N°9723 - IsActionAllowed should work with non instantiated users objects (#947)

* Replace references to user objects keys since objects can be non-instantiated (so no key available) and replace them by equivalent code

* Rename test + use self variable for profile

---------

Co-authored-by: jf-cbd <jf-cbd@users.noreply.github.com>

addons/userrights/userrightsprofile.class.inc.php

@@ -582,16 +582,26 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	 */
 	public function ListProfiles($oUser)
 	{
-		$aRet = [];
+		if (count($oUser->ListChanges()) === 0) { // backward compatibility
-		$oSearch = new DBObjectSearch('URP_UserProfile');
+			$aRet = [];
-		$oSearch->AllowAllData();
+			$oSearch = new DBObjectSearch('URP_UserProfile');
-		$oSearch->NoContextParameters();
+			$oSearch->AllowAllData();
-		$oSearch->Addcondition('userid', $oUser->GetKey(), '=');
+			$oSearch->NoContextParameters();
-		$oProfiles = new DBObjectSet($oSearch);
+			$oSearch->Addcondition('userid', $oUser->GetKey(), '=');
-		while ($oUserProfile = $oProfiles->Fetch()) {
+			$oProfiles = new DBObjectSet($oSearch);
-			$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+			while ($oUserProfile = $oProfiles->Fetch()) {
+				$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+			}
+
+			return $aRet;
+		} else {
+			$aRet = [];
+			$oProfilesSet = $oUser->Get('profile_list');
+			foreach ($oProfilesSet as $oUserProfile) {
+				$aRet[$oUserProfile->Get('profileid')] = $oUserProfile->Get('profileid_friendlyname');
+			}
+			return $aRet;
 		}
-		return $aRet;
 	}
 
 	public function GetSelectFilter($oUser, $sClass, $aSettings = [])
@@ -705,26 +715,23 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	protected function GetUserActionGrant($oUser, $sClass, $iActionCode)
 	{
 		$this->LoadCache();
-
+		if (count($oUser->ListChanges()) === 0) {
-		// load and cache permissions for the current user on the given class
+			// load and cache permissions for the current user on the given class
-		//
+			if (isset($this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode])) {
-		$iUser = $oUser->GetKey();
+				$aTest = $this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode];
-		if (isset($this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode])) {
+				if (is_array($aTest)) {
-			$aTest = $this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode];
+					return $aTest;
-			if (is_array($aTest)) {
+				}
-				return $aTest;
 			}
 		}
 
 		$sAction = self::$m_aActionCodes[$iActionCode];
 
 		$bStatus = null;
-		// Cache user's profiles
+
-		if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
+		$aProfileList = $this->GetProfileList($oUser);
-			$this->aUsersProfilesList[$iUser] = UserRights::ListProfiles($oUser);
-		}
 		// Call the API of UserRights because it caches the list for us
-		foreach ($this->aUsersProfilesList[$iUser] as $iProfile => $oProfile) {
+		foreach ($aProfileList as $iProfile => $oProfile) {
 			$bGrant = $this->GetProfileActionGrant($iProfile, $sClass, $sAction);
 			if (!is_null($bGrant)) {
 				if ($bGrant) {
@@ -742,7 +749,9 @@ class UserRightsProfile extends UserRightsAddOnAPI
 		$aRes = [
 			'permission' => $iPermission,
 		];
-		$this->m_aObjectActionGrants[$iUser][$sClass][$iActionCode] = $aRes;
+		if (count($oUser->ListChanges()) === 0) {
+			$this->m_aObjectActionGrants[$oUser->GetKey()][$sClass][$iActionCode] = $aRes;
+		}
 		return $aRes;
 	}
 
@@ -824,18 +833,14 @@ class UserRightsProfile extends UserRightsAddOnAPI
 	{
 		$this->LoadCache();
 		// Note: this code is VERY close to the code of IsActionAllowed()
-		$iUser = $oUser->GetKey();
 
-		// Cache user's profiles
+		$aProfileList  = $this->GetProfileList($oUser);
-		if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
-			$this->aUsersProfilesList[$iUser] = UserRights::ListProfiles($oUser);
-		}
 
 		// Note: The object set is ignored because it was interesting to optimize for huge data sets
 		//       and acceptable to consider only the root class of the object set
 		$bStatus = null;
 		// Call the API of UserRights because it caches the list for us
-		foreach ($this->aUsersProfilesList[$iUser] as $iProfile => $oProfile) {
+		foreach ($aProfileList as $iProfile => $oProfile) {
 			$bGrant = $this->GetClassStimulusGrant($iProfile, $sClass, $sStimulusCode);
 			if (!is_null($bGrant)) {
 				if ($bGrant) {
@@ -893,6 +898,25 @@ class UserRightsProfile extends UserRightsAddOnAPI
 		}
 		return $bHasSharing;
 	}
+
+	/**
+	 * @param \User $oUser
+	 *
+	 * @return array
+	 * @throws \Exception
+	 */
+	public function GetProfileList(User $oUser): array
+	{
+		if (count($oUser->ListChanges()) === 0) { // if user is already in db and not changed
+			$iUser = $oUser->GetKey();
+			if (false === array_key_exists($iUser, $this->aUsersProfilesList)) {
+				$aProfiles = UserRights::ListProfiles($oUser);
+				$this->aUsersProfilesList[$iUser] = $aProfiles;
+			}
+			return $this->aUsersProfilesList[$iUser];
+		}
+		return UserRights::ListProfiles($oUser);
+	}
 }
 
 UserRights::SelectModule('UserRightsProfile');

core/cmdbsource.class.inc.php

@@ -916,9 +916,7 @@ class CMDBSource
 		$aColumn = [];
 		$aData = self::QueryToArray($sSql);
 		foreach ($aData as $aRow) {
-			if ($aRow[$col] !== null) {
+			@$aColumn[] = $aRow[$col];
-				$aColumn[] = $aRow[$col];
-			}
 		}
 		return $aColumn;
 	}

core/userrights.class.inc.php

@@ -1530,6 +1530,37 @@ class UserRights
 		}
 	}
 
+	/**
+	 * @param User $oUser
+	 * @param array $aExcludedProfilesId Administrator by default, but can also be other proofiles depending on needs (e.g. power portal user or REST profile)
+	 * @return bool
+	 * @throws ArchivedObjectException
+	 * @throws CoreException
+	 * @throws CoreUnexpectedValue
+	 * @throws MySQLException
+	 */
+	public static function IsUserReadOnly(User $oUser, array $aExcludedProfilesId = [1]): bool
+	{
+		$oUserProfiles = $oUser->Get('profile_list');
+		$oUserRights = UserRights::GetModuleInstance();
+		while ($oUserProfile = $oUserProfiles->Fetch()) {
+			$iProfileId = $oUserProfile->Get('profileid');
+			if (in_array($iProfileId, $aExcludedProfilesId)) {
+				return false;
+			}
+			foreach (MetaModel::GetClasses('bizmodel,grant_by_profile') as $sClass) {
+				foreach (['w', 'bw', 'd', 'bd'] as $sWriteActionCode) {
+					$bIsGranted = $oUserRights->GetProfileActionGrant($iProfileId, $sClass, $sWriteActionCode);
+					if ($bIsGranted === true) {
+						return false;
+					}
+				}
+			}
+		}
+
+		return true;
+	}
+
 	/**
 	 * @param string $sClass
 	 * @param int $iActionCode see UR_ACTION_* constants

datamodels/2.x/combodo-data-feature-removal/src/Controller/DataFeatureRemovalController.php

@@ -18,7 +18,6 @@ use Combodo\iTop\DataFeatureRemoval\Helper\DataFeatureRemovalHelper;
 use Combodo\iTop\DataFeatureRemoval\Helper\DataFeatureRemovalLog;
 use Combodo\iTop\DataFeatureRemoval\Service\DataCleanupService;
 use Combodo\iTop\DataFeatureRemoval\Service\DataFeatureRemoverExtensionService;
-use Combodo\iTop\DataFeatureRemoval\Service\StaticDeletionPlan;
 use Combodo\iTop\Setup\FeatureRemoval\DryRemovalRuntimeEnvironment;
 use Combodo\iTop\Setup\FeatureRemoval\SetupAudit;
 use ContextTag;
@@ -169,7 +168,6 @@ class DataFeatureRemovalController extends Controller
 		$oSetupAudit = new SetupAudit($sSourceEnv);
 		$aGetRemovedClasses = array_keys($oSetupAudit->RunDataAudit());
 		DataFeatureRemovalLog::Debug(__METHOD__, null, ['aGetRemovedClasses' => $aGetRemovedClasses]);
-		$aDeletionPlan = (new StaticDeletionPlan())->GetStaticDeletionPlan($aGetRemovedClasses);
 
 		$aParams['aClasses'] = $aGetRemovedClasses;
 
@@ -224,7 +222,6 @@ class DataFeatureRemovalController extends Controller
 		$bIsDirEmpty = count(scandir($sBuildDir)) === 2;
 
 		if ($bIsDirEmpty || $bForceCompilation) {
-			Session::Unset('bForceCompilation');
 			DataFeatureRemovalLog::Debug(
 				__METHOD__,
 				null,
@@ -275,7 +272,7 @@ class DataFeatureRemovalController extends Controller
 	private function GetDeletionPlanSummaryTable(array $aRemovedClasses): array
 	{
 		$sName = 'DeletionPlanSummary';
-		$oDataCleanupService = new StaticDeletionPlan();
+		$oDataCleanupService = new DataCleanupService();
 		$aDeletionPlanSummaryEntities = $oDataCleanupService->GetCleanupSummary($aRemovedClasses);
 		$aColumns = ['Class', 'Delete Count' , 'Update Count', 'Issue Count'];
 		$aRows = [];

datamodels/2.x/combodo-data-feature-removal/src/Entity/DeletionPlanEntity.php

@@ -1,37 +0,0 @@
-<?php
-
-/*
- * @copyright   Copyright (C) 2010-2026 Combodo SAS
- * @license     http://opensource.org/licenses/AGPL-3.0
- */
-
-namespace Combodo\iTop\DataFeatureRemoval\Entity;
-
-class DeletionPlanEntity
-{
-	public readonly DeletionPlanItem $oDelete;
-	public readonly DeletionPlanItem $oUpdate;
-	public readonly DeletionPlanItem $oIssue;
-
-	/**
-	 * @param \Combodo\iTop\DataFeatureRemoval\Entity\DeletionPlanItem $oDelete
-	 * @param \Combodo\iTop\DataFeatureRemoval\Entity\DeletionPlanItem $oUpdate
-	 * @param \Combodo\iTop\DataFeatureRemoval\Entity\DeletionPlanItem $oIssue
-	 */
-	public function __construct()
-	{
-		$this->oDelete = $oDelete ?? new DeletionPlanItem();
-		$this->oUpdate = $oUpdate ?? new DeletionPlanItem();
-		$this->oIssue = $oIssue ?? new DeletionPlanItem();
-	}
-
-	public function TotalCount(): int
-	{
-		return $this->oDelete->Count() + $this->oUpdate->Count() + $this->oIssue->Count();
-	}
-
-	public function FilterUpdatesByDeletes()
-	{
-		$this->oUpdate->FilterBy($this->oDelete);
-	}
-}

datamodels/2.x/combodo-data-feature-removal/src/Entity/DeletionPlanItem.php

@@ -1,40 +0,0 @@
-<?php
-
-/*
- * @copyright   Copyright (C) 2010-2026 Combodo SAS
- * @license     http://opensource.org/licenses/AGPL-3.0
- */
-
-namespace Combodo\iTop\DataFeatureRemoval\Entity;
-
-class DeletionPlanItem
-{
-	public array $aQueries = [];
-	public array $aIds = [];
-
-	/**
-	 * @param array $aQueries
-	 * @param array $aIds
-	 */
-	public function __construct(array $aQueries = [], array $aIds = [])
-	{
-		$this->aQueries = $aQueries;
-		$this->aIds = $aIds;
-	}
-
-	public function Merge(DeletionPlanItem $oItem): void
-	{
-		$this->aQueries = array_merge($this->aQueries, $oItem->aQueries);
-		$this->aIds = array_unique(array_merge($this->aIds, $oItem->aIds));
-	}
-
-	public function Count(): int
-	{
-		return count($this->aIds);
-	}
-
-	public function FilterBy(DeletionPlanItem $oItem): void
-	{
-		$this->aIds = array_diff($this->aIds, $oItem->aIds);
-	}
-}

datamodels/2.x/combodo-data-feature-removal/src/Service/StaticDeletionPlan.php

@@ -1,242 +0,0 @@
-<?php
-
-/*
- * @copyright   Copyright (C) 2010-2026 Combodo SAS
- * @license     http://opensource.org/licenses/AGPL-3.0
- */
-
-namespace Combodo\iTop\DataFeatureRemoval\Service;
-
-use CMDBSource;
-use Combodo\iTop\DataFeatureRemoval\Entity\DataCleanupSummaryEntity;
-use Combodo\iTop\DataFeatureRemoval\Entity\DeletionPlanEntity;
-use Combodo\iTop\DataFeatureRemoval\Entity\DeletionPlanItem;
-use MetaModel;
-
-class StaticDeletionPlan
-{
-	/** @var array<DeletionPlanEntity> */
-	private array $aDeletionPlan = [];
-
-	/**
-	 * Get a summary of the deletion plan computed for the classes.
-	 * The result is used for display
-	 *
-	 * @param array|null $aClasses
-	 *
-	 * @return array<\Combodo\iTop\DataFeatureRemoval\Entity\DataCleanupSummaryEntity>
-	 * @throws \CoreException
-	 */
-	public function GetCleanupSummary(?array $aClasses): array
-	{
-		$aSummary = [];
-		$aDeletionPlan = $this->GetStaticDeletionPlan($aClasses ?? []);
-
-		foreach ($aDeletionPlan as $sClass => $oDeletionPlanEntity) {
-			if ($oDeletionPlanEntity->TotalCount() === 0) {
-				continue;
-			}
-			$oDeletionPlanEntity->FilterUpdatesByDeletes();
-			$oDataCleanupSummary = new DataCleanupSummaryEntity($sClass);
-			$oDataCleanupSummary->iUpdateCount = $oDeletionPlanEntity->oUpdate->Count();
-			$oDataCleanupSummary->iDeleteCount = $oDeletionPlanEntity->oDelete->Count();
-			$oDataCleanupSummary->iIssueCount = $oDeletionPlanEntity->oIssue->Count();
-
-			$aSummary[$sClass] = $oDataCleanupSummary;
-		}
-
-		return $aSummary;
-	}
-
-	/**
-	 * @param array $aClasses Classes to clean entirely
-	 *
-	 * @return array ['class' => DeletionPlanEntity];
-	 *
-	 * @throws \CoreException
-	 */
-	public function GetStaticDeletionPlan(array $aClasses): array
-	{
-		foreach ($aClasses as $sClass) {
-			$oDeletionPlanItem = $this->GetInitialClassDeletionPlan($sClass);
-			$oDeletionPlanEntity = new DeletionPlanEntity();
-			$oDeletionPlanEntity->oDelete->Merge($oDeletionPlanItem);
-			$this->aDeletionPlan[$sClass] = $oDeletionPlanEntity;
-
-			$this->DeletionPlanForReferencingClasses($sClass);
-		}
-
-		return $this->aDeletionPlan;
-	}
-
-	private function DeletionPlanForReferencingClasses(string $sClass): void
-	{
-		$sIdsToRemove = implode(', ', $this->aDeletionPlan[$sClass]->oDelete->aIds);
-		$aReferencingMe = MetaModel::EnumReferencingClasses($sClass);
-		foreach ($aReferencingMe as $sRemoteClass => $aExtKeys) {
-			if (!isset($this->aDeletionPlan[$sRemoteClass])) {
-				$this->aDeletionPlan[$sRemoteClass] =  new DeletionPlanEntity();
-			}
-			$oDeletionPlanEntity = $this->aDeletionPlan[$sRemoteClass];
-			/** @var \AttributeExternalKey $oExtKeyAttDef */
-			foreach ($aExtKeys as $sExtKeyAttCode => $oExtKeyAttDef) {
-				// skip if this external key is behind an external field
-				if (!$oExtKeyAttDef->IsExternalKey(EXTKEY_ABSOLUTE)) {
-					continue;
-				}
-
-				if ($oExtKeyAttDef->IsNullAllowed()) {
-					// update
-					$oUpdateItem = $this->UpdateExtKeyNullable($sRemoteClass, $sExtKeyAttCode, $sIdsToRemove);
-					$oDeletionPlanEntity->oUpdate->Merge($oUpdateItem);
-				} else {
-					// delete
-					$aRemoteIdsToRemove = $this->GetRemoteIdsForExtKey($sRemoteClass, $sExtKeyAttCode, $sIdsToRemove);
-
-					$iDeletePropagationOption = $oExtKeyAttDef->GetDeletionPropagationOption();
-					if ($iDeletePropagationOption == DEL_MANUAL) {
-						// Issue, do not recurse
-						$oDeletionPlanItem = new DeletionPlanItem(aIds: $aRemoteIdsToRemove);
-						$oDeletionPlanEntity->oIssue->Merge($oDeletionPlanItem);
-						continue;
-					}
-
-					if (($iDeletePropagationOption == DEL_MOVEUP) && ($oExtKeyAttDef->IsHierarchicalKey())) {
-						// update hierarchical keys due to row cleanup in the same table
-						$sIdsToRemove = implode(',', $this->aDeletionPlan[$sRemoteClass]->oDelete->aIds);
-						$oUpdateItem = $this->UpdateHierarchicalExtKey($sRemoteClass, $sExtKeyAttCode, $sIdsToRemove);
-						$oDeletionPlanEntity->oUpdate->Merge($oUpdateItem);
-						// do not recurse
-						continue;
-					}
-
-					// Delete entries in Remote Class
-					if (count($aRemoteIdsToRemove) !== 0) {
-						// TODO see ObjectService::Delete() !!!!!!
-						$sRemoteIdsToDelete = implode(',', $aRemoteIdsToRemove);
-						$sRemoteTable = MetaModel::DBGetTable($sRemoteClass);
-						$sDBKey = MetaModel::DBGetKey($sRemoteClass);
-						$sSQL = "DELETE FROM `$sRemoteTable` WHERE `$sDBKey` IN ($sRemoteIdsToDelete)";
-						$oDeletionPlanEntity->oDelete->Merge(new DeletionPlanItem([$sSQL], $aRemoteIdsToRemove));
-
-						$this->DeletionPlanForReferencingClasses($sRemoteClass);
-					}
-				}
-			}
-		}
-	}
-
-	/**
-	 * @param string $sRemoteClass
-	 * @param string $sExtKeyAttCode
-	 * @param string $sIdsToRemoveInTargetClass
-	 *
-	 * @return \Combodo\iTop\DataFeatureRemoval\Entity\DeletionPlanItem
-	 * @throws \CoreException
-	 */
-	public function UpdateExtKeyNullable(string $sRemoteClass, string $sExtKeyAttCode, string $sIdsToRemoveInTargetClass): DeletionPlanItem
-	{
-		$aIds = $this->GetRemoteIdsForExtKey($sRemoteClass, $sExtKeyAttCode, $sIdsToRemoveInTargetClass);
-
-		[$sDBTable, $sDBField] = $this->GetDBInfoForAttcode($sRemoteClass, $sExtKeyAttCode);
-		$sUpdateSQL = <<<SQL
-UPDATE `$sDBTable` SET `updated`.`$sDBField` = 0
-FROM `$sDBTable` AS `updated`
-WHERE `updated`.`$sDBField` IN ($sIdsToRemoveInTargetClass)
-SQL;
-
-		return new DeletionPlanItem([$sExtKeyAttCode => $sUpdateSQL], $aIds);
-	}
-
-	/**
-	 * @param string $sRemoteClass
-	 * @param string $sExtKeyAttCode
-	 * @param string $sIdsToRemoveInTargetClass
-	 *
-	 * @return \Combodo\iTop\DataFeatureRemoval\Entity\DeletionPlanItem
-	 * @throws \CoreException
-	 * @throws \MySQLException
-	 */
-	public function UpdateHierarchicalExtKey(string $sRemoteClass, string $sExtKeyAttCode, string $sIdsToRemoveInTargetClass): DeletionPlanItem
-	{
-		[$sDBTable, $sDBField, $sDBKey] = $this->GetDBInfoForAttcode($sRemoteClass, $sExtKeyAttCode);
-		$sUpdateSQL = <<<SQL
-UPDATE `$sDBTable` SET `updated`.`$sDBField` = `removed`.`$sDBField`
-FROM `$sDBTable` AS `updated`
-INNER JOIN `$sDBTable` AS `removed` ON `updated`.`$sDBField` = `removed`.`$sDBKey`
-WHERE `removed`.`$sDBKey` IN ($sIdsToRemoveInTargetClass)
-SQL;
-
-		$sSQL = <<<SQL
-SELECT `$sDBKey`
-FROM `$sDBTable` AS `updated`
-INNER JOIN `$sDBTable` AS `removed` ON `updated`.`$sDBField` = `removed`.`$sDBKey`
-WHERE `removed`.`$sDBKey` IN ($sIdsToRemoveInTargetClass)
-SQL;
-		$aIds = CMDBSource::QueryToCol($sSQL, $sDBKey);
-
-		return new DeletionPlanItem([$sExtKeyAttCode => $sUpdateSQL], $aIds);
-	}
-
-	/**
-	 * @param string $sRemoteClass
-	 * @param string $sExtKeyAttCode
-	 * @param string $sIdsToRemoveInTargetClass
-	 *
-	 * @return array
-	 * @throws \CoreException
-	 * @throws \MySQLException
-	 */
-	public function GetRemoteIdsForExtKey(string $sRemoteClass, string $sExtKeyAttCode, string $sIdsToRemoveInTargetClass): array
-	{
-		if (\utils::IsNullOrEmptyString($sIdsToRemoveInTargetClass)) {
-			return [];
-		}
-		[$sDBTable, $sDBField, $sDBKey] = $this->GetDBInfoForAttcode($sRemoteClass, $sExtKeyAttCode);
-		$sSQL = "SELECT `$sDBKey` FROM `$sDBTable` WHERE `$sDBField` IN ($sIdsToRemoveInTargetClass)";
-
-		return CMDBSource::QueryToCol($sSQL, $sDBKey);
-	}
-
-	/**
-	 * @param string $sClass
-	 *
-	 * @return \Combodo\iTop\DataFeatureRemoval\Entity\DeletionPlanItem
-	 * @throws \CoreException
-	 * @throws \MySQLException
-	 */
-	public function GetInitialClassDeletionPlan(string $sClass): DeletionPlanItem
-	{
-		$sTable = MetaModel::DBGetTable($sClass);
-		$sDBKey = MetaModel::DBGetKey($sClass);
-		$sSQL = "SELECT `$sDBKey` FROM `$sTable`";
-		$aIds = CMDBSource::QueryToCol($sSQL, $sDBKey);
-
-		// TODO see ObjectService::Delete() !!!!!!
-		$sDeleteSQL = "DELETE FROM `$sTable`";
-
-		return new DeletionPlanItem([$sDeleteSQL], $aIds);
-	}
-
-	/**
-	 * Get database table for an attcode
-	 *
-	 * @param string $sClass
-	 * @param string $sExtKeyAttCode
-	 *
-	 * @return array
-	 * @throws \CoreException
-	 * @throws \Exception
-	 */
-	public function GetDBInfoForAttcode(string $sClass, string $sExtKeyAttCode): array
-	{
-		$sOriginClass = MetaModel::GetAttributeOrigin($sClass, $sExtKeyAttCode);
-		$sDBTable = MetaModel::DBGetTable($sOriginClass);
-		$oAttDef = MetaModel::GetAttributeDef($sOriginClass, $sExtKeyAttCode);
-		// External key is on a single DB column
-		$sDBField = array_keys($oAttDef->GetSQLColumns())[0];
-		$sDBKey = MetaModel::DBGetKey($sClass);
-		return [$sDBTable, $sDBField, $sDBKey];
-	}
-
-}

datamodels/2.x/combodo-data-feature-removal/vendor/composer/autoload_classmap.php

@@ -8,8 +8,6 @@ $baseDir = dirname($vendorDir);
 return array(
     'Combodo\\iTop\\DataFeatureRemoval\\Controller\\DataFeatureRemovalController' => $baseDir . '/src/Controller/DataFeatureRemovalController.php',
     'Combodo\\iTop\\DataFeatureRemoval\\Entity\\DataCleanupSummaryEntity' => $baseDir . '/src/Entity/DataCleanupSummaryEntity.php',
-    'Combodo\\iTop\\DataFeatureRemoval\\Entity\\DeletionPlanEntity' => $baseDir . '/src/Entity/DeletionPlanEntity.php',
-    'Combodo\\iTop\\DataFeatureRemoval\\Entity\\DeletionPlanItem' => $baseDir . '/src/Entity/DeletionPlanItem.php',
     'Combodo\\iTop\\DataFeatureRemoval\\Helper\\DataFeatureRemovalConfig' => $baseDir . '/src/Helper/DataFeatureRemovalConfig.php',
     'Combodo\\iTop\\DataFeatureRemoval\\Helper\\DataFeatureRemovalException' => $baseDir . '/src/Helper/DataFeatureRemovalException.php',
     'Combodo\\iTop\\DataFeatureRemoval\\Helper\\DataFeatureRemovalHelper' => $baseDir . '/src/Helper/DataFeatureRemovalHelper.php',
@@ -18,7 +16,6 @@ return array(
     'Combodo\\iTop\\DataFeatureRemoval\\Service\\DataFeatureRemoverExtensionService' => $baseDir . '/src/Service/DataFeatureRemoverExtensionService.php',
     'Combodo\\iTop\\DataFeatureRemoval\\Service\\ObjectService' => $baseDir . '/src/Service/ObjectService.php',
     'Combodo\\iTop\\DataFeatureRemoval\\Service\\ObjectServiceSummary' => $baseDir . '/src/Service/ObjectServiceSummary.php',
-    'Combodo\\iTop\\DataFeatureRemoval\\Service\\StaticDeletionPlan' => $baseDir . '/src/Service/StaticDeletionPlan.php',
     'Combodo\\iTop\\DataFeatureRemoval\\Service\\iObjectService' => $baseDir . '/src/Service/iObjectService.php',
     'Composer\\InstalledVersions' => $vendorDir . '/composer/InstalledVersions.php',
 );

datamodels/2.x/combodo-data-feature-removal/vendor/composer/autoload_static.php

@@ -23,8 +23,6 @@ class ComposerStaticInit4f96a7199e2c0d90e547333758b26464
     public static $classMap = array (
         'Combodo\\iTop\\DataFeatureRemoval\\Controller\\DataFeatureRemovalController' => __DIR__ . '/../..' . '/src/Controller/DataFeatureRemovalController.php',
         'Combodo\\iTop\\DataFeatureRemoval\\Entity\\DataCleanupSummaryEntity' => __DIR__ . '/../..' . '/src/Entity/DataCleanupSummaryEntity.php',
-        'Combodo\\iTop\\DataFeatureRemoval\\Entity\\DeletionPlanEntity' => __DIR__ . '/../..' . '/src/Entity/DeletionPlanEntity.php',
-        'Combodo\\iTop\\DataFeatureRemoval\\Entity\\DeletionPlanItem' => __DIR__ . '/../..' . '/src/Entity/DeletionPlanItem.php',
         'Combodo\\iTop\\DataFeatureRemoval\\Helper\\DataFeatureRemovalConfig' => __DIR__ . '/../..' . '/src/Helper/DataFeatureRemovalConfig.php',
         'Combodo\\iTop\\DataFeatureRemoval\\Helper\\DataFeatureRemovalException' => __DIR__ . '/../..' . '/src/Helper/DataFeatureRemovalException.php',
         'Combodo\\iTop\\DataFeatureRemoval\\Helper\\DataFeatureRemovalHelper' => __DIR__ . '/../..' . '/src/Helper/DataFeatureRemovalHelper.php',
@@ -33,7 +31,6 @@ class ComposerStaticInit4f96a7199e2c0d90e547333758b26464
         'Combodo\\iTop\\DataFeatureRemoval\\Service\\DataFeatureRemoverExtensionService' => __DIR__ . '/../..' . '/src/Service/DataFeatureRemoverExtensionService.php',
         'Combodo\\iTop\\DataFeatureRemoval\\Service\\ObjectService' => __DIR__ . '/../..' . '/src/Service/ObjectService.php',
         'Combodo\\iTop\\DataFeatureRemoval\\Service\\ObjectServiceSummary' => __DIR__ . '/../..' . '/src/Service/ObjectServiceSummary.php',
-        'Combodo\\iTop\\DataFeatureRemoval\\Service\\StaticDeletionPlan' => __DIR__ . '/../..' . '/src/Service/StaticDeletionPlan.php',
         'Combodo\\iTop\\DataFeatureRemoval\\Service\\iObjectService' => __DIR__ . '/../..' . '/src/Service/iObjectService.php',
         'Composer\\InstalledVersions' => __DIR__ . '/..' . '/composer/InstalledVersions.php',
     );

datamodels/2.x/itop-core-update/src/Controller/AjaxController.php

@@ -242,7 +242,8 @@ class AjaxController extends Controller
 			throw new SecurityException('Access forbidden');
 		}
 
-		SetupUtils::CreateSetupToken();
+		$sConfigFile = APPCONF.'production/config-itop.php';
+		@chmod($sConfigFile, 0770); // Allow overwriting the file
 
 		header('Location: ../setup/');
 	}

datamodels/2.x/itop-core-update/src/Controller/UpdateController.php

@@ -166,6 +166,8 @@ class UpdateController extends Controller
 	public function OperationRunSetup()
 	{
 		SetupUtils::CheckSetupToken(true);
+		$sConfigFile = APPCONF.'production/'.ITOP_CONFIG_FILE;
+		@chmod($sConfigFile, 0770);
 		$sRedirectURL = utils::GetAbsoluteUrlAppRoot().'setup/index.php';
 		header("Location: $sRedirectURL");
 	}

datamodels/2.x/itop-profiles-itil/datamodel.itop-profiles-itil.xml

@@ -85,6 +85,13 @@
           <class id="Attachment"/>
         </classes>
       </group>
+      <group id="Ticket" _delta="define">
+        <classes>
+          <class id="Ticket"/>
+          <class id="WorkOrder"/>
+          <class id="Attachment"/>
+        </classes>
+      </group>
       <group id="Portal" _delta="define">
         <classes>
           <class id="lnkFunctionalCIToTicket"/>
@@ -205,6 +212,60 @@
       </group>
     </groups>
     <profiles>
+      <profile id="5500" _delta="define">
+        <name>Configuration ReadOnly</name>
+        <description>This read-only profile allows to see CIs objects.</description>
+        <groups>
+          <group id="Configuration">
+            <actions>
+              <action id="action:read">allow</action>
+              <action id="action:bulk read">allow</action>
+            </actions>
+          </group>
+          <group id="General">
+            <actions>
+              <action id="action:read">allow</action>
+              <action id="action:bulk read">allow</action>
+            </actions>
+          </group>
+        </groups>
+      </profile>
+      <profile id="5501" _delta="define">
+        <name>Ticket ReadOnly</name>
+        <description>This read-only profile allows to see Ticket objects.</description>
+        <groups>
+          <group id="Ticket">
+            <actions>
+              <action id="action:read">allow</action>
+              <action id="action:bulk read">allow</action>
+            </actions>
+          </group>
+          <group id="General">
+            <actions>
+              <action id="action:read">allow</action>
+              <action id="action:bulk read">allow</action>
+            </actions>
+          </group>
+        </groups>
+      </profile>
+      <profile id="5502" _delta="define">
+        <name>Service Catalog ReadOnly</name>
+        <description>This read-only profile allows to see Service Catalog objects.</description>
+        <groups>
+          <group id="Service">
+            <actions>
+              <action id="action:read">allow</action>
+              <action id="action:bulk read">allow</action>
+            </actions>
+          </group>
+          <group id="General">
+            <actions>
+              <action id="action:read">allow</action>
+              <action id="action:bulk read">allow</action>
+            </actions>
+          </group>
+        </groups>
+      </profile>
       <profile id="117" _delta="define">
         <name>SuperUser</name>
         <description>This profile allows all actions which are not Administrator restricted.</description>

datamodels/2.x/itop-structure/data/data.sample.users.xml

@@ -4,80 +4,64 @@
     <contactid>9</contactid>
     <email>jules.vernes@it.com</email>
     <org_id_friendlyname>IT Department</org_id_friendlyname>
-    <login>Agent</login>
+    <login>SupportAgent</login>
     <language>EN US</language>
     <status>disabled</status>
-    <profile_list>
+     <password><![CDATA[SupportAgent]]></password>
-      <Set>
-        <URP_UserProfile id="5">
-          <profileid>5</profileid>
-          <profile>Support Agent</profile>
-          <reason></reason>
-        </URP_UserProfile>
-      </Set>
-    </profile_list>
-    <allowed_org_list>
-      <Set>
-      </Set>
-    </allowed_org_list>
-    <password><![CDATA[R6rQ;p]JT*FA$aaP^4]]></password>
     <expiration>force_expire</expiration>
     <password_renewed_date>2026-06-04</password_renewed_date>
   </UserLocal>
+  <URP_UserProfile id="5">
+    <userid>4</userid>
+    <userlogin>SupportAgent</userlogin>
+    <profileid>SELECT URP_Profiles WHERE id='5'</profileid>
+    <profile>Support Agent</profile>
+    <reason></reason>
+  </URP_UserProfile>
   <UserLocal alias="UserLocal" id="5">
     <contactid>26</contactid>
     <contactid_friendlyname>Jean Ferrat</contactid_friendlyname>
     <org_id_friendlyname>IT Department</org_id_friendlyname>
-    <login>config</login>
+    <login>ConfigManager</login>
     <language>EN US</language>
     <status>disabled</status>
-    <profile_list>
+    <password><![CDATA[$W[ConfigManager]]></password>
-      <Set>
-        <URP_UserProfile id="6">
-          <profileid>3</profileid>
-          <profile>Configuration Manager</profile>
-          <reason></reason>
-        </URP_UserProfile>
-      </Set>
-    </profile_list>
-    <allowed_org_list>
-      <Set>
-      </Set>
-    </allowed_org_list>
-    <password><![CDATA[$W[:"7+Gf"Y\sd8#E~]]></password>
     <expiration>force_expire</expiration>
     <password_renewed_date>2026-06-04</password_renewed_date>
   </UserLocal>
+  <URP_UserProfile id="6">
+    <userid>5</userid>
+    <userlogin>ConfigManager</userlogin>
+    <profileid>SELECT URP_Profiles WHERE id='3'</profileid>
+    <profile>Configuration Manager</profile>
+    <reason></reason>
+  </URP_UserProfile>
   <UserLocal alias="UserLocal" id="2">
     <contactid>15</contactid>
     <email>agatha.christie@demo.com</email>
     <org_id_friendlyname>Sales Department</org_id_friendlyname>
-    <login>Portal</login>
+    <login>PortalUser</login>
     <language>EN US</language>
     <status>disabled</status>
-    <profile_list>
+    <password><![CDATA[PortalUser]]></password>
-      <Set>
-        <URP_UserProfile id="2">
-          <profileid>2</profileid>
-          <profile>Portal user</profile>
-          <reason></reason>
-        </URP_UserProfile>
-      </Set>
-    </profile_list>
-    <allowed_org_list>
-      <Set>
-        <URP_UserOrg id="2">
-          <allowed_org_id>6</allowed_org_id>
-          <allowed_org_name>Sales Department</allowed_org_name>
-          <reason></reason>
-          <allowed_org_id_obsolescence_flag>no</allowed_org_id_obsolescence_flag>
-        </URP_UserOrg>
-      </Set>
-    </allowed_org_list>
-    <password><![CDATA[-Why]KDdMJvkuB8#e]]></password>
     <expiration>force_expire</expiration>
     <password_renewed_date>2026-04-17</password_renewed_date>
   </UserLocal>
+  <URP_UserProfile id="2">
+    <userid>2</userid>
+    <userlogin>PortalUser</userlogin>
+    <profileid>SELECT URP_Profiles WHERE id='2'</profileid>
+    <profile>Portal user</profile>
+    <reason></reason>
+  </URP_UserProfile>
+  <URP_UserOrg id="2">
+    <userid>2</userid>
+    <userlogin>PortalUser</userlogin>
+    <allowed_org_id>6</allowed_org_id>
+    <allowed_org_name>Sales Department</allowed_org_name>
+    <reason></reason>
+    <allowed_org_id_obsolescence_flag>no</allowed_org_id_obsolescence_flag>
+  </URP_UserOrg>
   <UserLocal alias="UserLocal" id="3">
     <contactid>6</contactid>
     <email>claude.monet@demo.com</email>
@@ -85,32 +69,48 @@
     <login>SalesManager</login>
     <language>EN US</language>
     <status>disabled</status>
-    <profile_list>
+    <password><![CDATA[SalesManager]]></password>
-      <Set>
-        <URP_UserProfile id="4">
-          <profileid>12</profileid>
-          <profile>Portal power user</profile>
-          <reason></reason>
-        </URP_UserProfile>
-        <URP_UserProfile id="3">
-          <profileid>2</profileid>
-          <profile>Portal user</profile>
-          <reason></reason>
-        </URP_UserProfile>
-      </Set>
-    </profile_list>
-    <allowed_org_list>
-      <Set>
-        <URP_UserOrg id="1">
-          <allowed_org_id>6</allowed_org_id>
-          <allowed_org_name>Sales Department</allowed_org_name>
-          <reason></reason>
-          <allowed_org_id_obsolescence_flag>no</allowed_org_id_obsolescence_flag>
-        </URP_UserOrg>
-      </Set>
-    </allowed_org_list>
-    <password><![CDATA[D%r7hoZ})5*hvq5`{Q]]></password>
     <expiration>force_expire</expiration>
     <password_renewed_date>2026-06-04</password_renewed_date>
   </UserLocal>
+  <URP_UserProfile id="4">
+    <userid>3</userid>
+    <userlogin>SalesManager</userlogin>
+    <profileid>SELECT URP_Profiles WHERE id='12'</profileid>
+    <profile>Portal power user</profile>
+    <reason></reason>
+  </URP_UserProfile>
+  <URP_UserProfile id="3">
+    <userid>3</userid>
+    <userlogin>SalesManager</userlogin>
+    <profileid>SELECT URP_Profiles WHERE id='2'</profileid>
+    <profile>Portal user</profile>
+    <reason></reason>
+  </URP_UserProfile>
+  <URP_UserOrg id="1">
+    <userid>3</userid>
+    <userlogin>SalesManager</userlogin>
+    <allowed_org_id>6</allowed_org_id>
+    <allowed_org_name>Sales Department</allowed_org_name>
+    <reason></reason>
+    <allowed_org_id_obsolescence_flag>no</allowed_org_id_obsolescence_flag>
+  </URP_UserOrg>
+  <UserLocal alias="UserLocal" id="6">
+    <contactid>18</contactid>
+    <email>rene.descartes@demo.com</email>
+    <org_id_friendlyname>Demo</org_id_friendlyname>
+    <login>SuperUser</login>
+    <language>EN US</language>
+    <status>disabled</status>
+    <password><![CDATA[SuperUser]]></password>
+    <expiration>force_expire</expiration>
+    <password_renewed_date>2026-04-17</password_renewed_date>
+  </UserLocal>
+  <URP_UserProfile id="7">
+    <userid>6</userid>
+    <userlogin>SuperUser</userlogin>
+    <profileid>SELECT URP_Profiles WHERE id='117'</profileid>
+    <profile>Super User</profile>
+    <reason></reason>
+  </URP_UserProfile>
 </Set>

setup/wizard.php

@@ -74,6 +74,7 @@ if (SetupUtils::IsSessionSetupTokenValid()) {
 		// The configuration file already exists
 		if (!is_writable($sConfigFile)) {
 			SetupUtils::ExitReadOnlyMode(false); // Reset readonly mode in case of problem
+			SetupUtils::EraseSetupToken();
 			$sRelativePath = utils::GetConfigFilePathRelative(ITOP_DEFAULT_ENV);
 			$oP = new SetupPage('Installation Cannot Continue');
 			$oP->add("<h2>Fatal error</h2>\n");
@@ -86,6 +87,7 @@ HTML;
 			$oP->p($sButtonsHtml);
 
 			$oP->output();
+			// Prevent token creation
 			exit;
 		} else {
 			chmod($sConfigFile, 0440);

setup/wizardcontroller.class.inc.php

@@ -196,6 +196,7 @@ class WizardController
 		SetupLog::Info("=== Setup screen: ".$oStep->GetTitle().' ('.get_class($oStep).')');
 		$oPage = new SetupPage($oStep->GetTitle());
 		$oPage->LinkScriptFromAppRoot('setup/setup.js');
+		$oStep->PreFormDisplay($oPage);
 
 		$oPage->add('<form id="wiz_form" class="ibo-setup--wizard" method="post">');
 		$oPage->add('<div class="ibo-setup--wizard--content">');

setup/wizardsteps/WizStepWelcome.php

@@ -124,18 +124,18 @@ HTML
 			if (file_exists($sBuildConfigFile)) {
 				$oPage->add(
 					<<<HTML
-					<form id="fast_setup" method="post">
+					<form method="post">
 						<input type="hidden" name="_class" value="WizStepLandingBeforeAudit"/>
 						<input type="hidden" name="operation" value="next"/>
 						<input type="hidden" name="_params[skip_wizard]" value="1"/>
+						<table style="width:100%;" class="ibo-setup--wizard--buttons-container">
+						<tr>
+							<td style="text-align: right"><button type="submit" class="ibo-button ibo-is-regular ibo-is-secondary">Keep current choices</button></td>
+						</tr>
+						</table>
 					</form>
 HTML
 				);
-				$oPage->add_ready_script(
-					<<<JS
-$('.ibo-setup--wizard--buttons-container tr td:nth-child(1)').before('<td style="text-align:center;"><button class="ibo-button ibo-is-alternative ibo-is-neutral" form="fast_setup"><span class="ibo-button--label">Keep current choices</span></button></td>');
-JS
-				);
 			}
 		}
 	}

setup/wizardsteps/WizardStep.php

@@ -76,6 +76,10 @@ abstract class WizardStep
 	{
 	}
 
+	public function PreFormDisplay(SetupPage $oPage)
+	{
+	}
+
 	protected function CheckDependencies()
 	{
 		if (is_null($this->bDependencyCheck)) {

tests/php-unit-tests/src/BaseTestCase/ItopDataTestCase.php

@@ -87,8 +87,6 @@ abstract class ItopDataTestCase extends ItopTestCase
 	 */
 	public const DEFAULT_TEST_ENVIRONMENT = 'production';
 	public const USE_TRANSACTION = true;
-	public const CREATE_TEST_ORG = false;
-
 	protected static $aURP_Profiles = [
 		'Administrator'         => 1,
 		'Portal user'           => 2,
@@ -102,9 +100,15 @@ abstract class ItopDataTestCase extends ItopTestCase
 		'Service Manager'       => 10,
 		'Document author'       => 11,
 		'Portal power user'     => 12,
+		'Business partner user'     => 40,
 		'REST Services User'    => 1024,
+		'Configuration ReadOnly' => 5500,
+		'Ticket ReadOnly' => 5501,
+		'Service Catalog ReadOnly' => 5502,
 	];
 
+	public const CREATE_TEST_ORG = false;
+
 	/**
 	 * This method is called before the first test of this test class is run (in the current process).
 	 */
@@ -1463,16 +1467,42 @@ abstract class ItopDataTestCase extends ItopTestCase
 		]);
 	}
 
+	/**
+	 * @description To avoid adding finalclasses parameters to GivenUserInDB
+	 * @param string $sPassword
+	 * @param array $aProfiles Profile names Example: ['Administrator']
+	 * @param bool $bReturnLogin
+	 *
+	 * @return string|int The unique login
+	 * @throws \Exception
+	 */
+	protected function GivenTokenUserInDB(array $aProfiles, bool $bReturnLogin = true): string|int
+	{
+		$sLogin = 'demo_test_'.uniqid(__CLASS__, true);
+
+		$aProfileList = array_map(function ($sProfileId) {
+			return 'profileid:'.self::$aURP_Profiles[$sProfileId];
+		}, $aProfiles);
+
+		$iUser = $this->GivenObjectInDB('UserToken', [
+			'login' => $sLogin,
+			'language' => 'EN US',
+			'profile_list' => $aProfileList,
+		]);
+		return $bReturnLogin ? $sLogin : $iUser;
+	}
+
 	/**
 	 * @param string $sPassword
 	 * @param array $aProfiles Profile names Example: ['Administrator']
 	 * @param string|null $sLogin
 	 * @param string|null $sUserId
+	 * @param bool $bReturnLogin
 	 *
 	 * @return string The unique login
 	 * @throws \Exception
 	 */
-	protected function GivenUserInDB(string $sPassword, array $aProfiles, ?string $sLogin = null, ?string &$sUserId = null): string
+	protected function GivenUserInDB(string $sPassword, array $aProfiles, ?string $sLogin = null, ?string &$sUserId = null, bool $bReturnLogin = true): string
 	{
 		if (is_null($sLogin)) {
 			$sLogin = 'demo_test_'.uniqid(__CLASS__, true);
@@ -1489,7 +1519,7 @@ abstract class ItopDataTestCase extends ItopTestCase
 			'profile_list' => $aProfileList,
 		]);
 
-		return $sLogin;
+		return $bReturnLogin ? $sLogin : $sUserId;
 	}
 
 	/**

tests/php-unit-tests/unitary-tests/core/UserRightsTest.php

@@ -29,11 +29,11 @@ namespace Combodo\iTop\Test\UnitTest\Core;
 
 use Combodo\iTop\Test\UnitTest\ItopDataTestCase;
 use CoreCannotSaveObjectException;
-use CoreException;
 use DBObject;
 use DBObjectSearch;
 use DBObjectSet;
 use DeleteException;
+use Dict;
 use MetaModel;
 use UserLocal;
 use UserRights;
@@ -81,6 +81,65 @@ class UserRightsTest extends ItopDataTestCase
 		return $oUser;
 	}
 
+	public function testIsActionAllowedWithNonInstantiatedUserObject()
+	{
+		$oUser = $this->GivenUserWithProfiles('test1', [self::$aURP_Profiles['Configuration Manager']]); // not a readonly profile
+		$oAdminUser = $this->GivenUserWithProfiles('test2', [self::$aURP_Profiles['Administrator']]);
+		$oAdminUser->DBInsert();
+		$_SESSION = [];
+		UserRights::Login($oAdminUser->Get('login'));
+
+		self::assertTrue(UserRights::IsActionAllowed('Server', UR_ACTION_MODIFY, null, $oUser) === UR_ALLOWED_YES);
+	}
+
+	/**
+	 * @param array $aProfileIds
+	 * @param array $aShouldBeAllowedToSeeClass
+	 * @param array $aShouldBeAllowedToEditClass
+	 *
+	 * @return void
+	 * @throws \ArchivedObjectException
+	 * @throws \CoreCannotSaveObjectException
+	 * @throws \CoreException
+	 * @throws \CoreUnexpectedValue
+	 * @throws \CoreWarning
+	 * @throws \DictExceptionUnknownLanguage
+	 * @throws \MySQLException
+	 * @throws \OQLException
+	 * @dataProvider ReadOnlyProvider
+	 */
+	public function testReadOnlyUser(array $aProfileIds, array $aShouldBeAllowedToSeeClass, array $aShouldBeAllowedToEditClass): void
+	{
+
+		$oUser = $this->GivenUserWithProfiles('test1', $aProfileIds);
+		$oUser->DBInsert();
+		$_SESSION = [];
+		UserRights::Login($oUser->Get('login'));
+
+		$aClassesToTest = ['FunctionalCI', 'Ticket', 'ServiceFamily'];
+
+		foreach ($aClassesToTest as $sClass) {
+			$bShouldBeAllowedToSee = in_array($sClass, $aShouldBeAllowedToSeeClass);
+			$bIsAllowedReading = (bool)UserRights::IsActionAllowed($sClass, UR_ACTION_READ);
+
+			$this->assertSame(
+				$bShouldBeAllowedToSee,
+				$bIsAllowedReading,
+				"User with profiles ".implode(',', $aProfileIds)." should ".($bShouldBeAllowedToSee ? "" : "NOT ")."be allowed to see class $sClass"
+			);
+
+			$bShouldBeAllowedToEdit = in_array($sClass, $aShouldBeAllowedToEditClass);
+
+			$bIsAllowedEditing = (bool)UserRights::IsActionAllowed($sClass, UR_ACTION_MODIFY);
+
+			$this->assertSame(
+				$bIsAllowedEditing,
+				$bShouldBeAllowedToEdit,
+				"User with profiles ".implode(',', $aProfileIds)." should ".($bShouldBeAllowedToEdit ? "" : "NOT ")."be allowed to edit class $sClass"
+			);
+		}
+	}
+
 	protected function GivenUserWithProfiles(string $sLogin, array $aProfileIds): DBObject
 	{
 		$oProfiles = new \ormLinkSet(\UserLocal::class, 'profile_list', \DBObjectSet::FromScratch(\URP_UserProfile::class));
@@ -433,7 +492,7 @@ class UserRightsTest extends ItopDataTestCase
 		$oUser = $this->GivenUserWithProfiles('test1', [$iProfileId, 2]);
 
 		$this->expectException(CoreCannotSaveObjectException::class);
-		$this->expectExceptionMessage('Profile "Portal user" cannot be given to privileged Users (Administrators, SuperUsers and REST Services Users)');
+		$this->expectExceptionMessage(Dict::Format('Class:User/Error:PrivilegedUserMustHaveAccessToBackOffice', PORTAL_PROFILE_NAME));
 		$oUser->DBInsert();
 
 	}
@@ -572,4 +631,82 @@ class UserRightsTest extends ItopDataTestCase
 		$oUser = $this->InvokeNonPublicStaticMethod(UserRights::class, "FindUser", [$sLogin]);
 		static::assertNull($oUser, 'FindUser should return null when the login is unknown');
 	}
+
+	protected function ReadOnlyProvider(): array
+	{
+		return [
+			'CI' => [
+				'ProfilesId' => [
+					5500,
+				],
+				'ShouldBeAllowedToSeeClasses' => [
+					'FunctionalCI',
+				],
+				'ShouldBeAllowedToEditClasses' => [],
+			],
+			'Tickets' => [
+				'ProfilesId' => [
+					5501,
+				],
+				'ShouldBeAllowedToSeeClasses' => [
+					'Ticket',
+				],
+				'ShouldBeAllowedToEditClasses' => [],
+			],
+			'Catalog' => [
+				'ProfilesId' => [
+					5502,
+				],
+				'ShouldBeAllowedToSeeClasses' => [
+					'ServiceFamily',
+				],
+				'ShouldBeAllowedToEditClasses' => [],
+			],
+			'CI and Tickets' => [
+				'ProfilesId' => [
+					5500, 5501,
+				],
+				'ShouldBeAllowedToSeeClasses' => [
+					'FunctionalCI', 'Ticket',
+				],
+				'ShouldBeAllowedToEditClasses' => [],
+			],
+			'CI and Catalog' => [
+				'ProfilesId' => [
+					5500, 5502,
+				],
+				'ShouldBeAllowedToSeeClasses' => [
+					'FunctionalCI', 'ServiceFamily',
+				],
+				'ShouldBeAllowedToEditClasses' => [],
+			],
+			'Tickets and Catalog' => [
+				'ProfilesId' => [
+					5501, 5502,
+				],
+				'ShouldBeAllowedToSeeClasses' => [
+					'Ticket', 'ServiceFamily',
+				],
+				'ShouldBeAllowedToEditClasses' => [],
+			],
+			'Tickets and Catalog + profile Ccnfiguration Manager' => [
+				'ProfilesId' => [
+					5501, 5502, 3,
+				],
+				'ShouldBeAllowedToSeeClasses' => [
+					'FunctionalCI', 'Ticket', 'ServiceFamily',
+				],
+				'ShouldBeAllowedToEditClasses' => ['FunctionalCI'],
+			],
+			'CI, Tickets and Catalog' => [
+				'ProfilesId' => [
+					5500, 5501, 5502,
+				],
+				'ShouldBeAllowedToSeeClasses' => [
+					'FunctionalCI', 'Ticket', 'ServiceFamily',
+				],
+				'ShouldBeAllowedToEditClasses' => [],
+			],
+		];
+	}
 }

tests/php-unit-tests/unitary-tests/datamodels/2.x/combodo-data-feature-removal/AbstractCleanup.php

@@ -1,64 +0,0 @@
-<?php
-
-/*
- * @copyright   Copyright (C) 2010-2026 Combodo SAS
- * @license     http://opensource.org/licenses/AGPL-3.0
- */
-
-use Combodo\iTop\Test\UnitTest\ItopCustomDatamodelTestCase;
-
-class AbstractCleanup extends ItopCustomDatamodelTestCase
-{
-	public function GetDatamodelDeltaAbsPath(): string
-	{
-		return __DIR__.'/data_cleanup_delta.xml';
-	}
-
-	protected array $aIdByClass;
-	protected array $aIdByObjectName = [];
-
-	protected function GivenDFRTreeInDB(string $sTree)
-	{
-		$this->aIdByClass = [];
-		$aTree = explode("\n", $sTree);
-		foreach ($aTree as $sLine) {
-			if (trim($sLine) === '') {
-				continue;
-			}
-			$this->GivenDFRTreeLineInDB($sLine);
-		}
-	}
-
-	protected function GivenDFRTreeLineInDB(string $sLine)
-	{
-		[$sLeft, $sRight] = explode('<-', $sLine);
-		$sLeft = trim($sLeft);
-
-		$iLeftId = $this->aIdByObjectName[$sLeft] ?? 0;
-		if ($iLeftId === 0) {
-			[$sChildClass] = explode('_', $sLeft, 2);
-			$iLeftId = $this->GivenObjectInDB($sChildClass, ['name' => $sLeft]);
-			$this->aIdByClass[$sChildClass][] = $iLeftId;
-			$this->aIdByObjectName[$sLeft] = $iLeftId;
-		}
-
-		$sRight = trim($sRight);
-		if (preg_match("/(?<name>(?<class>[^_]+)_\d+)(\s+\((?<extkey>\w+)\))?/", $sRight, $aMatches) !== false) {
-			$sName = $aMatches['name'];
-			$sChildClass = $aMatches['class'];
-			$sExtKey = $aMatches['extkey'] ?? 'extkey_id';
-
-			$iRightId = $this->aIdByObjectName[$sName] ?? 0;
-			if ($iRightId === 0) {
-				$iRightId = $this->GivenObjectInDB($sChildClass, ['name' => $sName, $sExtKey => $iLeftId]);
-				$this->aIdByClass[$sChildClass][] = $iRightId;
-				$this->aIdByObjectName[$sName] = $iRightId;
-			} else {
-				// Update object
-				$oObj = MetaModel::GetObject($sChildClass, $iRightId);
-				$oObj->Set($sExtKey, $iLeftId);
-				$oObj->DBUpdate();
-			}
-		}
-	}
-}

tests/php-unit-tests/unitary-tests/datamodels/2.x/combodo-data-feature-removal/DataCleanupServiceTest.php

@@ -34,10 +34,15 @@ use PHPUnit\Framework\MockObject\MockObject;
  * @see DataCleanupSummaryEntity
  * @see ItopDataTestCase
  */
-class DataCleanupServiceTest extends \AbstractCleanup
+class DataCleanupServiceTest extends ItopCustomDatamodelTestCase
 {
 	private ExecutionLimits&MockObject $oExecutionLimits;
 
+	public function GetDatamodelDeltaAbsPath(): string
+	{
+		return __DIR__.'/data_cleanup_delta.xml';
+	}
+
 	//--- GetCleanupSummary tests ---
 
 	/**
@@ -256,6 +261,36 @@ class DataCleanupServiceTest extends \AbstractCleanup
 		$this->AssertSummaryEquals($aExpected, $aRes);
 	}
 
+	private function GivenDFRTreeInDB(string $sTree)
+	{
+		$aTree = explode("\n", $sTree);
+		foreach ($aTree as $sLine) {
+			if (trim($sLine) === "") {
+				continue;
+			}
+			$this->GivenDFRTreeLineInDB($sLine);
+		}
+	}
+
+	private array $aIdByObjectName = [];
+	private function GivenDFRTreeLineInDB(string $sLine)
+	{
+		[$sLeft, $sRight] = explode('<-', $sLine);
+		$sLeft = trim($sLeft);
+
+		$iLeftId = $this->aIdByObjectName[$sLeft] ?? 0;
+		if ($iLeftId === 0) {
+			[$sChildClass, ] = explode('_', $sLeft, 2);
+			$iLeftId = $this->GivenObjectInDB($sChildClass, ['name' => $sLeft]);
+			$this->aIdByObjectName[$sLeft] = $iLeftId;
+		}
+
+		$sRight = trim($sRight);
+		[$sChildClass, ] = explode('_', $sRight, 2);
+		$iRightId = $this->GivenObjectInDB($sChildClass, ['name' => $sRight, 'extkey_id' => $iLeftId]);
+		$this->aIdByObjectName[$sRight] = $iRightId;
+	}
+
 	private function GivenExecutionLimits(int $iStopAfterCallNumberReached): void
 	{
 		$matcher = $this->any();

tests/php-unit-tests/unitary-tests/datamodels/2.x/combodo-data-feature-removal/StaticDeletionPlanTest.php

@@ -1,167 +0,0 @@
-<?php
-
-namespace Combodo\iTop\Test\UnitTest\Module\DataFeatureRemoval;
-
-/*
- * @copyright   Copyright (C) 2010-2026 Combodo SAS
- * @license     http://opensource.org/licenses/AGPL-3.0
- */
-
-use Combodo\iTop\DataFeatureRemoval\Service\StaticDeletionPlan;
-use MetaModel;
-
-class StaticDeletionPlanTest extends \AbstractCleanup
-{
-	public function GetDatamodelDeltaAbsPath(): string
-	{
-		return __DIR__.'/data_cleanup_delta.xml';
-	}
-
-	public function testGetInitialClassDeletionPlan()
-	{
-		$this->GivenDFRTreeInDB(<<<EOF
-			DFRToRemoveLeaf_1 <- DFRToUpdate_1
-			DFRToRemoveLeaf_1 <- DFRToUpdate_2
-			DFRToRemoveLeaf_2 <- DFRToUpdate_3
-		EOF);
-
-		$oService = new StaticDeletionPlan();
-		$oDeletionPlanItem = $oService->GetInitialClassDeletionPlan('DFRToRemoveLeaf');
-		self::assertEquals(2, $oDeletionPlanItem->Count(), 'All entries of root table should be removed');
-		self::assertEquals($this->aIdByClass['DFRToRemoveLeaf'], $oDeletionPlanItem->aIds, 'All the Ids found in root table should correspond to the one created');
-		$sTable = MetaModel::DBGetTable('DFRToRemoveLeaf');
-		$sExpectedSQL = "DELETE FROM `$sTable`";
-		self::assertEquals($sExpectedSQL, $oDeletionPlanItem->aQueries[0], 'Removing elements in root class should suppress all entries');
-	}
-
-	public function testUpdateExtKeyNullable()
-	{
-		$this->GivenDFRTreeInDB(<<<EOF
-			DFRToRemoveLeaf_1 <- DFRToUpdate_1
-			DFRToRemoveLeaf_1 <- DFRToUpdate_2
-			DFRToRemoveLeaf_2 <- DFRToUpdate_3
-			DFRLeafNotToRemove_1 <- DFRToUpdate_4
-		EOF);
-
-		// WHEN
-		$oService = new StaticDeletionPlan();
-		$sRemoteClass = 'DFRToUpdate';
-		$oDeletionPlanItem = $oService->UpdateExtKeyNullable(
-			$sRemoteClass,
-			'extkey_id',
-			implode(',', $this->aIdByClass['DFRToRemoveLeaf'])
-		);
-		$sUpdateSQL = $oDeletionPlanItem->aQueries['extkey_id'];
-
-		// THEN
-		$sExpectedSQLEnd = " IN (".implode(',', $this->aIdByClass['DFRToRemoveLeaf']).")";
-		self::assertStringEndsWith($sExpectedSQLEnd, $sUpdateSQL, 'The query should be filtered with the ids of the root class');
-
-		self::assertEquals(3, $oDeletionPlanItem->Count(), 'All entries of root table should be removed');
-		$sIdsToRemoveInTargetClass = implode(',', $this->aIdByClass['DFRToRemoveLeaf']);
-		$aExpectedIds = $oService->GetRemoteIdsForExtKey($sRemoteClass, 'extkey_id', $sIdsToRemoveInTargetClass);
-
-		self::assertEquals($aExpectedIds, $oDeletionPlanItem->aIds, 'All entries pointing on root class should be removed');
-	}
-
-	/**
-	 * Tests that GetCleanupSummary returns an empty array when passed null as input.
-	 */
-	public function testGetCleanupSummaryReturnsEmptyArrayWhenNull(): void
-	{
-		$oService = new StaticDeletionPlan();
-		$aResult = $oService->GetStaticDeletionPlan([]);
-
-		$this->assertIsArray($aResult, 'Expected result to be an array when input is null.');
-		$this->assertEmpty($aResult, 'Expected result to be empty array when input is null.');
-	}
-
-	public function testGetStaticDeletionPlan_DeleteObjRecursively()
-	{
-		$this->GivenDFRTreeInDB(<<<EOF
-			DFRToRemoveLeaf_1 <- DFRToUpdate_1
-			DFRToRemoveLeaf_1 <- DFRRemovedCollateral_1
-			DFRRemovedCollateral_1 <- DFRRemovedCollateralCascade_1
-			DFRRemovedCollateral_1 <- DFRRemovedCollateralCascade_2
-		EOF);
-
-		$aClasses = [ 'DFRToRemoveLeaf' ];
-		$oService = new StaticDeletionPlan();
-		$aRes = $oService->GetStaticDeletionPlan($aClasses);
-
-		self::assertArrayHasKey('DFRRemovedCollateralCascade', $aRes, 'The cleanup should descend to the cascaded classes');
-
-		//		echo json_encode($aRes, JSON_PRETTY_PRINT)."\n";
-		//		echo json_encode($this->aIdByClass, JSON_PRETTY_PRINT);
-	}
-
-	public function testGetStaticDeletionPlan_IssuesArePresent()
-	{
-		$this->GivenDFRTreeInDB(<<<EOF
-			DFRToRemoveLeaf_1 <- DFRToUpdate_1
-			DFRToRemoveLeaf_1 <- DFRRemovedCollateral_1
-			DFRRemovedCollateral_1 <- DFRRemovedCollateralCascade_1
-			DFRRemovedCollateral_1 <- DFRRemovedCollateralCascade_2
-			DFRToRemoveLeaf_1 <- DFRManual_1
-		EOF);
-
-		$aClasses = [ 'DFRToRemoveLeaf' ];
-		$oService = new StaticDeletionPlan();
-		$aRes = $oService->GetStaticDeletionPlan($aClasses);
-
-		self::assertEquals(1, $aRes['DFRManual']->oIssue->Count(), 'Issue should be found because of DEL_MANUAL deletion policy');
-		self::assertEquals($this->aIdByClass['DFRManual'], $aRes['DFRManual']->oIssue->aIds, 'Issue should be correspond to the entries created');
-	}
-
-	public function testGetStaticDeletionPlan_UpdateMultipleExtKeys()
-	{
-		$this->GivenDFRTreeInDB(<<<EOF
-			DFRToRemoveLeaf_1 <- DFRToUpdate_1 (extkey_id)
-			DFRToRemoveLeaf_2 <- DFRToUpdate_2 (extkey2_id)
-			DFRLeafNotToRemove_1 <- DFRToUpdate_3 (extkey_id)
-		EOF);
-
-		$aClasses = [ 'DFRToRemoveLeaf' ];
-		$oService = new StaticDeletionPlan();
-		$aRes = $oService->GetStaticDeletionPlan($aClasses);
-
-		self::assertArrayHasKey('DFRToUpdate', $aRes, 'Class to update should be targeted');
-		self::assertEquals(2, $aRes['DFRToUpdate']->oUpdate->Count(), 'Update should be counted only for removed pointed classes');
-	}
-
-	public function testGetCleanupSummary()
-	{
-		$this->GivenDFRTreeInDB(<<<EOF
-			DFRToRemoveLeaf_1 <- DFRToUpdate_1
-			DFRToRemoveLeaf_1 <- DFRRemovedCollateral_1
-			DFRRemovedCollateral_1 <- DFRRemovedCollateralCascade_1
-			DFRRemovedCollateral_1 <- DFRRemovedCollateralCascade_2
-			DFRToRemoveLeaf_1 <- DFRManual_1
-		EOF);
-
-		$aClasses = [ 'DFRToRemoveLeaf' ];
-		$oService = new StaticDeletionPlan();
-		$aRes = $oService->GetCleanupSummary($aClasses);
-
-		self::assertEquals(1, $aRes['DFRManual']->iIssueCount, 'Issue should have been detected during cleanup count');
-	}
-
-	public function testCircularRefsShouldNotRunInfinitely()
-	{
-		$this->GivenDFRTreeInDB(<<<EOF
-			DFRToRemoveLeaf_1 <- DFRRemovedCollateral_1
-			DFRRemovedCollateral_1 <- DFRCircularRefs_1
-			DFRCircularRefs_1 <- DFRRemovedCollateral_1 (circular_id)
-		EOF);
-
-		$aClasses = [ 'DFRToRemoveLeaf' ];
-		$oService = new StaticDeletionPlan();
-		$aRes = $oService->GetCleanupSummary($aClasses);
-		echo json_encode($aRes, JSON_PRETTY_PRINT)."\n";
-
-		$aRes = $oService->GetStaticDeletionPlan($aClasses);
-		echo json_encode($aRes, JSON_PRETTY_PRINT)."\n";
-
-		self::assertTrue(true);
-	}
-}

tests/php-unit-tests/unitary-tests/datamodels/2.x/combodo-data-feature-removal/data_cleanup_delta.xml

@@ -71,15 +71,6 @@
           <on_target_delete>DEL_AUTO</on_target_delete>
           <tracking_level>all</tracking_level>
         </field>
-        <field id="extkey2_id" xsi:type="AttributeExternalKey">
-          <sql>extkey2_id</sql>
-          <filter/>
-          <dependencies/>
-          <is_null_allowed>true</is_null_allowed>
-          <target_class>DFRToRemove</target_class>
-          <on_target_delete>DEL_AUTO</on_target_delete>
-          <tracking_level>all</tracking_level>
-        </field>
       </fields>
       <methods/>
       <presentation>
@@ -132,15 +123,6 @@
           <on_target_delete>DEL_AUTO</on_target_delete>
           <tracking_level>all</tracking_level>
         </field>
-        <field id="circular_id" xsi:type="AttributeExternalKey">
-          <sql>circular_id</sql>
-          <filter/>
-          <dependencies/>
-          <is_null_allowed>true</is_null_allowed>
-          <target_class>DFRCircularRefs</target_class>
-          <on_target_delete>DEL_AUTO</on_target_delete>
-          <tracking_level>all</tracking_level>
-        </field>
       </fields>
       <methods/>
       <presentation>
@@ -163,11 +145,11 @@
       </presentation>
       <parent>cmdbAbstractObject</parent>
     </class>
-    <class id="DFRCircularRefs" _created_in="itop-structure" _delta="define">
+    <class id="DFRToRemoveLeaf" _created_in="itop-structure" _delta="define">
       <properties>
         <category>bizmodel,searchable</category>
         <abstract>false</abstract>
-        <db_table>dfrcircularrefs</db_table>
+        <db_table>dfrtoremoveleaf</db_table>
         <naming>
           <attributes/>
         </naming>
@@ -176,23 +158,14 @@
         </reconciliation>
       </properties>
       <fields>
-        <field id="name" xsi:type="AttributeString">
+        <field id="desc" xsi:type="AttributeString">
-          <sql>name</sql>
+          <sql>desc</sql>
           <default_value/>
           <is_null_allowed>true</is_null_allowed>
           <validation_pattern/>
           <dependencies/>
           <tracking_level>all</tracking_level>
         </field>
-        <field id="extkey_id" xsi:type="AttributeExternalKey">
-          <sql>extkey_id</sql>
-          <filter/>
-          <dependencies/>
-          <is_null_allowed>false</is_null_allowed>
-          <target_class>DFRRemovedCollateral</target_class>
-          <on_target_delete>DEL_AUTO</on_target_delete>
-          <tracking_level>all</tracking_level>
-        </field>
       </fields>
       <methods/>
       <presentation>
@@ -207,13 +180,13 @@
             <item id="name">
               <rank>10</rank>
             </item>
-            <item id="extkey_id">
+            <item id="desc">
               <rank>20</rank>
             </item>
           </items>
         </details>
       </presentation>
-      <parent>cmdbAbstractObject</parent>
+      <parent>DFRToRemove</parent>
     </class>
     <class id="DFRRemovedCollateralCascade" _created_in="itop-structure" _delta="define">
       <properties>
@@ -319,92 +292,6 @@
       </presentation>
       <parent>cmdbAbstractObject</parent>
     </class>
-    <class id="DFRLeafNotToRemove" _created_in="itop-structure" _delta="define">
-      <properties>
-        <category>bizmodel,searchable</category>
-        <abstract>false</abstract>
-        <db_table>dfrleafnottoremove</db_table>
-        <naming>
-          <attributes/>
-        </naming>
-        <reconciliation>
-          <attributes/>
-        </reconciliation>
-      </properties>
-      <fields>
-        <field id="info" xsi:type="AttributeString">
-          <sql>info</sql>
-          <default_value/>
-          <is_null_allowed>true</is_null_allowed>
-          <validation_pattern/>
-          <dependencies/>
-          <tracking_level>all</tracking_level>
-        </field>
-      </fields>
-      <methods/>
-      <presentation>
-        <list>
-          <items/>
-        </list>
-        <search>
-          <items/>
-        </search>
-        <details>
-          <items>
-            <item id="name">
-              <rank>10</rank>
-            </item>
-            <item id="info">
-              <rank>20</rank>
-            </item>
-          </items>
-        </details>
-      </presentation>
-      <parent>DFRToRemove</parent>
-    </class>
-    <class id="DFRToRemoveLeaf" _created_in="itop-structure" _delta="define">
-      <properties>
-        <category>bizmodel,searchable</category>
-        <abstract>false</abstract>
-        <db_table>dfrtoremoveleaf</db_table>
-        <naming>
-          <attributes/>
-        </naming>
-        <reconciliation>
-          <attributes/>
-        </reconciliation>
-      </properties>
-      <fields>
-        <field id="desc" xsi:type="AttributeString">
-          <sql>desc</sql>
-          <default_value/>
-          <is_null_allowed>true</is_null_allowed>
-          <validation_pattern/>
-          <dependencies/>
-          <tracking_level>all</tracking_level>
-        </field>
-      </fields>
-      <methods/>
-      <presentation>
-        <list>
-          <items/>
-        </list>
-        <search>
-          <items/>
-        </search>
-        <details>
-          <items>
-            <item id="name">
-              <rank>10</rank>
-            </item>
-            <item id="desc">
-              <rank>20</rank>
-            </item>
-          </items>
-        </details>
-      </presentation>
-      <parent>DFRToRemove</parent>
-    </class>
   </classes>
   <dictionaries>
     <dictionary id="EN US">

tests/php-unit-tests/unitary-tests/datamodels/2.x/combodo-data-feature-removal/simulate-audit-from-setup.php

@@ -59,7 +59,7 @@ foreach ($aAddedExtensions as $iIndex => $sExtensionCode) {
 	}
 }
 
-$sRemovedExtensions = utils::ReadParam('removed_modules', 'itop-container-mgmt', false, 'raw');
+$sRemovedExtensions = utils::ReadParam('removed_modules', '', false, 'raw');
 $aRemovedExtensionsAndModules = [];
 if (mb_strlen($sRemovedExtensions) > 0) {
 	$aRemovedExtensionsAndModules = explode(',', $sRemovedExtensions);