Add permission model base extensions

_config/security.yml

@@ -0,0 +1,9 @@
+---
+Name: fluentsecurity
+---
+SilverStripe\Security\Member:
+  extensions:
+    fluentmember: TractorCow\Fluent\Extension\FluentMemberExtension
+SilverStripe\Security\Group:
+  extensions:
+    fluentgroup: TractorCow\Fluent\Extension\FluentGroupExtension

src/Extension/FluentGroupExtension.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace TractorCow\Fluent\Extension;
+
+use SilverStripe\Forms\CheckboxSetField;
+use SilverStripe\Forms\FieldList;
+use SilverStripe\ORM\DataExtension;
+use SilverStripe\ORM\ManyManyList;
+use SilverStripe\Security\Group;
+use TractorCow\Fluent\Model\Locale;
+
+/**
+ * Provides fluent-filtered permission control for CMS users
+ *
+ * @method ManyManyList|Locale[] EnabledLocales()
+ * @property Group|FluentGroupExtension $owner
+ */
+class FluentGroupExtension extends DataExtension
+{
+    private static $many_many = [
+        'EnabledLocales' => Locale::class,
+    ];
+
+    public function updateCMSFields(FieldList $fields)
+    {
+        $locales = Locale::get();
+        if ($locales->count() === 0) {
+            return;
+        }
+
+        // Checklist list of visible locales
+        $checkboxSetField = CheckboxSetField::create(
+            'EnabledLocales',
+            _t(
+                __CLASS__ . '.ENABLED_LOCALES',
+                'Enabled in the following locales'
+            ),
+            $locales
+        )->setDescription(_t(
+            __CLASS__ . '.ENABLED_LOCALES_DESCRIPTION',
+            'Note: Leaving this field empty enables this group in all locales.'
+        ));
+
+        $fields->addFieldToTab('Root.Permissions', $checkboxSetField, 'Permissions');
+    }
+}

src/Extension/FluentMemberExtension.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace TractorCow\Fluent\Extension;
+
+use SilverStripe\ORM\DataExtension;
+use SilverStripe\Security\Group;
+use SilverStripe\Security\Member_GroupSet;
+use TractorCow\Fluent\State\FluentState;
+
+class FluentMemberExtension extends DataExtension
+{
+    /**
+     * Update groups
+     *
+     * @param Member_GroupSet $groups
+     */
+    public function updateGroups(Member_GroupSet &$groups)
+    {
+        // Filter groups by those that either have no locales selected (same as selected for all),
+        // or groups that have the current locale selected.
+        $locale = FluentState::singleton()->getLocale();
+
+        $filtered = $groups->filterByCallback(function (Group $group) use ($locale) {
+            /** @var Group|FluentGroupExtension $group */
+            $enabledLocales = $group->EnabledLocales();
+
+            // Enabled if no locales selected
+            if ($enabledLocales->count() === 0) {
+                return true;
+            }
+
+            // Enabled if the current locale is selected
+            if ($enabledLocales->find('Locale', $locale)) {
+                return true;
+            }
+
+            // Group disabled
+            return false;
+        });
+
+        // Adjust group filter
+        $ids = $filtered->column('ID');
+        $groups = $groups->filter('ID', $ids ?: -1);
+    }
+}