Component Revision with new Logging Infrastructure

components/ILIAS/AccessControl/AccessControl.php

@@ -20,6 +20,16 @@
 
 namespace ILIAS;
 
+use ILIAS\AccessControl\PublicInterface\Access;
+use ILIAS\AccessControl\PublicInterface\RBAC;
+use ILIAS\AccessControl\PublicInterface\DefaultRBAC;
+use ILIAS\AccessControl\User\UserIdProviderProxy;
+use ILIAS\AccessControl\Tree\RepositoryTreeAccessProxy;
+use ILIAS\AccessControl\Object\ObjectDataAccessProxy;
+use ILIAS\AccessControl\Object\ObjectDefinitionAccessProxy;
+use ILIAS\Database\PDO\External;
+use ILIAS\HTTP\GlobalHttpState;
+
 class AccessControl implements Component\Component
 {
     public function init(
@@ -32,6 +42,55 @@ public function init(
         array | \ArrayAccess &$pull,
         array | \ArrayAccess &$internal,
     ): void {
+        // Public surface
+        $define[] = Access::class;
+        $define[] = RBAC::class;
+
+        // Internal proxies (concrete classes — no interfaces)
+        $internal[UserIdProviderProxy::class] = static fn(): UserIdProviderProxy => new UserIdProviderProxy();
+        $internal[RepositoryTreeAccessProxy::class] = static fn(): RepositoryTreeAccessProxy => new RepositoryTreeAccessProxy();
+        $internal[ObjectDataAccessProxy::class] = static fn(): ObjectDataAccessProxy => new ObjectDataAccessProxy();
+        $internal[ObjectDefinitionAccessProxy::class] = static fn(): ObjectDefinitionAccessProxy => new ObjectDefinitionAccessProxy();
+
+        // Internal RBAC services (legacy concrete classes)
+        $internal[\ilRbacReview::class] = static fn(): \ilRbacReview => new \ilRbacReview(
+            $use[External::class],
+            $use[\ILIAS\Logging\Logger\LoggerFactoryInterface::class]->getLazy('ac'),
+        );
+
+        $internal[\ilRbacSystem::class] = static fn(): \ilRbacSystem => new \ilRbacSystem(
+            $internal[UserIdProviderProxy::class],
+            $use[External::class],
+            $internal[\ilRbacReview::class],
+            $internal[RepositoryTreeAccessProxy::class],
+            $use[GlobalHttpState::class],
+            $pull[\ILIAS\Refinery\Factory::class],
+            $internal[ObjectDataAccessProxy::class],
+        );
+
+        $internal[\ilRbacAdmin::class] = static fn(): \ilRbacAdmin => new \ilRbacAdmin(
+            $use[External::class],
+            $internal[\ilRbacReview::class],
+            $use[\ILIAS\Logging\Logger\LoggerFactoryInterface::class]->getLazy('ac'),
+        );
+
+        // Public implementations (in case of RBAC for legacy reasons only)
+        $implement[RBAC::class] = static fn(): RBAC => new DefaultRBAC(
+            $internal[\ilRbacReview::class],
+            $internal[\ilRbacSystem::class],
+            $internal[\ilRbacAdmin::class],
+        );
+
+        $implement[Access::class] = static fn(): Access => new \ilAccess(
+            $internal[UserIdProviderProxy::class],
+            $use[External::class],
+            $internal[\ilRbacSystem::class],
+            $internal[RepositoryTreeAccessProxy::class],
+            $internal[ObjectDefinitionAccessProxy::class],
+            $use[\ILIAS\Logging\Logger\LoggerFactoryInterface::class]->getLazy('ac'),
+        );
+
+        // Setup agents and assets
         $contribute[\ILIAS\Setup\Agent::class] = static fn() =>
             new \ilAccessControlSetupAgent(
                 $pull[\ILIAS\Refinery\Factory::class]

components/ILIAS/AccessControl/classes/class.ilAccess.php

@@ -18,17 +18,24 @@
 
 declare(strict_types=1);
 
+use ILIAS\User\PublicInterface;
+use ILIAS\AccessControl\Object\ObjectDefinitionAccessProxy;
+use ILIAS\AccessControl\Tree\RepositoryTreeAccessProxy;
+use ILIAS\AccessControl\User\UserIdProviderProxy;
+use ILIAS\Logging\Logger\LoggerInterface;
+use ILIAS\AccessControl\PublicInterface\Access;
+
 /**
- * Class ilAccessHandler
- * Checks access for ILIAS objects
+ * Checks access for ILIAS objects.
+ *
  * @author Alex Killing <alex.killing@gmx.de>
  * @author Sascha Hofmann <saschahofmann@gmx.de>
  */
-class ilAccess implements ilAccessHandler
+class ilAccess implements Access
 {
     private const MAX_CACHE_SIZE = 1000;
 
-    protected ilOrgUnitPositionAccess $ilOrgUnitPositionAccess;
+    protected ?ilOrgUnitPositionAccess $ilOrgUnitPositionAccess = null;
     protected array $obj_tree_cache;
     protected array $obj_type_cache;
     protected array $obj_id_cache;
@@ -50,26 +57,18 @@ class ilAccess implements ilAccessHandler
     protected array $stored_rbac_access = [];
     protected array $current_result_element = [];
 
-    protected ilRbacSystem $rbacsystem;
-    protected ilObjUser $user;
-    protected ilLogger $ac_logger;
-    protected ilDBInterface $db;
-    protected ilTree $repositoryTree;
-    protected ilObjectDefinition $objDefinition;
-
     protected ?ilLanguage $language = null;
 
-    public function __construct()
-    {
-        global $DIC;
-
-        $this->user = $DIC->user();
-        $this->db = $DIC->database();
-        $this->rbacsystem = $DIC['rbacsystem'];
+    public function __construct(
+        private UserIdProviderProxy $user,
+        private ilDBInterface $db,
+        private ilRbacSystem $rbacsystem,
+        private RepositoryTreeAccessProxy $repositoryTree,
+        private ObjectDefinitionAccessProxy $objDefinition,
+        private LoggerInterface $ac_logger
+    ) {
         $this->results = [];
         $this->current_info = new ilAccessInfo();
-        $this->repositoryTree = $DIC->repositoryTree();
-        $this->objDefinition = $DIC['objDefinition'];
 
         // use function enable to switch on/off tests (only cache is used so far)
         $this->cache = true;
@@ -82,10 +81,6 @@ public function __construct()
         $this->obj_type_cache = [];
         $this->obj_tree_cache = [];
         $this->ac_cache = [];
-
-        $this->ilOrgUnitPositionAccess = new ilOrgUnitPositionAccess($this);
-
-        $this->ac_logger = ilLoggerFactory::getLogger('ac');
     }
 
     private function getLanguage(): ilLanguage
@@ -733,12 +728,17 @@ public function enable(string $a_str, bool $a_bool): void
     // OrgUnit Positions
     //
 
+    private function positionAccess(): \ilOrgUnitPositionAccess
+    {
+        return $this->ilOrgUnitPositionAccess ?? $this->ilOrgUnitPositionAccess = new ilOrgUnitPositionAccess($this);
+    }
+
     /**
      * @inheritdoc
      */
     public function filterUserIdsForCurrentUsersPositionsAndPermission(array $user_ids, string $permission): array
     {
-        return $this->ilOrgUnitPositionAccess->filterUserIdsForCurrentUsersPositionsAndPermission(
+        return $this->positionAccess()->filterUserIdsForCurrentUsersPositionsAndPermission(
             $user_ids,
             $permission
         );
@@ -749,7 +749,7 @@ public function filterUserIdsForCurrentUsersPositionsAndPermission(array $user_i
      */
     public function filterUserIdsForUsersPositionsAndPermission(array $user_ids, int $for_user_id, string $permission): array
     {
-        return $this->ilOrgUnitPositionAccess->filterUserIdsForUsersPositionsAndPermission(
+        return $this->positionAccess()->filterUserIdsForUsersPositionsAndPermission(
             $user_ids,
             $for_user_id,
             $permission
@@ -761,15 +761,15 @@ public function filterUserIdsForUsersPositionsAndPermission(array $user_ids, int
      */
     public function isCurrentUserBasedOnPositionsAllowedTo(string $permission, array $on_user_ids): bool
     {
-        return $this->ilOrgUnitPositionAccess->isCurrentUserBasedOnPositionsAllowedTo($permission, $on_user_ids);
+        return $this->positionAccess()->isCurrentUserBasedOnPositionsAllowedTo($permission, $on_user_ids);
     }
 
     /**
      * @inheritdoc
      */
     public function isUserBasedOnPositionsAllowedTo(int $which_user_id, string $permission, array $on_user_ids): bool
     {
-        return $this->ilOrgUnitPositionAccess->isUserBasedOnPositionsAllowedTo(
+        return $this->positionAccess()->isUserBasedOnPositionsAllowedTo(
             $which_user_id,
             $permission,
             $on_user_ids
@@ -781,39 +781,39 @@ public function isUserBasedOnPositionsAllowedTo(int $which_user_id, string $perm
      */
     public function checkPositionAccess(string $pos_perm, int $ref_id): bool
     {
-        return $this->ilOrgUnitPositionAccess->checkPositionAccess($pos_perm, $ref_id);
+        return $this->positionAccess()->checkPositionAccess($pos_perm, $ref_id);
     }
 
     /**
      * @inheritdoc
      */
     public function checkRbacOrPositionPermissionAccess(string $rbac_perm, string $pos_perm, int $ref_id): bool
     {
-        return $this->ilOrgUnitPositionAccess->checkRbacOrPositionPermissionAccess($rbac_perm, $pos_perm, $ref_id);
+        return $this->positionAccess()->checkRbacOrPositionPermissionAccess($rbac_perm, $pos_perm, $ref_id);
     }
 
     /**
      * @inheritdoc
      */
     public function filterUserIdsByPositionOfCurrentUser(string $pos_perm, int $ref_id, array $user_ids): array
     {
-        return $this->ilOrgUnitPositionAccess->filterUserIdsByPositionOfCurrentUser($pos_perm, $ref_id, $user_ids);
+        return $this->positionAccess()->filterUserIdsByPositionOfCurrentUser($pos_perm, $ref_id, $user_ids);
     }
 
     /**
      * @inheritdoc
      */
     public function filterUserIdsByPositionOfUser(int $user_id, string $pos_perm, int $ref_id, array $user_ids): array
     {
-        return $this->ilOrgUnitPositionAccess->filterUserIdsByPositionOfUser($user_id, $pos_perm, $ref_id, $user_ids);
+        return $this->positionAccess()->filterUserIdsByPositionOfUser($user_id, $pos_perm, $ref_id, $user_ids);
     }
 
     /**
      * @inheritdoc
      */
     public function filterUserIdsByRbacOrPositionOfCurrentUser(string $rbac_perm, string $pos_perm, int $ref_id, array $user_ids): array
     {
-        return $this->ilOrgUnitPositionAccess->filterUserIdsByRbacOrPositionOfCurrentUser(
+        return $this->positionAccess()->filterUserIdsByRbacOrPositionOfCurrentUser(
             $rbac_perm,
             $pos_perm,
             $ref_id,
@@ -826,14 +826,14 @@ public function filterUserIdsByRbacOrPositionOfCurrentUser(string $rbac_perm, st
      */
     public function hasCurrentUserAnyPositionAccess(int $ref_id): bool
     {
-        return $this->ilOrgUnitPositionAccess->hasCurrentUserAnyPositionAccess($ref_id);
+        return $this->positionAccess()->hasCurrentUserAnyPositionAccess($ref_id);
     }
 
     /**
      * @inheritdoc
      */
     public function hasUserRBACorAnyPositionAccess(string $rbac_perm, int $ref_id): bool
     {
-        return $this->ilOrgUnitPositionAccess->hasUserRBACorAnyPositionAccess($rbac_perm, $ref_id);
+        return $this->positionAccess()->hasUserRBACorAnyPositionAccess($rbac_perm, $ref_id);
     }
 }

components/ILIAS/AccessControl/classes/class.ilRbacAdmin.php

@@ -18,6 +18,8 @@
 
 declare(strict_types=1);
 
+use ILIAS\Logging\Logger\LoggerInterface;
+
 /**
  * Class ilRbacAdmin
  *  Core functions for role based access control.
@@ -30,21 +32,15 @@
  */
 class ilRbacAdmin
 {
-    protected ilDBInterface $db;
-    protected ilRbacReview $rbacreview;
-    protected ilLogger $logger;
-
     /**
      * Constructor
      * @access    public
      */
-    public function __construct()
-    {
-        global $DIC;
-
-        $this->db = $DIC->database();
-        $this->rbacreview = $DIC->rbac()->review();
-        $this->logger = $DIC->logger()->ac();
+    public function __construct(
+        protected ilDBInterface $db,
+        protected ilRbacReview $rbacreview,
+        protected LoggerInterface $logger
+    ) {
     }
 
     public function setBlockedStatus(int $a_role_id, int $a_ref_id, bool $a_blocked_status): void

components/ILIAS/AccessControl/classes/class.ilRbacReview.php

@@ -18,6 +18,8 @@
 
 declare(strict_types=1);
 
+use ILIAS\Logging\Logger\LoggerInterface;
+
 /**
  * class ilRbacReview
  *  Contains Review functions of core Rbac.
@@ -45,19 +47,14 @@ class ilRbacReview
     protected static array $assigned_users_cache = [];
     protected static array $is_assigned_cache = [];
 
-    protected ilLogger $log;
-    protected ilDBInterface $db;
-
     /**
      * Constructor
      * @access    public
      */
-    public function __construct()
-    {
-        global $DIC;
-
-        $this->log = ilLoggerFactory::getLogger('ac');
-        $this->db = $DIC->database();
+    public function __construct(
+        protected ilDBInterface $db,
+        protected LoggerInterface $log
+    ) {
     }
 
     /**

components/ILIAS/AccessControl/classes/class.ilRbacSystem.php

@@ -20,6 +20,10 @@
 
 use ILIAS\HTTP\GlobalHttpState;
 use ILIAS\Refinery\Factory;
+use ILIAS\AccessControl\User\UserIdProviderProxy;
+use ILIAS\Database\PDO\External;
+use ILIAS\AccessControl\Tree\RepositoryTreeAccessProxy;
+use ILIAS\AccessControl\Object\ObjectDataAccessProxy;
 
 /**
  * class ilRbacSystem
@@ -46,36 +50,36 @@ class ilRbacSystem
     // Cache outcomes of calls to checkAccessOfuser
     private static array $_checkAccessOfUserCache = [];
 
-    protected ilObjUser $user;
-    protected ilDBInterface $db;
-    protected ilRbacReview $review;
-    protected ilObjectDataCache $objectDataCache;
-    protected ilTree $tree;
-    protected GlobalHttpState $http;
-    protected Factory $refinery;
+
 
     /**
      * Constructor
      */
-    protected function __construct()
+    public function __construct(
+        private UserIdProviderProxy $user,
+        private External $db,
+        private ilRbacReview $review,
+        private RepositoryTreeAccessProxy $tree,
+        private GlobalHttpState $http,
+        private Factory $refinery,
+        private ObjectDataAccessProxy $objectDataCache
+    )
     {
-        global $DIC;
-
-        $this->user = $DIC->user();
-        $this->db = $DIC->database();
-        $this->review = $DIC->rbac()->review();
-        $this->objectDataCache = $DIC['ilObjDataCache'];
-        $this->tree = $DIC->repositoryTree();
-        $this->http = $DIC->http();
-        $this->refinery = $DIC->refinery();
     }
 
     public static function getInstance(): ilRbacSystem
     {
-        if (self::$instance === null) {
-            self::$instance = new self();
+        if (self::$instance !== null) {
+            return self::$instance;
         }
-        return self::$instance;
+        global $DIC;
+        if ($DIC instanceof \Pimple\Container && isset($DIC['rbacsystem'])) {
+            return self::$instance = $DIC['rbacsystem'];
+        }
+        throw new \LogicException(
+            'ilRbacSystem::getInstance() requires a bootstrapped $DIC[\'rbacsystem\']; '
+            . 'register a mock via $DIC[\'rbacsystem\'] in tests.'
+        );
     }
 
     /**