Feature/access utilities be fileadmin

.build-v12/.gitignore

@@ -0,0 +1,5 @@
+# Isolated v12 analysis toolchain: only the manifests are tracked.
+/*
+!.gitignore
+!composer.json
+!phpstan.neon

.build-v12/composer.json

@@ -0,0 +1,31 @@
+{
+  "name": "fixpunkt/fp-fileprotector-cs-tools-v12",
+  "description": "Isolated tooling to static-analyse fp_fileprotector against TYPO3 12.4 (lowest supported). Mirror of .build/ but pinned to the v12 line.",
+  "autoload": {
+    "psr-4": {
+      "Fixpunkt\\FpFileprotector\\": "../Classes/"
+    }
+  },
+  "require-dev": {
+    "phpstan/extension-installer": "^1.4",
+    "saschaegerer/phpstan-typo3": "^1.10",
+    "typo3/cms-core": "^12.4",
+	  "typo3/cms-extbase": "*",
+	  "typo3/cms-fluid": "*",
+	  "typo3/cms-frontend": "*",
+	  "typo3/cms-backend": "*",
+	  "typo3/cms-install": "*"
+  },
+  "config": {
+    "allow-plugins": {
+      "typo3/class-alias-loader": true,
+      "typo3/cms-composer-installers": true,
+      "phpstan/extension-installer": true
+    },
+    "policy": {
+      "advisories": {
+        "block": false
+      }
+    }
+  }
+}

.build-v12/phpstan.neon

@@ -0,0 +1,6 @@
+parameters:
+    level: 5
+    paths:
+        - ../Classes
+    bootstrapFiles:
+        - vendor/autoload.php

.build-v13/.gitignore

@@ -0,0 +1,5 @@
+# Isolated dev toolchain: only the manifest is tracked, everything that
+# composer/TYPO3 generates here (vendor, lock, published public assets, …) is not.
+/*
+!.gitignore
+!composer.json

.build-v13/composer.json

@@ -0,0 +1,26 @@
+{
+  "name": "fixpunkt/fp-fileprotector-cs-tools-v13",
+  "description": "Isolated dev tooling (coding standards + static analysis) for fp_fileprotector — not part of the extension package. Mirror of .build/ but pinned to the v13 line.",
+  "autoload": {
+    "psr-4": {
+      "Fixpunkt\\FpFileprotector\\": "../Classes/"
+    }
+  },
+  "require-dev": {
+    "phpstan/extension-installer": "^1.4",
+    "saschaegerer/phpstan-typo3": "^2.1",
+    "typo3/cms-core": "^13.4",
+	  "typo3/cms-extbase": "*",
+	  "typo3/cms-fluid": "*",
+	  "typo3/cms-frontend": "*",
+	  "typo3/cms-backend": "*",
+	  "typo3/cms-install": "*"
+  },
+  "config": {
+    "allow-plugins": {
+      "typo3/class-alias-loader": true,
+      "typo3/cms-composer-installers": true,
+      "phpstan/extension-installer": true
+    }
+  }
+}

.build-v13/phpstan.neon

@@ -0,0 +1,6 @@
+parameters:
+    level: 5
+    paths:
+        - ../Classes
+    bootstrapFiles:
+        - vendor/autoload.php

.build/.gitignore

@@ -0,0 +1,5 @@
+# Isolated v14 analysis toolchain: only the manifests are tracked.
+/*
+!.gitignore
+!composer.json
+!phpstan.neon

.build/composer.json

@@ -0,0 +1,27 @@
+{
+  "name": "fixpunkt/fp-fileprotector-cs-tools",
+  "description": "Isolated tooling to static-analyse fp_fileprotector against TYPO3 14.3 (highest supported).",
+  "autoload": {
+    "psr-4": {
+      "Fixpunkt\\FpFileprotector\\": "../Classes/"
+    }
+  },
+  "require-dev": {
+    "typo3/coding-standards": "^0.8",
+    "phpstan/extension-installer": "^1.4",
+    "saschaegerer/phpstan-typo3": "^3",
+    "typo3/cms-core": "^14.3",
+    "typo3/cms-extbase": "*",
+    "typo3/cms-fluid": "*",
+    "typo3/cms-frontend": "*",
+    "typo3/cms-backend": "*",
+    "typo3/cms-install": "*"
+  },
+  "config": {
+    "allow-plugins": {
+      "typo3/class-alias-loader": true,
+      "typo3/cms-composer-installers": true,
+      "phpstan/extension-installer": true
+    }
+  }
+}

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+# Static analysis + coding standards across the supported TYPO3 versions.
+# Reuses the isolated toolchains in .build/ (v14), .build-v13/ (v13, also hosts
+# the coding-standards tooling) and .build-v12/ (v12) — see DEVELOPMENT.md.
+# All jobs run on PHP 8.4 because fp-social-bridge (dev-feature/typo3-14) requires ^8.4.
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  phpstan:
+    name: PHPStan (TYPO3 ${{ matrix.typo3 }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { typo3: '12.4', php: '8.4', build: '.build-v12', config: '.build-v12/phpstan.neon' }
+          - { typo3: '13.4', php: '8.4', build: '.build-v13', config: '.build-v13/phpstan.neon' }
+          - { typo3: '14.3', php: '8.4', build: '.build', config: 'phpstan.neon' }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '${{ matrix.php }}'
+          tools: composer:v2
+          coverage: none
+      - name: Install tooling (${{ matrix.build }})
+        run: composer update --working-dir=${{ matrix.build }} --no-progress --no-interaction
+      - name: PHPStan
+        run: ${{ matrix.build }}/vendor/bin/phpstan analyse -c ${{ matrix.config }} --no-progress
+
+  coding-standards:
+    name: Coding Standards
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          tools: composer:v2
+          coverage: none
+      - name: Install tooling
+        run: composer update --working-dir=.build --no-progress --no-interaction
+      - name: php-cs-fixer (dry-run)
+        run: .build/vendor/bin/php-cs-fixer fix --config=.php-cs-fixer.dist.php --dry-run --diff --using-cache=no

.gitignore

@@ -7,12 +7,14 @@ vendor/
 vendor/*
 Documentation-GENERATED-temp/
 Documentation-GENERATED-temp/*
+.php-cs-fixer.cache
 
 .env
 public
 public/*
 index.html
 composer.lock
+.DS_Store
 
 
 # User-specific stuff:

Classes/AccessType/AccessTypeInterface.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Fixpunkt\FpFileprotector\AccessType;
+
+interface AccessTypeInterface
+{
+    /** @param array<string, mixed> $protection Raw protection database record */
+    public function isGranted(array $protection): bool;
+    public function getPartials(): string;
+}

Classes/AccessType/BeLoginAccessType.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Fixpunkt\FpFileprotector\AccessType;
+
+use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
+
+class BeLoginAccessType implements AccessTypeInterface
+{
+    /** @param array<string, mixed> $protection Raw protection database record */
+    public function isGranted(array $protection): bool
+    {
+        /** @var BackendUserAuthentication|null $beUser */
+        $beUser = $GLOBALS['BE_USER'] ?? null;
+        if (!$beUser || empty($beUser->user['uid'])) {
+            return false;
+        }
+
+        if ($beUser->isAdmin()) {
+            return true;
+        }
+
+        foreach ($beUser->getFileStorages() as $storage) {
+            if ($storage->getUid() !== (int)$protection['storage']) {
+                continue;
+            }
+            try {
+                $folder = $storage->getFolder((string)$protection['folder']);
+                return $storage->isWithinFileMountBoundaries($folder, false);
+            } catch (\Exception) {
+                return false;
+            }
+        }
+
+        return false;
+    }
+
+    public function getPartials(): string
+    {
+        return 'Access/Be';
+    }
+}

Classes/AccessType/FeLoginAccessType.php

@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Fixpunkt\FpFileprotector\AccessType;
+
+use Doctrine\DBAL\ParameterType;
+use Fixpunkt\FpFileprotector\Utility\FrontendUserUtility;
+use TYPO3\CMS\Core\Database\ConnectionPool;
+
+class FeLoginAccessType implements AccessTypeInterface
+{
+    private const USERS_MM = 'tx_fpfileprotector_protection_feusers_mm';
+    private const GROUPS_MM = 'tx_fpfileprotector_protection_fegroups_mm';
+
+    public function __construct(
+        private readonly FrontendUserUtility $frontendUserUtility,
+        private readonly ConnectionPool $connectionPool,
+    ) {}
+
+    /** @param array<string, mixed> $protection Raw protection database record */
+    public function isGranted(array $protection): bool
+    {
+        if (!(bool)$protection['fe_login']) {
+            return false;
+        }
+
+        $feUser = $this->frontendUserUtility->getCurrentFrontendUser();
+        if (!$feUser || !$feUser->isLoggedIn()) {
+            return false;
+        }
+
+        $protectionUid = (int)$protection['uid'];
+        $userUids = $this->getRelatedUids(self::USERS_MM, $protectionUid);
+        $userGroupUids = $this->getRelatedUids(self::GROUPS_MM, $protectionUid);
+
+        if ($userGroupUids === [] && $userUids === []) {
+            return true;
+        }
+
+        if (in_array($feUser->get('id'), $userUids, true)) {
+            return true;
+        }
+
+        foreach ($feUser->get('groupIds') as $userGroupId) {
+            if (in_array($userGroupId, $userGroupUids, true)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Reads the related foreign uids from an MM table for a protection record.
+     *
+     * @return int[]
+     */
+    private function getRelatedUids(string $mmTable, int $protectionUid): array
+    {
+        $queryBuilder = $this->connectionPool->getConnectionForTable($mmTable)->createQueryBuilder();
+        $uids = $queryBuilder
+            ->select('uid_foreign')
+            ->from($mmTable)
+            ->where(
+                $queryBuilder->expr()->eq('uid_local', $queryBuilder->createNamedParameter($protectionUid, ParameterType::INTEGER))
+            )
+            ->executeQuery()
+            ->fetchFirstColumn();
+
+        return array_map('intval', $uids);
+    }
+
+    public function getPartials(): string
+    {
+        return 'Access/Fe';
+    }
+}

Classes/Controller/FileStorageController.php

@@ -40,7 +40,6 @@ public function editAction(string $id, int $fileStorageUid): ResponseInterface
     /**
      * Updates settings of a file storage.
      *
-     * @param int $id
      * @param int $fileStorageUid
      * @param bool $protected
      * @param bool $protectedByDefault