L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-76583 core_external: Implement Privacy API for core_external

Browse Source 
AMOS BEGIN
 MOV [privacy:metadata:serviceusers,core_webservice],[privacy:metadata:serviceusers,core_external]
 MOV [privacy:metadata:serviceusers:iprestriction,core_webservice],[privacy:metadata:serviceusers:iprestriction,core_external]
 MOV [privacy:metadata:serviceusers:timecreated,core_webservice],[privacy:metadata:serviceusers:timecreated,core_external]
 MOV [privacy:metadata:serviceusers:userid,core_webservice],[privacy:metadata:serviceusers:userid,core_external]
 MOV [privacy:metadata:serviceusers:validuntil,core_webservice],[privacy:metadata:serviceusers:validuntil,core_external]
 MOV [privacy:metadata:tokens,core_webservice],[privacy:metadata:tokens,core_external]
 MOV [privacy:metadata:tokens:creatorid,core_webservice],[privacy:metadata:tokens:creatorid,core_external]
 MOV [privacy:metadata:tokens:iprestriction,core_webservice],[privacy:metadata:tokens:iprestriction,core_external]
 MOV [privacy:metadata:tokens:lastaccess,core_webservice],[privacy:metadata:tokens:lastaccess,core_external]
 MOV [privacy:metadata:tokens:privatetoken,core_webservice],[privacy:metadata:tokens:privatetoken,core_external]
 MOV [privacy:metadata:tokens:timecreated,core_webservice],[privacy:metadata:tokens:timecreated,core_external]
 MOV [privacy:metadata:tokens:token,core_webservice],[privacy:metadata:tokens:token,core_external]
 MOV [privacy:metadata:tokens:tokentype,core_webservice],[privacy:metadata:tokens:tokentype,core_external]
 MOV [privacy:metadata:tokens:userid,core_webservice],[privacy:metadata:tokens:userid,core_external]
 MOV [privacy:metadata:tokens:validuntil,core_webservice],[privacy:metadata:tokens:validuntil,core_external]
 MOV [privacy:request:notexportedsecurity,core_webservice],[privacy:request:notexportedsecurity,core_external]
AMOS END
This commit is contained in:
Andrew Nicols
2023-01-19 07:33:35 +08:00
parent 0392551bcb
commit fa676b4776
5 changed files with 432 additions and 354 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lang/en/external.php
+41
View File
@@ -0,0 +1,41 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Strings for component 'webservice', language 'en', branch 'MOODLE_20_STABLE'
*
* @package core_webservice
* @copyright 1999 onwards Martin Dougiamas {@link http://moodle.com}
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
$string['privacy:metadata:serviceusers'] = 'A list of users who can use a certain external service';
$string['privacy:metadata:serviceusers:iprestriction'] = 'IP restricted to use the service';
$string['privacy:metadata:serviceusers:timecreated'] = 'The date when the record was created';
$string['privacy:metadata:serviceusers:userid'] = 'The ID of the user';
$string['privacy:metadata:serviceusers:validuntil'] = 'The date that the authorisation is valid until';
$string['privacy:metadata:tokens'] = 'A record of tokens for interacting with Moodle through web services or Mobile applications.';
$string['privacy:metadata:tokens:creatorid'] = 'The ID of the user who created the token';
$string['privacy:metadata:tokens:iprestriction'] = 'IP restricted to use this token';
$string['privacy:metadata:tokens:lastaccess'] = 'The date when the token was last used';
$string['privacy:metadata:tokens:privatetoken'] = 'A more private token occasionally used to validate certain operations, such as SSO';
$string['privacy:metadata:tokens:timecreated'] = 'The date when the token was created';
$string['privacy:metadata:tokens:token'] = 'The user\'s token';
$string['privacy:metadata:tokens:tokentype'] = 'The type of token';
$string['privacy:metadata:tokens:userid'] = 'The ID of the user whose token it is';
$string['privacy:metadata:tokens:validuntil'] = 'The date that the token is valid until';
$string['privacy:request:notexportedsecurity'] = 'Not exported for security reasons';
$string['services'] = 'External services';
lang/en/webservice.php
+1 -16
View File
@@ -144,22 +144,7 @@ $string['postrestparam'] = 'PHP code for REST (POST request)';
$string['potusers'] = 'Not authorised users';
$string['potusersmatching'] = 'Not authorised users matching';
$string['print'] = 'Print all';
$string['privacy:metadata:serviceusers'] = 'A list of users who can use a certain external service';
$string['privacy:metadata:serviceusers:iprestriction'] = 'IP restricted to use the service';
$string['privacy:metadata:serviceusers:timecreated'] = 'The date when the record was created';
$string['privacy:metadata:serviceusers:userid'] = 'The ID of the user';
$string['privacy:metadata:serviceusers:validuntil'] = 'The date that the authorisation is valid until';
$string['privacy:metadata:tokens'] = 'A record of tokens for interacting with Moodle through web services or Mobile applications.';
$string['privacy:metadata:tokens:creatorid'] = 'The ID of the user who created the token';
$string['privacy:metadata:tokens:iprestriction'] = 'IP restricted to use this token';
$string['privacy:metadata:tokens:lastaccess'] = 'The date when the token was last used';
$string['privacy:metadata:tokens:privatetoken'] = 'A more private token occasionally used to validate certain operations, such as SSO';
$string['privacy:metadata:tokens:timecreated'] = 'The date when the token was created';
$string['privacy:metadata:tokens:token'] = 'The user\'s token';
$string['privacy:metadata:tokens:tokentype'] = 'The type of token';
$string['privacy:metadata:tokens:userid'] = 'The ID of the user whose token it is';
$string['privacy:metadata:tokens:validuntil'] = 'The date that the token is valid until';
$string['privacy:request:notexportedsecurity'] = 'Not exported for security reasons';
$string['privacy:metadata'] = 'The WebService API does not store any data';
$string['protocol'] = 'Protocol';
$string['removefunction'] = 'Remove';
$string['removefunctionconfirm'] = 'Do you really want to remove function "{$a->function}" from service "{$a->service}"?';
lib/external/classes/privacy/provider.php
Vendored
+329
View File
@@ -0,0 +1,329 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
namespace core_external\privacy;
use context;
use context_user;
use core_privacy\local\metadata\collection;
use core_privacy\local\request\approved_contextlist;
use core_privacy\local\request\transform;
use core_privacy\local\request\writer;
use core_privacy\local\request\userlist;
use core_privacy\local\request\approved_userlist;
/**
* Data provider class.
*
* @package core_external
* @copyright 2018 Frédéric Massart
* @author Frédéric Massart <[email protected]>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class provider implements
\core_privacy\local\metadata\provider,
\core_privacy\local\request\core_userlist_provider,
\core_privacy\local\request\subsystem\provider {
/**
* Returns metadata.
*
* @param collection $collection The initialised collection to add items to.
* @return collection A listing of user data stored through this system.
*/
public static function get_metadata(collection $collection) : collection {
$collection->add_database_table('external_tokens', [
'token' => 'privacy:metadata:tokens:token',
'privatetoken' => 'privacy:metadata:tokens:privatetoken',
'tokentype' => 'privacy:metadata:tokens:tokentype',
'userid' => 'privacy:metadata:tokens:userid',
'creatorid' => 'privacy:metadata:tokens:creatorid',
'iprestriction' => 'privacy:metadata:tokens:iprestriction',
'validuntil' => 'privacy:metadata:tokens:validuntil',
'timecreated' => 'privacy:metadata:tokens:timecreated',
'lastaccess' => 'privacy:metadata:tokens:lastaccess',
], 'privacy:metadata:tokens');
$collection->add_database_table('external_services_users', [
'userid' => 'privacy:metadata:serviceusers:userid',
'iprestriction' => 'privacy:metadata:serviceusers:iprestriction',
'validuntil' => 'privacy:metadata:serviceusers:validuntil',
'timecreated' => 'privacy:metadata:serviceusers:timecreated',
], 'privacy:metadata:serviceusers');
return $collection;
}
/**
* Get the list of contexts that contain user information for the specified user.
*
* @param int $userid The user to search.
* @return \core_privacy\local\request\contextlist $contextlist The contextlist containing the list of contexts
* used in this plugin.
*/
public static function get_contexts_for_userid(int $userid): \core_privacy\local\request\contextlist {
$contextlist = new \core_privacy\local\request\contextlist();
$sql = "
SELECT ctx.id
FROM {external_tokens} t
JOIN {context} ctx
ON ctx.instanceid = t.userid
AND ctx.contextlevel = :userlevel
WHERE t.userid = :userid1
OR t.creatorid = :userid2";
$contextlist->add_from_sql($sql, ['userlevel' => CONTEXT_USER, 'userid1' => $userid, 'userid2' => $userid]);
$sql = "
SELECT ctx.id
FROM {external_services_users} su
JOIN {context} ctx
ON ctx.instanceid = su.userid
AND ctx.contextlevel = :userlevel
WHERE su.userid = :userid";
$contextlist->add_from_sql($sql, ['userlevel' => CONTEXT_USER, 'userid' => $userid]);
return $contextlist;
}
/**
* Get the list of users within a specific context.
*
* @param userlist $userlist The userlist containing the list of users who have data in this context/plugin combination.
*/
public static function get_users_in_context(userlist $userlist) {
global $DB;
$context = $userlist->get_context();
if (!$context instanceof \context_user) {
return;
}
$userid = $context->instanceid;
$hasdata = false;
$hasdata = $hasdata || $DB->record_exists_select('external_tokens', 'userid = ? OR creatorid = ?', [$userid, $userid]);
$hasdata = $hasdata || $DB->record_exists('external_services_users', ['userid' => $userid]);
if ($hasdata) {
$userlist->add_user($userid);
}
}
/**
* Export all user data for the specified user, in the specified contexts.
*
* @param approved_contextlist $contextlist The approved contexts to export information for.
*/
public static function export_user_data(approved_contextlist $contextlist) {
global $DB;
$userid = $contextlist->get_user()->id;
$contexts = array_reduce($contextlist->get_contexts(), function($carry, $context) use ($userid) {
if ($context->contextlevel == CONTEXT_USER) {
if ($context->instanceid == $userid) {
$carry['has_mine'] = true;
} else {
$carry['others'][] = $context->instanceid;
}
}
return $carry;
}, [
'has_mine' => false,
'others' => []
]);
$path = [get_string('services', 'core_external')];
// Exporting my stuff.
if ($contexts['has_mine']) {
$data = [];
// Exporting my tokens.
$sql = "
SELECT t.*, s.name as externalservicename
FROM {external_tokens} t
JOIN {external_services} s
ON s.id = t.externalserviceid
WHERE t.userid = :userid
ORDER BY t.id";
$recordset = $DB->get_recordset_sql($sql, ['userid' => $userid]);
foreach ($recordset as $record) {
if (!isset($data['tokens'])) {
$data['tokens'] = [];
}
$data['tokens'][] = static::transform_token($record);
}
$recordset->close();
// Exporting the services I have access to.
$sql = "
SELECT su.*, s.name as externalservicename
FROM {external_services_users} su
JOIN {external_services} s
ON s.id = su.externalserviceid
WHERE su.userid = :userid
ORDER BY su.id";
$recordset = $DB->get_recordset_sql($sql, ['userid' => $userid]);
foreach ($recordset as $record) {
if (!isset($data['services_user'])) {
$data['services_user'] = [];
}
$data['services_user'][] = [
'external_service' => $record->externalservicename,
'ip_restriction' => $record->iprestriction,
'valid_until' => $record->validuntil ? transform::datetime($record->validuntil) : null,
'created_on' => transform::datetime($record->timecreated),
];
}
$recordset->close();
if (!empty($data)) {
writer::with_context(context_user::instance($userid))->export_data($path, (object) $data);
};
}
// Exporting the tokens I created.
if (!empty($contexts['others'])) {
list($insql, $inparams) = $DB->get_in_or_equal($contexts['others'], SQL_PARAMS_NAMED);
$sql = "
SELECT t.*, s.name as externalservicename
FROM {external_tokens} t
JOIN {external_services} s
ON s.id = t.externalserviceid
WHERE t.userid $insql
AND t.creatorid = :userid1
AND t.userid <> :userid2
ORDER BY t.userid, t.id";
$params = array_merge($inparams, ['userid1' => $userid, 'userid2' => $userid]);
$recordset = $DB->get_recordset_sql($sql, $params);
static::recordset_loop_and_export($recordset, 'userid', [], function($carry, $record) {
$carry[] = static::transform_token($record);
return $carry;
}, function($userid, $data) use ($path) {
writer::with_context(context_user::instance($userid))->export_related_data($path, 'created_by_you', (object) [
'tokens' => $data
]);
});
}
}
/**
* Delete all data for all users in the specified context.
*
* @param context $context The specific context to delete data for.
*/
public static function delete_data_for_all_users_in_context(context $context) {
if ($context->contextlevel != CONTEXT_USER) {
return;
}
static::delete_user_data($context->instanceid);
}
/**
* Delete multiple users within a single context.
*
* @param approved_userlist $userlist The approved context and user information to delete information for.
*/
public static function delete_data_for_users(approved_userlist $userlist) {
$context = $userlist->get_context();
if ($context instanceof \context_user) {
static::delete_user_data($context->instanceid);
}
}
/**
* Delete all user data for the specified user, in the specified contexts.
*
* @param approved_contextlist $contextlist The approved contexts and user information to delete information for.
*/
public static function delete_data_for_user(approved_contextlist $contextlist) {
$userid = $contextlist->get_user()->id;
foreach ($contextlist as $context) {
if ($context->contextlevel == CONTEXT_USER && $context->instanceid == $userid) {
static::delete_user_data($context->instanceid);
break;
}
}
}
/**
* Delete user data.
*
* @param int $userid The user ID.
* @return void
*/
protected static function delete_user_data($userid) {
global $DB;
$DB->delete_records('external_tokens', ['userid' => $userid]);
$DB->delete_records('external_services_users', ['userid' => $userid]);
}
/**
* Transform a token entry.
*
* @param object $record The token record.
* @return array
*/
protected static function transform_token($record) {
$notexportedstr = get_string('privacy:request:notexportedsecurity', 'core_external');
return [
'external_service' => $record->externalservicename,
'token' => $notexportedstr,
'private_token' => $record->privatetoken ? $notexportedstr : null,
'ip_restriction' => $record->iprestriction,
'valid_until' => $record->validuntil ? transform::datetime($record->validuntil) : null,
'created_on' => transform::datetime($record->timecreated),
'last_access' => $record->lastaccess ? transform::datetime($record->lastaccess) : null,
];
}
/**
* Loop and export from a recordset.
*
* @param \moodle_recordset $recordset The recordset.
* @param string $splitkey The record key to determine when to export.
* @param mixed $initial The initial data to reduce from.
* @param callable $reducer The function to return the dataset, receives current dataset, and the current record.
* @param callable $export The function to export the dataset, receives the last value from $splitkey and the dataset.
* @return void
*/
protected static function recordset_loop_and_export(\moodle_recordset $recordset, $splitkey, $initial,
callable $reducer, callable $export) {
$data = $initial;
$lastid = null;
foreach ($recordset as $record) {
if ($lastid && $record->{$splitkey} != $lastid) {
$export($lastid, $data);
$data = $initial;
}
$data = $reducer($data, $record);
$lastid = $record->{$splitkey};
}
$recordset->close();
if (!empty($lastid)) {
$export($lastid, $data);
}
}
}
webservice/tests/privacy/provider_test.php → lib/external/tests/privacy/provider_test.php
Vendored
+55 -30
View File
@@ -17,42 +17,41 @@
/**
* Data provider tests.
*
* @package core_webservice
* @package core_external
* @category test
* @copyright 2018 Frédéric Massart
* @author Frédéric Massart <fred@branchup.tech>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
namespace core_webservice\privacy;
namespace core_external\privacy;
defined('MOODLE_INTERNAL') || die();
global $CFG;
use core_privacy\tests\provider_testcase;
use core_external\privacy\provider;
use core_privacy\local\request\approved_contextlist;
use core_privacy\local\request\approved_userlist;
use core_privacy\local\request\transform;
use core_privacy\local\request\writer;
use core_webservice\privacy\provider;
use core_privacy\local\request\approved_userlist;
require_once($CFG->dirroot . '/webservice/lib.php');
use core_privacy\tests\provider_testcase;
/**
* Data provider testcase class.
* External subsytem testcase class.
*
* @package core_webservice
* @package core_external
* @category test
* @copyright 2018 Frédéric Massart
* @author Frédéric Massart <fred@branchup.tech>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class provider_test extends provider_testcase {
public function setUp(): void {
$this->resetAfterTest();
}
public function test_get_contexts_for_userid() {
/**
* Test the external service get_contexts_for_userid function.
*
* @covers \core_external\privacy\provider::get_contexts_for_userid
*/
public function test_get_contexts_for_userid(): void {
$dg = $this->getDataGenerator();
$u1 = $dg->create_user();
$u2 = $dg->create_user();
@@ -90,7 +89,12 @@ class provider_test extends provider_testcase {
$this->assertTrue(in_array($u5ctx->id, $contextids));
}
public function test_delete_data_for_user() {
/**
* Test delete_data_for_user
*
* @covers \core_external\privacy\provider::delete_data_for_user
*/
public function test_delete_data_for_user(): void {
global $DB;
$dg = $this->getDataGenerator();
@@ -112,20 +116,25 @@ class provider_test extends provider_testcase {
$this->assertTrue($DB->record_exists('external_services_users', ['userid' => $u2->id]));
// Delete in another context, nothing happens.
provider::delete_data_for_user(new approved_contextlist($u2, 'core_webservice', [$u1ctx->id]));
provider::delete_data_for_user(new approved_contextlist($u2, 'core_external', [$u1ctx->id]));
$this->assertEquals(2, $DB->count_records('external_tokens', ['userid' => $u1->id]));
$this->assertEquals(1, $DB->count_records('external_tokens', ['userid' => $u2->id]));
$this->assertTrue($DB->record_exists('external_services_users', ['userid' => $u1->id]));
$this->assertTrue($DB->record_exists('external_services_users', ['userid' => $u2->id]));
// Delete in my context.
provider::delete_data_for_user(new approved_contextlist($u2, 'core_webservice', [$u2ctx->id]));
provider::delete_data_for_user(new approved_contextlist($u2, 'core_external', [$u2ctx->id]));
$this->assertEquals(2, $DB->count_records('external_tokens', ['userid' => $u1->id]));
$this->assertEquals(0, $DB->count_records('external_tokens', ['userid' => $u2->id]));
$this->assertTrue($DB->record_exists('external_services_users', ['userid' => $u1->id]));
$this->assertFalse($DB->record_exists('external_services_users', ['userid' => $u2->id]));
}
/**
* Test delete_data_for_all_users_in_context
*
* @covers \core_external\privacy\provider::delete_data_for_all_users_in_context
*/
public function test_delete_data_for_all_users_in_context() {
global $DB;
@@ -161,6 +170,10 @@ class provider_test extends provider_testcase {
}
/**
* Test the export_user_data function.
* @covers \core_external\privacy\provider::export_user_data
*/
public function test_export_data_for_user() {
global $DB;
@@ -170,21 +183,29 @@ class provider_test extends provider_testcase {
$u1ctx = \context_user::instance($u1->id);
$u2ctx = \context_user::instance($u2->id);
$path = [get_string('webservices', 'core_webservice')];
$path = [get_string('services', 'core_external')];
$yearago = time() - YEARSECS;
$hourago = time() - HOURSECS;
$s = $this->create_service(['name' => 'Party time!']);
$this->create_token(['userid' => $u1->id, 'timecreated' => $yearago]);
$this->create_token(['userid' => $u1->id, 'creatorid' => $u2->id, 'iprestriction' => '127.0.0.1',
'lastaccess' => $hourago]);
$this->create_token(['userid' => $u2->id, 'iprestriction' => '192.168.1.0/24', 'lastaccess' => $yearago,
'externalserviceid' => $s->id]);
$this->create_token([
'userid' => $u1->id,
'creatorid' => $u2->id,
'iprestriction' => '127.0.0.1',
'lastaccess' => $hourago,
]);
$this->create_token([
'userid' => $u2->id,
'iprestriction' => '192.168.1.0/24',
'lastaccess' => $yearago,
'externalserviceid' => $s->id,
]);
$this->create_service_user(['externalserviceid' => $s->id, 'userid' => $u2->id]);
// User 1 exporting user 2 context does not give anything.
writer::reset();
provider::export_user_data(new approved_contextlist($u1, 'core_webservice', [$u2ctx->id]));
provider::export_user_data(new approved_contextlist($u1, 'core_external', [$u2ctx->id]));
$data = writer::with_context($u1ctx)->get_data($path);
$this->assertEmpty($data);
$data = writer::with_context($u1ctx)->get_related_data($path, 'created_by_you');
@@ -196,7 +217,7 @@ class provider_test extends provider_testcase {
// User 1 exporting their context.
writer::reset();
provider::export_user_data(new approved_contextlist($u1, 'core_webservice', [$u1ctx->id, $u2ctx->id]));
provider::export_user_data(new approved_contextlist($u1, 'core_external', [$u1ctx->id, $u2ctx->id]));
$data = writer::with_context($u1ctx)->get_data($path);
$this->assertFalse(isset($data->services_user));
$this->assertCount(2, $data->tokens);
@@ -213,7 +234,7 @@ class provider_test extends provider_testcase {
// User 2 exporting their context.
writer::reset();
provider::export_user_data(new approved_contextlist($u2, 'core_webservice', [$u1ctx->id, $u2ctx->id]));
provider::export_user_data(new approved_contextlist($u2, 'core_external', [$u1ctx->id, $u2ctx->id]));
$data = writer::with_context($u2ctx)->get_data($path);
$this->assertCount(1, $data->tokens);
$this->assertEquals('Party time!', $data->tokens[0]['external_service']);
@@ -233,10 +254,12 @@ class provider_test extends provider_testcase {
/**
* Test that only users with a user context are fetched.
*
* @covers \core_external\privacy\provider::get_users_in_context
*/
public function test_get_users_in_context() {
$component = 'core_webservice';
$component = 'core_external';
// Create user u1.
$u1 = $this->getDataGenerator()->create_user();
$u1ctx = \context_user::instance($u1->id);
@@ -271,7 +294,7 @@ class provider_test extends provider_testcase {
provider::get_users_in_context($userlist5);
$this->assertCount(0, $userlist5);
// Create a webservice.
// Create a service.
$s = $this->create_service();
// Create a ws token for u1.
$this->create_token(['userid' => $u1->id]);
@@ -317,10 +340,12 @@ class provider_test extends provider_testcase {
/**
* Test that data for users in approved userlist is deleted.
*
* @covers \core_external\privacy\provider::delete_data_for_users
*/
public function test_delete_data_for_users() {
$component = 'core_webservice';
$component = 'core_external';
// Create user u1.
$u1 = $this->getDataGenerator()->create_user();
$u1ctx = \context_user::instance($u1->id);
@@ -337,7 +362,7 @@ class provider_test extends provider_testcase {
$u5 = $this->getDataGenerator()->create_user();
$u5ctx = \context_user::instance($u5->id);
// Create a webservice.
// Create a service.
$s = $this->create_service();
// Create a ws token for u1.
$this->create_token(['userid' => $u1->id]);
@@ -427,7 +452,7 @@ class provider_test extends provider_testcase {
'enabled' => '1',
'requiredcapability' => '',
'restrictedusers' => '0',
'component' => 'core_webservice',
'component' => 'core_external',
'timecreated' => time(),
'timemodified' => time(),
'shortname' => 'service' . $i,
webservice/classes/privacy/provider.php
+6 -308
View File
@@ -14,325 +14,23 @@
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Data provider.
*
* @package core_webservice
* @copyright 2018 Frédéric Massart
* @author Frédéric Massart <[email protected]>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
namespace core_webservice\privacy;
defined('MOODLE_INTERNAL') || die();
use context;
use context_user;
use core_privacy\local\metadata\collection;
use core_privacy\local\request\approved_contextlist;
use core_privacy\local\request\transform;
use core_privacy\local\request\writer;
use core_privacy\local\request\userlist;
use core_privacy\local\request\approved_userlist;
/**
* Data provider class.
* Privacy provider class for the core_webservice component.
*
* @package core_webservice
* @copyright 2018 Frédéric Massart
* @author Frédéric Massart <[email protected]>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class provider implements
\core_privacy\local\metadata\provider,
\core_privacy\local\request\core_userlist_provider,
\core_privacy\local\request\subsystem\provider {
class provider implements \core_privacy\local\metadata\null_provider {
/**
* Returns metadata.
* Get the lang string identifier for the reason that no data is returned by the Privacy API.
*
* @param collection $collection The initialised collection to add items to.
* @return collection A listing of user data stored through this system.
* @return string
*/
public static function get_metadata(collection $collection) : collection {
$collection->add_database_table('external_tokens', [
'token' => 'privacy:metadata:tokens:token',
'privatetoken' => 'privacy:metadata:tokens:privatetoken',
'tokentype' => 'privacy:metadata:tokens:tokentype',
'userid' => 'privacy:metadata:tokens:userid',
'creatorid' => 'privacy:metadata:tokens:creatorid',
'iprestriction' => 'privacy:metadata:tokens:iprestriction',
'validuntil' => 'privacy:metadata:tokens:validuntil',
'timecreated' => 'privacy:metadata:tokens:timecreated',
'lastaccess' => 'privacy:metadata:tokens:lastaccess',
], 'privacy:metadata:tokens');
$collection->add_database_table('external_services_users', [
'userid' => 'privacy:metadata:serviceusers:userid',
'iprestriction' => 'privacy:metadata:serviceusers:iprestriction',
'validuntil' => 'privacy:metadata:serviceusers:validuntil',
'timecreated' => 'privacy:metadata:serviceusers:timecreated',
], 'privacy:metadata:serviceusers');
return $collection;
}
/**
* Get the list of contexts that contain user information for the specified user.
*
* @param int $userid The user to search.
* @return contextlist $contextlist The contextlist containing the list of contexts used in this plugin.
*/
public static function get_contexts_for_userid(int $userid) : \core_privacy\local\request\contextlist {
$contextlist = new \core_privacy\local\request\contextlist();
$sql = "
SELECT ctx.id
FROM {external_tokens} t
JOIN {context} ctx
ON ctx.instanceid = t.userid
AND ctx.contextlevel = :userlevel
WHERE t.userid = :userid1
OR t.creatorid = :userid2";
$contextlist->add_from_sql($sql, ['userlevel' => CONTEXT_USER, 'userid1' => $userid, 'userid2' => $userid]);
$sql = "
SELECT ctx.id
FROM {external_services_users} su
JOIN {context} ctx
ON ctx.instanceid = su.userid
AND ctx.contextlevel = :userlevel
WHERE su.userid = :userid";
$contextlist->add_from_sql($sql, ['userlevel' => CONTEXT_USER, 'userid' => $userid]);
return $contextlist;
}
/**
* Get the list of users within a specific context.
*
* @param userlist $userlist The userlist containing the list of users who have data in this context/plugin combination.
*/
public static function get_users_in_context(userlist $userlist) {
global $DB;
$context = $userlist->get_context();
if (!$context instanceof \context_user) {
return;
}
$userid = $context->instanceid;
$hasdata = false;
$hasdata = $hasdata || $DB->record_exists_select('external_tokens', 'userid = ? OR creatorid = ?', [$userid, $userid]);
$hasdata = $hasdata || $DB->record_exists('external_services_users', ['userid' => $userid]);
if ($hasdata) {
$userlist->add_user($userid);
}
}
/**
* Export all user data for the specified user, in the specified contexts.
*
* @param approved_contextlist $contextlist The approved contexts to export information for.
*/
public static function export_user_data(approved_contextlist $contextlist) {
global $DB;
$userid = $contextlist->get_user()->id;
$contexts = array_reduce($contextlist->get_contexts(), function($carry, $context) use ($userid) {
if ($context->contextlevel == CONTEXT_USER) {
if ($context->instanceid == $userid) {
$carry['has_mine'] = true;
} else {
$carry['others'][] = $context->instanceid;
}
}
return $carry;
}, [
'has_mine' => false,
'others' => []
]);
$path = [get_string('webservices', 'core_webservice')];
// Exporting my stuff.
if ($contexts['has_mine']) {
$data = [];
// Exporting my tokens.
$sql = "
SELECT t.*, s.name as externalservicename
FROM {external_tokens} t
JOIN {external_services} s
ON s.id = t.externalserviceid
WHERE t.userid = :userid
ORDER BY t.id";
$recordset = $DB->get_recordset_sql($sql, ['userid' => $userid]);
foreach ($recordset as $record) {
if (!isset($data['tokens'])) {
$data['tokens'] = [];
}
$data['tokens'][] = static::transform_token($record);
}
$recordset->close();
// Exporting the services I have access to.
$sql = "
SELECT su.*, s.name as externalservicename
FROM {external_services_users} su
JOIN {external_services} s
ON s.id = su.externalserviceid
WHERE su.userid = :userid
ORDER BY su.id";
$recordset = $DB->get_recordset_sql($sql, ['userid' => $userid]);
foreach ($recordset as $record) {
if (!isset($data['services_user'])) {
$data['services_user'] = [];
}
$data['services_user'][] = [
'external_service' => $record->externalservicename,
'ip_restriction' => $record->iprestriction,
'valid_until' => $record->validuntil ? transform::datetime($record->validuntil) : null,
'created_on' => transform::datetime($record->timecreated),
];
}
$recordset->close();
if (!empty($data)) {
writer::with_context(context_user::instance($userid))->export_data($path, (object) $data);
};
}
// Exporting the tokens I created.
if (!empty($contexts['others'])) {
list($insql, $inparams) = $DB->get_in_or_equal($contexts['others'], SQL_PARAMS_NAMED);
$sql = "
SELECT t.*, s.name as externalservicename
FROM {external_tokens} t
JOIN {external_services} s
ON s.id = t.externalserviceid
WHERE t.userid $insql
AND t.creatorid = :userid1
AND t.userid <> :userid2
ORDER BY t.userid, t.id";
$params = array_merge($inparams, ['userid1' => $userid, 'userid2' => $userid]);
$recordset = $DB->get_recordset_sql($sql, $params);
static::recordset_loop_and_export($recordset, 'userid', [], function($carry, $record) {
$carry[] = static::transform_token($record);
return $carry;
}, function($userid, $data) use ($path) {
writer::with_context(context_user::instance($userid))->export_related_data($path, 'created_by_you', (object) [
'tokens' => $data
]);
});
}
}
/**
* Delete all data for all users in the specified context.
*
* @param context $context The specific context to delete data for.
*/
public static function delete_data_for_all_users_in_context(context $context) {
if ($context->contextlevel != CONTEXT_USER) {
return;
}
static::delete_user_data($context->instanceid);
}
/**
* Delete multiple users within a single context.
*
* @param approved_userlist $userlist The approved context and user information to delete information for.
*/
public static function delete_data_for_users(approved_userlist $userlist) {
$context = $userlist->get_context();
if ($context instanceof \context_user) {
static::delete_user_data($context->instanceid);
}
}
/**
* Delete all user data for the specified user, in the specified contexts.
*
* @param approved_contextlist $contextlist The approved contexts and user information to delete information for.
*/
public static function delete_data_for_user(approved_contextlist $contextlist) {
$userid = $contextlist->get_user()->id;
foreach ($contextlist as $context) {
if ($context->contextlevel == CONTEXT_USER && $context->instanceid == $userid) {
static::delete_user_data($context->instanceid);
break;
}
}
}
/**
* Delete user data.
*
* @param int $userid The user ID.
* @return void
*/
protected static function delete_user_data($userid) {
global $DB;
$DB->delete_records('external_tokens', ['userid' => $userid]);
$DB->delete_records('external_services_users', ['userid' => $userid]);
}
/**
* Transform a token entry.
*
* @param object $record The token record.
* @return array
*/
protected static function transform_token($record) {
$notexportedstr = get_string('privacy:request:notexportedsecurity', 'core_webservice');
return [
'external_service' => $record->externalservicename,
'token' => $notexportedstr,
'private_token' => $record->privatetoken ? $notexportedstr : null,
'ip_restriction' => $record->iprestriction,
'valid_until' => $record->validuntil ? transform::datetime($record->validuntil) : null,
'created_on' => transform::datetime($record->timecreated),
'last_access' => $record->lastaccess ? transform::datetime($record->lastaccess) : null,
];
}
/**
* Loop and export from a recordset.
*
* @param \moodle_recordset $recordset The recordset.
* @param string $splitkey The record key to determine when to export.
* @param mixed $initial The initial data to reduce from.
* @param callable $reducer The function to return the dataset, receives current dataset, and the current record.
* @param callable $export The function to export the dataset, receives the last value from $splitkey and the dataset.
* @return void
*/
protected static function recordset_loop_and_export(\moodle_recordset $recordset, $splitkey, $initial,
callable $reducer, callable $export) {
$data = $initial;
$lastid = null;
foreach ($recordset as $record) {
if ($lastid && $record->{$splitkey} != $lastid) {
$export($lastid, $data);
$data = $initial;
}
$data = $reducer($data, $record);
$lastid = $record->{$splitkey};
}
$recordset->close();
if (!empty($lastid)) {
$export($lastid, $data);
}
public static function get_reason(): string {
return 'privacy:metadata';
}
}