More sandbox code

Author: bastianallgeier

src/Permissions/Sandbox/ClientRolePermissions.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace Kirby\Permissions\Roles;
+
+use Kirby\Permissions\KirbyPermissions;
+
+class ClientRolePermissions extends KirbyPermissions
+{
+	public static function make(): static
+	{
+		$permissions = static::from(true);
+
+		$permissions->file->delete = false;
+		$permissions->language->delete = false;
+		$permissions->languageVariable->delete = false;
+		$permissions->page->delete = false;
+		$permissions->user->delete = false;
+
+		return $permissions;
+	}
+}

src/Permissions/Sandbox/Page.php

@@ -24,16 +24,12 @@ public function isHomePage(): bool
 	public function permissions(User|null $user = null): PagePermissions
 	{
 		// get the default page permissions for the user
-		$permissions = User::ensure($user)->role()->permissions()->page();
+		$role        = User::ensure($user)->role();
+		$permissions = $role->permissions()->page();
 
-		// the unauthenticated user must not get any additional positive permissions later by accident
-		if ($user->role()->isNobody() === true) {
-			return $permissions::from(false);
-		}
-
-		// the kirby superuser will always get full access
-		if ($user->role()->isKirby() === true) {
-			return $permissions::from(true);
+		// the permissions for the generic power or weak users cannot be adjusted
+		if ($role->isNobody() === true || $role->isKirby() === true) {
+			return $permissions;
 		}
 
 		// apply page-specific rules and permissions

src/Permissions/Sandbox/Role.php

@@ -34,8 +34,9 @@ public function name(): string
 	public function permissions(): KirbyPermissions
 	{
 		return match (true) {
-			$this->isAdmin()  => KirbyPermissions::forAdmin(),
-			$this->isNobody() => KirbyPermissions::forNobody(),
+			$this->isAdmin()  => (new KirbyPermissions())->wildcard(true),
+			$this->isKirby()  => (new KirbyPermissions())->wildcard(true),
+			$this->isNobody() => (new KirbyPermissions())->wildcard(false),
 
 			// load permissions from role/user blueprint here
 			default           => new KirbyPermissions()

src/Permissions/Sandbox/roles/ClientRolePermissions.php

@@ -0,0 +1,19 @@
+<?php
+
+use Kirby\Permissions\KirbyPermissions;
+
+class ClientRolePermissions extends KirbyPermissions
+{
+	public static function factory(): static
+	{
+		$permissions = static::from(true);
+
+		$permissions->file->delete = false;
+		$permissions->language->delete = false;
+		$permissions->languageVariable->delete = false;
+		$permissions->page->delete = false;
+		$permissions->user->delete = false;
+
+		return $permissions;
+	}
+}

src/Permissions/Sandbox/roles/admin.php

@@ -0,0 +1,7 @@
+<?php
+
+use Kirby\Permissions\KirbyPermissions;
+
+return function () {
+	return KirbyPermissions::from(true);
+};

src/Permissions/Sandbox/roles/client.php

@@ -0,0 +1,15 @@
+<?php
+
+use Kirby\Permissions\KirbyPermissions;
+
+return function () {
+	$permissions = KirbyPermissions::from(true);
+
+	$permissions->file->delete = false;
+	$permissions->language->delete = false;
+	$permissions->languageVariable->delete = false;
+	$permissions->page->delete = false;
+	$permissions->user->delete = false;
+
+	return $permissions;
+};

src/Permissions/Sandbox/roles/editor.php

@@ -0,0 +1,15 @@
+<?php
+
+use Kirby\Permissions\KirbyPermissions;
+
+return function () {
+	$permissions = KirbyPermissions::from(true);
+
+	$permissions->file->delete = false;
+	$permissions->language->delete = false;
+	$permissions->languageVariable->delete = false;
+	$permissions->page->delete = false;
+	$permissions->user->delete = false;
+
+	return $permissions;
+};