Merge pull request #36 from halkyon/environment_view

Adding specific permissions for viewers for DNEnvironment.

Author: Stig Lindqvist

code/model/DNEnvironment.php

@@ -12,6 +12,8 @@
  * @method DNProject Project()
  * @method DataList Deployments()
  *
+ * @method ManyManyList Viewers()
+ * @method ManyManyList ViewerGroups()
  * @method ManyManyList Deployers()
  * @method ManyManyList DeployerGroups()
  * @method ManyManyList CanRestoreMembers()
@@ -87,6 +89,8 @@ class DNEnvironment extends DataObject {
 	 * @var array
 	 */
 	public static $many_many = array(
+		"Viewers"            => "Member", // Who can view this environment
+		"ViewerGroups"       => "Group",
 		"Deployers"          => "Member", // Who can deploy to this environment
 		"DeployerGroups" => "Group",
 		"CanRestoreMembers"  => "Member", // Who can restore archive files to this environment
@@ -268,12 +272,23 @@ public function CanCancelPipeline() {
 	}
 
 	/**
-	 * Environments are only viewable by people that can view the parent project
+	 * Environments are only viewable by people that can view the environment.
 	 *
 	 * @param Member $member
 	 * @return boolean
 	 */
 	public function canView($member = null) {
+		if(!$member) $member = Member::currentUser();
+		if(!$member) return false; // Must be logged in to check permissions
+
+		if(Permission::checkMember($member, 'ADMIN')) return true;
+
+		// if no Viewers or ViewerGroups defined, fallback to DNProject::canView permissions
+		if($this->Viewers()->exists() || $this->ViewerGroups()->exists()) {
+			return $this->Viewers()->byID($member->ID)
+				|| $member->inGroups($this->ViewerGroups());
+		}
+
 		return $this->Project()->canView($member);
 	}
 
@@ -767,6 +782,12 @@ public function getCMSFields() {
 		));
 
 		$fields->addFieldsToTab('Root.UserPermissions', array(
+			// The viewers of the environment
+			$this
+				->buildPermissionField('ViewerGroups', 'Viewers', $groups, $members)
+				->setTitle('Who can view this environment?')
+				->setDescription('Groups or Users who can view this environment'),
+
 			// The Main.Deployers
 			$this
 				->buildPermissionField('DeployerGroups', 'Deployers', $groups, $members)

code/model/DNProject.php

@@ -300,7 +300,12 @@ public function getRepository() {
 	 * Provides a DNEnvironmentList of environments found in this project.
 	 */
 	public function DNEnvironmentList() {
-		return DNEnvironment::get()->filter('ProjectID', $this->ID)->setProjectID($this->ID);
+		return DNEnvironment::get()
+			->filter('ProjectID', $this->ID)
+			->setProjectID($this->ID)
+			->filterByCallBack(function($item) {
+				return $item->canView();
+			});
 	}
 
 	/**

tests/DNEnvironmentTest.php

@@ -26,11 +26,20 @@ public function testPermissions() {
 		$environment = $this->getEnvironment();
 
 		// Check deployer / restorer permissions
+		$viewer = $this->objFromFixture('Member', 'viewer');
+		$viewerbygroup = $this->objFromFixture('Member', 'viewerbygroup');
 		$deployer = $this->objFromFixture('Member', 'deployer');
 		$deployerbygroup = $this->objFromFixture('Member', 'deployerbygroup');
 		$restorer = $this->objFromFixture('Member', 'restorer');
 		$restorerbygroup = $this->objFromFixture('Member', 'restorerbygroup');
 
+		$random = new Member(array('Email' => 'random@example.com'));
+		$random->write();
+
+		$this->assertFalse($environment->canView($random));
+		$this->assertTrue($environment->canView($viewer));
+		$this->assertTrue($environment->canView($viewerbygroup));
+
 		$this->assertTrue($environment->canDeploy($deployer));
 		$this->assertTrue($environment->canDeploy($deployerbygroup));
 		$this->assertFalse($environment->canDeploy($restorer));
@@ -88,6 +97,17 @@ public function testPermissions() {
 		$this->assertFalse($environment->canAbort($approverbygroup));
 		$this->assertTrue($environment->canAbort($canceller));
 		$this->assertTrue($environment->canAbort($cancellerbygroup));
+	}
 
+	public function testViewerPermissionInheritedFromProjectIfNotConfigured() {
+		$environment = $this->objFromFixture('DNEnvironment', 'dev');
+		$viewerbygroup = $this->objFromFixture('Member', 'viewerbygroup');
+
+		$random = new Member(array('Email' => 'random@example.com'));
+		$random->write();
+
+		$this->assertFalse($environment->canView($random));
+		$this->assertTrue($environment->canView($viewerbygroup));
 	}
+
 }

tests/DNEnvironmentTest.yml

@@ -1,4 +1,8 @@
 Member:
+  viewer:
+    Email: viewer@example.com
+  viewerbygroup:
+    Email: viewer2@example.com
   deployer:
     Email: deployer@example.com
   deployerbygroup:
@@ -32,6 +36,9 @@ Member:
   cancellerbygroup:
     Email: canceller2@example.com
 Group:
+  viewer:
+    Title: Viewers
+    Members: =>Member.viewerbygroup
   deployer:
     Title: deployers
     Members: =>Member.deployerbygroup
@@ -59,10 +66,13 @@ Group:
 DNProject:
   testproject:
     Name: 'testproject'
+    Viewers: =>Group.viewer
 DNEnvironment:
   uat:
     Name: uat
     Project: =>DNProject.testproject
+    Viewers: =>Member.viewer
+    ViewerGroups: =>Group.viewer
     Deployers: =>Member.deployer
     DeployerGroups: =>Group.deployer
     CanRestoreMembers: =>Member.restorer
@@ -79,3 +89,6 @@ DNEnvironment:
     PipelineApproverGroups: =>Group.approver
     PipelineCancellers: =>Member.canceller
     PipelineCancellerGroups: =>Group.canceller
+  dev:
+    Name: dev
+    Project: =>DNProject.testproject