Manage dashboard access rights per Group and per User

front/itemright.form.php

@@ -0,0 +1,125 @@
+<?php
+
+/**
+ * -------------------------------------------------------------------------
+ * Metabase plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of Metabase.
+ *
+ * Metabase is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Metabase is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Metabase. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2018-2023 by Metabase plugin team.
+ * @license   GPLv2 https://www.gnu.org/licenses/gpl-2.0.html
+ * @link      https://github.com/pluginsGLPI/metabase
+ * -------------------------------------------------------------------------
+ *
+ * CUSTOM FORK NOTICE: added to handle per Group / per User dashboard rights.
+ * -------------------------------------------------------------------------
+ */
+
+function plugin_metabase_check_itemright_access($itemtype)
+{
+    if (!in_array($itemtype, PluginMetabaseItemright::SUPPORTED_ITEMTYPES, true)) {
+        Session::addMessageAfterRedirect(
+            __s('Invalid request.', 'metabase'),
+            false,
+            ERROR,
+        );
+        Html::back();
+    }
+
+    if ($itemtype === Group::class) {
+        Session::checkRight('group', UPDATE);
+    } else {
+        Session::checkRight('user', UPDATE);
+    }
+}
+
+if (isset($_REQUEST['update'])) {
+    if (
+        !array_key_exists('itemtype', $_REQUEST)
+        || empty($_REQUEST['itemtype'])
+        || !array_key_exists('items_id', $_REQUEST)
+        || empty($_REQUEST['items_id'])
+        || !array_key_exists('dashboard', $_REQUEST)
+        || !is_array($_REQUEST['dashboard'])
+    ) {
+        Session::addMessageAfterRedirect(
+            __s('Invalid request.', 'metabase'),
+            false,
+            ERROR,
+        );
+        Html::back();
+    }
+
+    plugin_metabase_check_itemright_access($_REQUEST['itemtype']);
+
+    $viewableDashboardsUuids = [];
+    foreach ($_REQUEST['dashboard'] as $dashboardUuid => $rights) {
+        PluginMetabaseItemright::setDashboardRightsForItem(
+            $_REQUEST['itemtype'],
+            $_REQUEST['items_id'],
+            $dashboardUuid,
+            $rights,
+        );
+
+        if (($rights & READ) !== 0) {
+            $viewableDashboardsUuids[] = $dashboardUuid;
+        }
+    }
+
+    if (!empty($viewableDashboardsUuids)) {
+        $apiclient = new PluginMetabaseAPIClient();
+        $apiclient->enableDashboardsEmbeddedDisplay($viewableDashboardsUuids);
+    }
+} elseif (isset($_REQUEST['set_rights_to_all'])) {
+    if (
+        !array_key_exists('itemtype', $_REQUEST)
+        || empty($_REQUEST['itemtype'])
+        || !array_key_exists('items_id', $_REQUEST)
+        || empty($_REQUEST['items_id'])
+    ) {
+        Session::addMessageAfterRedirect(
+            __s('Invalid request.', 'metabase'),
+            false,
+            ERROR,
+        );
+        Html::back();
+    }
+
+    plugin_metabase_check_itemright_access($_REQUEST['itemtype']);
+
+    $apiclient = new PluginMetabaseAPIClient();
+
+    $viewableDashboardsUuids = [];
+    foreach ($apiclient->getDashboards() as $dashboard) {
+        PluginMetabaseItemright::setDashboardRightsForItem(
+            $_REQUEST['itemtype'],
+            $_REQUEST['items_id'],
+            $dashboard['id'],
+            $_REQUEST['set_rights_to_all'],
+        );
+
+        $viewableDashboardsUuids[] = $dashboard['id'];
+    }
+
+    if ((int) $_REQUEST['set_rights_to_all'] !== 0) {
+        $apiclient->enableDashboardsEmbeddedDisplay($viewableDashboardsUuids);
+    }
+}
+
+Html::back();

inc/dashboard.class.php

@@ -43,6 +43,58 @@ public static function getTypeName($nb = 0)
         return __s('Metabase dashboard', 'metabase');
     }
 
+    /**
+     * Check if the currently logged-in user is able to view at least one
+     * dashboard, combining profile, group and user based rights.
+     *
+     * CUSTOM FORK: rights are additive (OR) across profile / groups / user.
+     *
+     * @return boolean
+     */
+    public static function canCurrentUserViewDashboards(): bool
+    {
+        if (PluginMetabaseProfileright::canProfileViewDashboards($_SESSION['glpiactiveprofile']['id'])) {
+            return true;
+        }
+
+        if (PluginMetabaseItemright::canItemViewDashboards(User::class, Session::getLoginUserID())) {
+            return true;
+        }
+
+        if (PluginMetabaseItemright::canGroupsViewDashboards($_SESSION['glpigroups'] ?? [])) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Check if the currently logged-in user is able to view the given
+     * dashboard, combining profile, group and user based rights.
+     *
+     * rights are additive (OR) across profile / groups / user.
+     *
+     * @param integer $dashboardUuid
+     *
+     * @return boolean
+     */
+    public static function canCurrentUserViewDashboard(int $dashboardUuid): bool
+    {
+        if (PluginMetabaseProfileright::canProfileViewDashboard($_SESSION['glpiactiveprofile']['id'], $dashboardUuid)) {
+            return true;
+        }
+
+        if (PluginMetabaseItemright::canItemViewDashboard(User::class, Session::getLoginUserID(), $dashboardUuid)) {
+            return true;
+        }
+
+        if (PluginMetabaseItemright::canGroupsViewDashboard($_SESSION['glpigroups'] ?? [], $dashboardUuid)) {
+            return true;
+        }
+
+        return false;
+    }
+
     /**
      * {@inheritDoc}
      * @see CommonGLPI::getTabNameForItem()
@@ -51,7 +103,7 @@ public function getTabNameForItem(CommonGLPI $item, $withtemplate = 0)
     {
         switch ($item->getType()) {
             case 'Central':
-                if (PluginMetabaseProfileright::canProfileViewDashboards($_SESSION['glpiactiveprofile']['id'])) {
+                if (self::canCurrentUserViewDashboards()) {
                     return self::createTabEntry(self::getTypeName(), 0, $item::getType(), PluginMetabaseConfig::getIcon());
                 }
 
@@ -69,7 +121,7 @@ public static function displayTabContentForItem(CommonGLPI $item, $tabnum = 1, $
     {
         switch (get_class($item)) {
             case Central::class:
-                if (PluginMetabaseProfileright::canProfileViewDashboards($_SESSION['glpiactiveprofile']['id'])) {
+                if (self::canCurrentUserViewDashboards()) {
                     self::showForCentral($item, $withtemplate);
                 }
 
@@ -99,10 +151,7 @@ public static function showForCentral(Central $item, $withtemplate = 0, $is_help
                 $dashboards,
                 function ($dashboard) {
                     $isEmbeddingEnabled = $dashboard['enable_embedding'];
-                    $canView            = PluginMetabaseProfileright::canProfileViewDashboard(
-                        $_SESSION['glpiactiveprofile']['id'],
-                        $dashboard['id'],
-                    );
+                    $canView            = self::canCurrentUserViewDashboard($dashboard['id']);
 
                     return $isEmbeddingEnabled && $canView;
                 },