Object permissions

application/controllers/CommentsController.php

@@ -106,8 +106,6 @@ public function indexAction()
 
     public function deleteAction()
     {
-        // TODO: Check permission
-
         $this->setTitle(t('Remove Comments'));
 
         $db = $this->getDb();
@@ -169,7 +167,6 @@ public function detailsAction()
             sprintf(t('Show all %d comments'), $comments->count())
         ));
 
-        // TODO: Check permission
         $this->addContent(
             (new DeleteCommentForm())
                 ->setObjects($comments)

application/controllers/DowntimesController.php

@@ -115,8 +115,6 @@ public function indexAction()
 
     public function deleteAction()
     {
-        // TODO: Check permission
-
         $this->setTitle(t('Cancel Downtimes'));
 
         $db = $this->getDb();
@@ -178,7 +176,6 @@ public function detailsAction()
             sprintf(t('Show all %d downtimes'), $downtimes->count())
         ));
 
-        // TODO: Check permission
         $this->addContent(
             (new DeleteDowntimeForm())
                 ->setObjects($downtimes)

application/forms/Command/Instance/ToggleInstanceFeaturesForm.php

@@ -41,7 +41,7 @@ public function __construct($featureStatus)
 
     protected function assembleElements()
     {
-        $disabled = ! $this->getAuth()->hasPermission('monitoring/command/feature/instance');
+        $disabled = ! $this->getAuth()->hasPermission('icingadb/command/feature/instance');
         $decorator = new IcingaFormDecorator();
 
         foreach ($this->features as $feature => $label) {

application/forms/Command/Object/AcknowledgeProblemForm.php

@@ -141,6 +141,10 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/acknowledge-problem', $object)) {
+            return null;
+        }
+
         $command = new AcknowledgeProblemCommand();
         $command->setObject($object);
         $command->setComment($this->getValue('comment'));

application/forms/Command/Object/AddCommentForm.php

@@ -95,6 +95,10 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/comment/add', $object)) {
+            return null;
+        }
+
         $command = new AddCommentCommand();
         $command->setObject($object);
         $command->setComment($this->getValue('comment'));

application/forms/Command/Object/CheckNowForm.php

@@ -47,8 +47,11 @@ protected function assembleSubmitButton()
     protected function getCommand(Model $object)
     {
         if (
-            ! $object->active_checks_enabled
-            && ! $this->getAuth()->hasPermission('monitoring/command/schedule-check')
+            ! $this->isGrantedOn('icingadb/command/schedule-check', $object)
+            && (
+                ! $object->active_checks_enabled
+                || ! $this->isGrantedOn('icingadb/command/schedule-check/active-only', $object)
+            )
         ) {
             return null;
         }

application/forms/Command/Object/DeleteCommentForm.php

@@ -38,6 +38,10 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/comment/delete', $object->{$object->object_type})) {
+            return null;
+        }
+
         $command = new DeleteCommentCommand();
         $command->setCommentName($object->name);
         $command->setAuthor($this->getAuth()->getUser()->getUsername());

application/forms/Command/Object/DeleteDowntimeForm.php

@@ -40,6 +40,10 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/downtime/delete', $object->{$object->object_type})) {
+            return null;
+        }
+
         $command = new DeleteDowntimeCommand();
         $command->setDowntimeName($object->name);
         $command->setAuthor($this->getAuth()->getUser()->getUsername());

application/forms/Command/Object/ProcessCheckResultForm.php

@@ -5,6 +5,7 @@
 namespace Icinga\Module\Icingadb\Forms\Command\Object;
 
 use Icinga\Module\Icingadb\Command\Object\ProcessCheckResultCommand;
+use Icinga\Module\Icingadb\Common\Auth;
 use Icinga\Module\Icingadb\Forms\Command\CommandForm;
 use Icinga\Module\Icingadb\Model\Host;
 use ipl\Html\HtmlElement;
@@ -14,6 +15,8 @@
 
 class ProcessCheckResultForm extends CommandForm
 {
+    use Auth;
+
     protected function assembleElements()
     {
         $this->add(new HtmlElement('div', ['class' => 'form-description'], [
@@ -100,6 +103,10 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/process-check-result', $object)) {
+            return null;
+        }
+
         $command = new ProcessCheckResultCommand();
         $command->setObject($object);
         $command->setStatus($this->getValue('status'));

application/forms/Command/Object/RemoveAcknowledgementForm.php

@@ -37,6 +37,10 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/remove-acknowledgement', $object)) {
+            return null;
+        }
+
         $command = new RemoveAcknowledgementCommand();
         $command->setObject($object);
         $command->setAuthor($this->getAuth()->getUser()->getUsername());

application/forms/Command/Object/ScheduleCheckForm.php

@@ -7,6 +7,7 @@
 use DateInterval;
 use DateTime;
 use Icinga\Module\Icingadb\Command\Object\ScheduleCheckCommand;
+use Icinga\Module\Icingadb\Common\Auth;
 use Icinga\Module\Icingadb\Forms\Command\CommandForm;
 use ipl\Html\HtmlElement;
 use ipl\Orm\Model;
@@ -15,6 +16,8 @@
 
 class ScheduleCheckForm extends CommandForm
 {
+    use Auth;
+
     protected function assembleElements()
     {
         $this->add(new HtmlElement('div', ['class' => 'form-description'], [
@@ -71,6 +74,16 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (
+            ! $this->isGrantedOn('icingadb/command/schedule-check', $object)
+            && (
+                ! $object->active_checks_enabled
+                || ! $this->isGrantedOn('icingadb/command/schedule-check/active-only', $object)
+            )
+        ) {
+            return null;
+        }
+
         $command = new ScheduleCheckCommand();
         $command->setObject($object);
         $command->setForced($this->getElement('force_check')->isChecked());

application/forms/Command/Object/ScheduleHostDowntimeForm.php

@@ -51,6 +51,10 @@ protected function assembleElements()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/downtime/schedule', $object)) {
+            return null;
+        }
+
         if (($childOptions = (int) $this->getValue('child_options'))) {
             $command = new PropagateHostDowntimeCommand();
             $command->setTriggered($childOptions === 1);

application/forms/Command/Object/ScheduleServiceDowntimeForm.php

@@ -159,6 +159,10 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/downtime/schedule', $object)) {
+            return null;
+        }
+
         $command = new ScheduleServiceDowntimeCommand();
         $command->setObject($object);
         $command->setComment($this->getValue('comment'));

application/forms/Command/Object/SendCustomNotificationForm.php

@@ -75,6 +75,10 @@ protected function assembleSubmitButton()
 
     protected function getCommand(Model $object)
     {
+        if (! $this->isGrantedOn('icingadb/command/send-custom-notification', $object)) {
+            return null;
+        }
+
         $command = new SendCustomNotificationCommand();
         $command->setObject($object);
         $command->setComment($this->getValue('comment'));

application/forms/Command/Object/ToggleObjectFeaturesForm.php

@@ -26,23 +26,23 @@ public function __construct($featureStatus)
         $this->features = [
             ToggleObjectFeatureCommand::FEATURE_ACTIVE_CHECKS => [
                 'label'         => t('Active Checks'),
-                'permission'    => 'monitoring/command/feature/object/active-checks'
+                'permission'    => 'icingadb/command/feature/object/active-checks'
             ],
             ToggleObjectFeatureCommand::FEATURE_PASSIVE_CHECKS => [
                 'label'         => t('Passive Checks'),
-                'permission'    => 'monitoring/command/feature/object/passive-checks'
+                'permission'    => 'icingadb/command/feature/object/passive-checks'
             ],
             ToggleObjectFeatureCommand::FEATURE_NOTIFICATIONS => [
                 'label'         => t('Notifications'),
-                'permission'    => 'monitoring/command/feature/object/notifications'
+                'permission'    => 'icingadb/command/feature/object/notifications'
             ],
             ToggleObjectFeatureCommand::FEATURE_EVENT_HANDLER => [
                 'label'         => t('Event Handler'),
-                'permission'    => 'monitoring/command/feature/object/event-handler'
+                'permission'    => 'icingadb/command/feature/object/event-handler'
             ],
             ToggleObjectFeatureCommand::FEATURE_FLAP_DETECTION => [
                 'label'         => t('Flap Detection'),
-                'permission'    => 'monitoring/command/feature/object/flap-detection'
+                'permission'    => 'icingadb/command/feature/object/flap-detection'
             ]
         ];
 
@@ -55,7 +55,9 @@ protected function assembleElements()
         foreach ($this->features as $feature => $spec) {
             $options = [
                 'class'         => 'autosubmit',
-                'disabled'      => ! $this->getAuth()->hasPermission($spec['permission']),
+                'disabled'      => $this->featureStatus instanceof Model
+                    ? ! $this->isGrantedOn($spec['permission'], $this->featureStatus)
+                    : false,
                 'label'         => $spec['label']
             ];
             if ($this->featureStatus[$feature] === 2) {
@@ -95,7 +97,7 @@ protected function getCommand(Model $object)
             $featureState = $this->getElement($feature)->isChecked();
 
             if (
-                ! $this->getAuth()->hasPermission($spec['permission'])
+                ! $this->isGrantedOn($spec['permission'], $object)
                 || $featureState === self::LEAVE_UNCHANGED
                 || (int) $featureState === (int) $this->featureStatus[$feature]
             ) {

configuration.php

@@ -13,6 +13,87 @@
 
     $this->provideSetupWizard('Icinga\Module\Icingadb\Setup\IcingaDbWizard');
 
+    $this->providePermission(
+        'icingadb/command/*',
+        $this->translate('Allow all commands')
+    );
+    $this->providePermission(
+        'icingadb/command/schedule-check',
+        $this->translate('Allow to schedule host and service checks')
+    );
+    $this->providePermission(
+        'icingadb/command/schedule-check/active-only',
+        $this->translate('Allow to schedule host and service checks (Only on objects with active checks enabled)')
+    );
+    $this->providePermission(
+        'icingadb/command/acknowledge-problem',
+        $this->translate('Allow to acknowledge host and service problems')
+    );
+    $this->providePermission(
+        'icingadb/command/remove-acknowledgement',
+        $this->translate('Allow to remove problem acknowledgements')
+    );
+    $this->providePermission(
+        'icingadb/command/comment/*',
+        $this->translate('Allow to add and delete host and service comments')
+    );
+    $this->providePermission(
+        'icingadb/command/comment/add',
+        $this->translate('Allow to add host and service comments')
+    );
+    $this->providePermission(
+        'icingadb/command/comment/delete',
+        $this->translate('Allow to delete host and service comments')
+    );
+    $this->providePermission(
+        'icingadb/command/downtime/*',
+        $this->translate('Allow to schedule and delete host and service downtimes')
+    );
+    $this->providePermission(
+        'icingadb/command/downtime/schedule',
+        $this->translate('Allow to schedule host and service downtimes')
+    );
+    $this->providePermission(
+        'icingadb/command/downtime/delete',
+        $this->translate('Allow to delete host and service downtimes')
+    );
+    $this->providePermission(
+        'icingadb/command/process-check-result',
+        $this->translate('Allow to process host and service check results')
+    );
+    $this->providePermission(
+        'icingadb/command/feature/instance',
+        $this->translate('Allow to toggle instance-wide features')
+    );
+    $this->providePermission(
+        'icingadb/command/feature/object/*',
+        $this->translate('Allow to toggle all features on host and service objects')
+    );
+    $this->providePermission(
+        'icingadb/command/feature/object/active-checks',
+        $this->translate('Allow to toggle active checks on host and service objects')
+    );
+    $this->providePermission(
+        'icingadb/command/feature/object/passive-checks',
+        $this->translate('Allow to toggle passive checks on host and service objects')
+    );
+    $this->providePermission(
+        'icingadb/command/feature/object/notifications',
+        $this->translate('Allow to toggle notifications on host and service objects')
+    );
+    $this->providePermission(
+        'icingadb/command/feature/object/event-handler',
+        $this->translate('Allow to toggle event handlers on host and service objects')
+    );
+    $this->providePermission(
+        'icingadb/command/feature/object/flap-detection',
+        $this->translate('Allow to toggle flap detection on host and service objects')
+    );
+    $this->providePermission(
+        'icingadb/command/send-custom-notification',
+        $this->translate('Allow to send custom notifications for hosts and services')
+    );
+
     $this->provideRestriction(
         'icingadb/filter/objects',
         $this->translate('Restrict access to the Icinga objects that match the filter')