diff --git a/src/Domain/User/Service/Authentication.php b/src/Domain/User/Service/Authentication.php index d13ed6bb..e23d8666 100644 --- a/src/Domain/User/Service/Authentication.php +++ b/src/Domain/User/Service/Authentication.php @@ -140,32 +140,19 @@ public function isUserAuthenticatedWithCookie() : bool public function isUserPageVisibleForApiRequest(Request $request, UserEntity $targetUser) : bool { - $userId = $this->getUserIdByApiToken($request); + $requestUserId = $this->getUserIdByApiToken($request); - $privacyLevel = $targetUser->getPrivacyLevel(); - - if ($privacyLevel === 2) { - return true; - } - - if ($privacyLevel === 1 && $userId !== null) { - return true; - } - - return $targetUser->getId() === $userId; + return $this->isUserPageVisibleForUser($targetUser, $requestUserId); } - public function isUserPageVisibleForCurrentUser(int $privacyLevel, int $userId) : bool + public function isUserPageVisibleForWebRequest(UserEntity $targetUser) : bool { - if ($privacyLevel === 2) { - return true; - } - - if ($privacyLevel === 1 && $this->isUserAuthenticatedWithCookie() === true) { - return true; + $requestUserId = null; + if ($this->isUserAuthenticatedWithCookie() === true) { + $requestUserId = $this->getCurrentUserId(); } - return $this->isUserAuthenticatedWithCookie() === true && $this->getCurrentUserId() === $userId; + return $this->isUserPageVisibleForUser($targetUser, $requestUserId); } public function isValidAuthToken(string $token) : bool @@ -244,6 +231,21 @@ public function setAuthenticationCookieAndNewSession(int $userId, string $token, $this->sessionWrapper->set('userId', $userId); } + private function isUserPageVisibleForUser(UserEntity $targetUser, ?int $requestUserId) : bool + { + $privacyLevel = $targetUser->getPrivacyLevel(); + + if ($privacyLevel === 2) { + return true; + } + + if ($privacyLevel === 1 && $requestUserId !== null) { + return true; + } + + return $targetUser->getId() === $requestUserId; + } + private function setAuthenticationToken(int $userId, string $deviceName, string $userAgent, DateTime $expirationDate) : string { $token = bin2hex(random_bytes(16)); diff --git a/src/Domain/User/Service/UserPageAuthorizationChecker.php b/src/Domain/User/Service/UserPageAuthorizationChecker.php index d7186dc4..29841431 100644 --- a/src/Domain/User/Service/UserPageAuthorizationChecker.php +++ b/src/Domain/User/Service/UserPageAuthorizationChecker.php @@ -49,12 +49,10 @@ public function findUserIdIfCurrentVisitorIsAllowedToSeeUser(Request $request) : return null; } - $requestedUserId = $requestedUser->getId(); - - if ($this->authenticationService->isUserPageVisibleForCurrentUser($requestedUser->getPrivacyLevel(), $requestedUserId) === false) { + if ($this->authenticationService->isUserPageVisibleForWebRequest($requestedUser) === false) { return null; } - return $requestedUserId; + return $requestedUser->getId(); } }