Add ability to temporarily override logged in user

Allows api4 to specify a different acting user

CRM/ACL/API.php

@@ -113,18 +113,18 @@ public static function whereClause(
       }
     }
 
-    if (!$contactID) {
-      $contactID = CRM_Core_Session::getLoggedInContactID();
-    }
-    $contactID = (int) $contactID;
-
     // first see if the contact has edit / view all permission
     if (CRM_Core_Permission::check('edit all contacts', $contactID) ||
       ($type == self::VIEW && CRM_Core_Permission::check('view all contacts', $contactID))
     ) {
       return $deleteClause;
     }
 
+    if (is_null($contactID)) {
+      $contactID = CRM_Core_Session::getLoggedInContactID();
+    }
+    $contactID = (int) $contactID;
+
     $whereClause = CRM_ACL_BAO_ACL::whereClause($type,
       $tables,
       $whereTables,

CRM/Core/Permission.php

@@ -118,6 +118,8 @@ public static function getPermission() {
    */
   public static function check($permissions, $contactId = NULL) {
     $permissions = (array) $permissions;
+    // If the logged in contact id is being overridden, use the substitute contactId
+    $contactId = $contactId ?? CRM_Core_Session::getOverriddenUser();
     $userId = CRM_Core_BAO_UFMatch::getUFId($contactId);
     // If contact has no associated user, set to 0 for anonymous (logged-out)
     if ($contactId === 0 || ($contactId && !$userId)) {

CRM/Core/Session.php

@@ -65,6 +65,13 @@ class CRM_Core_Session {
    */
   static private $_singleton = NULL;
 
+  /**
+   * Stack of contact ids when overriding current user
+   *
+   * @var array
+   */
+  static private $userOverride = [];
+
   /**
    * Constructor.
    *
@@ -250,6 +257,11 @@ public function get($name, $prefix = NULL) {
     // create session scope
     $this->createScope($prefix, TRUE);
 
+    if (!$prefix && $name == 'userID' && self::$userOverride) {
+      end(self::$userOverride);
+      return current(self::$userOverride);
+    }
+
     if (empty($this->_session) || empty($this->_session[$this->_key])) {
       return NULL;
     }
@@ -573,4 +585,60 @@ public function isEmpty() {
     return empty($_SESSION);
   }
 
+  /**
+   * Temporarily masquerade as a different user.
+   *
+   * Note: the override is stored in a static variable so does not persist past this page request.
+   *
+   * Returns a handle to identify this override so you can revert it later.
+   *
+   * @param int $contactId
+   *   Contact id to spoof as current user.
+   * @param string|int $handle
+   *   Specify your own handle if you wish.
+   * @return bool|string|int
+   *   Handle if anything was done, FALSE otherwise
+   */
+  public function overrideCurrentUser($contactId, $handle = NULL) {
+    if ($contactId == $this->get('userID')) {
+      // Current user is already $contactId; nothing to do
+      return FALSE;
+    }
+    $handle = $handle ?? uniqid();
+    self::$userOverride[$handle] = $contactId;
+    return $handle;
+  }
+
+  /**
+   * Reverts $this->overrideCurrentUser
+   *
+   * @param string|int $handle
+   *   Optionally specify the override to revert, else it will just
+   *   pop the latest override off the stack.
+   *
+   * @return bool
+   *   Whether or not anything was done.
+   */
+  public function restoreCurrentUser($handle = NULL) {
+    if (self::$userOverride) {
+      $handle = $handle ?? array_reverse(array_keys(self::$userOverride))[0];
+      if (array_key_exists($handle, self::$userOverride)) {
+        unset(self::$userOverride[$handle]);
+        return TRUE;
+      }
+    }
+    return FALSE;
+  }
+
+  /**
+   * If the contact id of the logged-in user has been overridden, return it.
+   *
+   * Otherwise return null to indicate the current user is not being overridden.
+   *
+   * @return int|null
+   */
+  public static function getOverriddenUser() {
+    return self::$userOverride ? self::getLoggedInContactID() : NULL;
+  }
+
 }

tests/phpunit/E2E/Core/UserOverrideTest.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace E2E\Core;
+
+/**
+ * Class UserOverrideTest
+ *
+ * Check that overriding session user behaves as expected.
+ *
+ * @package E2E\Core
+ * @group e2e
+ */
+class UserOverrideTest extends \CiviEndToEndTestCase {
+
+  protected function setUp() {
+    parent::setUp();
+  }
+
+  protected function tearDown() {
+    while (\CRM_Core_Session::singleton()->restoreCurrentUser()) {
+      // Loop until all overrides are cleared
+    }
+  }
+
+  public function testOverride() {
+    $session = \CRM_Core_Session::singleton();
+    $originalUser = $session::getLoggedInContactID();
+    // Set user CID to 2
+    $o1 = $session->overrideCurrentUser(2);
+    $this->assertEquals(2, $session::getLoggedInContactID());
+    // Set user CID to 3
+    $o2 = $session->overrideCurrentUser(3);
+    $this->assertEquals(3, $session::getLoggedInContactID());
+    // Set user CID to 4
+    $o3 = $session->overrideCurrentUser(4);
+    // Clear the second override
+    $this->assertTrue($session->restoreCurrentUser($o2));
+    // Latest override should still stand
+    $this->assertEquals(4, $session::getLoggedInContactID());
+    // Clear the last override, should revert to the one remaining override
+    $this->assertTrue($session->restoreCurrentUser());
+    $this->assertEquals(2, $session::getLoggedInContactID());
+    $this->assertEquals(2, $session->getOverriddenUser());
+    // Clear the final override
+    $this->assertTrue($session->restoreCurrentUser());
+    $this->assertEquals($originalUser, $session::getLoggedInContactID());
+    // Assert there are no overrides left to clear
+    $this->assertNull($session->getOverriddenUser());
+    $this->assertFalse($session->restoreCurrentUser());
+  }
+
+}