Skip to content

Technical Documentation: API Permission System

1. Overview

This document outlines the logic and database structure for the WBS Permission System. The system is designed with a "Default-Allow" philosophy to maintain usability, only restricting users once an explicit control record is created.

2. Database Schema

The system relies on three core tables to manage access:

wbs_services

Acts as the registry for all available APIs. * id: Unique identifier for the service. * wbs_code: short name of the API/Service. * wbs_name: The name of the API/Service.

wbs_methods

Contains specific endpoints or actions for each service. * id: Unique identifier for the method. * wbs: Foreign key relating to wbs_services.id. * name: The name of the function/method.

wbs_permissions

The junction table linking users to their allowed actions. * clients_users: The unique identifier for the user. * wbs_services: The ID of the service. * wbs_methods: * If set to 0: Acts as a "Control Flag" (Permissions are now active for this user). * If set to ID: Represents a specific permitted method.

3. Permission Logic

The system follows a specific sequence to determine if a request should be authorized:

  1. Check for Control Flag: The system looks for an entry where wbs_methods = 0 for the specific user and service.
    • If NOT found: The user is granted access by default (Usability mode).
    • If found: The system moves to strict mode.
  2. Strict Mode Validation: Once control is active, the system checks for a specific entry matching the requested method_id.
    • Entry exists: Access is Granted.
    • Entry does not exist: Access is Denied.

Logic Matrix

Control Entry (methods = 0) Method Entry Exists Result Note
No No ALLOWED Default state; no restrictions applied.
Yes Yes ALLOWED User is restricted but has explicit permission.
Yes No DENIED User is restricted and lacks specific permission.

4. Implementation

To verify permissions within the application, call the standard check function.

  • File: export/wbs/pkt/wbs_common_funcs.inc.php
  • Function: func_checkPermissions($user, $service, $method)
  • Return: Boolean (True = Access Granted / False = Access Denied)

Code Example

```php require_once('export/wbs/pkt/wbs_common_funcs.inc.php');

// Example: User 123 trying to access Service 5, Method 10 if (!wbs_pkt_common::func_checkPermissions(123, 5, 10)) { // Handle unauthorized access header('HTTP/1.0 403 Forbidden'); exit('Error: Insufficient Permissions.'); }