3 require_once 'financialacls.civix.php';
5 use Civi\Api4\EntityFinancialAccount
;
6 use Civi\Api4\MembershipType
;
7 use CRM_Financialacls_ExtensionUtil
as E
;
11 * Implements hook_civicrm_config().
13 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_config/
15 function financialacls_civicrm_config(&$config) {
16 _financialacls_civix_civicrm_config($config);
20 * @param \Symfony\Component\DependencyInjection\ContainerBuilder $container
22 function financialacls_civicrm_container($container) {
23 $dispatcherDefn = $container->getDefinition('dispatcher');
24 $container->addResource(new \Symfony\Component\Config\
Resource\
FileResource(__FILE__
));
25 $dispatcherDefn->addMethodCall('addListener', ['civi.api4.authorizeRecord::Contribution', '_financialacls_civi_api4_authorizeContribution']);
29 * Implements hook_civicrm_install().
31 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_install
33 function financialacls_civicrm_install() {
34 _financialacls_civix_civicrm_install();
38 * Implements hook_civicrm_postInstall().
40 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_postInstall
42 function financialacls_civicrm_postInstall() {
43 _financialacls_civix_civicrm_postInstall();
47 * Implements hook_civicrm_uninstall().
49 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_uninstall
51 function financialacls_civicrm_uninstall() {
52 _financialacls_civix_civicrm_uninstall();
56 * Implements hook_civicrm_enable().
58 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_enable
60 function financialacls_civicrm_enable() {
61 _financialacls_civix_civicrm_enable();
65 * Implements hook_civicrm_disable().
67 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_disable
69 function financialacls_civicrm_disable() {
70 _financialacls_civix_civicrm_disable();
74 * Implements hook_civicrm_upgrade().
76 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_upgrade
78 function financialacls_civicrm_upgrade($op, CRM_Queue_Queue
$queue = NULL) {
79 return _financialacls_civix_civicrm_upgrade($op, $queue);
83 * Implements hook_civicrm_entityTypes().
85 * Declare entity types provided by this module.
87 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_entityTypes
89 function financialacls_civicrm_entityTypes(&$entityTypes) {
90 _financialacls_civix_civicrm_entityTypes($entityTypes);
94 * Intervene to prevent deletion, where permissions block it.
97 * @param string $objectName
99 * @param array $params
101 * @throws \API_Exception
102 * @throws \CRM_Core_Exception
104 function financialacls_civicrm_pre($op, $objectName, $id, &$params) {
105 if (!financialacls_is_acl_limiting_enabled()) {
108 if ($objectName === 'LineItem' && !empty($params['check_permissions'])) {
109 $operationMap = ['delete' => CRM_Core_Action
::DELETE
, 'edit' => CRM_Core_Action
::UPDATE
, 'create' => CRM_Core_Action
::ADD
];
110 CRM_Financial_BAO_FinancialType
::getAvailableFinancialTypes($types, $operationMap[$op]);
111 if (empty($params['financial_type_id'])) {
112 $params['financial_type_id'] = CRM_Core_DAO
::getFieldValue('CRM_Price_DAO_LineItem', $params['id'], 'financial_type_id');
114 if (!array_key_exists($params['financial_type_id'], $types)) {
115 throw new API_Exception('You do not have permission to ' . $op . ' this line item');
118 if ($objectName === 'FinancialType' && !empty($params['id']) && !empty($params['name'])) {
119 $prevName = CRM_Core_DAO
::getFieldValue('CRM_Financial_DAO_FinancialType', $params['id']);
120 if ($prevName !== $params['name']) {
121 CRM_Core_Session
::setStatus(ts("Changing the name of a Financial Type will result in losing the current permissions associated with that Financial Type.
122 Before making this change you should likely note the existing permissions at Administer > Users and Permissions > Permissions (Access Control),
123 then clicking the Access Control link for your Content Management System, then noting down the permissions for 'CiviCRM: {financial type name} view', etc.
124 Then after making the change of name, reset the permissions to the way they were."), ts('Warning'), 'warning');
130 * Implements hook_civicrm_selectWhereClause().
132 * @link http://wiki.civicrm.org/confluence/display/CRMDOC/hook_civicrm_selectWhereClause
134 function financialacls_civicrm_selectWhereClause($entity, &$clauses) {
135 if (!financialacls_is_acl_limiting_enabled()) {
141 case 'MembershipType':
142 case 'ContributionRecur':
144 $clauses['financial_type_id'] = _financialacls_civicrm_get_type_clause();
148 $clauses['membership_type_id'] = _financialacls_civicrm_get_membership_type_clause();
151 case 'FinancialType':
152 $clauses['id'] = _financialacls_civicrm_get_type_clause();
155 case 'FinancialAccount':
156 $clauses['id'] = _financialacls_civicrm_get_accounts_clause();
164 * Get the clause to limit available types.
168 function _financialacls_civicrm_get_accounts_clause(): string {
169 if (!isset(Civi
::$statics['financial_acls'][__FUNCTION__
][CRM_Core_Session
::getLoggedInContactID()])) {
172 Civi
::$statics['financial_acls'][__FUNCTION__
][CRM_Core_Session
::getLoggedInContactID()] = &$clause;
173 $accounts = (array) EntityFinancialAccount
::get()
174 ->addWhere('account_relationship:name', '=', 'Income Account is')
175 ->addWhere('entity_table', '=', 'civicrm_financial_type')
176 ->addSelect('entity_id', 'financial_account_id')
177 ->addJoin('FinancialType AS financial_type', 'LEFT', [
182 ->execute()->indexBy('financial_account_id');
183 if (!empty($accounts)) {
184 $clause = 'IN (' . implode(',', array_keys($accounts)) . ')';
187 catch (\API_Exception
$e) {
188 // We've already set it to 0 so we can quietly handle this.
191 return Civi
::$statics['financial_acls'][__FUNCTION__
][CRM_Core_Session
::getLoggedInContactID()];
195 * Get the clause to limit available types.
199 function _financialacls_civicrm_get_type_clause(): string {
200 return 'IN (' . implode(',', _financialacls_civicrm_get_accessible_financial_types()) . ')';
204 * Get an array of the ids of accessible financial types.
206 * If none then it will be [0]
210 function _financialacls_civicrm_get_accessible_financial_types(): array {
212 CRM_Financial_BAO_FinancialType
::getAvailableFinancialTypes($types);
216 return array_keys($types);
220 * Get the clause to limit available membership types.
224 * @throws \API_Exception
226 function _financialacls_civicrm_get_membership_type_clause(): string {
227 $financialTypes = _financialacls_civicrm_get_accessible_financial_types();
228 if ($financialTypes === [0] ||
!CRM_Core_Component
::isEnabled('CiviMember')) {
231 $membershipTypes = (array) MembershipType
::get(FALSE)
232 ->addWhere('financial_type_id', 'IN', $financialTypes)->execute()->indexBy('id');
233 return empty($membershipTypes) ?
'= 0' : ('IN (' . implode(',', array_keys($membershipTypes)) . ')');
237 * Remove unpermitted options.
239 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_buildAmount
241 * @param string $component
242 * @param \CRM_Core_Form $form
243 * @param array $feeBlock
245 function financialacls_civicrm_buildAmount($component, $form, &$feeBlock) {
246 if (!financialacls_is_acl_limiting_enabled()) {
250 foreach ($feeBlock as $key => $value) {
251 foreach ($value['options'] as $k => $options) {
252 if (!CRM_Core_Permission
::check('add contributions of type ' . CRM_Contribute_PseudoConstant
::financialType($options['financial_type_id']))) {
253 unset($feeBlock[$key]['options'][$k]);
256 if (empty($feeBlock[$key]['options'])) {
257 unset($feeBlock[$key]);
263 * Remove unpermitted membership types from selection availability..
265 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_membershipTypeValues
267 * @param \CRM_Core_Form $form
268 * @param array $membershipTypeValues
270 function financialacls_civicrm_membershipTypeValues($form, &$membershipTypeValues) {
271 if (!financialacls_is_acl_limiting_enabled()) {
274 $financialTypes = NULL;
275 $financialTypes = CRM_Financial_BAO_FinancialType
::getAvailableFinancialTypes($financialTypes, CRM_Core_Action
::ADD
);
276 foreach ($membershipTypeValues as $id => $type) {
277 if (!isset($financialTypes[$type['financial_type_id']])) {
278 unset($membershipTypeValues[$id]);
286 * @see https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_permission/
288 * @param array $permissions
290 function financialacls_civicrm_permission(&$permissions) {
291 if (!financialacls_is_acl_limiting_enabled()) {
296 'view' => ts('view'),
297 'edit' => ts('edit'),
298 'delete' => ts('delete'),
300 $financialTypes = \CRM_Contribute_BAO_Contribution
::buildOptions('financial_type_id', 'validate');
301 foreach ($financialTypes as $id => $type) {
302 foreach ($actions as $action => $action_ts) {
303 $permissions[$action . ' contributions of type ' . $type] = [
304 ts("CiviCRM: %1 contributions of type %2", [1 => $action_ts, 2 => $type]),
305 ts('%1 contributions of type %2', [1 => $action_ts, 2 => $type]),
309 $permissions['administer CiviCRM Financial Types'] = [
310 ts('CiviCRM: administer CiviCRM Financial Types'),
311 ts('Administer access to Financial Types'),
316 * Listener for 'civi.api4.authorizeRecord::Contribution'
318 * @param \Civi\Api4\Event\AuthorizeRecordEvent $e
319 * @throws \CRM_Core_Exception
321 function _financialacls_civi_api4_authorizeContribution(\Civi\Api4\Event\AuthorizeRecordEvent
$e) {
322 if (!financialacls_is_acl_limiting_enabled()) {
325 if ($e->getEntityName() === 'Contribution') {
326 $contributionID = $e->getRecord()['id'] ??
NULL;
327 $financialTypeID = $e->getRecord()['financial_type_id'] ?? CRM_Core_DAO
::getFieldValue('CRM_Contribute_DAO_Contribution', $contributionID, 'financial_type_id');
328 if (!CRM_Core_Permission
::check(_financialacls_getRequiredPermission($financialTypeID, $e->getActionName()), $e->getUserID())) {
329 $e->setAuthorized(FALSE);
331 if ($e->getActionName() === 'delete') {
332 // First check contribution financial type
333 // Now check permissioned line items & permissioned contribution
334 if (!CRM_Financial_BAO_FinancialType
::checkPermissionedLineItems($contributionID, 'delete', FALSE, $e->getUserID())
336 $e->setAuthorized(FALSE);
343 * Get the permission required to perform this action on this financial type.
345 * @param int $financialTypeID
346 * @param string $action
350 function _financialacls_getRequiredPermission(int $financialTypeID, string $action): string {
351 $financialType = CRM_Core_PseudoConstant
::getName('CRM_Contribute_DAO_Contribution', 'financial_type_id', $financialTypeID);
355 'delete' => 'delete',
357 return $actionMap[$action] . ' contributions of type ' . $financialType;
361 * Remove unpermitted financial types from field Options in search context.
363 * Search context is described as
364 * 'search' => "search: searchable options are returned; labels are translated.",
365 * So this is appropriate to removing the options from search screens.
367 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_fieldOptions
369 * @param string $entity
370 * @param string $field
371 * @param array $options
372 * @param array $params
374 function financialacls_civicrm_fieldOptions($entity, $field, &$options, $params) {
375 if (!financialacls_is_acl_limiting_enabled()) {
378 if (in_array($entity, ['Contribution', 'ContributionRecur'], TRUE) && $field === 'financial_type_id' && $params['context'] === 'search') {
379 $action = CRM_Core_Action
::VIEW
;
380 // At this stage we are only considering the view action. Code from
381 // CRM_Financial_BAO_FinancialType::getAvailableFinancialTypes().
383 CRM_Core_Action
::VIEW
=> 'view',
384 CRM_Core_Action
::UPDATE
=> 'edit',
385 CRM_Core_Action
::ADD
=> 'add',
386 CRM_Core_Action
::DELETE
=> 'delete',
388 $cacheKey = 'available_types_' . $action;
389 if (!isset(\Civi
::$statics['CRM_Financial_BAO_FinancialType'][$cacheKey])) {
390 foreach ($options as $finTypeId => $type) {
391 if (!CRM_Core_Permission
::check($actions[$action] . ' contributions of type ' . $type)) {
392 unset($options[$finTypeId]);
395 \Civi
::$statics['CRM_Financial_BAO_FinancialType'][$cacheKey] = $options;
397 $options = \Civi
::$statics['CRM_Financial_BAO_FinancialType'][$cacheKey];
402 * Is financial acl limiting enabled.
404 * Once this extension is detangled enough to be optional this will go
405 * and the status of the extension rather than the setting will dictate.
409 function financialacls_is_acl_limiting_enabled(): bool {
410 return (bool) Civi
::settings()->get('acl_financial_type');
414 * Clear the statics cache when the setting is enabled or disabled.
416 * Note the setting will eventually disappear in favour of whether
417 * the extension is enabled or disabled.
419 function financialacls_toggle() {
420 unset(\Civi
::$statics['CRM_Financial_BAO_FinancialType']);
423 // --- Functions below this ship commented out. Uncomment as required. ---
426 * Implements hook_civicrm_preProcess().
428 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_preProcess
430 //function financialacls_civicrm_preProcess($formName, &$form) {
435 * Require financial acl permissions for financial screens.
439 function financialacls_civicrm_alterMenu(array &$menu): void
{
440 if (!financialacls_is_acl_limiting_enabled()) {
443 $menu['civicrm/admin/financial/financialType']['access_arguments'] = [['administer CiviCRM Financial Types']];
447 * Implements hook_civicrm_navigationMenu().
449 * @link https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_navigationMenu
451 //function financialacls_civicrm_navigationMenu(&$menu) {
452 // _financialacls_civix_insert_navigation_menu($menu, 'Mailings', array(
453 // 'label' => E::ts('New subliminal message'),
454 // 'name' => 'mailing_subliminal_message',
455 // 'url' => 'civicrm/mailing/subliminal',
456 // 'permission' => 'access CiviMail',
457 // 'operator' => 'OR',
460 // _financialacls_civix_navigationMenu($menu);