Add support to restrict users using defined prefix

* Introduce new restriction 'reporting/prefix'
* Introduce new permission 'reporting/reports/modify'

Author: jhoxhaa

application/controllers/ReportController.php

@@ -67,8 +67,8 @@ public function indexAction()
 
     public function editAction()
     {
-        $this->assertPermission('reporting/reports');
-        $this->addTitleTab($this->translate('Edit Report'));
+        $this->assertPermission('reporting/reports/modify');
+        $this->addTitleTab('Edit Report');
 
         $values = [
             'name'      => $this->report->getName(),
@@ -201,7 +201,7 @@ protected function assembleActions()
 
         $actions = new ActionBar();
 
-        if ($this->hasPermission('reporting/reports')) {
+        if ($this->hasPermission('reporting/reports/modify')) {
             $actions->addLink(
                 'Modify',
                 Url::fromPath('reporting/report/edit', ['id' => $reportId]),

application/controllers/ReportsController.php

@@ -25,7 +25,7 @@ public function indexAction()
     {
         $this->createTabs()->activate('reports');
 
-        if ($this->hasPermission('reporting/reports')) {
+        if ($this->hasPermission('reporting/reports/modify')) {
             $this->addControl(new ButtonLink(
                 $this->translate('New Report'),
                 Url::fromPath('reporting/reports/new'),
@@ -38,22 +38,29 @@ public function indexAction()
         $reports = Report::on($this->getDb())
             ->withColumns(['report.timeframe.name']);
 
+        $this->applyRestriction($reports, 'report.name');
+
         foreach ($reports as $report) {
             $url = Url::fromPath('reporting/report', ['id' => $report->id])->getAbsoluteUrl('&');
 
-            $tableRows[] = Html::tag('tr', ['href' => $url], [
+            $content = [
                 Html::tag('td', null, $report->name),
                 Html::tag('td', null, $report->author),
                 Html::tag('td', null, $report->timeframe->name),
                 Html::tag('td', null, date('Y-m-d H:i', $report->ctime / 1000)),
-                Html::tag('td', null, date('Y-m-d H:i', $report->mtime / 1000)),
-                Html::tag('td', ['class' => 'icon-col'], [
+                Html::tag('td', null, date('Y-m-d H:i', $report->mtime / 1000))
+            ];
+
+            if ($this->hasPermission('reporting/reports/modify')) {
+                $content[] = Html::tag('td', ['class' => 'icon-col'], [
                     new Link(
                         new Icon('edit'),
                         Url::fromPath('reporting/report/edit', ['id' => $report->id])
                     )
-                ])
-            ]);
+                ]);
+            }
+
+            $tableRows[] = Html::tag('tr', ['href' => $url], $content);
         }
 
         if (! empty($tableRows)) {
@@ -89,7 +96,7 @@ public function indexAction()
 
     public function newAction()
     {
-        $this->assertPermission('reporting/reports');
+        $this->assertPermission('reporting/reports/modify');
         $this->addTitleTab($this->translate('New Report'));
 
         $form = (new ReportForm())

configuration.php

@@ -36,6 +36,11 @@
         $this->translate('Allow managing reports')
     );
 
+    $this->providePermission(
+        'reporting/reports/modify',
+        $this->translate('Allow creating, editing and removing reports')
+    );
+
     $this->providePermission(
         'reporting/schedules',
         $this->translate('Allow managing schedules')
@@ -50,4 +55,9 @@
         'reporting/timeframes',
         $this->translate('Allow managing timeframes')
     );
+
+    $this->provideRestriction(
+        'reporting/prefix',
+        $this->translate('Restrict access to reports with the given prefix')
+    );
 }

library/Reporting/Web/Controller.php

@@ -4,8 +4,23 @@
 
 namespace Icinga\Module\Reporting\Web;
 
+use Icinga\Authentication\Auth;
+use ipl\Orm\Query;
+use ipl\Stdlib\Filter;
 use ipl\Web\Compat\CompatController;
 
 class Controller extends CompatController
 {
+    /**
+     * @param Query $query
+     * @param string $column
+     * @return void
+     */
+    protected function applyRestriction(Query $query, string $column)
+    {
+        $prefixes = Auth::getInstance()->getRestrictions('reporting/prefix');
+        if (! empty($prefixes)) {
+            $query->filter(Filter::like($column, $prefixes[0] . '*'));
+        }
+    }
 }

library/Reporting/Web/Forms/ReportForm.php

@@ -10,6 +10,7 @@
 use Icinga\Module\Reporting\Web\Forms\Decorator\CompatDecorator;
 use ipl\Html\Contract\FormSubmitElement;
 use ipl\Html\Form;
+use ipl\Validator\CallbackValidator;
 use ipl\Web\Compat\CompatForm;
 
 class ReportForm extends CompatForm
@@ -49,7 +50,37 @@ protected function assemble()
             'description' => $this->translate(
                 'A unique name of this report. It is used when exporting to pdf, json or csv format'
                 . ' and also when listing the reports in the cli'
-            )
+            ),
+            'validators'    => [
+                'Callback' => function ($value, $validator) {
+                    /** @var CallbackValidator $validator */
+                    $restrictions = Auth::getInstance()->getRestrictions('reporting/prefix');
+                    $prefixes = [];
+                    foreach ($restrictions as $restriction) {
+                        $prefixes = array_merge(
+                             $prefixes,
+                             explode(',', trim($restriction))
+                         );
+                    }
+
+                    if (! empty($prefixes)) {
+                        foreach ($prefixes as $prefix) {
+                            if (substr($value, 0, strlen($prefix)) === $prefix) {
+                                return true;
+                            }
+                        }
+
+                        $validator->addMessage(sprintf(
+                            $this->translate('Please prefix the name with "%s"'),
+                            implode(' | ', $prefixes)
+                        ));
+
+                        return false;
+                    }
+
+                    return true;
+                }
+            ]
         ]);
 
         $this->addElement('select', 'timeframe', [