17 lines
2.7 KiB
PHP
17 lines
2.7 KiB
PHP
<?php
|
|
$book=$argv[1]??'regression';require __DIR__.'/sgf-single-bootstrap.php';
|
|
$policy=App\Shared\Installation\SyntheticProfiles::policy();$profiles=json_decode(file_get_contents($s['root'].'/single-profiles.json'),true)['profiles'];
|
|
$host->transaction(function()use($host,$profiles,$policy,$f){
|
|
$old=$host->selectOne("SELECT pg_get_constraintdef(oid) value FROM pg_constraint WHERE conrelid='permission_grants'::regclass AND conname='permission_grants_scope_check'")->value;
|
|
if(!preg_match('/^CHECK \((.*)\)$/s',$old,$m))throw new LogicException('Grant schema changed');
|
|
$host->statement('ALTER TABLE permission_grants DROP CONSTRAINT permission_grants_scope_check');$host->statement("ALTER TABLE permission_grants ADD CONSTRAINT permission_grants_scope_check CHECK ((".$m[1].") OR (unit_id IS NOT NULL AND permission='supplier_payables.view'))");
|
|
foreach($policy['integration_grants'] as $key=>$groups)foreach($groups as $scope=>$rights)foreach($rights as $right){
|
|
if(!str_ends_with($right,'.view'))throw new LogicException('Only necessary existing read rights are admitted');
|
|
$values=['tenant_id'=>$f['tenant'],'company_id'=>$f['company'],'unit_id'=>$scope==='unit'?$f['unit']:null,'user_id'=>$profiles[$key]['user_id'],'permission'=>$right];
|
|
if($host->table('permission_grants')->where($values)->exists())continue;
|
|
$host->table('permission_grants')->insert($values);App\Modules\Identity\Services\Audit::record('access.granted_on_creation',null,$f['tenant'],$f['company'],$values['unit_id'],$values['user_id'],['permission'=>$right,'reason'=>'Consulta mínima de origens entre módulos no recorte sintético autorizado em10/11/2026.']);
|
|
}
|
|
});
|
|
$native->transaction(function()use($native,$nf){foreach([$nf['finance']=>['payments_view','payment_prepare','allocation_prepare','reversal_prepare'],$nf['finance_reviewer']=>['payments_view','payment_confirm','allocation_confirm','reversal_confirm'],$nf['finance_auditor']=>['payments_view']] as $user=>$actions){$scope=['tenant_id'=>$nf['tenant'],'company_id'=>0,'unit_id'=>0,'user_id'=>$user];$person=$native->table('pa_access')->where($scope+['action'=>'view'])->value('person');if(!is_string($person)||$person==='')throw new LogicException('Known native person required');foreach($actions as $action){if(!$native->table('pa_access')->where($scope+['action'=>$action])->exists())$native->table('pa_access')->insert($scope+['action'=>$action,'person'=>$person]);}}});
|
|
file_put_contents($work.'/integration-access.json',json_encode(['passed'=>true,'company'=>2,'unit'=>2,'read_grants_only_on_host'=>true,'native_synthetic_financial_actions'=>true,'new_right_names'=>0,'business_commands'=>0],JSON_PRETTY_PRINT));echo json_encode(['passed'=>true,'book'=>$book,'proof'=>$work.'/integration-access.json']).PHP_EOL;
|