Jakub Zych
7900f47ba6
The D-07 password-change hook is the existing AccessRevokedEvent, fired inside the write's transaction by a reset, the user's own change and an administrator's password; (*AccessRevokedEvent).PasswordChanged reports those three reasons, and the login rehash fires nothing. The Users screen declares the record action reset_two_factor (danger) behind the new permission golem15.users.reset_two_factor, which no role has by default. It is offered only when a two-factor plugin publishes a classes.TwoFactorAdmin and the user has a second factor; Run calls the service's Reset in the action's transaction.
65 lines
2.1 KiB
Go
65 lines
2.1 KiB
Go
package user
|
|
|
|
import (
|
|
"git.golem15.com/golem15/sm-user-plugin/classes"
|
|
"git.golem15.com/golem15/summercms/modules/pact"
|
|
)
|
|
|
|
const userPermissionTab = "golem15.user::lang.plugin.tab"
|
|
|
|
// Permissions is the plugin's Winter registerPermissions() catalog plus two
|
|
// codes of its own. The four PHP codes default to the developer role;
|
|
// impersonate_user is registered so imported backend roles that name it stay
|
|
// valid, although no screen uses it. The fifth code
|
|
// (classes.PermissionManagePrivilegedGroups) has no default role: only a
|
|
// superuser, or a role that was granted it explicitly, may change the email
|
|
// or password of a privileged-group member or delete one. The sixth
|
|
// (classes.PermissionManageBackendLinks) has no default role either: it
|
|
// links and unlinks another administrator's frontend account on the
|
|
// Administrators screen. The seventh (classes.PermissionResetTwoFactor) has
|
|
// no default role either: it runs the Users screen's "Reset 2FA" action,
|
|
// which a two-factor plugin backs.
|
|
func (*Plugin) Permissions() []pact.Permission {
|
|
return []pact.Permission{
|
|
{
|
|
Code: "golem15.users.access_users",
|
|
Tab: userPermissionTab,
|
|
Label: "golem15.user::lang.plugin.access_users",
|
|
Roles: []string{"developer"},
|
|
},
|
|
{
|
|
Code: "golem15.users.access_groups",
|
|
Tab: userPermissionTab,
|
|
Label: "golem15.user::lang.plugin.access_groups",
|
|
Roles: []string{"developer"},
|
|
},
|
|
{
|
|
Code: "golem15.users.access_settings",
|
|
Tab: userPermissionTab,
|
|
Label: "golem15.user::lang.plugin.access_settings",
|
|
Roles: []string{"developer"},
|
|
},
|
|
{
|
|
Code: "golem15.users.impersonate_user",
|
|
Tab: userPermissionTab,
|
|
Label: "golem15.user::lang.plugin.impersonate_user",
|
|
Roles: []string{"developer"},
|
|
},
|
|
{
|
|
Code: "golem15.users.manage_privileged_groups",
|
|
Tab: userPermissionTab,
|
|
Label: "golem15.user::lang.plugin.manage_privileged_groups",
|
|
},
|
|
{
|
|
Code: classes.PermissionManageBackendLinks,
|
|
Tab: userPermissionTab,
|
|
Label: "golem15.user::lang.plugin.manage_backend_links",
|
|
},
|
|
{
|
|
Code: classes.PermissionResetTwoFactor,
|
|
Tab: userPermissionTab,
|
|
Label: "golem15.user::lang.plugin.reset_two_factor",
|
|
},
|
|
}
|
|
}
|