ConfigService.php

<?php

/**
 * SPDX-FileCopyrightText: 2020 Nextcloud GmbH and Nextcloud contributors
 * SPDX-License-Identifier: AGPL-3.0-or-later
 */

declare(strict_types=1);

namespace OCA\Deck\Service;

use OCA\Deck\AppInfo\Application;
use OCA\Deck\BadRequestException;
use OCA\Deck\Exceptions\FederationDisabledException;
use OCA\Deck\NoPermissionException;
use OCP\IConfig;
use OCP\IGroup;
use OCP\IGroupManager;
use OCP\IUserSession;

class ConfigService {
	public const SETTING_BOARD_NOTIFICATION_DUE_OFF = 'off';
	public const SETTING_BOARD_NOTIFICATION_DUE_ASSIGNED = 'assigned';
	public const SETTING_BOARD_NOTIFICATION_DUE_ALL = 'all';
	public const SETTING_BOARD_NOTIFICATION_DUE_DEFAULT = self::SETTING_BOARD_NOTIFICATION_DUE_ASSIGNED;

	private const SWIMLANE_CONFIG_KEYS = ['swimlaneMode', 'swimlaneLabelOrder', 'swimlaneUserOrder'];

	private ?string $userId = null;

	public function __construct(
		private readonly IConfig $config,
		private readonly IGroupManager $groupManager,
	) {
	}

	public function getUserId(): ?string {
		if (!$this->userId) {
			// We cannot use DI for the userId or UserSession as the ConfigService
			// is initiated too early before the session is actually loaded
			$user = \OCP\Server::get(IUserSession::class)->getUser();
			$this->userId = $user ? $user->getUID() : null;
		}

		return $this->userId;
	}

	public function getAll(): array {
		$userId = $this->getUserId();
		if ($userId === null) {
			return [];
		}

		$data = [
			'calendar' => $this->isCalendarEnabled(),
			'cardDetailsInModal' => $this->isCardDetailsInModal(),
			'cardIdBadge' => $this->isCardIdBadgeEnabled()
		];
		if ($this->groupManager->isAdmin($userId)) {
			$data['groupLimit'] = $this->get('groupLimit');
			$data['federationEnabled'] = $this->get('federationEnabled');
		}
		return $data;
	}

	/**
	 * @return bool|array{id: string, displayname: string}[]
	 * @throws NoPermissionException
	 */
	public function get(string $key) {
		[$scope] = explode(':', $key, 2);
		switch ($scope) {
			case 'groupLimit':
				if ($this->getUserId() === null || !$this->groupManager->isAdmin($this->getUserId())) {
					throw new NoPermissionException('You must be admin to get the group limit');
				}
				return $this->getGroupLimit();
			case 'federationEnabled':
				return $this->config->getAppValue(Application::APP_ID, 'federationEnabled', 'no') === 'yes';
			case 'calendar':
				if ($this->getUserId() === null) {
					return false;
				}
				return (bool)$this->config->getUserValue($this->getUserId(), Application::APP_ID, 'calendar', true);
			case 'cardDetailsInModal':
				if ($this->getUserId() === null) {
					return false;
				}
				return (bool)$this->config->getUserValue($this->getUserId(), Application::APP_ID, 'cardDetailsInModal', true);
			case 'cardIdBadge':
				if ($this->getUserId() === null) {
					return false;
				}
				return (bool)$this->config->getUserValue($this->getUserId(), Application::APP_ID, 'cardIdBadge', false);
		}
		return false;
	}

	public function isCalendarEnabled(?int $boardId = null): bool {
		$userId = $this->getUserId();
		if ($userId === null) {
			return false;
		}

		$appConfigState = $this->config->getAppValue(Application::APP_ID, 'calendar', 'yes') === 'yes';
		$defaultState = (bool)$this->config->getUserValue($userId, Application::APP_ID, 'calendar', $appConfigState);
		if ($boardId === null) {
			return $defaultState;
		}

		return (bool)$this->config->getUserValue($userId, Application::APP_ID, 'board:' . $boardId . ':calendar', $defaultState);
	}

	public function isCardDetailsInModal(?int $boardId = null): bool {
		$userId = $this->getUserId();
		if ($userId === null) {
			return false;
		}

		$defaultState = (bool)$this->config->getUserValue($userId, Application::APP_ID, 'cardDetailsInModal', true);
		if ($boardId === null) {
			return $defaultState;
		}

		return (bool)$this->config->getUserValue($userId, Application::APP_ID, 'board:' . $boardId . ':cardDetailsInModal', $defaultState);
	}

	public function isCardIdBadgeEnabled(): bool {
		$userId = $this->getUserId();
		if ($userId === null) {
			return false;
		}
		$appConfigState = $this->config->getAppValue(Application::APP_ID, 'cardIdBadge', 'yes') === 'no';
		$defaultState = (bool)$this->config->getUserValue($userId, Application::APP_ID, 'cardIdBadge', $appConfigState);

		return (bool)$this->config->getUserValue($userId, Application::APP_ID, 'cardIdBadge', $defaultState);
	}

	public function ensureFederationEnabled() {
		if (!$this->get('federationEnabled')) {
			throw new FederationDisabledException();
		}
		// @TODO fine tune these config values to respect incoming and outgoing federation separately
		if ($this->config->getAppValue('files_sharing', 'outgoing_server2server_share_enabled', 'no') !== 'yes') {
			throw new FederationDisabledException();
		}
		if ($this->config->getAppValue('files_sharing', 'incoming_server2server_share_enabled', 'no') !== 'yes') {
			throw new FederationDisabledException();
		}
	}

	public function set($key, $value) {
		$userId = $this->getUserId();
		if ($userId === null) {
			throw new NoPermissionException('Must be logged in to set user config');
		}

		$result = null;
		[$scope] = explode(':', $key, 2);
		switch ($scope) {
			case 'groupLimit':
				if (!$this->groupManager->isAdmin($userId)) {
					throw new NoPermissionException('You must be admin to set the group limit');
				}
				$result = $this->setGroupLimit($value);
				break;
			case 'federationEnabled':
				if (!$this->groupManager->isAdmin($userId)) {
					throw new NoPermissionException('You must be admin to set the federation enabled setting');
				}
				$this->config->setAppValue(Application::APP_ID, 'federationEnabled', (string)$value);
				$result = $value;
				break;
			case 'calendar':
				$this->config->setUserValue($userId, Application::APP_ID, 'calendar', (string)$value);
				$result = $value;
				break;
			case 'cardDetailsInModal':
				$this->config->setUserValue($userId, Application::APP_ID, 'cardDetailsInModal', (string)$value);
				$result = $value;
				break;
			case 'cardIdBadge':
				$this->config->setUserValue($userId, Application::APP_ID, 'cardIdBadge', (string)$value);
				$result = $value;
				break;
			case 'board':
				// extra check that user only send one of the allowed board settings and not something random
				$parts = explode(':', $key, 3);
				if (count($parts) < 3) {
					break;
				}
				$boardId = $parts[1];
				$boardConfigKey = $parts[2];
				if ($boardId === '' || $boardConfigKey === '') {
					throw new BadRequestException('Board config key must be in the form board:<id>:<setting>');
				}
				if ($boardConfigKey === 'notify-due' && !in_array($value, [self::SETTING_BOARD_NOTIFICATION_DUE_ALL, self::SETTING_BOARD_NOTIFICATION_DUE_ASSIGNED, self::SETTING_BOARD_NOTIFICATION_DUE_OFF], true)) {
					throw new BadRequestException('Board notification option must be one of: off, assigned, all');
				}
				if (in_array($boardConfigKey, self::SWIMLANE_CONFIG_KEYS, true)) {
					// Shared board-level setting (visible to every board member).
					// EDIT permission is enforced in ConfigController::setValue(),
					// whose board:(\d+): match requires a numeric board id — so a
					// numeric id is required here too, otherwise the permission
					// check could be bypassed.
					if (!ctype_digit($boardId)) {
						throw new BadRequestException('Board id must be numeric');
					}
					$this->validateSwimlaneValue($boardConfigKey, $value);
					$this->config->setAppValue(Application::APP_ID, $key, (string)$value);
				} else {
					$this->config->setUserValue($userId, Application::APP_ID, $key, (string)$value);
				}
				$result = $value;
		}
		return $result;
	}

	/**
	 * Shared swimlane settings live in app config and are delivered to every
	 * board member on board load, so reject malformed values before storing.
	 */
	private function validateSwimlaneValue(string $boardConfigKey, mixed $value): void {
		if ($boardConfigKey === 'swimlaneMode') {
			if (!in_array($value, ['none', 'labels', 'assignees'], true)) {
				throw new BadRequestException('Swimlane mode must be one of: none, labels, assignees');
			}
			return;
		}

		// swimlaneLabelOrder / swimlaneUserOrder: JSON array of lane ids
		// (label ids, user ids or the '__none__' catch-all lane).
		if (!is_string($value) || strlen($value) > 8192) {
			throw new BadRequestException('Swimlane order must be a JSON array of lane ids');
		}
		$order = json_decode($value, true);
		if (!is_array($order) || !array_is_list($order) || count($order) > 1000) {
			throw new BadRequestException('Swimlane order must be a JSON array of lane ids');
		}
		foreach ($order as $laneId) {
			$isIntId = is_int($laneId);
			$isStringId = is_string($laneId) && $laneId !== '' && strlen($laneId) <= 64;
			if (!$isIntId && !$isStringId) {
				throw new BadRequestException('Swimlane order entries must be label ids, user ids or "__none__"');
			}
		}
	}

	/**
	 * @return string[]
	 */
	private function setGroupLimit(array $value): array {
		$groups = [];
		foreach ($value as $group) {
			$groups[] = $group['id'];
		}
		$data = implode(',', $groups);
		$this->config->setAppValue(Application::APP_ID, 'groupLimit', $data);
		return $groups;
	}

	private function getGroupLimitList(): array {
		$value = $this->config->getAppValue(Application::APP_ID, 'groupLimit', '');
		$groups = explode(',', $value);
		if ($value === '') {
			return [];
		}
		return $groups;
	}

	/** @return array{id: string, displayname: string}[] */
	private function getGroupLimit() {
		$groups = $this->getGroupLimitList();
		$groups = array_map(function (string $groupId): ?array {
			/** @var IGroup $groups */
			$group = $this->groupManager->get($groupId);
			if ($group === null) {
				return null;
			}
			return [
				'id' => $group->getGID(),
				'displayname' => $group->getDisplayName(),
			];
		}, $groups);
		return array_filter($groups);
	}

	public function getAttachmentFolder(?string $userId = null): string {
		if ($userId === null && $this->getUserId() === null) {
			throw new NoPermissionException('Must be logged in get the attachment folder');
		}

		return $this->config->getUserValue($userId ?? $this->getUserId(), 'deck', 'attachment_folder', '/Deck');
	}

	public function setAttachmentFolder(?string $userId, string $path): void {
		if ($userId === null && $this->getUserId() === null) {
			throw new NoPermissionException('Must be logged in get the attachment folder');
		}

		$this->config->setUserValue($userId ?? $this->getUserId(), 'deck', 'attachment_folder', $path);
	}
}