workbench_admin_per_menu.module

<?php
/**
 * I am a module that provides workbench access control for core drupal menus.
 *
 * @file Workbench Admin Per Menu
 * @author John Allen
 *
 * Modification Log:
 * Name               Date              Description
 * ============================================================================
 * John Allen         11/10/2015        Created
 * John Allen         03/01/2015        Bug fix for ambiguous menus context.
 */

/**
 * Implements hook_permission().
 *
 * I add permissions which will enforce that users in the selected roles can
 * only access menus that are assigned to the same taxonomy they are in
 * Workbench.
 */
function workbench_admin_per_menu_permission() {
  return array(
    'administer workbench admin per menu' => array(
      'title' => t('Administer Workbench Admin Per Menu'),
      'description' => t('Allow users to only work with menus based on their assigned Workbench access.'),
    ),
  );
}

/**
 * I intercept all of the Drupal menu administration 'admin/structure/menu/*'
 * and request callbacks.
 *
 * Implements hook_FORM_ID_alter().
 *
 * @param $items
 */
function workbench_admin_per_menu_menu_alter(&$items) {

  $items['admin/structure/menu']['page callback'] = 'workbench_admin_per_menu_change_menu';
  $items['admin/structure/menu']['access callback'] = 'workbench_admin_per_menu_menu_access';
  unset($items['admin/structure/menu']['access arguments']);
  $items['admin/structure/menu/manage/%menu']['access callback'] = 'workbench_admin_per_menu_menu_access';
  $items['admin/structure/menu/manage/%menu']['access arguments'] = array(4);
  $items['admin/structure/menu/manage/%menu/edit']['access callback'] = 'workbench_admin_per_menu_menu_edit_access';
  $items['admin/structure/menu/manage/%menu/edit']['access arguments'] = array(4);
  $items['admin/structure/menu/manage/%menu/add']['access callback'] = 'workbench_admin_per_menu_menu_access';
  $items['admin/structure/menu/manage/%menu/add']['access arguments'] = array(4);
  $items['admin/structure/menu/item/%menu_link/edit']['access callback'] = 'workbench_admin_per_menu_menu_link_access';
  $items['admin/structure/menu/item/%menu_link/edit']['access arguments'] = array(4);
  $items['admin/structure/menu/item/%menu_link/reset']['access callback'] = 'workbench_admin_per_menu_menu_link_access';
  $items['admin/structure/menu/item/%menu_link/reset']['access arguments'] = array(4);
  $items['admin/structure/menu/item/%menu_link/delete']['access callback'] = 'workbench_admin_per_menu_menu_link_access';
  $items['admin/structure/menu/item/%menu_link/delete']['access arguments'] = array(4);
}

/**
 * I am the access callback for the menu administration overview page.
 *
 * @return bool
 */
function workbench_admin_per_menu_menu_access(){
  if( user_is_anonymous() ){
    return false;
  } else {
    return getWAPMUserHasMenuPermission();
  }
}

/**
 * I am the access callback to check if user has admin rights to edit menus.
 *
 * @return bool
 */
function workbench_admin_per_menu_menu_edit_access(){
  if (getWAPMUserHasDrupalAdminPermission()){
    return true;
  } else {
    return false;
  }
}

/**
 * I am the access callback to check if a user has access to edit a specific
 * menu link option.
 *
 * @param $menu
 * @return bool
 */
function workbench_admin_per_menu_menu_link_access( $menu ){

  // If the user has admin menu rights set by Drupal return here and bypass
  if( getWAPMUserHasDrupalAdminPermission() ) {
    return TRUE;
  }

  $hasAccess = false;
  $userMenuArray = getWAPMUserMenu();

  foreach( $userMenuArray as $item ){

    if($item['menu_name'] === $menu['menu_name']){
      $hasAccess = true;
      break;
    }
  }

  return $hasAccess;
}

/**
 * I alter the Parent Link select list to limit whats displayed based on a users
 * Workbench access if needed.
 *
 * Implements hook_form_FORM_ID_alter()
 *
 * @param $form
 * @param $form_state
 * @param $form_id
 * @return bool
 */
function workbench_admin_per_menu_form_menu_edit_item_alter(&$form, $form_state, $form_id) {

  // If the user has admin menu rights set by Drupal return here and bypass
  if( getWAPMUserHasDrupalAdminPermission() ) {
    return TRUE;
  }

  // the menu form element data is present apply workbench restrictions
  if(isset($form['parent'])){

    // If they are controlled by WAPM give them menu access and then populate
    // the menu select list
    if (getWAPMUserHasMenuPermission()) {

      $userMenuArray = getWAPMUserMenu();
      $allMenuArray = array_keys($form['parent']['#options']);
      $availableMenuOptionArray = array();

      foreach ($userMenuArray as $userMenu) {

        foreach ($allMenuArray as $drupalMenu){

          $userMenuNameToCheck = $userMenu['menu_name'];
          $drupalMenuNameToCheck = explode(':', $drupalMenu)[0];

          if($userMenuNameToCheck === $drupalMenuNameToCheck){
            $availableMenuOptionArray[$drupalMenu] = $form['parent']['#options'][$drupalMenu];
          }
        }
      }

      $form['parent']['#options'] = $availableMenuOptionArray;

      return true;
    }
  }
}

/**
 * Implements hook_form_alter().
 *
 * I alter the menu options in the additional_settings
 *
 * @param $form
 * @param $form_state
 * @param $form_id
 * @return bool
 */
function workbench_admin_per_menu_form_alter(&$form, $form_state, $form_id){

  // If the user has admin menu rights set by Drupal return here and bypass
  if( getWAPMUserHasDrupalAdminPermission() ){
    return true;
  }

  // the menu form element data is present so apply workbench restrictions
  if(isset($form['menu']['link']['parent'])){

    // default to no access
    $form['menu']['#access'] = FALSE;

    // If they are controlled by WAPM give them menu access and then populate
    // the menu select list
    if (getWAPMUserHasMenuPermission()) {

      // if (the page a NOT menu link
      //  OR
      //    is the page in any menu the user has access to
      //  ){ show the menu stuff}
      //  ELSE
      //   { show the error message }

      $form['menu']['#access'] = TRUE;

      $userMenuArray = getWAPMUserMenu();
      $allMenuArray = array_keys($form['menu']['link']['parent']['#options']);
      $availableMenuOptionArray = array();

      foreach ($userMenuArray as $userMenu) {

        foreach ($allMenuArray as $drupalMenu){

          $userMenuNameToCheck = $userMenu['menu_name'];
          $drupalMenuNameToCheck = explode(':', $drupalMenu)[0];

          if($userMenuNameToCheck === $drupalMenuNameToCheck){
            $availableMenuOptionArray[$drupalMenu] = $form['menu']['link']['parent']['#options'][$drupalMenu];
          }
        }
      }


      // if the user can assign a node show their assigned menus ELSE show them
      // the 'no can do'
      if( isNodeAvailableForAssignmentToMenu($availableMenuOptionArray, $form['nid']['#value']) ){

        $form['menu']['link']['parent']['#options'] = $availableMenuOptionArray;

      } else {

        $form['menu']['#access'] = false;

        $form['workbench_admin_per_menu'] = array(
          '#type' => 'fieldset',
          '#title' => t('Menu'),
          '#group' => 'additional_settings',
          '#collapsible' => TRUE,
          '#collapsed' => TRUE,
          '#weight' => 2,
        );

        $menuName = explode(':', $form['menu']['link']['parent']['#default_value'])[0];
        $output = '<p>' . t('This content has already been assigned to a menu for which you do not have access.') . '</p>';
        $form['workbench_admin_per_menu']['help_text'] = array('#markup' => $output);
      }

    }
  }
}

/**
 * I paint the core Drupal menu select screen 'admin/structure/menu' with what
 * menus a user can edit based on their Workbench access and what's configured
 * in the permissions screen per a users role.
 *
 * @return string
 */
function workbench_admin_per_menu_change_menu() {

  // If the user has admin menu rights set by Drupal return here and bypass
  if (getWAPMUserHasDrupalAdminPermission()) {
    return menu_overview_page();
  }

  // get a users menus based on their workbench access
  $menuArray = getWAPMUserMenu();

  // build the array we use for the IN clause for the menu query
  $menuSelectOption = array();

  foreach( $menuArray as $menu ){
    array_push($menuSelectOption, $menu['menu_name']);
  }

  $result = db_select('menu_custom', 'c')
    ->fields('c')
    ->condition('menu_name', $menuSelectOption,'IN')
    ->execute()
    ->fetchAll(PDO::FETCH_ASSOC);

  $header = array(t('Title'), array('data' => t('Operations'), 'colspan' => '3'));
  $rows = array();
  foreach ($result as $menu) {
    $row = array(
      theme('menu_admin_overview', array(
        'title' => $menu['title'],
        'name' => $menu['menu_name'],
        'description' => $menu['description']
      ))
    );
    $row[] = array('data' => l(t('list links'), 'admin/structure/menu/manage/' . $menu['menu_name']));
    //$row[] = array('data' => l(t('edit menu'), 'admin/structure/menu/manage/' . $menu['menu_name'] . '/edit'));
    $row[] = array('data' => l(t('add link'), 'admin/structure/menu/manage/' . $menu['menu_name'] . '/add'));
    $rows[] = $row;
  }

  return theme('table', array('header' => $header, 'rows' => $rows));
}

/**
 * I add the Workbench taxonomy to the menu edit form.
 *
 * Implements hook_form_FORM_ID_alter()
 */
function workbench_admin_per_menu_form_menu_edit_menu_alter(&$form, $form_state){

  $menuName = getWAPMNameFromFormObject( $form );
  $permissionTID = getWAPMMenuPermissionTID( $menuName );

  $form['workbench_admin_per_menu'] = array(
    '#type' => 'fieldset',
    '#title' => t('Workbench Admin Access'),
    '#collapsible' => TRUE,
    '#collapsed' => TRUE,
    '#group' => 'additional_settings'
  );

  $form['workbench_admin_per_menu']['description'] = array(
    '#prefix' => '<div class="description">',
    '#suffix' => '</div>',
    '#markup' => t('Select the Permissions Group to restrict editing access for this menu.'),
  );

  $form['workbench_admin_per_menu'][getWAPMMenuFieldName()] = array(
    '#type' => 'radios',
    '#maxlength' => 999,
    '#options' => getWAPMTaxonomyForMenuEditForm(),
    '#required' => TRUE,
    '#default_value' => $permissionTID
  );

  $form['#submit'][]='workbench_admin_per_menu_submit';
}

/**
 * I am the callback for the menu edit submit form.
 *
 * @param $form
 * @param $form_state
 */
function workbench_admin_per_menu_submit($form, &$form_state){

  $menu_name = getWAPMNameFromFormObject( $form );

  if( strlen( $menu_name ) === 0 ){
    // don't like doing this... wish drupal did it differently and didn't append
    // the string like this.
    $menu_name = 'menu-' . $form_state['input']['menu_name'];
  }

  $IDPermissionNode = $form_state['values'][getWAPMMenuFieldName()];

  // should we insert the values into the db and if so delete and insert.
  if ( isset($IDPermissionNode) && is_numeric($IDPermissionNode) ){

    db_delete( getWAPMLookupTableName() )
      ->condition('menu_name', $menu_name, '=')
      ->execute();

    db_insert( getWAPMLookupTableName() )
      ->fields(array(
        'menu_name' => $menu_name,
        'IDTaxonomyAccessNode' => $IDPermissionNode
      ))
      ->execute();
  }
}

/**
 * I check if a node is NOT assigned to a menu or if a user has access to assign
 * a node to one of their assigned menus.
 *
 * @param $availableMenuOptionArray
 * @param $IDNode
 * @return bool
 */
function isNodeAvailableForAssignmentToMenu($availableMenuOptionArray, $IDNode){

  // this is total crap, basic pages MIGHT default to something else... but
  // they default to the 'navigation' menu so check this for now.
  $defaultMenuName = 'navigation';
  $testOne = false;
  $testTwo = false;
  $result = false;

  // old code...
  // $trail = menu_get_active_trail();
  // $lastInTrail = end($trail);
  // $menuName = $lastInTrail['menu_name'];

  // new FIX for ambiguous places a menu can live in. This value is attached
  // to the actual NODE that's being edited. We will check that one instead of
  // the menu_get_active_trail();
  // if the node already exists check its meno
  if( isset($IDNode) ){

    $theNode = node_load($IDNode);
    $menuName = $theNode->menu['menu_name'];

    // first test if the node is NOT assigned...
    if($defaultMenuName === $menuName){
      $testOne = true;
    }

    // second, test that the menu is in the users available menus
    foreach($availableMenuOptionArray as $key => $value){
      $availableMenu = explode(':', $key)[0];

      if($availableMenu === $menuName){
        $testTwo = true;
        break;
      }
    }

  } else {
    // this is a new node so pass $testOne
    $testOne = true;
    $testTwo = true;
  }

  if($testOne || $testTwo){
    $result = true;
  }

  return $result;
}

/**
 * I return an array that populates the added permissions module form field.
 *
 * @return array
 */
function getWAPMTaxonomyForMenuEditForm(){

  $vid = geWAPMTaxonomyID();

  // do we give them everything or just stuff based on workbench taxonomy?
  if ( isWAPMEnforced() ) {
    $taxonomy = getWAPMUserAssignedTaxonomy();
  } else {
    $taxonomy = taxonomy_get_tree($vid);
  }

  $taxonomyArray = array();

  foreach( $taxonomy as $term ){

    $visualLevel = '';

    // add dashes for as for as many levels deep the term is. mimicking the
    // other workbench screen. this might be done a different way but the output
    // is the same as the other.
    for ( $i = 1; $i <= $term->depth; $i++ ) {

      $visualLevel = $visualLevel . '-';
    }

    // prefix the dashes (-) which indicate the 'level' to the node name
    $display = $visualLevel . $term->name;

    $taxonomyArray[$term->tid] = $display;
  }

  return $taxonomyArray;
}

/**
 * I return the IDTaxonomyAccessNode value if there is one. Else I return an
 * empty string.
 *
 * @param $menu_name - String. I am the name of the menu to find. I am required.
 * @return mixed
 */
function getWAPMMenuPermissionTID( $menu_name ){

  $result = db_select( getWAPMLookupTableName(), 'c' )
    ->fields('c')
    ->condition('menu_name', $menu_name,'=')
    ->execute()
    ->fetchAssoc();

  if( is_array($result) ){
    return $result['IDTaxonomyAccessNode'];
  } else {
    return '';
  }
}

/**
 * I return a users assigned taxonomy.
 *
 * @return array
 */
function getWAPMUserAssignedTaxonomy(){

  $IDTaxonomy = geWAPMTaxonomyID();
  $userAllPermission = getWAPMWorkbenchUserTaxonomyNode();
  $fullTaxonomy = taxonomy_get_tree($IDTaxonomy);
  $result = array();

  // loop over the full taxonomy and pick out the assigned ones
  foreach($userAllPermission as $permission){

    foreach( $fullTaxonomy as $term ){

      if ( $permission === $term->tid ){

        array_push( $result, $term );
        break;
      }
    }
  }

  return $result;
}

/**
 * I return an array of menus used for the menu admin screen.
 *
 * @return mixed
 */
function getWAPMUserMenu(){

  $userAllPermission = getWAPMWorkbenchUserTaxonomyNode();

  if(is_array($userAllPermission) && count($userAllPermission)){
    // now query the look up table for any menus that are associated with the
    // users assigned permissions
    $userMenu = db_select(getWAPMLookupTableName(), 'c')
      ->fields('c')
      ->condition('IDTaxonomyAccessNode', $userAllPermission,'IN')
      ->execute()
      ->fetchAll(PDO::FETCH_ASSOC);

    return $userMenu;
  } else {
    return array();
  }
}

/**
 * I return whether a user should have menus filtered by workbench or not.
 *
 * @return bool
 */
function isWAPMEnforced(){

  // check the users access rights in workbench
  $userAccess = db_select( 'workbench_access_user', 'c' )
    ->fields('c')
    ->condition('uid', getWAPMUserID(),'=')
    ->execute()
    ->fetchAssoc();

  if( is_array($userAccess) && $userAccess['access_id'] === 'permissions' ){
    return false;
  } else {
    return true;
  }
}

/**
 * I return an array of node id that a user has access to.
 *
 * @return array
 */
function getWAPMWorkbenchUserTaxonomyNode(){

  $IDUser = getWAPMUserID();
  $IDTaxonomy = geWAPMTaxonomyID();

  // get the users assigned permission TID's
  $userTopPermission = db_select('workbench_access_user', 'c')
    ->fields('c')
    ->condition('uid', $IDUser,'=')
    ->execute()
    ->fetchAll(PDO::FETCH_ASSOC);

  // now get all the children they can work on
  $userAllPermission = array();

  // loop and put the top level permission IDs into the $userAllPermission, then
  // get their children and put their ID's into the $userAllPermission so we
  // have them in a single array
  foreach($userTopPermission as $row){

    array_push($userAllPermission, $row['access_id']);

    $temp = taxonomy_get_children($row['access_id'], $IDTaxonomy);

    foreach($temp as $childrenTID){
      array_push($userAllPermission, $childrenTID->tid);
    }
  }

  return $userAllPermission;
}

/**
 * I return the global users ID. I am a convince method so the developer wants
 * to return a restricted user ID it's easy to do. Im keeping our powder DRY.
 *
 * @return mixed
 */
function getWAPMUserID(){

  global $user;
  $IDUser = $user->uid;
  return $IDUser;
}

/**
 * I return the machine name of a menu when given a form object.
 *
 * @param $form - I am the menu edit form that was submitted.
 * @return mixed
 */
function getWAPMNameFromFormObject( $form ){
  return $form['menu_name']['#default_value'];
}

/**
 * I return the look up table name that keeps association of menus to
 * permissions.
 *
 * @return string
 */
function getWAPMLookupTableName(){
  return 'workbench_admin_per_menu_menu_workbench_lookup';
}

/**
 * I return the Menu Edit Form field name.
 *
 * @return string
 */
function getWAPMMenuFieldName(){
  return 'workbench_admin_per_menu_permission_taxonomy';
}

/**
 * I return the vid of the taxonomy used for access control by workbench.
 *
 * @return mixed
 */
function geWAPMTaxonomyID(){

  // TODO: What to do about multiple configured taxonomies????

  // get workbenches taxonomies that are assigned as access controls
  $taxonomyArray = variable_get('workbench_access_taxonomy', array());
  $machineName = '';

  foreach ($taxonomyArray as $item) {
    if(is_string($item)){
      $machineName = $item;
    }
  }

  return taxonomy_vocabulary_machine_name_load( $machineName )->vid;
}

/**
 * I return whether a user has Menu permissions access set by Drupal
 *
 * @return bool
 */
function getWAPMUserHasDrupalAdminPermission(){
  if (user_access('administer menu')){
    return true;
  } else {
    return false;
  }
}

/**
 * I return whether a user has Menu permissions access set by Drupal OR has
 * workbench_per_admin_access
 *
 * @return bool
 */
function getWAPMUserHasMenuPermission(){
  if (user_access('administer menu') || user_access('administer workbench admin per menu')){
    return true;
  } else {
    return false;
  }
}