Feat/4312 language permission enforcement - #4554

phpmyfaq/admin/assets/src/group/groups.ts (1)

665-705: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Move new visible fallback strings into translations.

The new language-restriction UI includes literal empty-state, permission-label, help, success, and failure text. This bypasses the translation system.

• phpmyfaq/admin/assets/src/group/groups.ts#L665-L705: Read all language-restriction messages and fallback permission labels from translated template data.
• phpmyfaq/admin/assets/src/group/groups.ts#L750-L753: Read save-result messages from translated template data.
• phpmyfaq/admin/assets/src/user/users.ts#L519-L559: Read all language-restriction messages and fallback permission labels from translated template data.
• phpmyfaq/admin/assets/src/user/users.ts#L605-L608: Read save-result messages from translated template data.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@phpmyfaq/admin/assets/src/group/groups.ts` around lines 665 - 705, Replace
the literal language-restriction UI and result messages with values read from
translated template data. In phpmyfaq/admin/assets/src/group/groups.ts:665-705,
use translated empty-state, help, and fallback permission-label messages; at
750-753, use translated save success/failure messages. Apply the same changes in
phpmyfaq/admin/assets/src/user/users.ts:519-559 and 605-608, preserving the
existing language-restriction and save flows.

Source: Coding guidelines

tests/phpMyFAQ/Permission/LanguagePermissionRepositoryTest.php (2)

1-11: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Align the test file header with the other new test files.

tests/phpMyFAQ/Language/LanguageRestrictionFilterTest.php in this pull request declares strict_types=1 and marks the class final. This file does neither. The production class LanguagePermissionRepository also declares strict_types=1. Other test classes in the repository, such as tests/phpMyFAQ/Controller/Administration/Api/UserControllerTest.php, add #[CoversClass].

♻️ Proposed header alignment

 <?php
 
+declare(strict_types=1);
+
 namespace phpMyFAQ\Permission;
 
 use phpMyFAQ\Configuration;
 use phpMyFAQ\Database;
 use phpMyFAQ\Database\Sqlite3;
+use PHPUnit\Framework\Attributes\CoversClass;
 use PHPUnit\Framework\TestCase;
 use ReflectionClass;
 
-class LanguagePermissionRepositoryTest extends TestCase
+#[CoversClass(LanguagePermissionRepository::class)]
+final class LanguagePermissionRepositoryTest extends TestCase
 {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/phpMyFAQ/Permission/LanguagePermissionRepositoryTest.php` around lines
1 - 11, Align the LanguagePermissionRepositoryTest header with the repository’s
test conventions: declare strict_types=1, mark the test class final, and add the
appropriate PHPUnit CoversClass attribute targeting
LanguagePermissionRepository. Keep the existing imports and test behavior
unchanged.

---

239-253: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add coverage for getAllUserLanguageRestrictions().

testGetAllLanguageRestrictions() covers the group variant. The user variant getAllUserLanguageRestrictions() has no test. Both methods build a keyed result from right_id, so a regression in the user path would go undetected.

🧪 Proposed test for the user variant

+    public function testGetAllUserLanguageRestrictions(): void
+    {
+        $this->assertEmpty($this->repository->getAllUserLanguageRestrictions(0));
+
+        $this->repository->setUserLanguageRestrictions(1, 1, ['en', 'de']);
+        $this->repository->setUserLanguageRestrictions(1, 3, ['fr']);
+
+        $all = $this->repository->getAllUserLanguageRestrictions(1);
+        $this->assertCount(2, $all);
+        $this->assertArrayHasKey(1, $all);
+        $this->assertArrayHasKey(3, $all);
+        $this->assertContains('en', $all[1]);
+        $this->assertContains('de', $all[1]);
+        $this->assertContains('fr', $all[3]);
+    }
+
     public function testCheckUserGroupRightForLanguageWithNoRestrictions(): void

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/phpMyFAQ/Permission/LanguagePermissionRepositoryTest.php` around lines
239 - 253, Add a dedicated test for getAllUserLanguageRestrictions() alongside
testGetAllLanguageRestrictions(), covering an empty user result, setting
restrictions for multiple right IDs, and asserting the returned keyed entries
and language values to detect regressions in the user path.

phpmyfaq/src/phpMyFAQ/Permission/LanguagePermissionRepository.php (3)

60-89: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider removing the duplication between the user and group code paths.

getAllUserLanguageRestrictions() and getAllLanguageRestrictions() have identical bodies except for the table name and the ID column. checkUserRightForLanguage() and checkUserGroupRightForLanguage() share the same NOT EXISTS OR EXISTS restriction logic. The set* and delete* pairs already share helpers.

Extract a private helper that takes the table name, the owner column, and the ID, in the same style as replaceLanguageRows().

Also applies to: 217-246, 312-355

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@phpmyfaq/src/phpMyFAQ/Permission/LanguagePermissionRepository.php` around
lines 60 - 89, Extract the duplicated retrieval logic from
getAllUserLanguageRestrictions() and getAllLanguageRestrictions() into a private
helper accepting the table name, owner-column name, and owner ID, then have both
methods delegate to it while preserving validation, ordering, and result
grouping. Apply the same deduplication to checkUserRightForLanguage() and
checkUserGroupRightForLanguage() by introducing a shared private helper for
their NOT EXISTS/EXISTS restriction logic, following the existing
replaceLanguageRows() helper style.

---

196-210: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Make the group method names symmetric with the user method names.

The user methods carry the entity in the name: getUserLanguageRestrictions(), setUserLanguageRestrictions(), deleteUserLanguageRestrictions(). The group methods drop it: getLanguageRestrictions(), setLanguageRestrictions(), deleteLanguageRestrictions(). Only deleteAllForGroup() names the entity. A caller cannot tell the scope of setLanguageRestrictions() from the name alone.

Rename the group methods to getGroupLanguageRestrictions(), setGroupLanguageRestrictions(), and deleteGroupLanguageRestrictions(). This class is new, so the rename has no external consumers outside this pull request. Note that MediumPermission exposes setLanguageRestrictions() for groups, as tests/phpMyFAQ/Permission/MediumPermissionTest.php Lines 780-796 show. Keep the public permission API unchanged if it is already documented.

Also applies to: 254-267, 272-286

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@phpmyfaq/src/phpMyFAQ/Permission/LanguagePermissionRepository.php` around
lines 196 - 210, Rename the group-scoped methods in LanguagePermissionRepository
from getLanguageRestrictions(), setLanguageRestrictions(), and
deleteLanguageRestrictions() to getGroupLanguageRestrictions(),
setGroupLanguageRestrictions(), and deleteGroupLanguageRestrictions(), updating
all internal call sites accordingly. Preserve MediumPermission’s existing public
setLanguageRestrictions() API and its behavior; only the repository method names
should change.

---

26-31: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Register LanguagePermissionRepository as a service.

LanguagePermissionRepository takes Configuration in its constructor, and BasicPermission instantiates it directly. Add it to phpmyfaq/src/services.php with service('phpmyfaq.configuration') so it follows the manual dependency injection pattern already used for this permission class and the project’s service-guideline requirement.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@phpmyfaq/src/phpMyFAQ/Permission/LanguagePermissionRepository.php` around
lines 26 - 31, Register LanguagePermissionRepository in services.php using the
existing service-definition pattern, injecting service('phpmyfaq.configuration')
into its constructor. Keep BasicPermission’s dependency resolution aligned with
this registered service.

Source: Coding guidelines

tests/phpMyFAQ/Controller/Administration/Api/UserControllerTest.php (1)

1195-1231: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a case for the empty languages array.

This test covers the guard for a language the acting user does not hold. It does not cover languages: [], which clears every restriction and grants unrestricted language access. That payload currently passes the guard; see the comment on Api/UserController.php Lines 699-711.

Add a sibling test that posts 'languages' => [] with the same restricted acting user and asserts HTTP 403.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/phpMyFAQ/Controller/Administration/Api/UserControllerTest.php` around
lines 1195 - 1231, Add a sibling test next to
testSaveUserLanguageRestrictionsRejectsLanguageNotHeldByNonSuperAdmin using the
same restricted non-SuperAdmin setup, but submit an empty languages array. Call
saveUserLanguageRestrictions and assert the response status is HTTP 403,
preserving the existing permission and CSRF setup.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes