ADR-005: Access control 

Access Decision Tree:

0. Does the actor hold the operation permission for what it is about to do
   (secret.use / secret.reveal / secret.create / secret.rotate /
   secret.delete / secret.manage_policy)?
   → NO: DENY. This gate is independent of everything below it; the
     per-secret tiers can never grant an operation the actor may not perform.

1. Is user a TYPO3 admin or system maintainer?
   → YES: ALLOW (full access) — UNLESS the hardened profile withdrew the
     bypass (disableAdminOverride) and no break-glass window is open.

2. Is user the secret's owner (owner_uid)?
   → YES: ALLOW (full access)

3. Is user a member of the secret's group tiers?
   → READ:   member of allowed_groups OR write_groups → ALLOW
   → WRITE:  member of write_groups → ALLOW
   → DELETE: no group tier applies — owner or admin only

4. Is this a CLI/scheduler context with CLI access enabled?
   → YES: Check CLI access groups
   → Group matches: ALLOW

5. Is this frontend context with frontend_accessible=true?
   → YES: ALLOW (read only). A frontend request holds NO operation
     permission at all, whatever backend session the visitor carries —
     TYPO3 populates $GLOBALS['BE_USER'] for any visitor with a valid
     backend session, and frontend output is page-cached.

6. Default: DENY

-- Single owner
owner_uid int(11) unsigned DEFAULT 0 NOT NULL,

-- Two group tiers (many-to-many). allowed_groups grants READ;
-- write_groups grants read AND write. Neither grants delete.
allowed_groups text,
write_groups text,

-- Frontend access flag
frontend_accessible tinyint(1) unsigned DEFAULT 0 NOT NULL,

-- Permission scoping
context varchar(50) DEFAULT '' NOT NULL,
scope_pid int(11) unsigned DEFAULT 0 NOT NULL,

-- Many-to-many relation tables, one per tier
CREATE TABLE tx_nrvault_secret_begroups_mm (
    uid_local int(11) unsigned,    -- Secret UID
    uid_foreign int(11) unsigned,  -- Backend group UID (read tier)
);

CREATE TABLE tx_nrvault_secret_writegroups_mm (
    uid_local int(11) unsigned,    -- Secret UID
    uid_foreign int(11) unsigned,  -- Backend group UID (write tier)
);

final readonly class AccessControlService implements AccessControlServiceInterface
{
    public function canRead(Secret $secret): bool
    {
        return $this->checkAccess($secret, self::PERMISSION_READ);
    }

    private function checkAccess(Secret $secret, string $permission): bool
    {
        $backendUser = $GLOBALS['BE_USER'] ?? null;

        if ($backendUser === null) {
            return $this->checkCliAccess($secret);
        }

        // THE single admin-bypass seam. Never inline isAdmin() or
        // isSystemMaintainer() in a caller: an override that is only
        // half-disabled is worse than one that is not disabled at all,
        // because the deployment believes it is protected.
        if ($this->adminBypassActive($backendUser->isAdmin())) {
            return true;
        }

        // Owner has full access
        $userUid = (int) ($backendUser->user['uid'] ?? 0);
        if ($userUid === $secret->getOwnerUid()) {
            return true;
        }

        // Group tiers are per-permission: read reads both tiers, write
        // reads write_groups only, delete has no group tier at all.
        $secretGroups = $this->secretGroupsForPermission($secret, $permission);

        return array_intersect($this->currentUserGroups(), $secretGroups) !== [];
    }
}

'owner_uid' => [
    'label' => 'Owner',
    'config' => [
        'type' => 'group',
        'allowed' => 'be_users',
        'maxitems' => 1,
    ],
],

'allowed_groups' => [
    'label' => 'Allowed Groups (read)',
    'config' => [
        'type' => 'group',
        'allowed' => 'be_groups',
        'MM' => 'tx_nrvault_secret_begroups_mm',
        'maxitems' => 20,
    ],
],

'write_groups' => [
    'label' => 'Write Groups (read + write)',
    'config' => [
        'type' => 'group',
        'allowed' => 'be_groups',
        'MM' => 'tx_nrvault_secret_writegroups_mm',
        'maxitems' => 20,
    ],
],

public function getCurrentActorUid(): int
{
    return (int) ($GLOBALS['BE_USER']->user['uid'] ?? 0);
}

public function getCurrentActorType(): string
{
    if (Environment::isCli()) {
        return 'cli';
    }
    if ($GLOBALS['BE_USER'] ?? null) {
        return 'backend';
    }
    return 'api';
}

vault.permissions {
    default {
        reveal = 1
        copy = 1
        edit = 1
        readOnly = 0
    }

    tx_myext_settings.api_key {
        reveal = 0
        copy = 0
    }
}