37 lines
877 B
PHP
37 lines
877 B
PHP
<?php
|
|
|
|
function hasPermission(string $resourceName, string $actionName)
|
|
{
|
|
global $conn;
|
|
|
|
if(!isset($_SESSION['id'])){
|
|
http_response_code(401);
|
|
exit;
|
|
}
|
|
|
|
$sql = "
|
|
SELECT COUNT(*) AS permission_count
|
|
FROM users u
|
|
JOIN group_permissions gp ON gp.group_id = u.group_id
|
|
JOIN resources r ON r.resource_id = gp.resource_id
|
|
JOIN actions a ON a.action_id = gp.action_id
|
|
WHERE u.user_id = :userId
|
|
AND r.name = :resourceName
|
|
AND a.name = :actionName
|
|
";
|
|
|
|
$stmt = $conn->prepare($sql);
|
|
$stmt->execute([
|
|
':userId' => $_SESSION['id'],
|
|
':resourceName' => $resourceName,
|
|
':actionName' => $actionName,
|
|
]);
|
|
|
|
$result = $stmt->fetch();
|
|
|
|
if(((int) $result['permission_count']) <= 0){
|
|
http_response_code(403);
|
|
exit;
|
|
}
|
|
}
|