Files
bij/app/Helpers/rbac_helper.php
2026-04-21 05:59:39 +07:00

105 lines
2.3 KiB
PHP

<?php
declare(strict_types=1);
use Config\AdminAccess;
if (! function_exists('admin_ion_roles')) {
/**
* Nama grup Ion dari sesi (sudah dinormalisasi string).
*
* @return list<string>
*/
function admin_ion_roles(): array
{
$raw = session()->get('admin_ion_groups');
if (! is_array($raw)) {
return [];
}
$out = [];
foreach ($raw as $g) {
$s = strtolower(trim((string) $g));
if ($s !== '') {
$out[] = $s;
}
}
return array_values(array_unique($out));
}
}
if (! function_exists('rbac_enforce_ion')) {
/**
* Grup Ion hanya relevan bila login dari tabel admin_users (Ion Auth).
* Login `pegawai` saja (tanpa admin terhubung) memakai {@see AdminAccess::$pegawaiPanelFeatures}.
*/
function rbac_enforce_ion(): bool
{
return session()->get('admin_auth_source') === 'admin_users';
}
}
if (! function_exists('hasRole')) {
function hasRole(string $role): bool
{
$want = strtolower(trim($role));
if ($want === '') {
return false;
}
foreach (admin_ion_roles() as $g) {
if ($g === $want) {
return true;
}
}
return false;
}
}
if (! function_exists('hasAnyRole')) {
/**
* @param list<string>|array<int, string> $roles
*/
function hasAnyRole(array $roles): bool
{
foreach ($roles as $r) {
if (hasRole((string) $r)) {
return true;
}
}
return false;
}
}
if (! function_exists('canAccess')) {
/**
* Cek akses fitur berdasarkan `Config\AdminAccess::$features`.
*/
function canAccess(string $feature): bool
{
/** @var AdminAccess $cfg */
$cfg = config('AdminAccess');
if (! isset($cfg->features[$feature])) {
return false;
}
if (! rbac_enforce_ion()) {
return in_array($feature, $cfg->pegawaiPanelFeatures, true);
}
$required = $cfg->features[$feature];
if ($required === []) {
return true;
}
if (admin_ion_roles() === []) {
return false;
}
return hasAnyRole($required);
}
}