
|
||
|
||
use PDO;
|
||
|
||
final class Access
|
||
{
|
||
public const ROLE_AGENT = 'AGENT';
|
||
public const ROLE_RESPONSABLE = 'RESPONSABLE_STRUCTURE';
|
||
public const ROLE_SERVICE = 'SERVICE_ENFANCE';
|
||
|
||
private const SESSION_KEY = 'pta_access';
|
||
|
||
public function __construct(private PDO $pdo)
|
||
{
|
||
if (session_status() !== PHP_SESSION_ACTIVE) {
|
||
session_start();
|
||
}
|
||
}
|
||
|
||
public function isConfigured(): bool
|
||
{
|
||
$role = $this->role();
|
||
if ($role === self::ROLE_AGENT) {
|
||
return $this->agentId() !== null && $this->agentRecord() !== null;
|
||
}
|
||
if ($role === self::ROLE_RESPONSABLE) {
|
||
return $this->structureId() !== null && $this->structureRecord() !== null;
|
||
}
|
||
return $role === self::ROLE_SERVICE;
|
||
}
|
||
|
||
public function role(): ?string
|
||
{
|
||
$role = strtoupper(trim((string) ($_SESSION[self::SESSION_KEY]['role'] ?? '')));
|
||
return in_array($role, [self::ROLE_AGENT, self::ROLE_RESPONSABLE, self::ROLE_SERVICE], true)
|
||
? $role
|
||
: null;
|
||
}
|
||
|
||
public function agentId(): ?int
|
||
{
|
||
$value = filter_var($_SESSION[self::SESSION_KEY]['agent_id'] ?? null, FILTER_VALIDATE_INT, [
|
||
'options' => ['min_range' => 1],
|
||
]);
|
||
return $value === false ? null : (int) $value;
|
||
}
|
||
|
||
public function structureId(): ?int
|
||
{
|
||
if ($this->role() === self::ROLE_AGENT) {
|
||
$agent = $this->agentRecord();
|
||
return isset($agent['id_structure']) && $agent['id_structure'] !== null
|
||
? (int) $agent['id_structure']
|
||
: null;
|
||
}
|
||
|
||
$value = filter_var($_SESSION[self::SESSION_KEY]['structure_id'] ?? null, FILTER_VALIDATE_INT, [
|
||
'options' => ['min_range' => 1],
|
||
]);
|
||
return $value === false ? null : (int) $value;
|
||
}
|
||
|
||
public function select(string $role, ?int $agentId = null, ?int $structureId = null): void
|
||
{
|
||
$role = strtoupper(trim($role));
|
||
if (!in_array($role, [self::ROLE_AGENT, self::ROLE_RESPONSABLE, self::ROLE_SERVICE], true)) {
|
||
throw new \DomainException('Rôle invalide.');
|
||
}
|
||
|
||
$selection = ['role' => $role, 'agent_id' => null, 'structure_id' => null];
|
||
|
||
if ($role === self::ROLE_AGENT) {
|
||
if (!$agentId || !$this->activeAgentExists($agentId)) {
|
||
throw new \DomainException('Sélectionnez un agent actif.');
|
||
}
|
||
$selection['agent_id'] = $agentId;
|
||
} elseif ($role === self::ROLE_RESPONSABLE) {
|
||
if (!$structureId || !$this->activeStructureExists($structureId)) {
|
||
throw new \DomainException('Sélectionnez un lieu d’affectation actif.');
|
||
}
|
||
$selection['structure_id'] = $structureId;
|
||
}
|
||
|
||
$_SESSION[self::SESSION_KEY] = $selection;
|
||
session_regenerate_id(true);
|
||
}
|
||
|
||
public function clear(): void
|
||
{
|
||
unset($_SESSION[self::SESSION_KEY]);
|
||
session_regenerate_id(true);
|
||
}
|
||
|
||
public function profile(): array
|
||
{
|
||
$role = $this->role();
|
||
$permissions = $this->permissions();
|
||
$profile = [
|
||
'role' => $role,
|
||
'role_label' => $this->roleLabel(),
|
||
'label' => $this->roleLabel(),
|
||
'agent_id' => $this->agentId(),
|
||
'structure_id' => $this->structureId(),
|
||
'permissions' => $permissions,
|
||
];
|
||
|
||
if ($role === self::ROLE_AGENT) {
|
||
$agent = $this->agentRecord();
|
||
if ($agent !== null) {
|
||
$profile['label'] = trim((string) $agent['prenom'] . ' ' . (string) $agent['nom']);
|
||
$profile['matricule'] = $agent['matricule'];
|
||
$profile['structure_name'] = $agent['structure_nom'];
|
||
$profile['structure_id'] = $agent['id_structure'] !== null ? (int) $agent['id_structure'] : null;
|
||
}
|
||
} elseif ($role === self::ROLE_RESPONSABLE) {
|
||
$structure = $this->structureRecord();
|
||
if ($structure !== null) {
|
||
$profile['label'] = (string) $structure['nom'];
|
||
$profile['structure_name'] = (string) $structure['nom'];
|
||
$profile['structure_code'] = (string) $structure['code'];
|
||
}
|
||
}
|
||
|
||
return $profile;
|
||
}
|
||
|
||
public function permissions(): array
|
||
{
|
||
$role = $this->role();
|
||
$service = $role === self::ROLE_SERVICE;
|
||
$responsable = $role === self::ROLE_RESPONSABLE;
|
||
|
||
return [
|
||
'read_only' => $role === self::ROLE_AGENT,
|
||
'can_edit_draft' => $service || $responsable,
|
||
'can_edit_cross_structure' => $service,
|
||
'can_validate' => $service,
|
||
'can_reopen' => $service || $responsable,
|
||
'can_use_templates' => $service,
|
||
'can_copy_full_week' => $service,
|
||
'can_view_pending' => $service,
|
||
'can_manage_coverage' => $service,
|
||
'can_manage_agents' => $service,
|
||
'can_manage_structures' => $service,
|
||
'can_manage_vacations' => $service,
|
||
'can_manage_teams' => $service,
|
||
'can_manage_pta' => $service,
|
||
'can_forecast_next_year' => $service,
|
||
];
|
||
}
|
||
|
||
public function allowedPages(): array
|
||
{
|
||
return match ($this->role()) {
|
||
self::ROLE_AGENT => ['agents', 'structures'],
|
||
self::ROLE_RESPONSABLE => ['planning', 'structures', 'agents', 'coverage'],
|
||
self::ROLE_SERVICE => ['planning', 'pending', 'coverage', 'structures', 'agents', 'annual', 'pta', 'teams', 'vacations', 'administration'],
|
||
default => [],
|
||
};
|
||
}
|
||
|
||
public function canAccessPage(string $page): bool
|
||
{
|
||
return in_array($page, $this->allowedPages(), true);
|
||
}
|
||
|
||
public function homeUrl(): string
|
||
{
|
||
return match ($this->role()) {
|
||
self::ROLE_AGENT => 'agents.php?agent_id=' . (int) $this->agentId(),
|
||
self::ROLE_RESPONSABLE => 'planning.php?structure_id=' . (int) $this->structureId(),
|
||
self::ROLE_SERVICE => 'planning.php',
|
||
default => 'role.php',
|
||
};
|
||
}
|
||
|
||
public function requirePage(string $page): void
|
||
{
|
||
if (!$this->isConfigured()) {
|
||
header('Location: role.php', true, 302);
|
||
exit;
|
||
}
|
||
if (!$this->canAccessPage($page)) {
|
||
header('Location: ' . $this->homeUrl() . (str_contains($this->homeUrl(), '?') ? '&' : '?') . 'access_denied=1', true, 302);
|
||
exit;
|
||
}
|
||
}
|
||
|
||
public function requireRoles(array $roles): void
|
||
{
|
||
if (!$this->isConfigured()) {
|
||
JsonResponse::send(401, ['error' => 'Choisissez votre rôle avant de continuer.', 'code' => 'ROLE_REQUIRED']);
|
||
}
|
||
if (!in_array($this->role(), $roles, true)) {
|
||
JsonResponse::send(403, ['error' => 'Votre rôle ne permet pas cette action.', 'code' => 'ACCESS_DENIED']);
|
||
}
|
||
}
|
||
|
||
public function requireService(): void
|
||
{
|
||
$this->requireRoles([self::ROLE_SERVICE]);
|
||
}
|
||
|
||
public function requireDraftEditor(): void
|
||
{
|
||
$this->requireRoles([self::ROLE_RESPONSABLE, self::ROLE_SERVICE]);
|
||
}
|
||
|
||
public function requireStructureView(int $structureId): void
|
||
{
|
||
$this->requireRoles([self::ROLE_AGENT, self::ROLE_RESPONSABLE, self::ROLE_SERVICE]);
|
||
if ($this->role() !== self::ROLE_SERVICE && $this->structureId() !== $structureId) {
|
||
JsonResponse::send(403, ['error' => 'Vous ne pouvez consulter que le planning de votre lieu de rattachement.', 'code' => 'STRUCTURE_SCOPE']);
|
||
}
|
||
}
|
||
|
||
public function requireStructureEdit(int $structureId): void
|
||
{
|
||
$this->requireDraftEditor();
|
||
if ($this->role() === self::ROLE_RESPONSABLE && $this->structureId() !== $structureId) {
|
||
JsonResponse::send(403, ['error' => 'Vous ne pouvez modifier que les brouillons de votre lieu.', 'code' => 'STRUCTURE_SCOPE']);
|
||
}
|
||
}
|
||
|
||
public function requireAgentView(int $agentId): void
|
||
{
|
||
$this->requireRoles([self::ROLE_AGENT, self::ROLE_RESPONSABLE, self::ROLE_SERVICE]);
|
||
if ($this->role() === self::ROLE_SERVICE) {
|
||
return;
|
||
}
|
||
if ($this->role() === self::ROLE_AGENT && $this->agentId() === $agentId) {
|
||
return;
|
||
}
|
||
if ($this->role() === self::ROLE_RESPONSABLE && $this->responsibleCanViewAgent($agentId)) {
|
||
return;
|
||
}
|
||
JsonResponse::send(403, ['error' => 'Vous ne pouvez pas consulter le planning de cet agent.', 'code' => 'AGENT_SCOPE']);
|
||
}
|
||
|
||
public function requireEntryEdit(int $entryId): void
|
||
{
|
||
$this->requireDraftEditor();
|
||
if ($this->role() === self::ROLE_SERVICE) {
|
||
return;
|
||
}
|
||
$stmt = $this->pdo->prepare(
|
||
'SELECT p.id_structure
|
||
FROM creneau_horaire c
|
||
INNER JOIN planning p ON p.id_planning = c.id_planning
|
||
WHERE c.id_creneau = :id LIMIT 1'
|
||
);
|
||
$stmt->execute(['id' => $entryId]);
|
||
$structureId = $stmt->fetchColumn();
|
||
if ($structureId === false) {
|
||
JsonResponse::send(404, ['error' => 'Créneau introuvable.']);
|
||
}
|
||
$this->requireStructureEdit((int) $structureId);
|
||
}
|
||
|
||
public function requirePlanningEdit(int $planningId): void
|
||
{
|
||
$this->requireDraftEditor();
|
||
if ($this->role() === self::ROLE_SERVICE) {
|
||
return;
|
||
}
|
||
$stmt = $this->pdo->prepare('SELECT id_structure FROM planning WHERE id_planning = :id LIMIT 1');
|
||
$stmt->execute(['id' => $planningId]);
|
||
$structureId = $stmt->fetchColumn();
|
||
if ($structureId === false) {
|
||
JsonResponse::send(404, ['error' => 'Planning introuvable.']);
|
||
}
|
||
$this->requireStructureEdit((int) $structureId);
|
||
}
|
||
|
||
public function editableStructureId(): ?int
|
||
{
|
||
return $this->role() === self::ROLE_RESPONSABLE ? $this->structureId() : null;
|
||
}
|
||
|
||
private function roleLabel(): string
|
||
{
|
||
return match ($this->role()) {
|
||
self::ROLE_AGENT => 'Agent',
|
||
self::ROLE_RESPONSABLE => 'Responsable de structure',
|
||
self::ROLE_SERVICE => 'Service Enfance',
|
||
default => 'Rôle non sélectionné',
|
||
};
|
||
}
|
||
|
||
private function activeAgentExists(int $agentId): bool
|
||
{
|
||
$stmt = $this->pdo->prepare('SELECT 1 FROM agent WHERE id_agent = :id AND actif = TRUE LIMIT 1');
|
||
$stmt->execute(['id' => $agentId]);
|
||
return $stmt->fetchColumn() !== false;
|
||
}
|
||
|
||
private function activeStructureExists(int $structureId): bool
|
||
{
|
||
$stmt = $this->pdo->prepare('SELECT 1 FROM structure WHERE id_structure = :id AND actif = TRUE LIMIT 1');
|
||
$stmt->execute(['id' => $structureId]);
|
||
return $stmt->fetchColumn() !== false;
|
||
}
|
||
|
||
private function agentRecord(): ?array
|
||
{
|
||
$agentId = $this->agentId();
|
||
if ($agentId === null) {
|
||
return null;
|
||
}
|
||
$stmt = $this->pdo->prepare(
|
||
'SELECT a.id_agent, a.matricule, a.nom, a.prenom, a.id_structure,
|
||
s.nom AS structure_nom
|
||
FROM agent a
|
||
LEFT JOIN structure s ON s.id_structure = a.id_structure
|
||
WHERE a.id_agent = :id AND a.actif = TRUE LIMIT 1'
|
||
);
|
||
$stmt->execute(['id' => $agentId]);
|
||
return $stmt->fetch() ?: null;
|
||
}
|
||
|
||
private function structureRecord(): ?array
|
||
{
|
||
$structureId = $this->structureId();
|
||
if ($structureId === null) {
|
||
return null;
|
||
}
|
||
$stmt = $this->pdo->prepare(
|
||
'SELECT id_structure, code, nom
|
||
FROM structure
|
||
WHERE id_structure = :id AND actif = TRUE LIMIT 1'
|
||
);
|
||
$stmt->execute(['id' => $structureId]);
|
||
return $stmt->fetch() ?: null;
|
||
}
|
||
|
||
private function responsibleCanViewAgent(int $agentId): bool
|
||
{
|
||
$structureId = $this->structureId();
|
||
if ($structureId === null) {
|
||
return false;
|
||
}
|
||
$stmt = $this->pdo->prepare(
|
||
'SELECT 1
|
||
FROM agent a
|
||
WHERE a.id_agent = :agent_id
|
||
AND a.actif = TRUE
|
||
AND (
|
||
a.id_structure = :structure_id_default
|
||
OR EXISTS (
|
||
SELECT 1 FROM planning p
|
||
WHERE p.id_agent = a.id_agent
|
||
AND p.id_structure = :structure_id_planning
|
||
)
|
||
)
|
||
LIMIT 1'
|
||
);
|
||
$stmt->execute([
|
||
'agent_id' => $agentId,
|
||
'structure_id_default' => $structureId,
|
||
'structure_id_planning' => $structureId,
|
||
]);
|
||
return $stmt->fetchColumn() !== false;
|
||
}
|
||
}
|