nala/SGF
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

commit melhorias sgf

Browse Source
This commit is contained in:
nala
2026-11-11 09:00:17 +02:00
parent 0b05a1192c
commit 1d11a5e57b
736 changed files with 40746 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/sgf-integration-access.php
+16
View File
@@ -0,0 +1,16 @@
<?php
$book=$argv[1]??'regression';require __DIR__.'/sgf-single-bootstrap.php';
$policy=App\Shared\Installation\SyntheticProfiles::policy();$profiles=json_decode(file_get_contents($s['root'].'/single-profiles.json'),true)['profiles'];
$host->transaction(function()use($host,$profiles,$policy,$f){
$old=$host->selectOne("SELECT pg_get_constraintdef(oid) value FROM pg_constraint WHERE conrelid='permission_grants'::regclass AND conname='permission_grants_scope_check'")->value;
if(!preg_match('/^CHECK \((.*)\)$/s',$old,$m))throw new LogicException('Grant schema changed');
$host->statement('ALTER TABLE permission_grants DROP CONSTRAINT permission_grants_scope_check');$host->statement("ALTER TABLE permission_grants ADD CONSTRAINT permission_grants_scope_check CHECK ((".$m[1].") OR (unit_id IS NOT NULL AND permission='supplier_payables.view'))");
foreach($policy['integration_grants'] as $key=>$groups)foreach($groups as $scope=>$rights)foreach($rights as $right){
if(!str_ends_with($right,'.view'))throw new LogicException('Only necessary existing read rights are admitted');
$values=['tenant_id'=>$f['tenant'],'company_id'=>$f['company'],'unit_id'=>$scope==='unit'?$f['unit']:null,'user_id'=>$profiles[$key]['user_id'],'permission'=>$right];
if($host->table('permission_grants')->where($values)->exists())continue;
$host->table('permission_grants')->insert($values);App\Modules\Identity\Services\Audit::record('access.granted_on_creation',null,$f['tenant'],$f['company'],$values['unit_id'],$values['user_id'],['permission'=>$right,'reason'=>'Consulta mínima de origens entre módulos no recorte sintético autorizado em10/11/2026.']);
}
});
$native->transaction(function()use($native,$nf){foreach([$nf['finance']=>['payments_view','payment_prepare','allocation_prepare','reversal_prepare'],$nf['finance_reviewer']=>['payments_view','payment_confirm','allocation_confirm','reversal_confirm'],$nf['finance_auditor']=>['payments_view']] as $user=>$actions){$scope=['tenant_id'=>$nf['tenant'],'company_id'=>0,'unit_id'=>0,'user_id'=>$user];$person=$native->table('pa_access')->where($scope+['action'=>'view'])->value('person');if(!is_string($person)||$person==='')throw new LogicException('Known native person required');foreach($actions as $action){if(!$native->table('pa_access')->where($scope+['action'=>$action])->exists())$native->table('pa_access')->insert($scope+['action'=>$action,'person'=>$person]);}}});
file_put_contents($work.'/integration-access.json',json_encode(['passed'=>true,'company'=>2,'unit'=>2,'read_grants_only_on_host'=>true,'native_synthetic_financial_actions'=>true,'new_right_names'=>0,'business_commands'=>0],JSON_PRETTY_PRINT));echo json_encode(['passed'=>true,'book'=>$book,'proof'=>$work.'/integration-access.json']).PHP_EOL;