se/SE/se-lib/UserAcl.php

<?php

Lib::loadClass('DB');
Lib::loadClass('UsersHelper');
Lib::loadClass('ProcesHelper');
Lib::loadClass('TableAcl');
Lib::loadClass('SchemaReader');
Lib::loadClass('SchemaFactory');

class UserAcl {

	var $_user_id;
	var $_use_cache = false;
	/**
	 * User groups (cached)
	 */
	var $_groups = array();
	var $_proces_ids = array();
	var $_proces_tree_flat = array();
	var $_proces_used_ids = array();
	var $_proces_used_map = array();
	var $_proces_init_used_ids = array();

	function __construct($user_id, $use_cache = false) {
		$this->_user_id = $user_id;
		$this->_use_cache = $use_cache;

		$this->_cache_init();
	}

	function fetchGroups() {
		if ($this->_user_id < 0) return false;
		if (!empty($this->_groups)) {
			return $this->_groups;
		}

		$this->_groups = $this->_cache_read('_groups');
		if ($this->_groups != null) {
			return $this->_groups;
		}
		$this->_groups = array();

		$this->_groups = UsersHelper::get_group_by_user($this->_user_id);

		$this->_cache_save('_groups', $this->_groups);

		return $this->_groups;
	}

	function getProcesIds() {
		if (!empty($this->_proces_ids)) {
			return $this->_proces_ids;
		}
		$db = DB::getDB();
		$groups = $this->fetchGroups();
		if (empty($groups)) {
			return false;
		}
		$sql = "select p.`ID`
			from `CRM_PROCES` as p
				left join `CRM_WSKAZNIK` as w on(p.`ID`=w.`ID_PROCES`)
			where
				w.`ID_ZASOB` in(" . implode(",", array_keys($groups)) . ")
				and w.`A_STATUS` in('NORMAL', 'WAITING')
				and p.`A_STATUS` in('NORMAL', 'WAITING')
		";
		$res = $db->query($sql);
		while ($r = $db->fetch($res)) {
			$this->_proces_ids [$r->ID] = true;
		}
		$this->_proces_ids = array_keys($this->_proces_ids);
		return $this->_proces_ids;
	}

	function getProcesTree() {
		if (!empty($this->_proces_tree_flat)) {
			return $this->_proces_tree_flat;
		}

		$db = DB::getDB();
		$sql = "select p.`ID`, p.`PARENT_ID`
				from `CRM_PROCES` as p
				where p.`A_STATUS` in('WAITING','NORMAL')
			union
				select p.`IF_TRUE_GOTO` as ID, p.`ID` as PARENT_ID
				from `CRM_PROCES` as p
				where p.`A_STATUS` in('WAITING','NORMAL')
					and p.IF_TRUE_GOTO>0
					and p.IF_TRUE_GOTO_FLAG='GOTO_AND_RETURN'
		";
		//	union select '83','122'		  union select p.`ID` as ID, p.`IF_TRUE_GOTO` as PARENT_ID from `CRM_PROCES` as p where p.`A_STATUS` in('WAITING','NORMAL') and p.IF_TRUE_GOTO>0
		//union select '83','122'
		//union select '83','2025'
		$res = $db->query($sql);
		while ($r = $db->fetch($res)) {
			$this->_proces_tree_flat[$r->PARENT_ID][] = $r->ID;
		}
		return $this->_proces_tree_flat;
	}

	function _cache_init() {
		if (!$this->_use_cache) return;

		if (!isset($_SESSION['UserAcl_cache'])) {
			$_SESSION['UserAcl_cache'] = array();
		}
		else {
			$user_id = V::get('_user_id', 0, $_SESSION['UserAcl_cache'], 'int');
			if ($user_id > 0) {
				if ($user_id != $this->_user_id) {
					// clean cache if another user
					$_SESSION['UserAcl_cache'] = array();
				}
			}
		}
	}

	function _cache_clear() {
		if (!$this->_use_cache) return;

		$_SESSION['UserAcl_cache'] = array();
	}

	/**
	 * Read data from cache.
	 */
	function _cache_read($key) {
		if (!$this->_use_cache) return null;

		if (array_key_exists($key, $_SESSION['UserAcl_cache'])) {
			return $_SESSION['UserAcl_cache'][$key];
		}
		return null;
	}

	/**
	 * Save data in cache.
	 */
	function _cache_save($key, $value) {
		if (!$this->_use_cache) return;

		if ($key == 'foundTables') {
			$tblIds = array();
			foreach ($value as $idTable => $tableConfig) {
				$tblIds[] = $idTable;
				$vTableAcl = TableAcl::buildInstance($idTable, $tableConfig);
			}
			$value = $tblIds;
		}
		$_SESSION['UserAcl_cache'][$key] = $value;
	}

	public function getUrls() {// @require _fetchPerms
		static $_userUrls = null;
		if (null !== $_userUrls) return $_userUrls;
		$_userUrls = [];
		$filterIdProces = $this->getFilterIdProces();
		$userUrlAction = SchemaFactory::loadDefaultObject('UserUrlAction');
		$userUrlAction->setIdUser($this->_user_id);
		$userUrlAction->setIdProcesFilter($filterIdProces);
		foreach ($userUrlAction->getItems() as $url) {
			$_userUrls[ $url['ID_URL'] ] = $url['opis'];
		}
		return $_userUrls;
	}

	public function getObjectAcl($sourceName, $objName) {// TODO: rename $sourceName to $prefix (xml namespace - @see Core_AclHelper)
		if (empty($objName)) throw new Exception("Missing object name", 400);
		if ('default_db' == $sourceName) {
			$zasobTblInfo = ProcesHelper::getZasobTableInfoByUri("{$sourceName}/{$objName}");
			if (!$zasobTblInfo) throw new HttpException("Object not Found '{$objName}'", 404);
			if (!$this->hasTableAcl($zasobTblInfo->ID)) throw new HttpException("Access Denied for '{$sourceName}/{$objName}'", 403);
			return $this->getTableAcl($zasobTblInfo->ID);
		} else if ('objects' == $sourceName) {
			return SchemaFactory::loadDefaultObject($objName);
		} else if ('default_objects' == $sourceName) {
			return SchemaFactory::loadDefaultObject($objName);
		} else if ('default_db__x3A__' == substr($sourceName, 0, 17)) {
			$rootTableName = strtolower(substr($sourceName, 17));
			return SchemaFactory::loadTableObject($rootTableName, $objName);
		}
		throw new HttpException("Not Implemented", 501);
	}

	public function getTablesAcl() {// TODO: read from `CRM_PROCES_idx_TABLE_TO_USER_VIEW`
		$tbls = array();
		$tblIds = $this->_cache_read('foundTables');
		foreach ($tblIds as $vTableID) {
			$tbls[$vTableID] = TableAcl::getInstance($vTableID);
		}
		return $tbls;
	}

	public function hasTableAcl($tableID) {// TODO: read from `CRM_PROCES_idx_TABLE_TO_USER_VIEW`
		$tbls = $this->_cache_read('foundTables');
		return (is_array($tbls) && in_array($tableID, $tbls));
	}

	public function getTableAcl($tableID) {
		$tblAcl = TableAcl::getInstance($tableID);
		if (!$tblAcl) throw new Exception("Brak tabeli nr [{$tableID}]!");
		$tblAcl->init();
		return $tblAcl;
	}

	/**
	 * Check if perms are only for one proces.
	 * @returns int or false
	 */
	public function getPermsFiltrProcesId() {// TODO: RMME mved to getFilterIdProces
		return $this->getFilterIdProces();
	}
	public function getFilterIdProces() {
		$procesID = $this->_cache_read('permsByProcesID');
		return ($procesID > 0)? $procesID : false;
	}

	public function fetchAllPerms($force = false) {
		$this->_fetchPerms('All', $force);
	}

	public function fetchProcesPerms($procesID, $force = false) {
		$this->_fetchPerms($procesID, $force);
	}

	/**
	 * @param $type - 'All', $procesID
	 */
	private function _fetchPerms($type, $force = false) {
		$procesID = 0;// if 0 - All, alse perms by procesID
		$foundTbls = array();

		if ($force) {
			$this->_cache_clear();
		}

		$schemaReader = new SchemaReader();
		if ($type == 'All') {
			$procesID = 0;// if 0 - All, alse perms by procesID
			$schemaReader->getAll();
		} else if (is_numeric($type) && $type > 0) {
			$procesID = (int)$type;
		}

		{// fetch from schema files in SE/schema/process/*.ini.php
		if ($schemaReader->hasProcessConfigs()) {
			foreach ($schemaReader->getProcessConfigs() as $process) {
				DBG::_('DBG_SCH', '1', "process", $process, __CLASS__, __FUNCTION__, __LINE__ );
				if ($process->hasAccess()) {
					$tables = $process->getTables();
					DBG::_('DBG_SCH', '1', "tables", $tables, __CLASS__, __FUNCTION__, __LINE__ );
					foreach ($tables as $vTable) {
						$tblUri = $vTable->getUri();
						$zasobTblInfo = ProcesHelper::getZasobTableInfoByUri($tblUri);
						DBG::_('DBG_SCH', '1', "table(" . $vTable->getLabel() . ")", $zasobTblInfo, __CLASS__, __FUNCTION__, __LINE__ );
						if ($zasobTblInfo) {
							$idTable = $zasobTblInfo->ID;
							if (!array_key_exists($idTable, $foundTbls)) {
								$tableConfig = array();
								$tableConfig['ID_TABLE'] = $idTable;
								$tableConfig['db'] = $zasobTblInfo->P__ID;
								$tableConfig['name'] = $zasobTblInfo->DESC;
								$tableConfig['label'] = $zasobTblInfo->DESC_PL;
								$tableConfig['opis'] = $zasobTblInfo->OPIS;
								$foundTbls[$idTable] = $tableConfig;
							}
							$tableAcl = TableAcl::buildInstance($idTable, $foundTbls[$idTable]);

							$fieldsConfig = array();
							$fldsInfo = ProcesHelper::getZasobTableFieldsInfo($idTable);
							foreach ($vTable->getFields() as $field) {
								$fldInfo = V::get($field->getName(), null, $fldsInfo);
								if ($fldInfo) {
									if (!array_key_exists($fldInfo->ID, $fieldsConfig)) {//if (!$tableAcl->hasField($fldInfo->ID)) {
										$fieldsConfig[$fldInfo->ID] = array();
										$fieldsConfig[$fldInfo->ID]['ID_CELL'] = $fldInfo->ID;
										$fieldsConfig[$fldInfo->ID]['CELL_NAME'] = $fldInfo->DESC;
										$fieldsConfig[$fldInfo->ID]['CELL_DESC'] = $fldInfo->OPIS;
										$fieldsConfig[$fldInfo->ID]['SORT_PRIO'] = $fldInfo->SORT_PRIO;
										$fieldsConfig[$fldInfo->ID]['CELL_LABEL'] = $fldInfo->DESC_PL;
										$fieldsConfig[$fldInfo->ID]['FORM_TREAT'] = '';
										//$tableAcl->addField($fldInfo->ID, $fldInfo->DESC, $fldInfo->OPIS, $fldInfo->SORT_PRIO, $fldInfo->DESC_PL);
									}

									// TODO: $field->getPerms() -> PERM_R, PERM_W, ... etc.?
									$fieldsConfig[$fldInfo->ID]['FORM_TREAT'] .= $field->getPerms();//$tableAcl->setFieldPerms($fldInfo->ID, $field->getPerms());
								}
							}
							$tableAcl->initFieldsFromConfig($fieldsConfig);
							DBG::_('DBG_SCH', '1', "fieldsConfig({$idTable})", $fieldsConfig, __CLASS__, __FUNCTION__, __LINE__);
							$tableAcl->save();
							DBG::_('DBG_SCH', '1', "tableAcl({$idTable})", $tableAcl, __CLASS__, __FUNCTION__, __LINE__);
						}
					}
				}
			}
		} else {
			DBG::_('DBG_SCH', '1', "NO \$schemaReader->hasProcessConfigs()", null, __CLASS__, __FUNCTION__, __LINE__);
		}
		DBG::_('DBG_SCH', '1', "foundTbls", $foundTbls, __CLASS__, __FUNCTION__, __LINE__);
		}// fetch from schema files

		$this->setFilterIdProces($procesID);//$this->_cache_save('permsByProcesID', $procesID);

		$filterIdProces = $this->getFilterIdProces();

		$userConfigStorage = SchemaFactory::loadDefaultObject('UserConfig');// TODO:? UserSession
		$userConfigStorage->setIdUser($this->_user_id);
		$userConfigStorage->setIdProcesFilter($filterIdProces);
		$userConf = $userConfigStorage->getItem(1);// TODO:? session_id() or 'api'
		DBG::simpleLog('auth', "UserAcl::fetchPerms UserConf: " . str_replace('"', '', json_encode($userConf)));
		// 'lastLogin' => [ '@type' => 'xsd:dateTime', '@confKey' => 'auth_user_{ID_USER}' ],// TODO: store last login time
		// 'lastAuthCacheUpdate' => [ '@type' => 'xsd:dateTime', '@confKey' => 'acl_user_{ID_USER}_cache_update' ],

		$userObject = SchemaFactory::loadDefaultObject('UserObject');
		$userObject->setIdUser($this->_user_id);
		$userObject->setIdProcesFilter($filterIdProces);

		$userUrlAction = SchemaFactory::loadDefaultObject('UserUrlAction');
		$userUrlAction->setIdUser($this->_user_id);
		$userUrlAction->setIdProcesFilter($filterIdProces);

		// DB cache
		// TODO: session garbage collector. CRM_CONFIG: last_proces_update, user_last_req_date, last_user_acl_cache_update
		$lastProcesIndexer = DB::getPDO()->fetchValue(" select CONF_VAL from CRM_CONFIG where CONF_KEY = 'tbl_indexer_CRM_PROCES_last_exec_end' ");
		DBG::simpleLog('auth', "UserAcl::fetchPerms lastProcesIndexer: '{$lastProcesIndexer}'");
		if ($userConf['lastAuthCacheUpdate'] > $lastProcesIndexer) {
			DBG::simpleLog('auth', "UserAcl::fetchPerms skip update cache");
		} else {
			DBG::simpleLog('auth', "UserAcl::fetchPerms update cache");
			$userObject->updateCacheFeatures();
			$userUrlAction->updateCacheFeatures();
			$userConfigStorage->updateItem([
				'ID_USER' => $this->_user_id,
				'ID_PROCES' => $filterIdProces,
				'lastAuthCacheUpdate' => 'NOW()'
			]);
		}

		$userAccessForTables = $userObject->getItems();
		DBG::simpleLog('auth', "UserAcl::fetchPerms fetched " . count($userAccessForTables) . " tables");
		DBG::_('DBG_SCH', '1', "userAccessForTables", $userAccessForTables, __CLASS__, __FUNCTION__, __LINE__ );
		foreach ($userAccessForTables as $tableConfig) {
			unset($tableConfig['ID']);
			$idTable = $tableConfig['ID_TABLE'];
			if (!array_key_exists($idTable, $foundTbls)) {
				$foundTbls[$idTable] = $tableConfig;
			}
		}

		$this->_cache_save('foundTables', $foundTbls);

		// use cache for UserUrlAction turned OFF @see getUrls()
		// $userAccessForUrls = $userUrlAction->getItems();
		// DBG::logAuth($userAccessForUrls, "_fetchPerms \$userAccessForUrls");
		// DBG::_('DBG_SCH', '2', "userAccessForUrls", $userAccessForUrls, __CLASS__, __FUNCTION__, __LINE__ );
		// $foundUrls = array();
		// foreach ($userAccessForUrls as $vUrlConfig) {
		// 	$foundUrls[$vUrlConfig['ID_URL']] = $vUrlConfig['opis'];
		// }
		// $this->_cache_save('foundUrls', $foundUrls);
	}

	public function setFilterIdProces($procesID) {
		$this->_cache_save('permsByProcesID', $procesID);
	}

	public function getPermsForTable($idTable) {
		$sqlIdProcesListSql = $this->getUsedUserProcesIdsSql();
		$tableCellToProcesSql = <<<SQL
			select z.`ID` as `ID_CELL`
					, z.`DESC` as `CELL_NAME`
					, z.`DESC_PL` as `CELL_LABEL`
					, z.`OPIS` as `CELL_DESC`
					, z.`SORT_PRIO` as `SORT_PRIO`
					, zp.`ID` as `ID_TABLE`
		--			, zp.`DESC` as `TABLE_NAME`
		--			, wsk.`ID_PROCES` as `ID_PROCES`
					, sum(IF(przyp.`FORM_TREAT` & 2,   1, 0)) as PERM_R
					, sum(IF(przyp.`FORM_TREAT` & 4,   1, 0)) as PERM_W
					, sum(IF(przyp.`FORM_TREAT` & 8,   1, 0)) as PERM_X
					, sum(IF(przyp.`FORM_TREAT` & 16,  1, 0)) as PERM_C
					, sum(IF(przyp.`FORM_TREAT` & 32,  1, 0)) as PERM_S
					, sum(IF(przyp.`FORM_TREAT` & 64,  1, 0)) as PERM_O
					, sum(IF(przyp.`FORM_TREAT` & 128, 1, 0)) as PERM_V
					, sum(IF(przyp.`FORM_TREAT` & 256, 1, 0)) as PERM_E
				from `CRM_LISTA_ZASOBOW` z
					join `CRM_LISTA_ZASOBOW` zp on(zp.`ID`=z.`PARENT_ID` and zp.`TYPE`='TABELA' and zp.`A_STATUS` in('WAITING','NORMAL'))
					join `CRM_WSKAZNIK` wsk on(wsk.`ID_ZASOB`=z.`ID` and wsk.`A_STATUS` in('WAITING','NORMAL'))
					join `CRM_PROCES` p on(p.`ID`=wsk.`ID_PROCES` and p.`A_STATUS` in('WAITING','NORMAL'))
					join `CRM_PRZYPADEK` as przyp on (przyp.`ID`=wsk.`ID_PRZYPADEK`)
				where z.`TYPE`='KOMORKA'
					and z.`A_STATUS` in('WAITING','NORMAL')
					and zp.`ID`='{$idTable}'
					and wsk.`ID_PROCES` in({$sqlIdProcesListSql})
				-- group by z.`ID`, wsk.`ID_PROCES`
				group by z.`ID`
				order by z.`SORT_PRIO`
SQL;
		//echo'<pre>UserAcl::getPermsForTable('.$idTable.')::$tableCellToProcesSql ';print_r($tableCellToProcesSql);echo'</pre>';
		$userPermsForTable = array();
		$db = DB::getDB();
		$res = $db->query($tableCellToProcesSql);
		while ($h = $db->fetch_assoc($res)) {
			$idCell = $h['ID_CELL'];
			$userPermsForTable[$idCell] = $h;
		}
		return $userPermsForTable;
	}

	public function getUsedUserGroupIds() {
		$idUserGroupList = User::getGroupsIds();// TODO:? $this->_user_id
		// TODO: acl filtr by group ids
		return $idUserGroupList;
	}

	public function getUsedUserProcesIdsSql() {
		$filterIdProces = $this->getFilterIdProces();
		if ($filterIdProces > 0) {
			return "
				select i.`ID_PROCES`
					from `CRM_PROCES_idx` i
					where i.`idx_MAIN_PROCES_INIT_ID`='{$filterIdProces}'
			";
		}

		$idUserGroupList = $this->getUsedUserGroupIds();
		$sqlIdUserGroupList = implode(",", $idUserGroupList);
		return "
			select gi.`ID_PROCES`
				from `CRM_PROCES_idx_GROUP_to_PROCES` gi
				where gi.`ID_GROUP` in({$sqlIdUserGroupList})
		";
	}

	public function getProcesMaxUpdateDate($idProcesInit) {
		return DB::getPDO()->fetchValue("
			select max(p.`A_RECORD_UPDATE_DATE`) as max_update_date
			from `CRM_PROCES` as p
			where p.`ID` in(
				select i.`ID_PROCES`
					from `CRM_PROCES_idx` i
					where i.`idx_PROCES_INIT_ID`='{$idProcesInit}'
			)
		");
	}

	/**
	 * Ids List of Proces Init for user (skip filters)
	 */
	public function getUserProcesInitIds() {
		$procesInitList = $this->getUserProcesInitList();
		return array_keys($procesInitList);
	}

	/**
	 * List of Proces Init for user (skip filters)
	 */
	public function getUserProcesInitList() {// TODO: read from CRM_PROCES_idx_GROUP_to_INIT_VIEW?
		$userProcesInitList = array();
		$idUserGroupList = $this->fetchGroups();
		$sqlIdUserGroupList = implode(",", array_keys($idUserGroupList));
		$sqlIdProcesListSql = <<<SQL
			select gi.`ID_PROCES`
				from `CRM_PROCES_idx_GROUP_to_PROCES` gi
				where gi.`ID_GROUP` in({$sqlIdUserGroupList})
SQL;
		$fetchUserProcesInitListSql = <<<SQL
			select p.`ID`, p.`DESC`
				from `CRM_PROCES_idx` i
					join `CRM_PROCES` p on(p.`ID`=i.`idx_PROCES_INIT_ID`)
				where i.`ID_PROCES` in({$sqlIdProcesListSql})
				group by p.`ID`
				order by p.`SORT_PRIO`
SQL;
		$db = DB::getDB();
		$res = $db->query($fetchUserProcesInitListSql);
		while ($r = $db->fetch($res)) {
			$userProcesInitList[$r->ID] = $r->DESC;
		}
		return $userProcesInitList;
	}

	/**
	 * Ids List of Proces Init for user (use filters)
	 */
	public function getUsedUserProcesInitIds() {
		$usedProcesInitList = $this->getUsedUserProcesInitList();
		return array_keys($usedProcesInitList);
	}

	/**
	 * List of Proces Init for user (use filters)
	 */
	public function getUsedUserProcesInitList() {
		$filterIdProces = $this->getFilterIdProces();
		if ($filterIdProces > 0) {
			return $filterIdProces;
		}

		$sqlIdProcesListSql = $this->getUsedUserProcesIdsSql();
		$fetchUsedProcesInitListSql = <<<SQL
			select p.`ID`, p.`DESC`
				from `CRM_PROCES` p
				where p.`ID` in({$sqlIdProcesListSql})
					and p.`TYPE`='PROCES_INIT'
				order by p.`SORT_PRIO`
SQL;
		$usedProcesInitList = array();
		$db = DB::getDB();
		$res = $db->query($fetchUsedProcesInitListSql);
		while ($r = $db->fetch($res)) {
			$usedProcesInitList[$r->ID] = $r->DESC;
		}
		return $usedProcesInitList;
	}

	/**
	 * Ids List of Proces Init for given tabel (skip filters)
	 */
	public function getTableProcesInitIds($idTable) {
		$procesInitList = $this->getTableProcesInitList($idTable);
		return array_keys($procesInitList);
	}

	/**
	 * List of Proces Init for given table (skip filters)
	 */
	public function getTableProcesInitList($idTable) {
		$tableProcesInitList = ACL::getTableProcesInitList($idTable);
		if (!empty($tableProcesInitList)) {
			$filteredTableProcesInitList = array();
			DBG::_('DBG_MAP', '1', "tableProcesInitList({$idTable})", $tableProcesInitList, __CLASS__, __FUNCTION__, __LINE__);
			$procesIds = array_keys($tableProcesInitList);
			$sqlProcesIds = implode(",", $procesIds);
			$userLogin = User::getLogin();
			$sql = "select uiv.`ID_PROCES_INIT`, uiv.`DESC`
				from `CRM_PROCES_idx_USER_to_INIT_VIEW` uiv
				where uiv.`ADM_ACCOUNT`='{$userLogin}'
					and uiv.`ID_PROCES_INIT` in({$sqlProcesIds})
				group by uiv.`ID_PROCES_INIT`
			";
			DBG::_('DBG_MAP', '1', "tableProcesInitList({$idTable}):sql", $sql, __CLASS__, __FUNCTION__, __LINE__);
			$db = DB::getDB();
			$res = $db->query($sql);
			while ($r = $db->fetch($res)) {
				$filteredTableProcesInitList[$r->ID_PROCES_INIT] = $r->DESC;
			}
			$tableProcesInitList = $filteredTableProcesInitList;
			DBG::_('DBG_MAP', '1', "tableProcesInitList({$idTable}):filteredTableProcesInitList", $filteredTableProcesInitList, __CLASS__, __FUNCTION__, __LINE__);
		}
		return $tableProcesInitList;
	}

	public function canExecuteProcesInit($idProcesInit) {
		$isAllowed = false;
		$idProcesInit = (int)$idProcesInit;
		if (!$idProcesInit) return false;
		$idUserGroupList = $this->fetchGroups();
		$sqlIdUserGroupList = implode(",", array_keys($idUserGroupList));
		$checkProcesAccessSql = <<<SQL
			select count(*) as cnt
				from `CRM_PROCES_idx_GROUP_to_PROCES` gi
					join `CRM_PROCES` p on(p.`ID`=gi.`ID_PROCES` and p.`TYPE`='PROCES_INIT')
				where gi.`ID_GROUP` in({$sqlIdUserGroupList})
					and gi.`ID_PROCES`='{$idProcesInit}'
SQL;
		$db = DB::getDB();
		$res = $db->query($checkProcesAccessSql);
		if ($r = $db->fetch($res)) {
			if ($r->cnt > 0) {
				$isAllowed = true;
			}
		}
		return $isAllowed;
	}

	public function canViewProces($idProcesInit) {
		$isAllowed = false;
		$idProcesInit = (int)$idProcesInit;
		if (!$idProcesInit) return false;
		$idUserGroupList = $this->fetchGroups();
		$sqlIdUserGroupList = implode(",", array_keys($idUserGroupList));
		$checkProcesAccessSql = <<<SQL
			select count(*) as cnt
				from `CRM_PROCES_idx_GROUP_to_PROCES_PERM` gi
					join `CRM_PROCES` p on(p.`ID`=gi.`ID_PROCES`)
				where gi.`ID_GROUP` in({$sqlIdUserGroupList})
					and gi.`ID_PROCES`='{$idProcesInit}'
			--		and gi.`HAS_PERM_R`=1 -- TODO: allow only with defined perm 'R'
SQL;
		$db = DB::getDB();
		$res = $db->query($checkProcesAccessSql);
		if ($r = $db->fetch($res)) {
			if ($r->cnt > 0) {
				$isAllowed = true;
			}
		}
		return $isAllowed;
	}

}