4 lines
2.0 KiB
PHP
4 lines
2.0 KiB
PHP
<?php
|
|
$book=$argv[1]??'regression';require __DIR__.'/sgf-single-bootstrap.php';$p=json_decode(file_get_contents($repo.'/docs/integration/sgf-cash-access-proposal.json'),true);if(($p['approved']??false)!==true||$p['scope']!==$f['scope'])throw new LogicException('Explicit cash approval required');$profiles=json_decode(file_get_contents($s['root'].'/single-profiles.json'),true)['profiles'];$count=0;
|
|
$host->transaction(function()use($host,$p,$profiles,&$count){$old=$host->selectOne("SELECT pg_get_constraintdef(oid) d FROM pg_constraint WHERE conrelid='permission_grants'::regclass AND conname='permission_grants_scope_check'")->d;if(!str_contains($old,'cash.view')){if(!preg_match('/^CHECK \((.*)\)$/s',$old,$m))throw new LogicException('Unknown scope check');$host->statement('ALTER TABLE permission_grants DROP CONSTRAINT permission_grants_scope_check');$host->statement("ALTER TABLE permission_grants ADD CONSTRAINT permission_grants_scope_check CHECK ((".$m[1].") OR (unit_id IS NOT NULL AND permission IN('cash.view','cash.prepare','cash.review','cash.close')))");}foreach($p['new_host_rights'] as $g)foreach($g['profiles'] as $profile){$id=$profiles[$profile]['user_id'];if($id!==$p['profiles'][$profile]||!$host->table('company_memberships')->where(['user_id'=>$id,'tenant_id'=>1,'company_id'=>2])->exists())throw new LogicException('Existing approved QA identity only');$v=$p['scope']+['user_id'=>$id,'permission'=>$g['permission']];if($host->table('permission_grants')->where($v)->exists())continue;$host->table('permission_grants')->insert($v);App\Modules\Identity\Services\Audit::record('access.granted_on_creation',null,1,2,2,$id,['permission'=>$g['permission'],'reason'=>$p['authorization']]);$count++;}});file_put_contents($work.'/cash-access.json',json_encode(['passed'=>true,'book'=>$book,'new_grants'=>$count,'new_profiles'=>0,'public_grants'=>0],JSON_PRETTY_PRINT));echo json_encode(['passed'=>true,'book'=>$book,'new_grants'=>$count,'proof'=>$work.'/cash-access.json']).PHP_EOL;
|