feat: RedirectToLogin now honors guest READ permission

Author: ralflang

src/Middleware/RedirectToLogin.php

@@ -7,6 +7,7 @@
 use Exception;
 use Horde\Core\Config\State;
 use Horde\Core\Horde;
+use Horde\Core\Service\PermissionService;
 use Psr\Http\Message\ResponseFactoryInterface;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
@@ -17,42 +18,72 @@
 /**
  * RedirectToLogin middleware
  *
- * Purpose: Redirect to login if not authenticated
+ * Purpose: Redirect to login if not authenticated or if the user lacks
+ * top level read permission on the target app.
  *
  * Reads attribute:
  * - HORDE_AUTHENTICATED_USER the uid, if authenticated
+ * - app the target application name
  *
  */
 class RedirectToLogin implements MiddlewareInterface
 {
     private State $conf;
     private Horde_Registry $registry;
     private ResponseFactoryInterface $responseFactory;
-    public function __construct(Horde_Registry $registry, ResponseFactoryInterface $responseFactory, State $conf)
-    {
+    private ?PermissionService $permissionService;
+
+    public function __construct(
+        Horde_Registry $registry,
+        ResponseFactoryInterface $responseFactory,
+        State $conf,
+        ?PermissionService $permissionService = null,
+    ) {
         $this->registry = $registry;
         $this->responseFactory = $responseFactory;
         $this->conf = $conf;
+        $this->permissionService = $permissionService;
     }
+
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
-        if ($request->getAttribute('HORDE_AUTHENTICATED_USER')) {
+        $user = $request->getAttribute('HORDE_AUTHENTICATED_USER');
+        $app = $request->getAttribute('app');
+
+        // Check app-level read permission if PermissionService is available
+        if ($this->permissionService !== null && $app) {
+            if ($this->permissionService->exists($app)) {
+                // Pass empty string for guests — backend returns guest permissions
+                $checkUser = $user ?: '';
+                if (!$this->permissionService->hasPermission($app, $checkUser, ['read'])) {
+                    return $this->redirectToLogin($request);
+                }
+                // Permission granted — allow through even if not authenticated (guest read)
+                return $handler->handle($request);
+            }
+        }
+
+        // No permission defined or no service — fall back to authentication check
+        if ($user) {
             return $handler->handle($request);
         }
 
+        return $this->redirectToLogin($request);
+    }
+
+    private function redirectToLogin(ServerRequestInterface $request): ResponseInterface
+    {
         $requestUrl = (string) $request->getUri();
         $signedRequestUrl = Horde::signUrl($requestUrl);
 
-        // set baseurl: check if alternative login is set and use it as baseurl
         $configArray = $this->conf->toArray();
-        $configArray['auth']['alternate_login'] ?? null;
+        $alternateLogin = $configArray['auth']['alternate_login'] ?? null;
 
         if (!empty($alternateLogin)) {
             $baseUrl = $alternateLogin;
         } else {
-            // set baseurl: if no alternative login, use Horde login as baseurl
             $baseUrl = $this->registry->getServiceLink('login');
-        };
+        }
 
         $redirectUrl = (string) Horde::url($baseUrl, true)->add('url', $signedRequestUrl);