<?
	#---------------------------------------------------------------------#
	# This source code is (c)2000 White Pajamas, Inc                      #
	# see http://www.stonekeep.com/license.html for licensing information #
	#
	# Modifications done by t'Sade, with no additional
	# restrictions.
	#---------------------------------------------------------------------#

	#----------------------------------------------------------------------
	# $Id: acl.php3,v 1.15 2000/12/14 19:13:42 shevett Exp $
	#----------------------------------------------------------------------
	
	# Contains the ACL functions used all over the place

	#----------------------------------------------------------------------
	# Backend ACL Functions
	#		retrieves the acl information about a specific user/
	#		group/policy combination. The cache system actually
	#  		retrieves the entire set of ACL, and stores
	#		them in the appropriate variable.

	Function ACL_GetPermissionVia($name, $type, $policy) {
		# Select it
		if (! IsSet($policy)) {
			$policy = 0;
		} 
#		$policy = (unset($policy)) ? 0 : $policy;
		$query = "select acl_view, acl_delete, acl_create, "
				."acl_child, acl_modify, acl_follow, "
				."acl_email, acl_close "
				."from policy_$type "
				."where pid=$policy and $type='$name'";
		$sth = db_query($query);

		Logit("DEBUG","acl.php3","Collection permissions for '$name', under type '$type', for policy '$policy'");
		# Go through the rows
		while($strow = db_fetch_array($sth)) {
			# Save them
			$perms["view"] = $strow["acl_view"];
			LogIt("DEBUG","acl.php3","View -------: $perms[view]");
			$perms["delete"] = $strow["acl_delete"];
			LogIt("DEBUG","acl.php3","Delete  ----: $perms[delete]");
			$perms["create"] = $strow["acl_create"];
			LogIt("DEBUG","acl.php3","Create  ----: $perms[create]");
			$perms["child"] = $strow["acl_child"];
			LogIt("DEBUG","acl.php3","Child  -----: $perms[child]");
			$perms["modify"] = $strow["acl_modify"];
			LogIt("DEBUG","acl.php3","Modify -----: $perms[modify]");
			$perms["follow"] = $strow["acl_follow"];
			LogIt("DEBUG","acl.php3","Follow -----: $perms[follow]");
			$perms["email"] = $strow["acl_email"];
			LogIt("DEBUG","acl.php3","Email  -----: $perms[email]");
			$perms["close"] = $strow["acl_close"];
			LogIt("DEBUG","acl.php3","Close  -----: $perms[close]");
		}

		# No change
		return $perms;	
	}

	Function ACL_GetPermissionUser($user, $policy) {
		return ACL_GetPermissionVia($user, "login", $policy);
	}

	Function ACL_GetPermissionGroup($group, $policy) {
		return ACL_GetPermissionVia($group, "grp", $policy);
	}

	#----------------------------------------------------------------------
	# Merging ACL Functions
	#		Combines the permissions together and produces
	#		some sort of unifed permission.

	Function ACL_MergePermission($perm, $new_perm) {
		# Check for plus, minus, etc
		if($new_perm == '+') { $perm = '+'; }
		if($new_perm == '-') { $perm = '-'; }

		# Return it
		return $perm;
	}

	Function ACL_MergePermissions($perm, $new_perm) {
		# Merge all of them
		$perm["view"] = ACL_MergePermission($perm["view"],
					$new_perm["view"]);
		$perm["delete"] = ACL_MergePermission($perm["delete"],
					$new_perm["delete"]);
		$perm["create"] = ACL_MergePermission($perm["create"],
					$new_perm["create"]);
		$perm["child"] = ACL_MergePermission($perm["child"],
					$new_perm["child"]);
		$perm["modify"] = ACL_MergePermission($perm["modify"],
					$new_perm["modify"]);
		$perm["follow"] = ACL_MergePermission($perm["follow"],
					$new_perm["follow"]);
		$perm["email"] = ACL_MergePermission($perm["email"],
					$new_perm["email"]);
		$perm["close"] = ACL_MergePermission($perm["close"],
					$new_perm["close"]);

		# Return them
		return $perm;
	}

	#----------------------------------------------------------------------
	# Ownership Controls
	#		This is a second set of permissions for owners.
	#		We only check it if the user is an owner.

	Function ACL_OwnerPermission($policy) {
		# Get the ownership
		Global $acl_is_owner, $acl_owner_cache;

		# Reset it
		if($acl_is_owner) {
			# Check the cache
			if($acl_owner_cache[$policy]) {
				# This is it
				return $acl_owner_cache[$policy];
			}

			# Add it
			$perms = ACL_GetPermissionUser('owner', $policy);

			# Save the cache
			$acl_owner_cache[$policy] = $perms;
		}

		# Return this
		return $perms;
	}

	#----------------------------------------------------------------------
	# Permission Checking
	#		These functions actually see if a specific user
	#		has permissions to do something.

	Function ACL_CheckPermission($user, $policy, $control) {
		# First check to see if its in the cache
		Global $acl_cache, $sys_enableacl;

		# Check to see if we want to use acl
		if(!$sys_enableacl) {
			# Always good
			return 1;
		}

		LogIt("DEBUG","acl.php3","Checking permission for '$user', under policy '$policy' to '$control'");

		# Get the owner permission
		$owner = ACL_OwnerPermission($policy);

		# Check to see if its in the cache
		if($acl_cache[$policy]) {
			# Get it
			$ref = $acl_cache[$policy];
			LogIt("DEBUG","acl.php3","Policy '$policy' was cached.");
			LogIt("DEBUG","acl.php3","Ref is $ref[$control]");
			if ($owner) {
				LogIt("DEBUG","acl.php3","owner is $owner[$control]");
			}
			LogIt("DEBUG","acl.php3","---------Here's what was cached-------------");
			LogIt("DEBUG","acl.php3","View -------: $ref[view]");
			LogIt("DEBUG","acl.php3","Delete  ----: $ref[delete]");
			LogIt("DEBUG","acl.php3","Create  ----: $ref[create]");
			LogIt("DEBUG","acl.php3","Child  -----: $ref[child]");
			LogIt("DEBUG","acl.php3","Modify -----: $ref[modify]");
			LogIt("DEBUG","acl.php3","Follow -----: $ref[follow]");
			LogIt("DEBUG","acl.php3","Email  -----: $ref[email]");
			LogIt("DEBUG","acl.php3","Close  -----: $ref[close]");
			LogIt("DEBUG","acl.php3","--------------------------------------------");

			# Merge it
			$results = ACL_MergePermission($ref[$control], $owner[$control]);
			LogIt("DEBUG","acl.php3","Result was '$results'");

			# Return

			return ($results == '+');
		}

		# Figure out the group and user, guests are 'nobody'
		# in the 'nobody' group
		if("$user" == "visitor") {
			# Its nobody
			$user = 'visitor';
			$group = 'visitor';

			# Don't check anyone
			$check_anyone = 0;
		} else {
			# Get the user's group
			$sth = db_query("select grp from people "
					."where login='$user'");
			while($strow = db_fetch_array($sth)) {
				$group = $strow[grp];
			}

			# Don't check anyone
			$check_anyone = 1;
		}

		# Reset it
		$perm = array(
				"view" => '+',
				"delete" => '+',
				"create" => '+',
				"child" => '+',
				"modify" => '+',
				"follow" => '+',
				"email" => '+',
				"close" => '+');

		# Check for group
		if($check_anyone) {
			# Get the permissions
			$perms = ACL_GetPermissionGroup('anyone', $policy);

			# Check to see if its real
			$perm = ACL_MergePermissions($perm, $perms);
		}

		# Check the group
		$perms = ACL_GetPermissionGroup($group, $policy);
		$perm = ACL_MergePermissions($perm, $perms);

		# Check for anyone
		if($check_anyone) {
			# Get the permissions
			$perms = ACL_GetPermissionUser('anyone', $policy);

			# Merge them
			$perm = ACL_MergePermissions($perm, $perms);
		}

		# Check ourselves
		$perms = ACL_GetPermissionUser($user, $policy);
		$perm = ACL_MergePermissions($perm, $perms);

		#
		# Figure out what to do
		#

		# Save it in the cache
		$acl_cache[$policy] = $perm;
		LogIt("DEBUG","acl.php3","Caching policy $policy with permission $perm.");

		# Merge it
		#$acl_scratch = ACL_MergePermission($perm[$control], $owner[$control]);
		$results = ACL_MergePermission($perm[$control], $owner[$control]);

		# Check it
		return ($results == '+');
	}

	#----------------------------------------------------------------------
	# Naming

	Function ACL_GetPolicyName($policy) {
		# Assume no policy
		$res = "No Policy.";

		# Look for a policy
		if(isset($policy)) { # 0 policies are possible
			# Query
			$sth = db_query("select fullname from policy where pid=$policy");

			# Go through the results
			while($strow = db_fetch_array($sth)) {
				$res = $strow[fullname];
			}
		}

		# Return the results
		return $res;
	}
		
	#----------------------------------------------------------------------
	# Basic Functions

	Function ACL_CanView($policy) {
		# Global
		Global $curruser;

		# User
		return ACL_CheckPermission("$curruser", $policy, "view");
	}

	Function ACL_CanDelete($policy) {
		# Global
		Global $curruser;

		# Return it
		return ACL_CheckPermission($curruser, $policy, "delete");
	}

	Function ACL_CanCreate($policy) {
		# Global
		Global $curruser;

		# Return it
		return ACL_CheckPermission($curruser, $policy, "create");
	}

	Function ACL_CanAddChildren($policy) {
		# Global
		Global $curruser;

		# Return it
		return ACL_CheckPermission($curruser, $policy, "child");
	}

	Function ACL_CanModify($policy) {
		# Global
		Global $curruser;

		# Return it
		return ACL_CheckPermission($curruser, $policy, "modify");
	}

	Function ACL_CanAddFollowup($policy) {
		# Global
		Global $curruser;

		# Return it
		return ACL_CheckPermission($curruser, $policy, "follow");
	}

	Function ACL_CanEmail($policy) {
		# Global
		Global $curruser;

		# Return it
		return ACL_CheckPermission($curruser, $policy, "email");
	}

	Function ACL_CanClose($policy) {
		# Global
		Global $curruser;

		# Return it
		return ACL_CheckPermission($curruser, $policy, "close");
	}
?>
