From 4cca18d4a81186b66abf2040090ec037ee4fa49c Mon Sep 17 00:00:00 2001
From: Dennis Eichhorn <spl1nes.com@googlemail.com>
Date: Fri, 17 Aug 2018 20:02:29 +0200
Subject: [PATCH] fix #96 fix #97

---
 Admin/Routes/Web/Api.php     |  8 ++++++++
 Admin/Routes/Web/Backend.php | 28 ++++++++++++++++++++++++++++
 Controller.php               | 24 ------------------------
 Models/PermissionState.php   |  3 +--
 4 files changed, 37 insertions(+), 26 deletions(-)

diff --git a/Admin/Routes/Web/Api.php b/Admin/Routes/Web/Api.php
index 014e934..d443ab0 100644
--- a/Admin/Routes/Web/Api.php
+++ b/Admin/Routes/Web/Api.php
@@ -1,12 +1,20 @@
 <?php
 
 use phpOMS\Router\RouteVerb;
+use phpOMS\Account\PermissionType;
+use Modules\Draw\Models\PermissionState;
+use Modules\Draw\Controller;
 
 return [
     '^.*/api/draw.*$' => [
         [
             'dest' => '\Modules\Draw\Controller:apiDrawCreate',
             'verb' => RouteVerb::SET,
+            'permission' => [
+                'module' => Controller::MODULE_NAME,
+                'type'  => PermissionType::CREATE,
+                'state' => PermissionState::DRAW,
+            ],
         ],
     ],
 ];
diff --git a/Admin/Routes/Web/Backend.php b/Admin/Routes/Web/Backend.php
index cdf71b2..ea7529d 100644
--- a/Admin/Routes/Web/Backend.php
+++ b/Admin/Routes/Web/Backend.php
@@ -1,32 +1,60 @@
 <?php
 
 use phpOMS\Router\RouteVerb;
+use phpOMS\Account\PermissionType;
+use Modules\Draw\Models\PermissionState;
+use Modules\Draw\Controller;
 
 return [
     '^.*/backend/draw/create.*$' => [
         [
             'dest' => '\Modules\Draw\Controller:setUpDrawEditor',
             'verb' => RouteVerb::GET,
+            'permission' => [
+                'module' => Controller::MODULE_NAME,
+                'type'  => PermissionType::CREATE,
+                'state' => PermissionState::DRAW,
+            ],
         ],
         [
             'dest' => '\Modules\Draw\Controller:viewDrawCreate',
             'verb' => RouteVerb::GET,
+            'permission' => [
+                'module' => Controller::MODULE_NAME,
+                'type'  => PermissionType::CREATE,
+                'state' => PermissionState::DRAW,
+            ],
         ],
     ],
     '^.*/backend/draw/list.*$' => [
         [
             'dest' => '\Modules\Draw\Controller:viewDrawList',
             'verb' => RouteVerb::GET,
+            'permission' => [
+                'module' => Controller::MODULE_NAME,
+                'type'  => PermissionType::READ,
+                'state' => PermissionState::DRAW,
+            ],
         ],
     ],
     '^.*/backend/draw/single.*$' => [
         [
             'dest' => '\Modules\Draw\Controller:setUpDrawEditor',
             'verb' => RouteVerb::GET,
+            'permission' => [
+                'module' => Controller::MODULE_NAME,
+                'type'  => PermissionType::READ,
+                'state' => PermissionState::DRAW,
+            ],
         ],
         [
             'dest' => '\Modules\Draw\Controller:viewDrawSingle',
             'verb' => RouteVerb::GET,
+            'permission' => [
+                'module' => Controller::MODULE_NAME,
+                'type'  => PermissionType::READ,
+                'state' => PermissionState::DRAW,
+            ],
         ],
     ],
 ];
diff --git a/Controller.php b/Controller.php
index 8e9c8e4..5cf2bc9 100644
--- a/Controller.php
+++ b/Controller.php
@@ -125,14 +125,6 @@ final class Controller extends ModuleAbstract implements WebInterface
     {
         $view = new View($this->app, $request, $response);
 
-        if (!$this->app->accountManager->get($request->getHeader()->getAccount())->hasPermission(
-            PermissionType::CREATE, $this->app->orgId, $this->app->appName, self::MODULE_NAME, PermissionState::DRAW)
-        ) {
-            $view->setTemplate('/Web/Backend/Error/403_inline');
-            $response->getHeader()->setStatusCode(RequestStatusCode::R_403);
-            return $view;
-        }
-
         $view->setTemplate('/Modules/Draw/Theme/Backend/draw-create');
         $view->addData('nav', $this->app->moduleManager->get('Navigation')->createNavigationMid(1005201001, $request, $response));
 
@@ -187,14 +179,6 @@ final class Controller extends ModuleAbstract implements WebInterface
     {
         $view = new View($this->app, $request, $response);
 
-        if (!$this->app->accountManager->get($request->getHeader()->getAccount())->hasPermission(
-            PermissionType::READ, $this->app->orgId, $this->app->appName, self::MODULE_NAME, PermissionState::DASHBOARD)
-        ) {
-            $view->setTemplate('/Web/Backend/Error/403_inline');
-            $response->getHeader()->setStatusCode(RequestStatusCode::R_403);
-            return $view;
-        }
-
         $view->setTemplate('/Modules/Draw/Theme/Backend/draw-list');
         $view->addData('nav', $this->app->moduleManager->get('Navigation')->createNavigationMid(1005201001, $request, $response));
 
@@ -238,14 +222,6 @@ final class Controller extends ModuleAbstract implements WebInterface
      */
     public function apiDrawCreate(RequestAbstract $request, ResponseAbstract $response, $data = null) : void
     {
-        if (!$this->app->accountManager->get($request->getHeader()->getAccount())->hasPermission(
-            PermissionType::CREATE, $this->app->orgId, $this->app->appName, self::MODULE_NAME, PermissionState::DRAW)
-        ) {
-            $response->set('draw_create', null);
-            $response->getHeader()->setStatusCode(RequestStatusCode::R_403);
-            return;
-        }
-
         if (!empty($val = $this->validateDrawCreate($request))) {
             $response->set('draw_create', new FormValidation($val));
 
diff --git a/Models/PermissionState.php b/Models/PermissionState.php
index ecbea92..b4a431a 100644
--- a/Models/PermissionState.php
+++ b/Models/PermissionState.php
@@ -26,6 +26,5 @@ use phpOMS\Stdlib\Base\Enum;
  */
 abstract class PermissionState extends Enum
 {
-    public const DASHBOARD = 1;
-    public const DRAW      = 2;
+    public const DRAW = 1;
 }