se/SE/se-lib/UserAcl.php

<?php

Lib::loadClass('DB');
Lib::loadClass('UsersHelper');
Lib::loadClass('ProcesHelper');
Lib::loadClass('TableAcl');
Lib::loadClass('SchemaReader');
Lib::loadClass('SchemaFactory');
Lib::loadClass('DBG');

class UserAcl {

	public $_user_id;
	public $_use_cache = false;
	public $_session_id = false;
	/**
	 * User groups (cached)
	 */
	public $_groups = array();
	public $_proces_ids = array();
	public $_proces_tree_flat = array();
	public $_proces_used_ids = array();
	public $_proces_used_map = array();
	public $_proces_init_used_ids = array();

	function __construct($user_id, $use_cache = false, $session_id = null) {
		$this->_user_id = $user_id;
		$this->_use_cache = $use_cache;
		$this->_session_id = (null !== $session_id) ? $session_id : session_id();
		DBG::simpleLog('auth', "UserAcl::__construct {{$user_id}, {$this->_session_id}}");
		// try {
		// 	throw new Exception("Error Processing Request");
		// } catch (Exception $e) {
		// 	DBG::simpleLog('auth', "UserAcl::__construct {{$user_id}, {$this->_session_id}} trace:" . "\n" . $e->getTraceAsString());
		// }

		$this->_cache_init();
	}

	function fetchGroups() {
		if ($this->_user_id < 0) return false;
		if (!empty($this->_groups)) {
			return $this->_groups;
		}

		$this->_groups = $this->_cache_read('_groups');
		if ($this->_groups != null) {
			return $this->_groups;
		}
		$this->_groups = array();

		$this->_groups = UsersHelper::get_group_by_user($this->_user_id);

		$this->_cache_save('_groups', $this->_groups);

		return $this->_groups;
	}

	function getProcesIds() {
		if (!empty($this->_proces_ids)) return $this->_proces_ids;

		$groups = $this->fetchGroups();
		if (empty($groups)) {
			return false;
		}
		$this->_proces_ids = DB::getPDO()->fetchValuesList("
			select p.`ID`
			from `CRM_PROCES` as p
				left join `CRM_WSKAZNIK` as w on ( p.`ID` = w.`ID_PROCES` )
			where
				w.`ID_ZASOB` in ( " . implode(",", array_keys($groups)) . " )
				and w.`A_STATUS` in ( 'NORMAL', 'WAITING' )
				and p.`A_STATUS` in ( 'NORMAL', 'WAITING' )
		");
		return $this->_proces_ids;
	}

	function getProcesTree() {
		if (!empty($this->_proces_tree_flat)) return $this->_proces_tree_flat;

		$listItems = DB::getPDO()->fetchAll("
			select p.`ID`, p.`PARENT_ID`
				from `CRM_PROCES` as p
				where p.`A_STATUS` in ( 'WAITING', 'NORMAL' )
			union
				select p.`IF_TRUE_GOTO` as ID, p.`ID` as PARENT_ID
				from `CRM_PROCES` as p
				where p.`A_STATUS` in ( 'WAITING', 'NORMAL' )
					and p.IF_TRUE_GOTO > 0
					and p.IF_TRUE_GOTO_FLAG = 'GOTO_AND_RETURN'
		");
		//	union select '83','122'		  union select p.`ID` as ID, p.`IF_TRUE_GOTO` as PARENT_ID from `CRM_PROCES` as p where p.`A_STATUS` in('WAITING','NORMAL') and p.IF_TRUE_GOTO>0
		//union select '83','122'
		//union select '83','2025'
		$this->_proces_tree_flat = [];
		foreach ($listItems as $item) {
			$this->_proces_tree_flat[$item['PARENT_ID']][] = $item['ID'];
		}
		return $this->_proces_tree_flat;
	}

	function _cache_init() {
		if (!$this->_use_cache) return;

		if (!isset($_SESSION['UserAcl_cache'])) {
			$_SESSION['UserAcl_cache'] = array();
		}
		else {
			$user_id = V::get('_user_id', 0, $_SESSION['UserAcl_cache'], 'int');
			if ($user_id > 0) {
				if ($user_id != $this->_user_id) {
					// clean cache if another user
					$_SESSION['UserAcl_cache'] = array();
				}
			}
		}
	}

	function _cache_clear() {
		if (!$this->_use_cache) return;

		$_SESSION['UserAcl_cache'] = array();
	}

	/**
	 * Read data from cache.
	 */
	function _cache_read($key) {
		if (!$this->_use_cache) return null;

		if (array_key_exists($key, $_SESSION['UserAcl_cache'])) {
			return $_SESSION['UserAcl_cache'][$key];
		}
		return null;
	}

	/**
	 * Save data in cache.
	 */
	function _cache_save($key, $value) {
		if (!$this->_use_cache) return;

		if ($key == 'foundTables') {
			$tblIds = array();
			foreach ($value as $idTable => $tableConfig) {
				$tblIds[] = $idTable;
				TableAcl::buildInstance($idTable, $tableConfig);
			}
			$value = $tblIds;
		}
		$_SESSION['UserAcl_cache'][$key] = $value;
	}

	public function getUrls() {// @require _fetchPerms
		static $_userUrls = null;
		if (null !== $_userUrls) return $_userUrls;
		$_userUrls = [];
		$filterIdProces = $this->getFilterIdProces();
		$userUrlAction = SchemaFactory::loadDefaultObject('UserUrlAction');
		$userUrlAction->setIdUser($this->_user_id);
		$userUrlAction->setIdProcesFilter($filterIdProces);
		foreach ($userUrlAction->getItems() as $url) {
			$_userUrls[ $url['ID_URL'] ] = $url['opis'];
		}
		return $_userUrls;
	}

	public function getObjectAcl($sourceName, $objName) {// TODO: rename $sourceName to $prefix (xml namespace - @see Core_AclHelper)
		if (empty($objName)) throw new Exception("Missing object name", 400);
		if ('default_db' == $sourceName) {
			$zasobTblInfo = ProcesHelper::getZasobTableInfoByUri("{$sourceName}/{$objName}");
			if (!$zasobTblInfo) throw new HttpException("Object not Found '{$objName}'", 404);
			if (!$this->hasTableAcl($zasobTblInfo->ID)) throw new HttpException("Access Denied for '{$sourceName}/{$objName}'", 403);
			return $this->getTableAcl($zasobTblInfo->ID);
		} else if ('objects' == $sourceName) {
			return SchemaFactory::loadDefaultObject($objName);
		} else if ('default_objects' == $sourceName) {
			return SchemaFactory::loadDefaultObject($objName);
		} else if ('default_db__x3A__' == substr($sourceName, 0, 17)) {
			$rootTableName = strtolower(substr($sourceName, 17));
			return SchemaFactory::loadTableObject($rootTableName, $objName);
		} else if ('zasob_' == substr($sourceName, 0, strlen('zasob_'))) {
			$idDatabase = strtolower(substr($sourceName, strlen('zasob_')));
			// return SchemaFactory::loadTableObject($rootTableName, $objName);
			if (!is_numeric($idDatabase)) throw new HttpException("Not Implemented - Database({$idDatabase})", 501);
			$remoteDB = DB::getPDO($idDatabase); // TODO: may throw Exception 'Config file not exists ...'
			DBG::log($remoteDB, 'array', "\$remoteDB");
			$dbType = $remoteDB->getType();
			switch ($dbType) {
				case 'mysql': {
					// throw new HttpException("Not Implemented - TODO idDatabase({$idDatabase}) type({$dbType})", 501);
					$zasobTblInfo = ProcesHelper::getZasobTableInfoByUri("{$sourceName}/{$objName}");
					DBG::log($zasobTblInfo, 'array', "\$zasobTblInfo");
					if (!$zasobTblInfo) throw new HttpException("Object not Found '{$objName}'", 404);
					if (!$this->hasTableAcl($zasobTblInfo->ID)) throw new HttpException("Access Denied for '{$sourceName}/{$objName}'", 403);
					return $this->getTableAcl($zasobTblInfo->ID);
				}
				case 'pgsql': {
					$zasobTblInfo = ProcesHelper::getZasobTableInfoByUri("{$sourceName}/{$objName}");
					DBG::log($zasobTblInfo, 'array', "\$zasobTblInfo");
					if (!$zasobTblInfo) throw new HttpException("Object not Found '{$objName}'", 404);
					if (!$this->hasTableAcl($zasobTblInfo->ID)) throw new HttpException("Access Denied for '{$sourceName}/{$objName}'", 403);
					return $this->getTableAcl($zasobTblInfo->ID);
					// throw new HttpException("Not Implemented - TODO idDatabase({$idDatabase}) type({$dbType})", 501);
				}
				default: throw new HttpException("Not Implemented - TODO idDatabase({$idDatabase}) type({$dbType})", 501);
			}
		}
		throw new HttpException("Not Implemented", 501);
	}

	public function getTablesAcl() {// TODO: read from `CRM_PROCES_idx_TABLE_TO_USER_VIEW`
		$tbls = array();
		$tblIds = $this->_cache_read('foundTables');
		foreach ($tblIds as $vTableID) {
			$tbls[$vTableID] = TableAcl::getInstance($vTableID);
		}
		return $tbls;
	}

	public function hasTableAcl($tableID) {// TODO: read from `CRM_PROCES_idx_TABLE_TO_USER_VIEW`
		$tbls = $this->_cache_read('foundTables');
		return (is_array($tbls) && in_array($tableID, $tbls));
	}

	public function getTableAcl($tableID) {
		$tblAcl = TableAcl::getInstance($tableID);
		if (!$tblAcl) throw new Exception("Brak obiektu nr [{$tableID}]!");
		$tblAcl->init();
		return $tblAcl;
	}

	/**
	 * Check if perms are only for one proces.
	 * @returns int or false
	 */
	public function getPermsFiltrProcesId() {// TODO: RMME mved to getFilterIdProces
		return $this->getFilterIdProces();
	}
	public function getFilterIdProces() {
		$procesID = $this->_cache_read('permsByProcesID');
		return ($procesID > 0)? $procesID : false;
	}

	public function fetchAllPerms($force = false) {
		$this->_fetchPerms('All', $force);
	}

	public function fetchProcesPerms($procesID, $force = false) {
		$this->_fetchPerms($procesID, $force);
	}

	/**
	 * @param $type - 'All', $procesID
	 */
	private function _fetchPerms($type, $force = false) {
		$procesID = 0;// if 0 - All, alse perms by procesID
		$foundTbls = array();

		if ($force) {
			$this->_cache_clear();
		}

		$schemaReader = new SchemaReader();
		if ($type == 'All') {
			$procesID = 0;// if 0 - All, alse perms by procesID
			$schemaReader->getAll();
		} else if (is_numeric($type) && $type > 0) {
			$procesID = (int)$type;
		}

		{// fetch from schema files in SE/schema/process/*.ini.php
		if ($schemaReader->hasProcessConfigs()) {
			foreach ($schemaReader->getProcessConfigs() as $process) {
				DBG::_('DBG_SCH', '1', "process", $process, __CLASS__, __FUNCTION__, __LINE__ );
				if ($process->hasAccess()) {
					$tables = $process->getTables();
					DBG::_('DBG_SCH', '1', "tables", $tables, __CLASS__, __FUNCTION__, __LINE__ );
					foreach ($tables as $vTable) {
						$tblUri = $vTable->getUri();
						$zasobTblInfo = ProcesHelper::getZasobTableInfoByUri($tblUri);
						DBG::_('DBG_SCH', '1', "table(" . $vTable->getLabel() . ")", $zasobTblInfo, __CLASS__, __FUNCTION__, __LINE__ );
						if ($zasobTblInfo) {
							$idTable = $zasobTblInfo->ID;
							if (!array_key_exists($idTable, $foundTbls)) {
								$tableConfig = array();
								$tableConfig['ID_TABLE'] = $idTable;
								$tableConfig['db'] = $zasobTblInfo->P__ID;
								$tableConfig['name'] = $zasobTblInfo->DESC;
								$tableConfig['label'] = $zasobTblInfo->DESC_PL;
								$tableConfig['opis'] = $zasobTblInfo->OPIS;
								$foundTbls[$idTable] = $tableConfig;
							}
							$tableAcl = TableAcl::buildInstance($idTable, $foundTbls[$idTable]);

							$fieldsConfig = array();
							$fldsInfo = ProcesHelper::getZasobTableFieldsInfo($idTable);
							foreach ($vTable->getFields() as $field) {
								$fldInfo = V::get($field->getName(), null, $fldsInfo);
								if ($fldInfo) {
									if (!array_key_exists($fldInfo->ID, $fieldsConfig)) {
										$fieldsConfig[$fldInfo->ID] = array();
										$fieldsConfig[$fldInfo->ID]['ID_CELL'] = $fldInfo->ID;
										$fieldsConfig[$fldInfo->ID]['CELL_NAME'] = $fldInfo->DESC;
										$fieldsConfig[$fldInfo->ID]['CELL_DESC'] = $fldInfo->OPIS;
										$fieldsConfig[$fldInfo->ID]['SORT_PRIO'] = $fldInfo->SORT_PRIO;
										$fieldsConfig[$fldInfo->ID]['CELL_LABEL'] = $fldInfo->DESC_PL;
										$fieldsConfig[$fldInfo->ID]['FORM_TREAT'] = '';
										//$tableAcl->addField($fldInfo->ID, $fldInfo->DESC, $fldInfo->OPIS, $fldInfo->SORT_PRIO, $fldInfo->DESC_PL);
									}

									// TODO: $field->getPerms() -> PERM_R, PERM_W, ... etc.?
									$fieldsConfig[$fldInfo->ID]['FORM_TREAT'] .= $field->getPerms();//$tableAcl->setFieldPerms($fldInfo->ID, $field->getPerms());
								}
							}
							$tableAcl->initFieldsFromConfig($fieldsConfig);
							DBG::_('DBG_SCH', '1', "fieldsConfig({$idTable})", $fieldsConfig, __CLASS__, __FUNCTION__, __LINE__);
							$tableAcl->save();
							DBG::_('DBG_SCH', '1', "tableAcl({$idTable})", $tableAcl, __CLASS__, __FUNCTION__, __LINE__);
						}
					}
				}
			}
		} else {
			DBG::_('DBG_SCH', '1', "NO \$schemaReader->hasProcessConfigs()", null, __CLASS__, __FUNCTION__, __LINE__);
		}
		DBG::_('DBG_SCH', '1', "foundTbls", $foundTbls, __CLASS__, __FUNCTION__, __LINE__);
		}// fetch from schema files

		$this->setFilterIdProces($procesID);//$this->_cache_save('permsByProcesID', $procesID);

		$filterIdProces = $this->getFilterIdProces();

		$userConfigStorage = SchemaFactory::loadDefaultObject('UserConfig');// TODO:? UserSession
		$userConfigStorage->setIdUser($this->_user_id);
		$userConfigStorage->setIdProcesFilter($filterIdProces);
		$userConf = $userConfigStorage->getItem(1);// TODO:? session_id() or 'api'
		DBG::simpleLog('auth', "UserAcl::fetchPerms UserConf: " . str_replace('"', '', json_encode($userConf)));
		// 'lastLogin' => [ '@type' => 'xsd:dateTime', '@confKey' => 'auth_user_{ID_USER}' ],// TODO: store last login time
		// 'lastAuthCacheUpdate' => [ '@type' => 'xsd:dateTime', '@confKey' => 'acl_user_{ID_USER}_cache_update' ],

		$userObject = SchemaFactory::loadDefaultObject('UserObject');
		$userObject->setIdUser($this->_user_id);
		$userObject->setIdProcesFilter($filterIdProces);

		$userUrlAction = SchemaFactory::loadDefaultObject('UserUrlAction');
		$userUrlAction->setIdUser($this->_user_id);
		$userUrlAction->setIdProcesFilter($filterIdProces);

		// DB cache
		// TODO: session garbage collector. CRM_CONFIG: last_proces_update, user_last_req_date, last_user_acl_cache_update
		$lastProcesIndexer = DB::getPDO()->fetchValue(" select CONF_VAL from CRM_CONFIG where CONF_KEY = 'tbl_indexer_CRM_PROCES_last_exec_end' ");
		DBG::simpleLog('auth', "UserAcl::fetchPerms lastProcesIndexer: '{$lastProcesIndexer}'");
		if ($userConf['lastAuthCacheUpdate'] > $lastProcesIndexer) {
			DBG::simpleLog('auth', "UserAcl::fetchPerms skip update cache");
		} else {
			DBG::simpleLog('auth', "UserAcl::fetchPerms update cache");
			$userObject->updateCacheFeatures();
			$userUrlAction->updateCacheFeatures();
			$userConfigStorage->updateItem([
				'ID_USER' => $this->_user_id,
				'ID_PROCES' => $filterIdProces,
				'lastAuthCacheUpdate' => 'NOW()'
			]);
		}

		$userAccessForTables = array_map(function ($tableConfig) {
			$sourceNs = substr($tableConfig['namespace'], 0, strpos($tableConfig['namespace'], '/'));

			return array_merge($tableConfig, [
				'_sourceNamespace' => $sourceNs,
			]);
		}, $userObject->getItems());
		DBG::simpleLog('auth', "UserAcl::fetchPerms fetched " . count($userAccessForTables) . " tables");
		DBG::_('DBG_SCH', '1', "userAccessForTables", $userAccessForTables, __CLASS__, __FUNCTION__, __LINE__ );
		foreach ($userAccessForTables as $tableConfig) {
			unset($tableConfig['ID']);
			$idTable = $tableConfig['ID_TABLE'];
			if (!array_key_exists($idTable, $foundTbls)) {
				$foundTbls[$idTable] = $tableConfig;
			}
		}

		$this->_cache_save('foundTables', $foundTbls);

		// use cache for UserUrlAction turned OFF @see getUrls()
		// $userAccessForUrls = $userUrlAction->getItems();
		// DBG::logAuth($userAccessForUrls, "_fetchPerms \$userAccessForUrls");
		// DBG::_('DBG_SCH', '2', "userAccessForUrls", $userAccessForUrls, __CLASS__, __FUNCTION__, __LINE__ );
		// $foundUrls = array();
		// foreach ($userAccessForUrls as $vUrlConfig) {
		// 	$foundUrls[$vUrlConfig['ID_URL']] = $vUrlConfig['opis'];
		// }
		// $this->_cache_save('foundUrls', $foundUrls);
	}

	public function setFilterIdProces($procesID) {
		$this->_cache_save('permsByProcesID', $procesID);
	}

	public function getPermsForTable($idTable) { // @returns [ permInfo group by ID_CELL ]; permInfo = [ ID_CELL, CELL_NAME, SORT_PRIO, PERM_R, PERM_W, PERM_... ]
		$sqlIdProcesListSql = $this->getUsedUserProcesIdsSql();
		if (!$sqlIdProcesListSql) return [];
		$tableCellToProcesSql = "
			select z.`ID` as `ID_CELL`
					, z.`DESC` as `CELL_NAME`
					, z.`DESC_PL` as `CELL_LABEL`
					, z.`OPIS` as `CELL_DESC`
					, z.`SORT_PRIO` as `SORT_PRIO`
					, zp.`ID` as `ID_TABLE`
		--			, zp.`DESC` as `TABLE_NAME`
		--			, wsk.`ID_PROCES` as `ID_PROCES`
					, sum(IF(przyp.`FORM_TREAT` & 2,   1, 0)) as PERM_R
					, sum(IF(przyp.`FORM_TREAT` & 4,   1, 0)) as PERM_W
					, sum(IF(przyp.`FORM_TREAT` & 8,   1, 0)) as PERM_X
					, sum(IF(przyp.`FORM_TREAT` & 16,  1, 0)) as PERM_C
					, sum(IF(przyp.`FORM_TREAT` & 32,  1, 0)) as PERM_S
					, sum(IF(przyp.`FORM_TREAT` & 64,  1, 0)) as PERM_O
					, sum(IF(przyp.`FORM_TREAT` & 128, 1, 0)) as PERM_V
					, sum(IF(przyp.`FORM_TREAT` & 256, 1, 0)) as PERM_E
				from `CRM_LISTA_ZASOBOW` z
					join `CRM_LISTA_ZASOBOW` zp on(zp.`ID`=z.`PARENT_ID` and zp.`TYPE`='TABELA' and zp.`A_STATUS` in('WAITING','NORMAL'))
					join `CRM_WSKAZNIK` wsk on(wsk.`ID_ZASOB`=z.`ID` and wsk.`A_STATUS` in('WAITING','NORMAL'))
					join `CRM_PROCES` p on(p.`ID`=wsk.`ID_PROCES` and p.`A_STATUS` in('WAITING','NORMAL'))
					join `CRM_PRZYPADEK` as przyp on (przyp.`ID`=wsk.`ID_PRZYPADEK`)
				where z.`TYPE`='KOMORKA'
					and z.`A_STATUS` in('WAITING','NORMAL')
					and zp.`ID`='{$idTable}'
					and wsk.`ID_PROCES` in({$sqlIdProcesListSql})
				-- group by z.`ID`, wsk.`ID_PROCES`
				group by z.`ID`
				order by z.`SORT_PRIO`
		";
		$userPermsForTable = array();
		foreach (DB::getPDO()->fetchAll($tableCellToProcesSql) as $h) {
			$idCell = $h['ID_CELL'];
			$userPermsForTable[$idCell] = $h;
		}
		return $userPermsForTable;
	}

	public function getUsedUserGroupIds() {
		$idUserGroupList = User::getGroupsIds();// TODO:? $this->_user_id
		// TODO: acl filtr by group ids
		return $idUserGroupList;
	}

	public function getUsedUserProcesIdsSql() {
		$filterIdProces = $this->getFilterIdProces();
		if ($filterIdProces > 0) {
			return "
				select i.`ID_PROCES`
					from `CRM_PROCES_idx` i
					where i.`idx_MAIN_PROCES_INIT_ID`='{$filterIdProces}'
			";
		}

		$idUserGroupList = $this->getUsedUserGroupIds();
		if (empty($idUserGroupList)) return null;
		$sqlIdUserGroupList = implode(",", $idUserGroupList);
		return "
			select gi.`ID_PROCES`
				from `CRM_PROCES_idx_GROUP_to_PROCES` gi
				where gi.`ID_GROUP` in({$sqlIdUserGroupList})
		";
	}

	public function getProcesMaxUpdateDate($idProcesInit) {
		return DB::getPDO()->fetchValue("
			select max(p.`A_RECORD_UPDATE_DATE`) as max_update_date
			from `CRM_PROCES` as p
			where p.`ID` in(
				select i.`ID_PROCES`
					from `CRM_PROCES_idx` i
					where i.`idx_PROCES_INIT_ID`='{$idProcesInit}'
			)
		");
	}

	/**
	 * Ids List of Proces Init for user (skip filters)
	 */
	public function getUserProcesInitIds() {
		$procesInitList = $this->getUserProcesInitList();
		return array_keys($procesInitList);
	}

	/**
	 * List of Proces Init for user (skip filters)
	 */
	public function getUserProcesInitList() {// TODO: read from CRM_PROCES_idx_GROUP_to_INIT_VIEW?
		$idUserGroupList = $this->fetchGroups();
		if (empty($idUserGroupList)) return [];
		$sqlIdUserGroupList = implode(",", array_keys($idUserGroupList));
		$sqlIdProcesListSql = "
			select gi.`ID_PROCES`
			from `CRM_PROCES_idx_GROUP_to_PROCES` gi
			where gi.`ID_GROUP` in({$sqlIdUserGroupList})
		";
		$sqlFetchUserProcesInitList = "
			select p.`ID`, p.`DESC`
			from `CRM_PROCES_idx` i
				join `CRM_PROCES` p on(p.`ID`=i.`idx_PROCES_INIT_ID`)
			where i.`ID_PROCES` in({$sqlIdProcesListSql})
			group by p.`ID`
			order by p.`SORT_PRIO`
		";
		return array_map(function ($row) {
			return $row['DESC'];
		}, DB::getPDO()->fetchAllByKey($sqlFetchUserProcesInitList, 'ID'));
	}

	/**
	 * Ids List of Proces Init for user (use filters)
	 */
	function getUsedUserProcesInitIds() {
		$usedProcesInitList = $this->getUsedUserProcesInitList();
		return array_keys($usedProcesInitList);
	}

	/**
	 * List of Proces Init for user (use filters)
	 */
	function getUsedUserProcesInitList() {
		$filterIdProces = $this->getFilterIdProces();
		if ($filterIdProces > 0) return $filterIdProces;

		$sqlIdProcesListSql = $this->getUsedUserProcesIdsSql();
		if (!$sqlIdProcesListSql) return [];
		$listItems = DB::getPDO()->fetchAll("
			select p.`ID`, p.`DESC`
			from `CRM_PROCES` p
			where p.`ID` in ( {$sqlIdProcesListSql} )
				and p.`TYPE` = 'PROCES_INIT'
			order by p.`SORT_PRIO`
		");
		$usedProcesInitList = array();
		foreach ($listItems as $item) {
			$usedProcesInitList[$item['ID']] = $item['DESC'];
		}
		return $usedProcesInitList;
	}

	/**
	 * Ids List of Proces Init for given tabel (skip filters)
	 */
	public function getTableProcesInitIds($idTable) {
		$procesInitList = $this->getTableProcesInitList($idTable);
		return array_keys($procesInitList);
	}

	/**
	 * List of Proces Init for given table (skip filters)
	 */
	public function getTableProcesInitList($idTable) {
		$tableProcesInitList = ACL::getTableProcesInitList($idTable);
		if (!empty($tableProcesInitList)) {
			$filteredTableProcesInitList = array();
			$procesIds = array_keys($tableProcesInitList);
			if (empty($procesIds)) {
				DBG::log("BUG empty \$procesIds for table {$idTable}");
				return [];
			}
			$sqlProcesIds = implode(",", $procesIds);
			$userLogin = User::getLogin();
			$groupIds = User::getGroupsIds();
			if (empty($procesIds)) {
				DBG::log("BUG empty User Group Ids");
				return [];
			}
			$sqlGroupIds = implode(",", $groupIds);
			// $sql = " -- slow
			// 	select uiv.`ID_PROCES_INIT`, uiv.`DESC`
			// 	from `CRM_PROCES_idx_USER_to_INIT_VIEW` uiv
			// 	where uiv.`ADM_ACCOUNT`='{$userLogin}'
			// 		and uiv.`ID_PROCES_INIT` in({$sqlProcesIds})
			// 	group by uiv.`ID_PROCES_INIT`
			// ";
			$sql = "
				select ugiv.`ID_PROCES_INIT`, ugiv.`DESC`
				from `CRM_PROCES_idx_GROUP_to_INIT_VIEW` ugiv
				where ugiv.`ID_GROUP` in({$sqlGroupIds})
					and ugiv.`ID_PROCES_INIT` in({$sqlProcesIds})
			";
			foreach (DB::getPDO()->fetchAll($sql) as $row) {
				$filteredTableProcesInitList[$row['ID_PROCES_INIT']] = $row['DESC'];
			}
			$tableProcesInitList = $filteredTableProcesInitList;
			DBG::log($filteredTableProcesInitList, 'array', "tableProcesInitList({$idTable}):filteredTableProcesInitList");
		}
		return $tableProcesInitList;
	}

	function canExecuteProcesInit($idProcesInit) {
		$isAllowed = false;
		$idProcesInit = (int)$idProcesInit;
		if (!$idProcesInit) return false;
		$idUserGroupList = $this->fetchGroups();
		$sqlIdUserGroupList = implode(",", array_keys($idUserGroupList));
		$isAlowed = DB::getPDO()->fetchValue("
			select count(*) as cnt
			from `CRM_PROCES_idx_GROUP_to_PROCES` gi
				join `CRM_PROCES` p on ( p.`ID` = gi.`ID_PROCES` and p.`TYPE` = 'PROCES_INIT' )
			where gi.`ID_GROUP` in ( {$sqlIdUserGroupList} )
				and gi.`ID_PROCES` = :id_proces_init
		", [
			':id_proces_init' => $idProcesInit,
		]);
		return ($isAlowed > 0);
	}

	function canViewProces($idProcesInit) {
		$isAllowed = false;
		$idProcesInit = (int)$idProcesInit;
		if (!$idProcesInit) return false;
		$idUserGroupList = $this->fetchGroups();
		$sqlIdUserGroupList = implode(",", array_keys($idUserGroupList));
		$isAllowed = DB::getPDO()->fetchValue("
			select count(*) as cnt
			from `CRM_PROCES_idx_GROUP_to_PROCES_PERM` gi
				join `CRM_PROCES` p on ( p.`ID` = gi.`ID_PROCES` )
			where gi.`ID_GROUP` in ( {$sqlIdUserGroupList} )
				and gi.`ID_PROCES` = :id_proces_init
		", [
			':id_proces_init' => $idProcesInit,
		]);
		// --		and gi.`HAS_PERM_R` = 1 -- TODO allow only with defined perm 'R'
		return ($isAllowed > 0);
	}

}