From 58bb96ae46855042fbbef3278222b02546c0fe46 Mon Sep 17 00:00:00 2001 From: mainframe98 Date: Wed, 24 Sep 2025 17:53:19 +0000 Subject: [PATCH] Conpherence: Add a capability to restrict room creation Summary: This capability controls which users are allowed to create rooms. By default anyone is allowed to do so, similar to how it was before. Closes T16021 Test Plan: * Change the policy for room creation in Conpherence to Administrators * Sign-in with a non administrator * Go to conpherence and see that "Create a Room" is greyed out * Click on "Create a Room" and see an error message warning about insufficient permissions Reviewers: O1 Blessed Committers, avivey Reviewed By: O1 Blessed Committers, avivey Subscribers: avivey, tobiaswiese, valerio.bozzolan, Matthew, Cigaryno Maniphest Tasks: T16021 Differential Revision: https://we.phorge.it/D26375 --- src/__phutil_library_map__.php | 2 ++ src/applications/conpherence/application/PhabricatorConpherenceApplication.php | 8 ++++++++ src/applications/conpherence/capability/ConpherenceCreateRoomCapability.php | 16 ++++++++++++++++ src/applications/conpherence/controller/ConpherenceRoomEditController.php | 6 ++++++ src/applications/conpherence/editor/ConpherenceEditEngine.php | 5 +++++ src/applications/conpherence/view/ConpherenceThreadListView.php | 19 +++++++++++++++++++ 6 file(s) changed, 56 insertion(s)(+), 0 deletion(s)(-) diff --git a/src/__phutil_library_map__.php b/src/__phutil_library_map__.php --- a/src/__phutil_library_map__.php +++ b/src/__phutil_library_map__.php @@ -379,6 +379,7 @@ 'ConpherenceConduitAPIMethod' => 'applications/conpherence/conduit/ConpherenceConduitAPIMethod.php', 'ConpherenceConstants' => 'applications/conpherence/constants/ConpherenceConstants.php', 'ConpherenceController' => 'applications/conpherence/controller/ConpherenceController.php', + 'ConpherenceCreateRoomCapability' => 'applications/conpherence/capability/ConpherenceCreateRoomCapability.php', 'ConpherenceCreateThreadConduitAPIMethod' => 'applications/conpherence/conduit/ConpherenceCreateThreadConduitAPIMethod.php', 'ConpherenceDAO' => 'applications/conpherence/storage/ConpherenceDAO.php', 'ConpherenceDurableColumnView' => 'applications/conpherence/view/ConpherenceDurableColumnView.php', @@ -6403,6 +6404,7 @@ 'ConpherenceConduitAPIMethod' => 'ConduitAPIMethod', 'ConpherenceConstants' => 'Phobject', 'ConpherenceController' => 'PhabricatorController', + 'ConpherenceCreateRoomCapability' => 'PhabricatorPolicyCapability', 'ConpherenceCreateThreadConduitAPIMethod' => 'ConpherenceConduitAPIMethod', 'ConpherenceDAO' => 'PhabricatorLiskDAO', 'ConpherenceDurableColumnView' => 'AphrontTagView', diff --git a/src/applications/conpherence/application/PhabricatorConpherenceApplication.php b/src/applications/conpherence/application/PhabricatorConpherenceApplication.php --- a/src/applications/conpherence/application/PhabricatorConpherenceApplication.php +++ b/src/applications/conpherence/application/PhabricatorConpherenceApplication.php @@ -76,6 +76,14 @@ ); } + protected function getCustomCapabilities() { + return array( + ConpherenceCreateRoomCapability::CAPABILITY => array( + 'default' => PhabricatorPolicies::POLICY_USER, + ), + ); + } + public function getMailCommandObjects() { // TODO: Conpherence threads don't currently support any commands directly, diff --git a/src/applications/conpherence/capability/ConpherenceCreateRoomCapability.php b/src/applications/conpherence/capability/ConpherenceCreateRoomCapability.php new file mode 100644 --- /dev/null +++ b/src/applications/conpherence/capability/ConpherenceCreateRoomCapability.php @@ -0,0 +1,16 @@ +getURIData('id'); + if (!$id) { + $this->requireApplicationCapability( + ConpherenceCreateRoomCapability::CAPABILITY); + } + return id(new ConpherenceEditEngine()) ->setController($this) ->buildResponse(); diff --git a/src/applications/conpherence/editor/ConpherenceEditEngine.php b/src/applications/conpherence/editor/ConpherenceEditEngine.php --- a/src/applications/conpherence/editor/ConpherenceEditEngine.php +++ b/src/applications/conpherence/editor/ConpherenceEditEngine.php @@ -61,6 +61,11 @@ return $object->getURI(); } + protected function getCreateNewObjectPolicy() { + return $this->getApplication()->getPolicy( + ConpherenceCreateRoomCapability::CAPABILITY); + } + public function isEngineConfigurable() { return false; } diff --git a/src/applications/conpherence/view/ConpherenceThreadListView.php b/src/applications/conpherence/view/ConpherenceThreadListView.php --- a/src/applications/conpherence/view/ConpherenceThreadListView.php +++ b/src/applications/conpherence/view/ConpherenceThreadListView.php @@ -24,6 +24,13 @@ public function render() { require_celerity_resource('conpherence-menu-css'); + $viewer = $this->getViewer(); + $can_create_room = PhabricatorPolicyFilter::hasCapability( + $viewer, + PhabricatorApplication::getByClass( + PhabricatorConpherenceApplication::class), + ConpherenceCreateRoomCapability::CAPABILITY); + $menu = id(new PHUIListView()) ->addClass('conpherence-menu') ->setID('conpherence-menu'); @@ -43,6 +50,7 @@ ->setType(PHUIListItemView::TYPE_LINK) ->setHref('/conpherence/new/') ->setWorkflow(true) + ->setDisabled(!$can_create_room) ->setName(pht('Create a Room')); $menu->addMenuItem($create_item); } @@ -109,6 +117,13 @@ } private function buildHeaderItemView() { + $viewer = $this->getViewer(); + $can_create_room = PhabricatorPolicyFilter::hasCapability( + $viewer, + PhabricatorApplication::getByClass( + PhabricatorConpherenceApplication::class), + ConpherenceCreateRoomCapability::CAPABILITY); + $rooms = phutil_tag( 'a', array( @@ -125,6 +140,10 @@ ->setMetaData(array( 'tip' => pht('New Room'), )); + + if (!$can_create_room) { + $new_icon->setColor('lightgreytext'); + } $search_icon = id(new PHUIIconView()) ->setIcon('fa-search') -- tangled.sh