Merge pull request #18112 from craftcms/feature/user-permissions

[6.x] UserPermissions

Author: brandonkelly

CHANGELOG-WIP.md

@@ -426,3 +426,6 @@ Moved the following controllers:
 - Deprecated `\craft\records\User`. `\CraftCms\Cms\User\Models\User` should be used instead.
 - Deprecated `\craft\records\UserGroup`. `\CraftCms\Cms\User\Models\UserGroup` should be used instead.
 - Deprecated `\craft\records\UserPermission`. `\CraftCms\Cms\User\Models\UserPermission` should be used instead.
+- Deprecated `craft\services\UserPermissions`. `CraftCms\Cms\User\UserPermissions` should be used instead.
+- Deprecated `craft.app.userPermissions`. `craft.userPermissions` should be used instead.
+- Deprecated `craft\events\DefineEditUserScreensEvent`. `CraftCms\Cms\User\Events\DefineEditUserScreens` should be used instead.

resources/templates/_includes/permissions.twig

@@ -16,17 +16,17 @@
     {% from _self import permissionList %}
 
     <ul{% if id %} id="{{ id|replace(':', '-') }}"{% endif %}>
-        {% for permissionName, props in permissions %}
-            {% set isInGroupPermissions = permissionName|lower in groupPermissions %}
+        {% for permission in permissions %}
+            {% set isInGroupPermissions = permission.key|lower in groupPermissions %}
 
             {% if (isInGroupPermissions) %}
                 {% set checked = true %}
             {% else %}
                 {% if subject %}
-                    {% if craft.app.request.getActionSegments() == ['users', 'save-user'] %}
-                        {% set checked = permissionName in craft.app.request.getBodyParam('permissions', []) %}
+                    {% if request.actionSegments() == ['users', 'save-user'] %}
+                        {% set checked = permission.key in request.input('permissions', []) %}
                     {% else %}
-                        {% set checked = subject.can(permissionName) %}
+                        {% set checked = subject.can(permission.key) %}
                     {% endif %}
                 {% else %}
                     {% set checked = false %}
@@ -35,24 +35,24 @@
 
             <li>
                 {{ checkbox({
-                    label: props.label,
+                    label: permission.label,
                     name: 'permissions[]',
-                    value: permissionName,
+                    value: permission.key,
                     checked: checked,
                     class: isInGroupPermissions ? 'group-permission',
                     disabled: disabled or isInGroupPermissions,
                 }) }}
 
-                {% if props.info ?? false %}
-                    <div class="info">{{ props.info }}</div>
+                {% if permission.info ?? false %}
+                    <div class="info">{{ permission.info }}</div>
                 {% endif %}
 
-                {% if props.warning ?? false %}
-                    <div class="info warning">{{ props.warning }}</div>
+                {% if permission.warning ?? false %}
+                    <div class="info warning">{{ permission.warning }}</div>
                 {% endif %}
 
-                {% if props.nested ?? false %}
-                    {{ permissionList(subject, groupPermissions, props.nested, permissionName~'-nested', disabled or not checked) }}
+                {% if permission.nested ?? false %}
+                    {{ permissionList(subject, groupPermissions, permission.nested, permission.key~'-nested', disabled or not checked) }}
                 {% endif %}
             </li>
         {% endfor %}
@@ -63,18 +63,11 @@
 
 {% for group in permissions %}
     {# Include a placeholder for the user group being created? #}
-    {% if (includeGroupPlaceholder ?? false) and group.permissions.editUsers is defined %}
-        {% set group = group|merge({
-            permissions: {
-                editUsers: {
-                    nested: {
-                        assignNewUserGroup: {
-                            label: 'Assign users to this group'|t('app'),
-                        },
-                    },
-                },
-            },
-        }, recursive=true) %}
+    {% if (includeGroupPlaceholder ?? false) and group.permissions.has('viewUsers') and group.permissions.viewUsers.nested.has('editUsers') %}
+        {% do group.permissions.viewUsers.nested.editUsers.nested.add(create('\\CraftCms\\Cms\\User\\Data\\Permission', {
+            key: 'assignNewUserGroup',
+            label: 'Assign users to this group'|t('app')
+        })) %}
     {% endif %}
 
     <div class="user-permissions {{ wrapperClass }}">

resources/templates/settings/users/groups/_edit.twig

@@ -53,7 +53,7 @@
 <div id="permissions">
     {% include "_includes/permissions" with {
         subject: group ?? null,
-        permissions: craft.app.userPermissions.getAllPermissions(),
+        permissions: craft.userPermissions.getAllPermissions(),
         includeGroupPlaceholder: not group.id,
         disabled: readOnly,
     } only %}

resources/templates/settings/users/groups/_team.twig

@@ -15,7 +15,7 @@
   <div id="permissions">
     {% include "_includes/permissions" with {
       subject: group ?? null,
-      permissions: craft.app.userPermissions.getAllPermissions(),
+      permissions: craft.userPermissions.getAllPermissions(),
       includeGroupPlaceholder: not group.id,
       disabled: readOnly,
     } only %}

resources/templates/users/_permissions.twig

@@ -80,8 +80,8 @@
 
       {% include '_includes/permissions' with {
         subject: user.admin ? null : user,
-        permissions: craft.app.userPermissions.getAssignablePermissions(user),
-        groupPermissions: user.id ? craft.app.userPermissions.getGroupPermissionsByUserId(user.id) : [],
+        permissions: craft.userPermissions.getAssignablePermissions(user),
+        groupPermissions: user.id ? craft.userPermissions.getGroupPermissionsByUserId(user.id) : [],
         disabled: CraftEdition == CraftTeam,
       } only %}
     </div>

routes/actions.php

@@ -35,6 +35,7 @@
 use CraftCms\Cms\Http\Controllers\Updates\UpdaterController;
 use CraftCms\Cms\Http\Controllers\Updates\UpdatesController;
 use CraftCms\Cms\Http\Controllers\Users\ImpersonationController;
+use CraftCms\Cms\Http\Controllers\Users\PermissionsController;
 use CraftCms\Cms\Http\Controllers\Utilities\ClearCachesController;
 use CraftCms\Cms\Http\Controllers\Utilities\DbBackupController;
 use CraftCms\Cms\Http\Controllers\Utilities\DeprecationErrorsController;
@@ -276,6 +277,8 @@
             Route::post('users/get-impersonation-url', [ImpersonationController::class, 'getUrl']);
         });
 
+        Route::post('users/save-permissions', [PermissionsController::class, 'store']);
+
         // User groups
         Route::middleware([
             RequireAdminChanges::class,

routes/cp.php

@@ -19,6 +19,7 @@
 use CraftCms\Cms\Http\Controllers\Settings\UserGroupsController;
 use CraftCms\Cms\Http\Controllers\Settings\UserSettingsController;
 use CraftCms\Cms\Http\Controllers\Updates\UpdaterController;
+use CraftCms\Cms\Http\Controllers\Users\PermissionsController;
 use CraftCms\Cms\Http\Controllers\Utilities\UtilitiesController;
 use CraftCms\Cms\Http\Middleware\HandleInertiaRequests;
 use CraftCms\Cms\Http\Middleware\RequireAdmin;
@@ -57,6 +58,12 @@
     Route::view('content/{page}/{sectionHandle}', 'craftcms::entries.index')->where('page', '[^\/]+');
     Route::get('content/{section}/new', CreateEntryController::class);
 
+    /**
+     * Users
+     */
+    Route::get('users/{user}/permissions', [PermissionsController::class, 'index']);
+    Route::get('myaccount/permissions', [PermissionsController::class, 'index']);
+
     /**
      * Routes that require admin, but do not require admin changes
      */

src/Database/Migrations/Install.php

@@ -37,6 +37,7 @@
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Schema;
 use ReflectionClass;
+use Throwable;
 
 class Install extends Migration
 {
@@ -69,7 +70,11 @@ public function up(): void
         }
 
         DB::afterCommit(function () {
-            $this->insertDefaultData();
+            try {
+                $this->insertDefaultData();
+            } catch (Throwable $e) {
+                $this->components->error("Error inserting default data: {$e->getMessage()}");
+            }
         });
 
         $this->newLine();

src/Database/Queries/ElementQuery.php

@@ -42,6 +42,7 @@
  *
  * @mixin \Illuminate\Database\Query\Builder
  *
+ * @method self addSelect($column)
  * @method self orderByDesc($column)
  * @method self where($column, $operator = null, $value = null, $boolean = 'and')
  * @method self whereIn($column, $values, $boolean = 'and', $not = false)
@@ -412,6 +413,9 @@ public function sole(array|string $columns = ['*']): ElementInterface
         }
     }
 
+    /**
+     * @return TElement|null
+     */
     public function first($columns = ['*']): ?ElementInterface
     {
         // Eagerly?

src/Database/Queries/UserQuery.php

@@ -5,14 +5,14 @@
 namespace CraftCms\Cms\Database\Queries;
 
 use Closure;
-use craft\elements\User;
 use CraftCms\Cms\Database\Queries\Concerns\User\QueriesAffiliatedSite;
 use CraftCms\Cms\Database\Queries\Concerns\User\QueriesAssetUploaders;
 use CraftCms\Cms\Database\Queries\Concerns\User\QueriesAuthors;
 use CraftCms\Cms\Database\Queries\Concerns\User\QueriesRolesAndPermissions;
 use CraftCms\Cms\Database\Queries\Concerns\User\QueriesUserGroups;
 use CraftCms\Cms\Database\Queries\Concerns\User\QueriesUserProperties;
 use CraftCms\Cms\Database\Table;
+use CraftCms\Cms\Element\Elements\User;
 use Illuminate\Database\Query\Builder;
 
 /**
@@ -38,7 +38,7 @@ final class UserQuery extends ElementQuery
 
     public function __construct(array $config = [])
     {
-        parent::__construct(\CraftCms\Cms\Element\Elements\User::class, $config);
+        parent::__construct(User::class, $config);
 
         $this->joinElementTable(Table::USERS);
 
@@ -53,7 +53,7 @@ public function __construct(array $config = [])
             'users.lastName as lastName',
             'users.email as email',
             'users.unverifiedEmail as unverifiedEmail',
-            'users.lastLoginDate as lastLo2ginDate',
+            'users.lastLoginDate as lastLoginDate',
             'users.lockoutDate as lockoutDate',
             'users.hasDashboard as hasDashboard',
             'users.affiliatedSiteId as affiliatedSiteId',