Userlogin mit Mandanten gefixt (erster Schritt)

[mfinanz.git] / SL / Auth.pm

diff --git a/SL/Auth.pm b/SL/Auth.pm
index 23a9771e702d1f0e8065542564988ad1d498fb2a..6a69604b6bb2d5773708514b53e9e04903a18a3f 100644 (file)
--- a/SL/Auth.pm
+++ b/SL/Auth.pm
@@ -26,6 +26,11 @@ use strict;
 use constant SESSION_KEY_ROOT_AUTH => 'session_auth_status_root';
 use constant SESSION_KEY_USER_AUTH => 'session_auth_status_user';
 
 use constant SESSION_KEY_ROOT_AUTH => 'session_auth_status_root';
 use constant SESSION_KEY_USER_AUTH => 'session_auth_status_user';
 

+use Rose::Object::MakeMethods::Generic (
+  scalar => [ qw(client) ],
+);
+
+

 sub new {
   $main::lxdebug->enter_sub();
 
 sub new {
   $main::lxdebug->enter_sub();
 


@@ -51,32 +56,25 @@ sub reset {
   $self->{unique_counter}     = 0;
   $self->{column_information} = SL::Auth::ColumnInformation->new(auth => $self);
   $self->{authenticator}->reset;
   $self->{unique_counter}     = 0;
   $self->{column_information} = SL::Auth::ColumnInformation->new(auth => $self);
   $self->{authenticator}->reset;

+
+  $self->client(undef);

 }
 
 }
 

-sub get_user_dbh {
-  my ($self, $login, %params) = @_;
-  my $may_fail = delete $params{may_fail};
-
-  my %user = $self->read_user(login => $login);
-  my $dbh  = SL::DBConnect->connect(
-    $user{dbconnect},
-    $user{dbuser},
-    $user{dbpasswd},
-    {
-      pg_enable_utf8 => $::locale->is_utf8,
-      AutoCommit     => 0
-    }
-  );
+sub set_client {
+  my ($self, $id_or_name) = @_;

 
 

-  if (!$may_fail && !$dbh) {
-    $::form->error($::locale->text('The connection to the authentication database failed:') . "\n" . $DBI::errstr);
-  }
+  $self->client(undef);

 
 

-  if ($user{dboptions} && $dbh) {
-    $dbh->do($user{dboptions}) or $::form->dberror($user{dboptions});
-  }
+  return undef unless $id_or_name;
+
+  my $column = $id_or_name =~ m/^\d+$/ ? 'id' : 'name';
+  my $dbh    = $self->dbconnect;

 
 

-  return $dbh;
+  return undef unless $dbh;
+
+  $self->client($dbh->selectrow_hashref(qq|SELECT * FROM auth.clients WHERE ${column} = ?|, undef, $id_or_name));
+
+  return $self->client;

 }
 
 sub DESTROY {
 }
 
 sub DESTROY {


@@ -144,6 +142,23 @@ sub _read_auth_config {
   $main::lxdebug->leave_sub();
 }
 
   $main::lxdebug->leave_sub();
 }
 

+sub has_access_to_client {
+  my ($self, $login) = @_;
+
+  return 0 if !$self->client || !$self->client->{id};
+
+  my $sql = <<SQL;
+    SELECT cu.client_id
+    FROM auth.clients_users cu
+    LEFT JOIN auth."user" u ON (cu.user_id = u.id)
+    WHERE (u.login      = ?)
+      AND (cu.client_id = ?)
+SQL
+
+  my ($has_access) = $self->dbconnect->selectrow_array($sql, undef, $login, $self->client->{id});
+  return $has_access;
+}
+

 sub authenticate_root {
   $main::lxdebug->enter_sub();
 
 sub authenticate_root {
   $main::lxdebug->enter_sub();
 


@@ -175,6 +190,11 @@ sub authenticate {
 
   my ($self, $login, $password) = @_;
 
 
   my ($self, $login, $password) = @_;
 

+  if (!$self->client || !$self->has_access_to_client($login)) {
+    $::lxdebug->leave_sub;
+    return ERR_PASSWORD;
+  }
+

   my $session_auth = $self->get_session_value(SESSION_KEY_USER_AUTH());
   if (defined $session_auth && $session_auth == OK) {
     $::lxdebug->leave_sub;
   my $session_auth = $self->get_session_value(SESSION_KEY_USER_AUTH());
   if (defined $session_auth && $session_auth == OK) {
     $::lxdebug->leave_sub;


@@ -187,7 +207,7 @@ sub authenticate {
   }
 
   my $result = $login ? $self->{authenticator}->authenticate($login, $password) : ERR_USER;
   }
 
   my $result = $login ? $self->{authenticator}->authenticate($login, $password) : ERR_USER;

-  $self->set_session_value(SESSION_KEY_USER_AUTH() => $result, login => $login);
+  $self->set_session_value(SESSION_KEY_USER_AUTH() => $result, login => $login, client_id => $self->client->{id});

 
   $::lxdebug->leave_sub;
   return $result;
 
   $::lxdebug->leave_sub;
   return $result;


@@ -528,24 +548,19 @@ sub delete_user {
 
   my $dbh   = $self->dbconnect;
   my $id    = $self->get_user_id($login);
 
   my $dbh   = $self->dbconnect;
   my $id    = $self->get_user_id($login);

-  my $user_db_exists;

 
   $dbh->rollback and return $::lxdebug->leave_sub if (!$id);
 
 
   $dbh->rollback and return $::lxdebug->leave_sub if (!$id);
 

-  my $u_dbh = $self->get_user_dbh($login, may_fail => 1);
-  $user_db_exists = $self->check_tables($u_dbh) if $u_dbh;
-
-  $u_dbh->begin_work if $u_dbh && $user_db_exists;
-

   $dbh->begin_work;
 
   do_query($::form, $dbh, qq|DELETE FROM auth.user_group WHERE user_id = ?|, $id);
   do_query($::form, $dbh, qq|DELETE FROM auth.user_config WHERE user_id = ?|, $id);
   do_query($::form, $dbh, qq|DELETE FROM auth.user WHERE id = ?|, $id);
   $dbh->begin_work;
 
   do_query($::form, $dbh, qq|DELETE FROM auth.user_group WHERE user_id = ?|, $id);
   do_query($::form, $dbh, qq|DELETE FROM auth.user_config WHERE user_id = ?|, $id);
   do_query($::form, $dbh, qq|DELETE FROM auth.user WHERE id = ?|, $id);

-  do_query($::form, $u_dbh, qq|UPDATE employee SET deleted = 't' WHERE login = ?|, $login) if $u_dbh && $user_db_exists;
+
+  # TODO: SL::Auth::delete_user
+  # do_query($::form, $u_dbh, qq|UPDATE employee SET deleted = 't' WHERE login = ?|, $login) if $u_dbh && $user_db_exists;

 
   $dbh->commit;
 
   $dbh->commit;

-  $u_dbh->commit if $u_dbh && $user_db_exists;

 
   $::lxdebug->leave_sub;
 }
 
   $::lxdebug->leave_sub;
 }


@@ -566,7 +581,7 @@ sub restore_session {
 
   if (!$session_id) {
     $main::lxdebug->leave_sub();
 
   if (!$session_id) {
     $main::lxdebug->leave_sub();

-    return SESSION_NONE;
+    return $self->session_restore_result(SESSION_NONE());

   }
 
   my ($dbh, $query, $sth, $cookie, $ref, $form);
   }
 
   my ($dbh, $query, $sth, $cookie, $ref, $form);


@@ -576,7 +591,7 @@ sub restore_session {
   # Don't fail if the auth DB doesn't yet.
   if (!( $dbh = $self->dbconnect(1) )) {
     $::lxdebug->leave_sub;
   # Don't fail if the auth DB doesn't yet.
   if (!( $dbh = $self->dbconnect(1) )) {
     $::lxdebug->leave_sub;

-    return SESSION_NONE;
+    return $self->session_restore_result(SESSION_NONE());

   }
 
   # Don't fail if the "auth" schema doesn't exist yet, e.g. if the
   }
 
   # Don't fail if the "auth" schema doesn't exist yet, e.g. if the


@@ -586,7 +601,7 @@ sub restore_session {
   if (!($sth = $dbh->prepare($query)) || !$sth->execute($session_id)) {
     $sth->finish if $sth;
     $::lxdebug->leave_sub;
   if (!($sth = $dbh->prepare($query)) || !$sth->execute($session_id)) {
     $sth->finish if $sth;
     $::lxdebug->leave_sub;

-    return SESSION_NONE;
+    return $self->session_restore_result(SESSION_NONE());

   }
 
   $cookie = $sth->fetchrow_hashref;
   }
 
   $cookie = $sth->fetchrow_hashref;


@@ -605,7 +620,7 @@ sub restore_session {
   if ($cookie_is_bad) {
     $self->destroy_session();
     $main::lxdebug->leave_sub();
   if ($cookie_is_bad) {
     $self->destroy_session();
     $main::lxdebug->leave_sub();

-    return $cookie ? SESSION_EXPIRED : SESSION_NONE;
+    return $self->session_restore_result($cookie ? SESSION_EXPIRED() : SESSION_NONE());

   }
 
   if ($self->{column_information}->has('auto_restore')) {
   }
 
   if ($self->{column_information}->has('auto_restore')) {


@@ -616,7 +631,15 @@ sub restore_session {
 
   $main::lxdebug->leave_sub();
 
 
   $main::lxdebug->leave_sub();
 

-  return SESSION_OK;
+  return $self->session_restore_result(SESSION_OK());
+}
+
+sub session_restore_result {
+  my $self = shift;
+  if (@_) {
+    $self->{session_restore_result} = $_[0];
+  }
+  return $self->{session_restore_result};

 }
 
 sub _load_without_auto_restore_column {
 }
 
 sub _load_without_auto_restore_column {