Adjusting ACLs -- allow external group manager to create sub-groups.

Author: krulis-martin

app/V1Module/presenters/GroupExternalAttributesPresenter.php

@@ -94,9 +94,10 @@ public function actionDefault(string $instance, ?string $service, ?string $user)
     }
 
 
-    public function checkAdd()
+    public function checkAdd(string $groupId)
     {
-        if (!$this->groupAcl->canSetExternalAttributes()) {
+        $group = $this->groups->findOrThrow($groupId);
+        if (!$this->groupAcl->canSetExternalAttributes($group)) {
             throw new ForbiddenRequestException();
         }
     }
@@ -128,9 +129,10 @@ public function actionAdd(string $groupId)
         $this->sendSuccessResponse("OK");
     }
 
-    public function checkRemove()
+    public function checkRemove(string $groupId)
     {
-        if (!$this->groupAcl->canSetExternalAttributes()) {
+        $group = $this->groups->findOrThrow($groupId);
+        if (!$this->groupAcl->canSetExternalAttributes($group)) {
             throw new ForbiddenRequestException();
         }
     }

app/V1Module/security/ACL/IGroupPermissions.php

@@ -78,5 +78,5 @@ public function canUnlockStudent(Group $group, User $student): bool;
 
     public function canViewExternalAttributes(): bool;
 
-    public function canSetExternalAttributes(): bool;
+    public function canSetExternalAttributes(Group $group): bool;
 }

app/config/permissions.neon

@@ -79,11 +79,28 @@ permissions:
       resource: group
       actions:
           - viewExternalAttributes
+
+    - allow: true
+      role: scope-group-external
+      resource: group
+      actions:
           - setExternalAttributes
           - addStudent
           - removeStudent
           - addMember
           - removeMember
+          - addSubgroup
+      conditions:
+          - group.isNotArchived
+
+    - allow: true
+      resource: group
+      role: scope-group-external
+      actions:
+          - addSubgroup
+      conditions:
+          - group.isNotArchived
+          - group.isNotExam
 
     - allow: true
       role: student