% foreach my $ace_id (keys %acl_map) {
<%Data::Dumper::Dumper($acl_map{$ace_id})%><& /Admin/Tools/RightsMatrix/Elements/IllustrateACE, ACEObj => $acl_map{$ace_id}{ace}, Groups => $acl_map{$ace_id}{groups}, PrincipalObj => $Principal &> % } <%INIT> # In order to determine how a user, group or role has a right on an object, # find all the Access Control Entries of that object and right (and on # RT::System for that right and SuperUser. my $Object = $ObjectType->new($RT::SystemUser); $Object->Load($ObjectId); my $Principal; if ($PrincipalId =~ /^\d+$/) { $Principal = RT::Principal->new($RT::SystemUser); $Principal->Load($PrincipalId); } elsif ( $PrincipalId =~ /^(.*)-Role$/ ) { # load the principal that represents the role for the Object my $role = $1; $Principal = RTx::RightsMatrix::RolePrincipal->new($role)->_RealPrincipal(Object => $Object); } my @acl = RTx::RightsMatrix::Util::acl_for_object_right_and_principal(Principal => $Principal, RightName => $Right, ObjectType => $ObjectType, ObjectId => $ObjectId);; # And now for each ACE we build list of lists to represent the group the ACE # is granted on, and an members of the group that are also groups (recursively) my %acl_map; $RT::Logger->debug("Number of ACEs is now: " . scalar(@acl)); foreach my $ace (@acl) { my $ace_group = RT::Group->new($session{CurrentUser}); my ($rv, $msg) = $ace_group->Load($ace->PrincipalId); $rv or $RT::Logger->debug("principal group didn't load: " . $ace->PrincipalId); my $members = RTx::RightsMatrix::Util::build_group_lists($ace_group, ref($Object), $Object->Id); $acl_map{$ace->id}{ace} = $ace; $acl_map{$ace->id}{groups} = $members; $RT::Logger->debug("For ace " . $ace->id); } # Some of the lists of nested groups my not have as a member the user/group/role we are interested in # so filter those out foreach my $ace (keys %acl_map) { my $lol = $acl_map{$ace}{groups}; foreach my $list (@$lol) { unless (RTx::RightsMatrix::Util::list_has_member($list, $Principal)) { $list = [()]; } } @$lol = grep { scalar(@$_) } @$lol; #elimate the empties } # If the ace has no group lists now, eliminate it because the ace in no way applied # to the user/group/role we are interested in foreach my $ace (keys %acl_map) { my $lol = $acl_map{$ace}{groups}; delete $acl_map{$ace} unless scalar(@$lol); } #$m->out("
".Data::Dumper::Dumper(\%acl_map).""); # This next step could be combined with the previous steps, but let's keep it easy # to understand. Now we want to truncate each group list so that the last group # has the principal as a member. This saves work in IllustrateACE. foreach my $ace (keys %acl_map) { my $lol = $acl_map{$ace}{groups}; foreach my $list (@$lol) { $list = RTx::RightsMatrix::Util::reduce_list($list, $Principal); } } # And now, with the lists truncated we need to check them to make sure they are # not the same. foreach my $ace (keys %acl_map) { my $lol = $acl_map{$ace}{groups}; my %compared; foreach my $a (0..$#$lol) { foreach my $b (0..$#$lol) { next if $a == $b; next if $compared{"$a$b"}; $lol->[$a] = [()] if RTx::RightsMatrix::Util::same($lol->[$a], $lol->[$b]); $compared{"$a$b"} = 1; $compared{"$b$a"} = 1; } } @$lol = grep { scalar(@$_) } @$lol; #elimate the empties } %INIT> <%ARGS> $PrincipalId $ObjectId $ObjectType $Right %ARGS> <%ONCE> use RTx::RightsMatrix::RolePrincipal; use RTx::RightsMatrix::Util; use Data::Dumper; %ONCE>