Upload via GUI (452 Dateien)

DeskHub-Webseite/api/staff/v1/roles.php

@@ -9,10 +9,7 @@ $pdo = get_db();
 
 // Ticket-Rechte + alle Adminportal-Bereichsrechte (admin_section_permissions(), includes/functions.php) –
 // zusammen ergeben sie das vollständige Set, das über eine benutzerdefinierte Rolle vergeben werden kann.
-$rolePermissionKeys = array_merge([
-    'reply_ticket', 'close_ticket', 'delete_ticket', 'transfer_ticket', 'post_note',
-    'assign_ticket', 'manage_canned', 'view_reports', 'manage_kb', 'create_ticket',
-], array_keys(admin_section_permissions()));
+$rolePermissionKeys = array_keys(permission_labels());
 
 if ($_SERVER['REQUEST_METHOD'] === 'GET') {
     $roles = $pdo->query(
@@ -21,11 +18,14 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
 
     api_json([
         'permissionKeys' => $rolePermissionKeys,
+        'permissionLabels' => permission_labels(),
+        'permissionGroups' => array_values(array_map(fn($g) => ['title' => $g['title'], 'keys' => array_keys($g['items'])], permission_catalog())),
         'defaultAgentPermissions' => default_permissions('agent'),
         'items' => array_map(fn(array $r) => [
             'id' => (int) $r['id'],
             'name' => $r['name'],
             'permissions' => json_decode($r['permissions'] ?? '{}', true) ?? [],
+            'effectivePermissions' => permission_effective(json_decode($r['permissions'] ?? '{}', true) ?? []),
             'staffCount' => (int) $r['staff_count'],
             'isActive' => (bool) ($r['is_active'] ?? 1),
             'notes' => $r['notes'] ?? null,
@@ -44,9 +44,19 @@ if ($action === 'save') {
     if ($name === '') api_error(422, 'NAME_REQUIRED', 'Bitte einen Namen angeben.');
 
     $incoming = (array) ($body['permissions'] ?? []);
+    // Rechte, die eine ältere App-Version nicht kennt (und deshalb nicht mitschickt), bleiben unverändert bzw. bekommen den Standardwert
+    $existingPerms = default_permissions('agent');
+    if ($id) {
+        $ep = $pdo->prepare('SELECT permissions FROM roles WHERE id = ?');
+        $ep->execute([$id]);
+        $existingPerms = array_merge($existingPerms, json_decode((string) $ep->fetchColumn(), true) ?: []);
+    }
     $perms = [];
     foreach ($rolePermissionKeys as $p) {
-        $perms[$p] = !empty($incoming[$p]);
+        $want = array_key_exists($p, $incoming) ? !empty($incoming[$p]) : !empty($existingPerms[$p]);
+        // Wer kein echter Administrator ist, kann keine Rechte vergeben, die er selbst nicht hat
+        if ($staff['role'] !== 'admin' && $want && !has_permission($staff, $p)) $want = !empty($existingPerms[$p]) && $id > 0;
+        $perms[$p] = $want;
     }
     $json = json_encode($perms);
     $dup = $pdo->prepare('SELECT COUNT(*) FROM roles WHERE LOWER(name) = LOWER(?) AND id <> ?');

DeskHub-Webseite/api/staff/v1/status.php

@@ -17,7 +17,7 @@ $staff = api_require_staff();
 $pdo = get_db();
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-    api_require_admin($staff);
+    api_require_admin_or_permission($staff, 'manage_status_page');
     $b = api_request_body();
     $action = (string) ($b['action'] ?? '');
     if ($action === 'set_component') {
@@ -39,4 +39,4 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         api_error(422, 'UNKNOWN_ACTION', 'Unbekannte Aktion.');
     }
 }
-api_json(['status' => status_summary($pdo)] + ['canManage' => $staff['role'] === 'admin']);
+api_json(['status' => status_summary($pdo)] + ['canManage' => has_permission($staff, 'manage_status_page')]);

DeskHub-Webseite/api/staff/v1/ticket_rules.php

@@ -12,8 +12,8 @@ require_once __DIR__ . '/common.php';
 
 api_require_method('GET', 'POST');
 $staff = api_require_staff();
-if ($staff['role'] !== 'admin') {
-    api_error(403, 'ADMIN_REQUIRED', 'Nur Administratoren können Ticket-Regeln verwalten.');
+if (!has_permission($staff, 'manage_automation')) {
+    api_error(403, 'FORBIDDEN', 'Für Ticket-Regeln fehlt die erforderliche Berechtigung.');
 }
 $pdo = get_db();