mirror of
git://f0xx.org/ac/ac-ms-rbac
synced 2026-07-29 11:39:22 +03:00
71 lines
2.1 KiB
PHP
71 lines
2.1 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
require_once __DIR__ . '/../../src/bootstrap.php';
|
|
require_once __DIR__ . '/../../src/RbacAdminRepository.php';
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
|
|
Auth::check();
|
|
|
|
if (!Rbac::canManageRbac()) {
|
|
json_out(['ok' => false, 'error' => 'forbidden'], 403);
|
|
}
|
|
|
|
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
|
|
$action = trim((string) ($_GET['action'] ?? ''));
|
|
|
|
if ($method === 'GET' && $action === 'panel') {
|
|
$panel = RbacAdminRepository::buildPanel();
|
|
json_out($panel, empty($panel['ok']) ? 403 : 200);
|
|
}
|
|
|
|
if ($method !== 'POST') {
|
|
json_out(['ok' => false, 'error' => 'method_not_allowed'], 405);
|
|
}
|
|
|
|
$raw = file_get_contents('php://input') ?: '';
|
|
$body = json_decode($raw, true);
|
|
if (!is_array($body)) {
|
|
json_out(['ok' => false, 'error' => 'invalid_json'], 400);
|
|
}
|
|
|
|
if ($action === 'set_global_role') {
|
|
$result = RbacAdminRepository::setGlobalRole(
|
|
(int) ($body['user_id'] ?? 0),
|
|
(string) ($body['role'] ?? '')
|
|
);
|
|
json_out($result, empty($result['ok']) ? 400 : 200);
|
|
}
|
|
|
|
if ($action === 'set_company_role') {
|
|
$result = RbacAdminRepository::setCompanyRole(
|
|
(int) ($body['user_id'] ?? 0),
|
|
(int) ($body['company_id'] ?? 0),
|
|
(string) ($body['role'] ?? '')
|
|
);
|
|
json_out($result, empty($result['ok']) ? 400 : 200);
|
|
}
|
|
|
|
if ($action === 'apply_privilege_set') {
|
|
$result = RbacAdminRepository::applyPrivilegeSet(
|
|
(int) ($body['user_id'] ?? 0),
|
|
(int) ($body['company_id'] ?? 0),
|
|
(string) ($body['privilege_set'] ?? '')
|
|
);
|
|
json_out($result, empty($result['ok']) ? 400 : 200);
|
|
}
|
|
|
|
if ($action === 'clear_auth_lockouts') {
|
|
if (!Rbac::isRoot() && !Rbac::isGlobalAdmin()) {
|
|
json_out(['ok' => false, 'error' => 'forbidden'], 403);
|
|
}
|
|
$userId = (int) ($body['user_id'] ?? 0);
|
|
if ($userId <= 0) {
|
|
json_out(['ok' => false, 'error' => 'invalid_user'], 400);
|
|
}
|
|
$deleted = AuthAttempts::clearForUser($userId);
|
|
json_out(['ok' => true, 'cleared' => $deleted]);
|
|
}
|
|
|
|
json_out(['ok' => false, 'error' => 'unknown_action'], 400);
|