get_action_info

Return the UI info for the named action.

Todo: Some of this code is duplicated in the OpenXPKI::Workflow::Config - might be useful to merge this into a helper. Might be useful in the API.

can_create_workflow (type, role)

Check if the given role (default is the session role) is allowed to create workflows of the given type. Returns true/false and throws an exception if the workflow type is unknown or missing.

Helper method to evaluate the acl given in the workflow config against against a concrete instance. Expects two hashes to be passed, the first hash represents the workflow instance, the second the entity that requests access.

The first hash must include type and creator, tenant must be set to evaluate tenant based rules.

The second hash is optional, if present it must have the keys user, role and tenant (if enabled). If omited user/role is read from the session and tenant is checked against the current users tenant list.

Returns 1 if the user can access the workflow. Return undef if no acl is defined for the current role and 0 if an acl was found but does not authorize the current user.

Will thrown an exception if a mandatory parameter was not passed.

can_access_handle

Check if a user/role can access a certain property (history, techlog) or handle (resume, wakeup) for a given workflow type.

Returns boolean true/false or undef if no permissions are set.

update_proc_state($wf, $old_state, $new_state)

Tries to update the "proc_state" in the database to $new_state.

Returns 1 on success and 0 if e.g. another parallel process already changed the given $old_state.

Name

OpenXPKI::Workflow::Factory - OpenXPKI specific workflow factory

Description

This is the OpenXPKI specific subclass of Workflow::Factory. We need an OpenXPKI specific subclass because Workflow currently enforces that a Factory is a singleton. In OpenXPKI, we want to have several factory objects (one for each version and each PKI realm). The most important difference between Workflow::Factory and OpenXPKI::Workflow::Factory is in the instance() class method, which creates only one global instance in the original and a new one for each call in the OpenXPKI version.

In addition, the fetch_workflow() method has been modified to do ACL checks before returning the workflow to the caller.