Ensembia/QRForge-selfhosted
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fase 2: read-only user role with per-category view toggles

Browse Source 
Adds a third account type 'user' alongside super/admin: no create/edit/delete
rights on qr codes, view access to dynamic/static lists gated per-account by
two admin-controlled toggles (can_view_static, can_view_dynamic), and always
full visibility into the dashboard/reports regardless of those toggles.

- New columns can_view_static/can_view_dynamic on users (migrations/003)
- Users class + form_users.php: 'user' type option with the two toggles
- Access control: dynamic_qrcode.php/static_qrcode.php/bulk_action.php reject
  all mutations for type=user; dynamic_qrcodes.php/static_qrcodes.php enforce
  the view toggle and show all codes (no owner scoping, since 'user' owns none)
- Sidebar and list tables hide add/edit/delete/bulk UI for the read-only role
- index.php dashboard stats are unscoped for both 'super' and 'user'

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Dillard Blom
2026-07-08 16:37:25 +02:00
parent feb5380b28
commit a1ab16d54c
15 changed files with 163 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/index.php
+9 -5
View File
@@ -4,15 +4,19 @@ require_once 'includes/auth_validate.php';
$db = getDbInstance();
// Reports/statistieken zijn voor de 'user'-rol altijd volledig zichtbaar (net als 'super'),
// ongeacht de can_view_static/can_view_dynamic toggles die alleen de qrcode-lijsten regelen.
$is_full_visibility = in_array($_SESSION['type'], ['super', 'user'], true);
//Get Dynamic qr code rows
if($_SESSION['type'] !== 'super') {
if(!$is_full_visibility) {
$db->where("id_owner", $_SESSION['user_id']);
$db->orWhere ("id_owner", NULL, 'IS');
}
$numQrcode_dynamic = $db->getValue("dynamic_qrcodes", "count(*)");
//Get Static qr code rows
if($_SESSION['type'] !== 'super') {
if(!$is_full_visibility) {
$db->where("id_owner", $_SESSION['user_id']);
$db->orWhere ("id_owner", NULL, 'IS');
}
@@ -21,7 +25,7 @@ $numQrcode_static = $db->getValue("static_qrcodes", "count(*)");
$total = $numQrcode_dynamic + $numQrcode_static;
//Get Total scan
if($_SESSION['type'] !== 'super') {
if(!$is_full_visibility) {
$db->where("id_owner", $_SESSION['user_id']);
$db->orWhere ("id_owner", NULL, 'IS');
}
@@ -31,7 +35,7 @@ $numScan = $db->getOne("dynamic_qrcodes", "sum(scan) as numScan");
//I initialize the variables that will contain the daily values to 0 otherwise in the foreach loop they will be reset every time
//Get the number of DYNAMIC qr code created in 7 days and total scan
if($_SESSION['type'] !== 'super')
if(!$is_full_visibility)
$createdQrcode_dynamic = $db->query("select `created_at`, `scan` from " . DATABASE_PREFIX . "dynamic_qrcodes where `created_at` > curdate()-7 AND (`id_owner`= " . $_SESSION['user_id'] . " OR `id_owner` IS NULL);");
else
$createdQrcode_dynamic = $db->query("select `created_at`, `scan` from ".DATABASE_PREFIX."dynamic_qrcodes where `created_at` > curdate()-7;");
@@ -54,7 +58,7 @@ foreach ($createdQrcode_dynamic as $row) {
/* SCAN CHART */
//Get the number of STATIC qr code created in 7 days
if($_SESSION['type'] !== 'super')
if(!$is_full_visibility)
$createdQrcode_static = $db->query("select `created_at` from " . DATABASE_PREFIX . "static_qrcodes where `created_at` > curdate()-7 AND (`id_owner`=" . $_SESSION['user_id'] . " OR `id_owner` IS NULL);");
else
$createdQrcode_static = $db->query("select `created_at` from ".DATABASE_PREFIX."static_qrcodes where `created_at` > curdate()-7;");