se/SE/se-lib/ACL.php

<?php

Lib::loadClass('Core_AclHelper');
Lib::loadClass('AntAclBase');
Lib::loadClass('RefConfig');
Lib::loadClass('InstanceConfig');

class ACL {

	/**
	 * Ids List of Proces Init for given tabel (skip filters)
	 */
	public static function getTableProcesInitIds($idTable) {
		$procesInitList = self::getTableProcesInitList($idTable);
		return array_keys($procesInitList);
	}

	/**
	 * List of Proces Init for given table (skip filters)
	 */
	public static function getTableProcesInitList($idTable) {
		$tableProcesInitList = array();
		$sqlIdProcesListSql = "
			select tpv.`ID_PROCES`
				from `CRM_PROCES_idx_TABLE_TO_PROCES_VIEW` tpv
				where tpv.`ID_TABLE`='{$idTable}'
		";
		$fetchTableProcesInitListSql = "
			-- time ~0.07 -- no goto and return
			select p.`ID`, p.`DESC`
			from `CRM_PROCES` p
			where p.`ID` in(
						select i.`idx_PROCES_INIT_ID`
						from `CRM_PROCES_idx` i
						where i.`ID_PROCES` in({$sqlIdProcesListSql})
				)
				and p.`TYPE`='PROCES_INIT'
			order by p.`SORT_PRIO`
		";
		/*
			SELECT p.`ID` , p.`DESC`
			FROM `CRM_PROCES` p
			WHERE p.`ID`
			IN (
					SELECT i.`idx_PROCES_INIT_ID`
					FROM `CRM_PROCES_idx` i
					WHERE i.`ID_PROCES`
					IN (
							SELECT tpv.`ID_PROCES`
							FROM `CRM_PROCES_idx_TABLE_TO_PROCES_VIEW` tpv
							WHERE tpv.`ID_TABLE` = '13051'
					)
			)
			AND p.`TYPE` = 'PROCES_INIT'
			order by p.`SORT_PRIO`
		*/
		$fetchTableProcesInitListSql = "
			-- time ~0.15s
			select p.`ID`, p.`DESC`
			from `CRM_PROCES` p
			where p.`ID` in(
						select i.`idx_PROCES_INIT_ID`
						from `CRM_PROCES_idx` i
						where i.`ID_PROCES` in({$sqlIdProcesListSql})
					union
						select ig.`idx_PROCES_INIT_ID`
						from `CRM_PROCES_idx` i
							join `CRM_PROCES_idx` ig on(ig.`ID_PROCES`=i.`idx_PROCES_WITH_GROUPS_ID`)
						where i.`ID_PROCES` in({$sqlIdProcesListSql})
				)
				and p.`TYPE`='PROCES_INIT'
			order by p.`SORT_PRIO`
		";
		$fetchTableProcesInitListSql = "
			-- time ~0.14
			select p.`ID`, p.`DESC`
			from `CRM_PROCES` p
			where p.`ID` in(
					select i.`idx_PROCES_INIT_ID`
					from `CRM_PROCES_idx` i
					where i.`ID_PROCES` in({$sqlIdProcesListSql})
						or i.`ID_PROCES` in(
							select ig.`idx_PROCES_WITH_GROUPS_ID`
							from `CRM_PROCES_idx` ig
							where ig.`ID_PROCES` in({$sqlIdProcesListSql})
						)
				)
				and p.`TYPE`='PROCES_INIT'
			order by p.`SORT_PRIO`
		";
		return array_map(function ($row) {
			return $row['DESC'];
		}, DB::getPDO()->fetchAllByKey($fetchTableProcesInitListSql, 'ID'));
	}

	public static function getProcesInitMapTreeOnlyIds($ids) {
		$mapTree = array();
		$map = self::getProcesInitMapOnlyIds($ids);
		foreach ($map as $row) {
			if ('PROCES_INIT' == $row['TYPE']) {
				$mapTree[ $row['ID_PROCES'] ] = array();
			}
		}
		foreach ($map as $row) {
			if ('GOTO_AND_RETURN' == $row['TYPE']) {
				$mapTree[ $row['idx_MAIN_PROCES_INIT_ID'] ][ $row['ID_PROCES'] ] = array();
			}
		}
		foreach ($map as $row) {
			if ('GOTO_AND_RETURN_LVL2' == $row['TYPE']) {
				$mapTree[ $row['idx_MAIN_PROCES_INIT_ID'] ][ $row['idx_GOTO_LVL2_INIT_ID'] ][ $row['ID_PROCES'] ] = true;
			}
		}
		return $mapTree;
	}

	public static function getProcesInitMapOnlyIds($ids) {
		$map = array();
		$sqlIds = V::filter($ids, array('V', 'filterPositiveInteger'));
		$sqlIds = implode(',', $sqlIds);
		if (empty($sqlIds)) return $map;
		$sql = "
			select i.`ID_PROCES`
				, i.`PARENT_ID`
				, i.`TYPE`
				, i.`idx_PROCES_INIT_ID`
				, i.`idx_MAIN_PROCES_INIT_ID`
				, i.`idx_PROCES_WITH_GROUPS_ID`
				, IF(i.`TYPE`='GOTO_AND_RETURN_LVL2'
					, (select ig.`idx_PROCES_INIT_ID`
						from `CRM_PROCES_idx` ig
						where ig.`ID_PROCES`=i.`PARENT_ID`
						limit 1)
					, 0
				) as idx_GOTO_LVL2_INIT_ID
			from `CRM_PROCES_idx` i
			where i.`ID_PROCES` in({$sqlIds})
				and i.`idx_MAIN_PROCES_INIT_ID` in({$sqlIds})
		";
		return DB::getPDO()->fetchAll($sql);
	}

	public static function canGroupViewProces($idGroup, $idProcesInit) {
		$isAllowed = false;
		$idProcesInit = (int)$idProcesInit;
		if (!$idProcesInit) return false;
		$checkProcesAccessSql = "
			select count(*) as cnt
			from `CRM_PROCES_idx_GROUP_to_INIT_VIEW` giv
			where giv.`ID_GROUP` = '{$idGroup}'
				and giv.`ID_PROCES_INIT` = '{$idProcesInit}'
		";
		return ( DB::getPDO()->fetchValue($checkProcesAccessSql) > 0 );
	}

	public static function getStorageByNamespace($namespace, $forceTblAclInit = false) {
		Lib::loadClass('Core_AclHelper');
		Lib::loadClass('SchemaFactory');
		$ns = Core_AclHelper::parseNamespaceUrl($namespace);
		DBG::log($ns, 'array', "parseNamespaceUrl({$namespace})");
		if ('default_db' == $ns['prefix']) {
			$acl = User::getAcl()->getObjectAcl($ns['prefix'], $ns['name']);
		} else if ('objects' == $ns['prefix']) {
			$acl = SchemaFactory::loadDefaultObject($ns['name']);
		} else if ('default_objects' == $ns['prefix']) {
			$acl = SchemaFactory::loadDefaultObject($ns['name']);
		} else if ('default_db__x3A__' == substr($ns['prefix'], 0, 17)) {
			$rootTableName = strtolower(substr($ns['prefix'], 17));
			$acl = SchemaFactory::loadTableObject($rootTableName, $ns['name']);
		} else {
			throw new HttpException("Not Implemented", 501);
		}
		$acl->init($forceTblAclInit);
		return $acl;
	}

	public static function getBaseNamespace($namespace) {
		// map SystemObjects__x3A__{parent}/{name} to default_objects/{name}
		if ('SystemObjects/' === substr($namespace, 0, strlen('SystemObjects/'))) {
			$exNs = explode('/', $namespace);
			if (3 === count($exNs)) {
				return "default_objects/{$exNs[2]}";
			}
		}
		return $namespace;
	}

	public static function getAclByNamespace($namespace, $forceTblAclInit = false) {
		$namespace = ACL::getBaseNamespace($namespace);
		return Core_AclHelper::getAclByNamespace($namespace, $forceTblAclInit);
	}

	public static function getAclByTypeName($typeName, $forceTblAclInit = false) {
		return Core_AclHelper::getAclByNamespace(str_replace(':', '/', $typeName), $forceTblAclInit);
	}

	public static function getNamespaceFromId($idZasob) {
		$sqlIdZasob = DB::getPDO()->quote($idZasob, PDO::PARAM_INT);
		$zasob = DB::getPDO()->fetchFirst("
			select z.ID, z.DESC, z.PARENT_ID
			from CRM_LISTA_ZASOBOW z
			where z.ID = {$sqlIdZasob}
				and z.`TYPE` = 'TABELA'
				and z.A_STATUS != 'DELETED'
		");
		if (!$zasob) throw new Exception("Object not exists '{$idZasob}'");
		if ($zasob['PARENT_ID'] != DB::getPDO()->getZasobId()) {
			throw new Exception("TODO: getNamespaceFromId for remote database");
		}
		return ('default_db/' === substr($zasob['DESC'], 0, strlen('default_db/')))
			? $zasob['DESC']
			: "default_db/{$zasob['DESC']}"
		;
	}

	public static function parseNamespaceUrl($namespace) {// returns assoc array: [ 'name', 'url', 'prefix', 'sourceName' ]
		return Core_AclHelper::parseNamespaceUrl($namespace);
	}

	public static function getRefTable($rootObjectNamespace, $childName) { // TODO: mv to RefConfig
		static $cacheRefTables = array();

		DBG::log("DBG get ref table ({$rootObjectNamespace}, {$childName}) ...");
		$rootObjectNamespace = ACL::getBaseNamespace($rootObjectNamespace);
		$cacheKey = "{$rootObjectNamespace}/{$childName}";
		if (array_key_exists($cacheKey, $cacheRefTables)) return $cacheRefTables[$cacheKey];

		$rootAcl = self::getAclByNamespace($rootObjectNamespace);

		$refConfig = RefConfig::fetch($rootObjectNamespace, $childName);

		// TODO: CASE: Obj: A, B not installed, Ref: A->B; Install A / cannot install Ref A->B / require install B first / then go back and reinstall A
		// TODO: What if primaryKey type != int ?
		// TODO: require 2 pass for Install every object - first install all base Obj, then reinstall fixes Ref config
		// \--- TODO: or split Reinstall obj action to: 1. Reinstall base Obj and 2. Install Ref tables

		if ('view' === $refConfig->source) {
			$refTableName = "CRM__#REF_TABLE__{$refConfig->id}_VIEW"; // view created by ACL::generateRefSelectSqlByFlatRelationCache
			if ('WAITING' == $refConfig->status) {
				if (!($rootAcl instanceof AntAclBase)) throw new Exception("Ref allowed only for AntAcl objects");
				$fieldInfo = $rootAcl->_getField($childName);
				$typeField = Type_Field::build($fieldInfo);
				RefConfig::installRefView($rootObjectNamespace, $childName, $typeField, $refConfig);
				$refConfig = RefConfig::fetch($rootObjectNamespace, $childName);
			}
		} else if ('backRef' === $refConfig->source) {
			$refTableName = "CRM__#REF_TABLE__{$refConfig->id}_VIEW"; // view created by ACL::generateRefSelectSqlByFlatRelationCache
			if ('WAITING' == $refConfig->status) {
				throw new Exception("Install backRef view for '{$rootObjectNamespace}' to '{$childName}'");
				// if (!($rootAcl instanceof AntAclBase)) throw new Exception("Ref allowed only for AntAcl objects");
				// $fieldInfo = $rootAcl->_getField($childName);
				// $typeField = Type_Field::build($fieldInfo);
				// RefConfig::installRefView($rootObjectNamespace, $childName, $typeField, $refConfig);
				// $refConfig = RefConfig::fetch($rootObjectNamespace, $childName);
			}
		} else if ('table' === $refConfig->source) {
			$refTableName = "CRM__#REF_TABLE__{$refConfig->id}";
			if ('WAITING' == $refConfig->status) {
				RefConfig::createRefTable($rootObjectNamespace, $childName);
				$refConfig = RefConfig::fetch($rootObjectNamespace, $childName);
			}
		} else {
			throw new Exception("Not Implemented ref SOURCE = '{$refConfig->source}'");
		}

		if ('0' === (string)$refConfig->version) {
			DBG::log($refConfig, 'array', "BUG RefConfig VERSION = 0 (ID: {$refConfig->version})");
			throw new Exception("Wystąpiły błędy w konfiguracji tabeli powiązań - zainstaluj ponownie obiekt");
		}
		if ($refConfig->version < RefConfig::$REF_TABLE_VERSION) {
			if (1 == $refConfig->version) {
				RefConfig::createRefTable($rootObjectNamespace, $childName);
				$refConfig = RefConfig::fetch($rootObjectNamespace, $childName);
			}
		}
		if ($refConfig->version < RefConfig::$REF_TABLE_VERSION) throw new Exception("TODO: ref table {$refConfig->id} require upgrade - field '{$childName}' in object '{$rootObjectNamespace}'");

		$cacheRefTables[$cacheKey] = $refTableName;
		return $refTableName;
	}
	public static function getRefSource($rootObjectNamespace, $childName) { // CRM_REF_CONFIG
		$rootObjectNamespace = ACL::getBaseNamespace($rootObjectNamespace);
		$refConfig = RefConfig::fetch($rootObjectNamespace, $childName);
		return $refConfig->source;
	}
	public static function decodeAppInfoJson($appInfoJsonString) {
		$appInfo = @json_decode($appInfoJsonString, $assoc = true);
		if (null == $appInfo && 0 !== json_last_error()) throw new Exception("Parsing Json failed: " . json_last_error());
		return $appInfo;
	}
	public static function generateRefSelectSqlByFlatRelationCache($rootObjectNamespace, $childName) { // CRM_REF_CONFIG
		$appInfo = DB::getPDO()->fetchValue("
			select f.appInfo
			from `CRM_#CACHE_ACL_OBJECT_FIELD` f
			where f.objectNamespace = '{$rootObjectNamespace}'
				and f.fieldNamespace = '{$childName}'
		");
		if (!$appInfo) throw new Exception("Missing app:info for field '{$rootObjectNamespace}/{$childName}'");
		$appInfo = ACL::decodeAppInfoJson($appInfo);
		if (empty($appInfo)) throw new Exception("Empty app:info for field '{$rootObjectNamespace}/{$childName}'");

		DBG::log(['$appInfo'=>$appInfo, '$rootObjectNamespace'=>$rootObjectNamespace, '$childName'=>$childName], 'array', "\$appInfo");
		$rootAcl = self::getAclByNamespace($rootObjectNamespace);
		$childXsdType = $rootAcl->getXsdFieldType($childName);
		list($typePrefix, $childNamespace) = explode(':', $childXsdType, 2);
		switch ($typePrefix) {
			case 'ref_uri': $childAcl = self::getAclByNamespace($childNamespace); break;
			case 'ref': $childAcl = self::getAclByTypeName($childNamespace); break;
			default: throw new Exception("Expected ref type for field '{$childName}' in object '{$rootObjectNamespace}'");
		}

		$lastActionDateField = "NULL"; // , IF(l.A_RECORD_UPDATE_DATE > r.A_RECORD_UPDATE_DATE, l.A_RECORD_UPDATE_DATE, r.A_RECORD_UPDATE_DATE) as A_LAST_ACTION_DATE
		$rootPrimaryKeyField = $rootAcl->getPrimaryKeyField();
		$childPrimaryKeyField = $childAcl->getPrimaryKeyField();
		$rootTableName = $rootAcl->getRootTableName();
		$childTableName = $childAcl->getRootTableName();
		//   '$appInfo' => [
		//     'flat_relation_cache' => [
		//       'source' => [
		//         '@name' => 'ID',
		//         '@xpath' => 'default_db__x3A__CRM_WSKAZNIK:CRM_WSKAZNIK/ID_PROCES',
		//       ),
		//     ),
		//   ),
		//   '$rootObjectNamespace' => 'default_db/CRM_PROCES/PROCES',
		//   '$childName' => 'default_db__x3A__CRM_WSKAZNIK:CRM_WSKAZNIK',

		//   '$appInfo' => [
		//   'flat_relation_cache' => [
		//     'source' => [
		//       '@name' => 'ID',
		//       '@xpath' => 'default_db__x3A__CRM_PROCES:PROCES/PARENT_ID',
		//     ),
		//   ),
		// ),
		// '$rootObjectNamespace' => 'default_db/CRM_PROCES/PROCES',
		// '$childName' => 'default_db__x3A__CRM_PROCES:PROCES',
		$appInfoRootFieldName = null;
		$appInfoChildFieldName = null;
		{
			if (empty($appInfo['flat_relation_cache']['source']['@name'])) throw new Exception("Missing flat_relation_cache/source/@name");
			if (empty($appInfo['flat_relation_cache']['source']['@xpath'])) throw new Exception("Missing flat_relation_cache/source/@xpath");
			$appInfoName = $appInfo['flat_relation_cache']['source']['@name'];
			$appInfoXpath = $appInfo['flat_relation_cache']['source']['@xpath'];
			// $rootNs = $rootAcl->getNamespace()
			if ("{$childName}/" === substr($appInfoXpath, 0, strlen("{$childName}/"))) {
				$appInfoRootFieldName = substr($appInfoXpath, strlen("{$childName}/"));
				$appInfoChildFieldName = $appInfoName;
			} else {
				throw new Exception("TODO parse flat_relation_cache");
			}
		}
		if (!$appInfoRootFieldName || !$appInfoChildFieldName) throw new Exception("Error Processing flat_relation_cache");
		$sqlWhereFromRestrictions = [];
		DBG::log(['root'=>$rootAcl->getFields(), 'child'=>$childAcl->getFields()], 'array', "rootAcl and childAcl fields - xsdRestrictions");
		if ($rootAcl instanceof AntAclBase && $childAcl instanceof AntAclBase) {
			$rootLocalFieldsWithRestrictions = array_filter($rootAcl->getFields(), function ($field) {
				if (!$field['isLocal']) return false;
				if (empty($field['xsdRestrictions'])) return false;
				if ('[]' == $field['xsdRestrictions']) return false;
				return true;
			});
			$childLocalFieldsWithRestrictions = array_filter($childAcl->getFields(), function ($field) {
				if (!$field['isLocal']) return false;
				if (empty($field['xsdRestrictions'])) return false;
				if ('[]' == $field['xsdRestrictions']) return false;
				return true;
			});
			DBG::log(['root'=>$rootLocalFieldsWithRestrictions, 'child'=>$childLocalFieldsWithRestrictions], 'array', "root and child fields with xsdRestrictions");
			if (!empty($rootLocalFieldsWithRestrictions)) {
				$sqlTablePrefix = 'root';
				$sqlWhereFromRestrictions = array_reduce(
					array_map(function ($field) use ($sqlTablePrefix) {
						$sqlRestrictions = [];
						// 'xsdRestrictions' => '{"enumeration":{"PROCES":"PROCES"}}',
						$restrictions = @json_decode($field['xsdRestrictions'], $assoc = true);
						if (!empty($restrictions)) {
							if (!empty($restrictions['enumeration'])) {
								$sqlRestrictions[] = "{$sqlTablePrefix}.`{$field['fieldNamespace']}` in (" . implode(",", array_map([DB::getPDO(), 'quote'], array_keys($restrictions['enumeration']))) . ")";
							}
						}
						return $sqlRestrictions;
					}, $rootLocalFieldsWithRestrictions),
					function ($ret, $cur) {
						return array_merge($ret, array_filter($cur, ['V', 'filterNotEmpty']));
					},
					$sqlWhereFromRestrictions
				);
			}
			if (!empty($childLocalFieldsWithRestrictions)) {
				$sqlTablePrefix = 'child';
				$sqlWhereFromRestrictions = array_reduce(
					array_map(function ($field) use ($sqlTablePrefix) {
						$sqlRestrictions = [];
						// 'xsdRestrictions' => '{"enumeration":{"PROCES":"PROCES"}}',
						$restrictions = @json_decode($field['xsdRestrictions'], $assoc = true);
						if (!empty($restrictions)) {
							if (!empty($restrictions['enumeration'])) {
								$sqlRestrictions[] = "{$sqlTablePrefix}.`{$field['fieldNamespace']}` in (" . implode(",", array_map([DB::getPDO(), 'quote'], array_keys($restrictions['enumeration']))) . ")";
							}
						}
						return $sqlRestrictions;
					}, $childLocalFieldsWithRestrictions),
					function ($ret, $cur) {
						return array_merge($ret, array_filter($cur, ['V', 'filterNotEmpty']));
					},
					$sqlWhereFromRestrictions
				);
			}
		}
		$sqlWhereFromRestrictions = (!empty($sqlWhereFromRestrictions)) ? implode(" and ", $sqlWhereFromRestrictions) : "1=1";
		$sqlChildFieldName = $childAcl->getSqlFieldName($appInfoRootFieldName);
		$sql = "
			select root.{$rootPrimaryKeyField} as PRIMARY_KEY
					, child.{$childPrimaryKeyField} as REMOTE_PRIMARY_KEY
					, '' as REMOTE_TYPENAME
					, 'WAITING' as A_STATUS
					, 0 as TRANSACTION_ID
					, {$lastActionDateField} as A_LAST_ACTION_DATE
			from `{$rootTableName}` root
				join `{$childTableName}` child on(child.{$sqlChildFieldName} = root.{$appInfoChildFieldName})
			where {$sqlWhereFromRestrictions}
		";
		DBG::log($sql, 'sql', "generateRefSelectSqlByFlatRelationCache");
		return $sql;
	}
	public static function getBackRefList($namespace) {
		if (!$namespace) throw new Exception("Missing namespace");
		$nsParts = explode('/', $namespace);
		$typeName = array_pop($nsParts);
		$typeName = implode("__x3A__", $nsParts) . ":{$typeName}";
		return DB::getPDO()->fetchAll("
			select c.ROOT_OBJECT_NS as namespace
				, i.id as idInstance
			from CRM_REF_CONFIG c
				join CRM_INSTANCE_CONFIG i on ( i.namespace = c.ROOT_OBJECT_NS )
			where ( c.CHILD_NAME = :type_name or c.CHILD_NAME = :namespace )
				and c.A_STATUS = 'NORMAL'
		", [
			':type_name' => $typeName,
			':namespace' => $namespace,
		]);
	}

	public static function fetchRefs($namespace, $childNamespace, $primaryKey, $params = []) { // TODO: $params: limit, total
		if (!$namespace) throw new Exception("Missing namespace");
		if (!$childNamespace) throw new Exception("Missing child namespace");
		if (!$primaryKey) throw new Exception("Missing primary key");
		throw new Exception("TODO: fetch refs from '{$namespace}' where primaryKey = '{$primaryKey}'");
	}

	public static function fetchBackRefs($namespace, $primaryKey, $parentNamespace, $params = []) { // TODO: $params: limit, total
		if (!$namespace) throw new Exception("Missing namespace");
		if (!$parentNamespace) throw new Exception("Missing parent namespace");
		if (!$primaryKey) throw new Exception("Missing primary key");

		$typeName = Api_WfsNs::typeName($namespace);
		$refTable = ACL::getRefTable($parentNamespace, $typeName);
		if (V::get('total', false, $params)) {
			return DB::getPDO()->fetchValue(" select count(*) as cnt from `{$refTable}` where REMOTE_PRIMARY_KEY = :primary_key and A_STATUS not in ('DELETED') ", [ ':primary_key' => $primaryKey ]);
		}
		throw new Exception("TODO: fetch back refs from '{$namespace}' where primaryKey({$primaryKey}) by refTable({$refTable})");
	}

	public static function generateIsInstanceFunctionBody($namespace, $item = null) {
		if (!$item) $item = SchemaFactory::loadDefaultObject('SystemObject')->getItem($namespace, [ 'propertyName' => '*,field' ]);
		if (!in_array( $item['_type'], [ 'AntAcl' ] )) return null;
		$sqlFunBody = " RETURN 1; ";
		$localFieldsWithRestrictions = array_filter($item['field'], function ($field) {
			if (!$field['isLocal']) return false;
			if (empty($field['xsdRestrictions'])) return false;
			if ('[]' == $field['xsdRestrictions']) return false;
			return true;
		});
		// TODO: get fields with minOccurs > 1 (may require select by ref)
		$sqlTablePrefix = 'root';
		$sqlWhereFromRestrictions = (!empty($localFieldsWithRestrictions))
		?	array_reduce(
				array_map(function ($field) use ($sqlTablePrefix) {
					$sqlRestrictions = [];
					// 'xsdRestrictions' => '{"enumeration":{"PROCES":"PROCES"}}',
					$restrictions = @json_decode($field['xsdRestrictions'], $assoc = true);
					if (!empty($restrictions)) {
						if (!empty($restrictions['enumeration'])) {
							$sqlRestrictions[] = "{$sqlTablePrefix}.`{$field['fieldNamespace']}` in (" . implode(",", array_map([DB::getPDO(), 'quote'], array_keys($restrictions['enumeration']))) . ")";
						}
					}
					return $sqlRestrictions;
				}, $localFieldsWithRestrictions),
				function ($ret, $cur) {
					return array_merge($ret, array_filter($cur, ['V', 'filterNotEmpty']));
				},
				[]
			)
		:	'';
		DBG::nicePrint($localFieldsWithRestrictions, "\$localFieldsWithRestrictions");
		DBG::nicePrint($sqlWhereFromRestrictions, "\$sqlWhereFromRestrictions");
		$sqlWhereFromRestrictions = (!empty($sqlWhereFromRestrictions)) ? implode(" and ", $sqlWhereFromRestrictions) : "1=1";
		$pkField = 'ID'; // TODO: primaryKeyField into SystemObject structure
		$rootTableName = $item['_rootTableName'];
		$sqlFunBody = (!empty($sqlWhereFromRestrictions))
		?	" RETURN IF(
				(select count(1) as cnt from `{$rootTableName}` root where root.`{$pkField}` = pk and {$sqlWhereFromRestrictions}) > 0
				, 1, 0)
			"
		:	" RETURN 1; ";
		return $sqlFunBody;
	}

	public static function getInstanceId($namespace) {
		return InstanceConfig::getInstanceConfig($namespace)['id'];
	}
	public static function getInstanceConfig($namespace) { // @returns { id, namespace, rootNamespace, idInstanceBase, _createdAt }
		return InstanceConfig::getInstanceConfig($namespace);
	}
	public static function getInstanceTable($namespace) { // @returns tableName with struct { pk, idInstance, _createdAt }
		return InstanceConfig::getInstanceTable($namespace);
	}

	public static function getRootNamespace($namespace) { // TODO: works only for relative urls! - mv to Acl->getRootNamespace
		Lib::loadClass('SchemaFactory');
		try {
			$objectItem = SchemaFactory::loadDefaultObject('SystemObject')->getItem($namespace);
		} catch (Exception $e) {
			throw new Exception("Object not installed '{$namespace}'");
		}
		if (!$objectItem['isStructInstalled']) throw new Exception("Object structure not installed '{$namespace}'");

		if ($objectItem['idDatabase'] != DB::getPDO()->getZasobId()) {
			if ('StorageAcl' === $objectItem['_type']) {
				DBG::log("getRootNamespace...");
				return $objectItem['namespace'];
			}
			else {
				throw new Exception("Only default_db supported"); // TODO: support more Sources
			}
		}

		return "default_db/{$objectItem['_rootTableName']}";
	}
	public static function getNamespaceSiblings($namespace) {
		return InstanceConfig::getNamespaceSiblings($namespace);
	}
	public static function getFeatureNamespaces($namespace, $pk) {
		return InstanceConfig::getFeatureNamespaces($namespace, $pk);
	}

	// @params $from - ( ACL | tableName | namespace | etc... - only ACL)
	public static function query($from, $prefix = 't') {
		Lib::loadClass('AclQueryBuilder');
		$query = new AclQueryBuilder();
		$query->from($from, $prefix);
		return $query;
	}

	/**
	 * @param mixed $object - Core_AclBase or string - namespace
	 * @return Core_AclFields
	 */
	public static function getObjectFields($object) {
		// TODO: try to get structure from `CRM_#CACHE_ACL_OBJECT_FIELD`
		// if ($object is instance Core_AclBase) {
		//   if ($object->isStructInstalled) then get structure from `CRM_#CACHE_ACL_OBJECT_FIELD` and put into Core_AclFields
		//   else get from $object->getFields() and put into Core_AclFields
	}

	public static function canUserReadObject($idUser, $aclOrIdZasob) {
		throw new Exception("TODO: canUserReadObjec({$idUser}, {$aclOrIdZasob})");
	}
	public static function canUserCreateObject($idUser, $aclOrIdZasob) {
		throw new Exception("TODO: canUserCreateObjec({$idUser}, {$aclOrIdZasob})");
	}
	public static function canUserWriteObject($idUser, $aclOrIdZasob) {
		throw new Exception("TODO: canUserWriteObjec({$idUser}, {$aclOrIdZasob})");
	}
	public static function canUserReadObjectField($idUser, $aclOrIdZasob, $fieldNameOrXPath) {
		throw new Exception("TODO: canUserReadObjectFiel({$idUser}, {$aclOrIdZasob}, {$fieldNameOrXPath})");
	}
	public static function canUserCreateObjectField($idUser, $aclOrIdZasob, $fieldNameOrXPath) {
		throw new Exception("TODO: canUserCreateObjectFiel({$idUser}, {$aclOrIdZasob}, {$fieldNameOrXPath})");
	}
	public static function canUserWriteObjectField($idUser, $aclOrIdZasob, $fieldNameOrXPath) {
		throw new Exception("TODO: canUserWriteObjectFiel({$idUser}, {$aclOrIdZasob}, {$fieldNameOrXPath})");
	}
	// TODO: replace below:
	// AclBase->canCreateField
	// AclBase->canReadField
	// AclBase->canReadObjectField
	// AclBase->canWriteField
	// AclBase->canWriteObjectField
	// AclBase->canWriteRecord
	// AclBase->canReadRecord
}