32 lines
988 B
PHP
32 lines
988 B
PHP
 
|
<?php
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Who may use Tinker Tickets at all. Shared by the web login
|
||
|
|
* (AuthMiddleware, from Authelia's Remote-Groups header) and the MCP endpoint
|
||
|
|
* (from the OAuth access token's groups claim), so both entry points enforce
|
||
|
|
* one rule instead of two copies that can drift apart.
|
||
|
|
*/
|
||
|
|
class AccessPolicy
|
||
|
|
{
|
||
|
|
/** Membership in any of these grants access. */
|
||
|
|
private const REQUIRED_GROUPS = ['admin', 'employee'];
|
||
|
|
|
||
|
|
/**
|
||
|
|
* @param string $groups Comma-separated group names (Remote-Groups format)
|
||
|
|
*/
|
||
|
|
public static function hasAppAccess(string $groups): bool
|
||
|
|
{
|
||
|
|
if ($groups === '') {
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Filter to safe characters only to prevent header injection attacks
|
||
|
|
$userGroups = array_filter(
|
||
|
|
array_map('trim', explode(',', strtolower($groups))),
|
||
|
|
fn($g) => preg_match('/^[a-z0-9_\-]+$/', $g)
|
||
|
|
);
|
||
|
|
|
||
|
|
return !empty(array_intersect($userGroups, self::REQUIRED_GROUPS));
|
||
|
|
}
|
||
|
|
}
|