$authorizeAttributes */ public function checkAuthorization( ActionController $controller, array $authorizeAttributes, array $preparedArguments ): AuthorizationResult { if ($authorizeAttributes === []) { return AuthorizationResult::allowed(); } foreach ($authorizeAttributes as $authorize) { $result = $this->evaluateAuthorizeAttribute($authorize, $controller, $preparedArguments); if ($result->isDenied()) { return $result; } } return AuthorizationResult::allowed(); } protected function evaluateAuthorizeAttribute( Authorize $authorize, ActionController $controller, array $preparedArguments ): AuthorizationResult { $userAspect = $this->context->getAspect('frontend.user'); if ($authorize->requireLogin && !$userAspect->isLoggedIn()) { return AuthorizationResult::denied(AuthorizationFailureReason::NOT_LOGGED_IN, $authorize); } if (!$this->checkGroupAccess($authorize, $userAspect)) { return AuthorizationResult::denied(AuthorizationFailureReason::MISSING_GROUP, $authorize); } if ($authorize->callback !== null && !$this->executeCallback($authorize, $controller, $preparedArguments)) { return AuthorizationResult::denied(AuthorizationFailureReason::CALLBACK_DENIED, $authorize); } return AuthorizationResult::allowed(); } protected function checkGroupAccess(Authorize $authorize, object $userAspect): bool { if (empty($authorize->requireGroups)) { return true; } $userGroupIds = $userAspect->getGroupIds(); $userGroupNames = $userAspect->getGroupNames(); foreach ($authorize->requireGroups as $requiredGroup) { if (is_numeric($requiredGroup) && in_array((int)$requiredGroup, $userGroupIds, true)) { return true; } if (!is_numeric($requiredGroup) && in_array($requiredGroup, $userGroupNames, true)) { return true; } } return false; } protected function executeCallback( Authorize $authorize, ActionController $controller, array $preparedArguments ): bool { if (is_array($authorize->callback)) { return $this->executeClassCallback($authorize->callback, $preparedArguments); } return $this->executeControllerCallback($controller, $authorize->callback, $preparedArguments); } protected function executeClassCallback(array $callback, array $arguments): bool { [$className, $methodName] = $callback; $instance = $this->getCallbackInstance($className); $this->validateCallbackMethod($instance, $methodName, $className); return (bool)$instance->$methodName(...$arguments); } protected function executeControllerCallback(ActionController $controller, string $methodName, array $arguments): bool { $this->validateCallbackMethod($controller, $methodName, $controller::class); return (bool)$controller->$methodName(...$arguments); } protected function getCallbackInstance(string $className): object { if (!class_exists($className)) { throw new \RuntimeException( sprintf('Authorization callback class "%s" does not exist', $className), 1761287267 ); } return GeneralUtility::makeInstance($className); } protected function validateCallbackMethod(object $instance, string $methodName, string $className): void { if (!method_exists($instance, $methodName)) { throw new \RuntimeException( sprintf('Authorization callback method "%s::%s" does not exist', $className, $methodName), 1761287268 ); } $reflectionMethod = new \ReflectionMethod($instance, $methodName); if (!$reflectionMethod->isPublic()) { throw new \RuntimeException( sprintf('Authorization callback method "%s::%s" must be public', $className, $methodName), 1761287269 ); } } }