dillard
a1ab16d54c
Adds a third account type 'user' alongside super/admin: no create/edit/delete rights on qr codes, view access to dynamic/static lists gated per-account by two admin-controlled toggles (can_view_static, can_view_dynamic), and always full visibility into the dashboard/reports regardless of those toggles. - New columns can_view_static/can_view_dynamic on users (migrations/003) - Users class + form_users.php: 'user' type option with the two toggles - Access control: dynamic_qrcode.php/static_qrcode.php/bulk_action.php reject all mutations for type=user; dynamic_qrcodes.php/static_qrcodes.php enforce the view toggle and show all codes (no owner scoping, since 'user' owns none) - Sidebar and list tables hide add/edit/delete/bulk UI for the read-only role - index.php dashboard stats are unscoped for both 'super' and 'user' Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
23 lines
886 B
SQL
23 lines
886 B
SQL
-- Fase 2: read-only 'user' rol met twee zichtbaarheids-toggles.
|
|
-- type='user' vereist geen schemawijziging (varchar(10), geen enum-constraint).
|
|
|
|
SET @db := DATABASE();
|
|
|
|
SET @col_exists := (
|
|
SELECT COUNT(*) FROM information_schema.COLUMNS
|
|
WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'can_view_static'
|
|
);
|
|
SET @sql := IF(@col_exists = 0,
|
|
'ALTER TABLE `users` ADD COLUMN `can_view_static` TINYINT(1) NOT NULL DEFAULT 0',
|
|
'SELECT 1');
|
|
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
|
|
|
|
SET @col_exists := (
|
|
SELECT COUNT(*) FROM information_schema.COLUMNS
|
|
WHERE TABLE_SCHEMA = @db AND TABLE_NAME = 'users' AND COLUMN_NAME = 'can_view_dynamic'
|
|
);
|
|
SET @sql := IF(@col_exists = 0,
|
|
'ALTER TABLE `users` ADD COLUMN `can_view_dynamic` TINYINT(1) NOT NULL DEFAULT 0',
|
|
'SELECT 1');
|
|
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
|