#!/usr/bin/perl

 #

 # DW::Hooks::PrivList

 #

 # This module implements the listing of valid arguments for each

 # known user privilege in dw-free.  Any site that defines a different

 # set of privs or privargs must create additional hooks to supplement

 # this list.

 #

 # Authors:

 #      Jen Griffin <kareila@livejournal.com>

 #

 # Copyright (c) 2011 by Dreamwidth Studios, LLC.

 #

 # This program is free software; you may redistribute it and/or modify it under

 # the same terms as Perl itself. For a copy of the license, please reference

 # 'perldoc perlartistic' or 'perldoc perlgpl'.

 #

 package DW::Hooks::PrivList;

 use strict;

 use LJ::Hooks;

 use LJ::DB;

 use LJ::Lang;

 use LJ::Support;

 LJ::Hooks::register_hook( 'privlist-add', sub {

     my ( $priv ) = @_;

     return unless defined $priv;

     my $hr = {};

     # valid admin privargs are the same as defined DB privs

     if ( $priv eq 'admin' ) {

         my $dbr = LJ::get_db_reader();

         $hr = $dbr->selectall_hashref(

             'SELECT privcode, privname FROM priv_list', 'privcode' );

         # unfold result

         $hr->{$_} = $hr->{$_}->{privname} foreach keys %$hr;

         # add subprivs for supporthelp

         my $cats = LJ::Support::load_cats();

         $hr->{"supporthelp/$_"} = "$hr->{supporthelp} for $_"

             foreach map { $_->{catkey} } values %$cats;

     }

     # valid support* privargs are the same as support cats

     if ( my ( $sup ) = ( $priv =~ /^support(.*)$/ ) ) {

         my $cats = LJ::Support::load_cats();

         my @catkeys = map { $_->{catkey} } values %$cats;

         if ( $priv eq 'supportread' ) {

             $hr->{"$_+"} = "Extended $sup privs for $_ category"

                 foreach @catkeys;

         }

         $sup = $priv eq 'supporthelp' ? 'All' : ucfirst $sup;

         $hr->{$_} = "$sup privs for $_ category"

             foreach @catkeys;

         $hr->{''} = "$sup privs for public categories";

     }

     # valid faqadd/faqedit privargs are the same as faqcats

     if ( $priv eq 'faqadd' or $priv eq 'faqedit' ) {

         my $dbr = LJ::get_db_reader();

         $hr = $dbr->selectall_hashref(

             'SELECT faqcat, faqcatname FROM faqcat', 'faqcat' );

         # unfold result

         $hr->{$_} = $hr->{$_}->{faqcatname} foreach keys %$hr;

     }

     # valid translate privargs are the same as defined languages

     if ( $priv eq 'translate' ) {

         my %langs = @{ LJ::Lang::get_lang_names() };

         $hr->{$_} = "Can translate $langs{$_}" foreach keys %langs;

         # plus a couple of extras

         $hr->{'[itemdelete]'} = "Can delete translation strings";

         $hr->{'[itemrename]'} = "Can rename translation strings";

     }

     # have to manually maintain the other lists

     $hr = {

         entryprops => "Access to /admin/entryprops",

         sessions   => "Access to admin mode on /manage/logins",

         styles     => "Access to private styles on /customize/advanced",

         suspended  => "Access to suspended journal content",

         userlog    => "Access to /admin/userlog",

         userprops  => "Access to /admin/propedit",

     } if $priv eq 'canview';

     $hr = {

         codetrace   => "Access to /admin/invites/codetrace",

         infohistory => "Access to infohistory console command",

     } if $priv eq 'finduser';

     # extracted from grep -r statushistory_add

     if ( $priv eq 'historyview' ) {

         my @shtypes = qw/ account_level_change b2lid_remap capedit

                           change_journal_type comment_action communityxfer

                           create_from_invite create_from_promo

                           entry_action email_changed expunge_userpic

                           impersonate journal_status logout_user

                           mass_privacy paid_from_invite paidstatus

                           privadd privdel reset_email reset_password

                           s2lid_remap set_badpassword shop_points

                           suspend sysban_add sysban_mod synd_create

                           synd_edit synd_merge sysban_add sysban_modify

                           sysban_trig unsuspend vgifts viewall /;

         $hr->{$_} = "Access to statushistory for $_ logs"

             foreach @shtypes;

     }

     $hr = {

         commentview    => "Access to /admin/recent_comments",

         emailqueue     => "Access to /tools/recent_email",

         entry_redirect => "Access to /misc/entry_redirect",

         invites        => "Access to some invites functionality under /admin/invites",

         largefeedsize  => "Overrides synsuck_max_size for a feed",

         memcacheclear  => "Access to /admin/memcache_clear",

         memcacheview   => "Access to /admin/memcache",

         mysqlstatus    => "Access to /admin/mysql_status",

         navtag         => "Access to /admin/navtag",

         propedit       => "Allow to change userprops for other users",

         rename         => "Access to rename_opts console command",

         sitemessages   => "Access to /admin/sitemessages",

         spamreports    => "Access to /admin/spamreports",

         themes         => "Access to /admin/themes",

         theschwartz    => "Access to /admin/theschwartz",

         usernames      => "Bypasses is_protected_username check",

         userpics       => "Access to expunge_userpic console command",

         users          => "Access to change_journal_status console command",

         vgifts         => "Access to approval functions on /admin/vgifts",

     } if $priv eq 'siteadmin';

     $hr = {

         openid => "Only allowed to suspend OpenID accounts",

     } if $priv eq 'suspend';

     # extracted from LJ::Sysban::validate

     $hr = {

         email         => "Can ban specific email addresses",

         email_domain  => "Can ban entire email domains",

         invite_email  => "Can ban invites for email addresses",

         invite_user   => "Can ban invites for users",

         ip            => "Can ban connections from specific IPs",

         lostpassword  => "Can ban requests for lost passwords",

         noanon_ip     => "Can ban anonymous comments from specific IPs",

         pay_cc        => "Can ban payments from specific credit cards",

         pay_email     => "Can ban payments from specific emails",

         pay_uniq      => "Can ban payments from specific sessions",

         pay_user      => "Can ban payments from specific users",

         spamreport    => "Can ban spam reports from specific users",

         support_email => "Can ban support requests from emails",

         support_uniq  => "Can ban support requests from sessions",

         support_user  => "Can ban support requests from users",

         talk_ip_test  => "Can force IPs to complete CAPTCHA to leave comments",

         uniq          => "Can ban specific browser sessions",

         user          => "Can ban specific users",

     } if $priv eq 'sysban';

     return $hr;

 } );

 1;