CVE-2024-37167: Insufficient Information (NVD-CWE-noinfo)
value: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see. This issue has been patched in Tuleap Community Edition version 15.9.99.97.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-25T20:15Z
Repository: https://github.com/Enalean/tuleap
Language: PHP
Files changed: plugins/agiledashboard/include/AgileDashboard/Milestone/Backlog/BacklogItemCollectionFactory.class.php, plugins/agiledashboard/include/AgileDashboard/REST/v1/ContentForMiletoneProvider.php, plugins/agiledashboard/include/AgileDashboard/REST/v1/MilestoneResource.class.php, plugins/agiledashboard/include/AgileDashboard/REST/v1/ProjectBacklogResource.class.php, plugins/agiledashboard/include/AgileDashboard/REST/v2/ProjectBacklogResource.class.php, plugins/agiledashboard/include/agiledashboardPlugin.php, plugins/agiledashboard/tests/unit/AgileDashboard/Milestone/Backlog/AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactoryTest.php, plugins/cardwall/include/Pane.class.php, plugins/projectmilestones/include/Widget/ProjectMilestonesPresenterBuilder.php, plugins/tracker/include/Tracker/Permission/TrackersPermissionsRetriever.php, plugins/tracker/tests/unit/Stub/Tracker/Permission/TrackersPermissionsPassthroughRetriever.php
Commit date: 2024-06-07 14:33:32 +0200
Commit message: fix: request #38297 Permissions of the backlog items are not verified

Change-Id: I5ea5e5cb4e5d320e77cb174fda9c598fd4604963

Diff: diff --git a/plugins/agiledashboard/include/AgileDashboard/Milestone/Backlog/BacklogItemCollectionFactory.class.php b/plugins/agiledashboard/include/AgileDashboard/Milestone/Backlog/BacklogItemCollectionFactory.class.php
index c5dd98616bd4f..4c9ea4e4e63e7 100644
--- a/plugins/agiledashboard/include/AgileDashboard/Milestone/Backlog/BacklogItemCollectionFactory.class.php
+++ b/plugins/agiledashboard/include/AgileDashboard/Milestone/Backlog/BacklogItemCollectionFactory.class.php
@@ -23,10 +23,11 @@
  */
 
 use Tuleap\AgileDashboard\ExplicitBacklog\ArtifactsInExplicitBacklogDao;
 use Tuleap\AgileDashboard\RemainingEffortValueRetriever;
 use Tuleap\Tracker\Artifact\Artifact;
+use Tuleap\Tracker\Permission\RetrieveUserPermissionOnArtifacts;
 
 /**
  * I build collections of IBacklogItem
  */
 class AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactory
@@ -93,10 +94,11 @@ class AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactory
         PlanningFactory $planning_factory,
         AgileDashboard_Milestone_Backlog_IBuildBacklogItemAndBacklogItemCollection $backlog_item_builder,
         RemainingEffortValueRetriever $remaining_effort_value_retriever,
         ArtifactsInExplicitBacklogDao $artifacts_in_explicit_backlog_dao,
         Tracker_Artifact_PriorityDao $artifact_priority_dao,
+        private readonly RetrieveUserPermissionOnArtifacts $user_permission_on_artifacts_retriever,
     ) {
         $this->dao                               = $dao;
         $this->artifact_factory                  = $artifact_factory;
         $this->milestone_factory                 = $milestone_factory;
         $this->planning_factory                  = $planning_factory;
@@ -183,14 +185,20 @@ class AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactory
         AgileDashboard_Milestone_Backlog_DescendantItemsCollection $item_collection,
         PFUser $user,
         Planning_Milestone $milestone,
         ?string $redirection_url,
     ): AgileDashboard_Milestone_Backlog_IBacklogItemCollection {
+        $permissions_on_items = $this->user_permission_on_artifacts_retriever->retrieveUserPermissionOnArtifacts(
+            $user,
+            iterator_to_array($item_collection),
+            \Tuleap\Tracker\Permission\ArtifactPermissionType::PERMISSION_VIEW
+        );
+
         $artifacts        = [];
         $backlog_item_ids = [];
 
-        foreach ($item_collection as $artifact) {
+        foreach ($permissions_on_items->allowed as $artifact) {
             $artifacts[$artifact->getId()] = $artifact;
             $backlog_item_ids[]            = $artifact->getId();
         }
 
         $parents   = $this->getParentArtifacts($milestone, $user, $backlog_item_ids);
@@ -232,24 +240,21 @@ class AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactory
         Planning_Milestone $milestone,
         AgileDashboard_Milestone_Backlog_Backlog $backlog,
         $redirect_to_self,
     ): AgileDashboard_Milestone_Backlog_IBacklogItemCollection {
         $artifacts         = [];
-        $backlog_item_ids  = [];
         $sub_milestone_ids = $this->getSubmilestoneIds($user, $milestone);
 
         $item_collection = $backlog->getOpenUnplannedArtifacts($user, $sub_milestone_ids);
         foreach ($item_collection as $artifact) {
             $artifacts[$artifact->getId()] = $artifact;
-            $backlog_item_ids[]            = $artifact->getId();
         }
 
         $collection = $this->buildTopBacklogCollection(
             $user,
             $milestone,
             $redirect_to_self,
-            $backlog_item_ids,
             $artifacts
         );
         $collection->setTotalAvaialableSize($item_collection->getTotalAvaialableSize());
 
         return $collection;
@@ -711,51 +716,61 @@ class AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactory
             $limit,
             $offset
         );
         $collection_total_size = $this->artifacts_in_explicit_backlog_dao->foundRows();
 
-        $backlog_item_ids = [];
-        $artifacts        = [];
+        $artifacts = [];
         foreach ($rows as $row) {
             $artifact = $this->artifact_factory->getArtifactById($row['artifact_id']);
             if ($artifact === null) {
                 continue;
             }
             $artifacts[$artifact->getId()] = $artifact;
-            $backlog_item_ids[]            = $artifact->getId();
         }
 
         $collection = $this->buildTopBacklogCollection(
             $user,
             $milestone,
             $redirect_to_self,
-            $backlog_item_ids,
             $artifacts
         );
         $collection->setTotalAvaialableSize($collection_total_size);
 
         return $collection;
     }
 
+    /**
+     * @param Artifact[] $open_artifacts
+     */
     private function buildTopBacklogCollection(
         PFUser $user,
         Planning_Milestone $milestone,
         ?string $redirection_url,
-        array $backlog_item_ids,
         array $open_artifacts,
     ): AgileDashboard_Milestone_Backlog_IBacklogItemCollection {
+        $permissions_on_items = $this->user_permission_on_artifacts_retriever->retrieveUserPermissionOnArtifacts(
+            $user,
+            $open_artifacts,
+            \Tuleap\Tracker\Permission\ArtifactPermissionType::PERMISSION_VIEW,
+        );
+
+        $backlog_item_ids = [];
+        foreach ($permissions_on_items->allowed as $artifact) {
+            $backlog_item_ids[] = $artifact->getId();
+        }
+
         $parents   = $this->getParentArtifacts($milestone, $user, $backlog_item_ids);
         $semantics = $this->getArtifactsSemantics($user, $milestone, $backlog_item_ids, $open_artifacts);
 
         if (empty($backlog_item_ids)) {
             $children = 0;
         } else {
             $children = $this->artifact_factory->getChildrenCount($backlog_item_ids);
         }
 
         $collection = $this->backlog_item_builder->getCollection();
-        foreach ($open_artifacts as $artifact) {
+        foreach ($permissions_on_items->allowed as $artifact) {
             $artifact_id = $artifact->getId();
 
             if (! isset($semantics[$artifact_id])) {
                 continue;
             }
diff --git a/plugins/agiledashboard/include/AgileDashboard/REST/v1/ContentForMiletoneProvider.php b/plugins/agiledashboard/include/AgileDashboard/REST/v1/ContentForMiletoneProvider.php
index 90f020780a05d..4d6a1c2465352 100644
--- a/plugins/agiledashboard/include/AgileDashboard/REST/v1/ContentForMiletoneProvider.php
+++ b/plugins/agiledashboard/include/AgileDashboard/REST/v1/ContentForMiletoneProvider.php
@@ -73,11 +73,12 @@ class ContentForMiletoneProvider
                 new AgileDashboard_Milestone_Backlog_BacklogItemBuilder(),
                 new RemainingEffortValueRetriever(
                     Tracker_FormElementFactory::instance()
                 ),
                 new ArtifactsInExplicitBacklogDao(),
-                new Tracker_Artifact_PriorityDao()
+                new Tracker_Artifact_PriorityDao(),
+                \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
             )
         );
     }
 
     public function getContent(
diff --git a/plugins/agiledashboard/include/AgileDashboard/REST/v1/MilestoneResource.class.php b/plugins/agiledashboard/include/AgileDashboard/REST/v1/MilestoneResource.class.php
index 98bb4715c4ed1..d01af692d5a65 100644
--- a/plugins/agiledashboard/include/AgileDashboard/REST/v1/MilestoneResource.class.php
+++ b/plugins/agiledashboard/include/AgileDashboard/REST/v1/MilestoneResource.class.php
@@ -158,11 +158,12 @@ class MilestoneResource extends AuthenticatedResource
             $this->milestone_factory,
             $planning_factory,
             new AgileDashboard_Milestone_Backlog_BacklogItemBuilder(),
             new RemainingEffortValueRetriever(Tracker_FormElementFactory::instance()),
             new ArtifactsInExplicitBacklogDao(),
-            new Tracker_Artifact_PriorityDao()
+            new Tracker_Artifact_PriorityDao(),
+            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
         );
 
         $this->milestone_validator = new MilestoneResourceValidator(
             $planning_factory,
             $this->tracker_artifact_factory,
diff --git a/plugins/agiledashboard/include/AgileDashboard/REST/v1/ProjectBacklogResource.class.php b/plugins/agiledashboard/include/AgileDashboard/REST/v1/ProjectBacklogResource.class.php
index fcca17f682db4..da705c5e24058 100644
--- a/plugins/agiledashboard/include/AgileDashboard/REST/v1/ProjectBacklogResource.class.php
+++ b/plugins/agiledashboard/include/AgileDashboard/REST/v1/ProjectBacklogResource.class.php
@@ -117,11 +117,12 @@ class ProjectBacklogResource
             new AgileDashboard_Milestone_Backlog_BacklogItemBuilder(),
             new RemainingEffortValueRetriever(
                 $tracker_form_element_factory
             ),
             new ArtifactsInExplicitBacklogDao(),
-            new Tracker_Artifact_PriorityDao()
+            new Tracker_Artifact_PriorityDao(),
+            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
         );
 
         $this->milestone_validator = new MilestoneResourceValidator(
             $this->planning_factory,
             $tracker_artifact_factory,
diff --git a/plugins/agiledashboard/include/AgileDashboard/REST/v2/ProjectBacklogResource.class.php b/plugins/agiledashboard/include/AgileDashboard/REST/v2/ProjectBacklogResource.class.php
index a61f1c3c0896d..3d99c2f83fe13 100644
--- a/plugins/agiledashboard/include/AgileDashboard/REST/v2/ProjectBacklogResource.class.php
+++ b/plugins/agiledashboard/include/AgileDashboard/REST/v2/ProjectBacklogResource.class.php
@@ -91,11 +91,12 @@ class ProjectBacklogResource
             new AgileDashboard_Milestone_Backlog_BacklogItemBuilder(),
             new RemainingEffortValueRetriever(
                 $tracker_form_element_factory
             ),
             new ArtifactsInExplicitBacklogDao(),
-            new \Tracker_Artifact_PriorityDao()
+            new \Tracker_Artifact_PriorityDao(),
+            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
         );
 
         $this->parent_tracker_retriever = new ParentTrackerRetriever($this->planning_factory);
     }
 
diff --git a/plugins/agiledashboard/include/agiledashboardPlugin.php b/plugins/agiledashboard/include/agiledashboardPlugin.php
index daff8d6184c12..ad393b199d47f 100644
--- a/plugins/agiledashboard/include/agiledashboardPlugin.php
+++ b/plugins/agiledashboard/include/agiledashboardPlugin.php
@@ -1333,11 +1333,12 @@ class AgileDashboardPlugin extends Plugin implements PluginWithConfigKeys, Plugi
             $milestone_factory,
             $this->getPlanningFactory(),
             $presenter_builder,
             new RemainingEffortValueRetriever($form_element_factory),
             new ArtifactsInExplicitBacklogDao(),
-            new Tracker_Artifact_PriorityDao()
+            new Tracker_Artifact_PriorityDao(),
+            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
         );
     }
 
     public function getMilestonePaneFactory(): Planning_MilestonePaneFactory
     {
diff --git a/plugins/agiledashboard/tests/unit/AgileDashboard/Milestone/Backlog/AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactoryTest.php b/plugins/agiledashboard/tests/unit/AgileDashboard/Milestone/Backlog/AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactoryTest.php
index 9201aa077a5f9..7572db362a9d7 100644
--- a/plugins/agiledashboard/tests/unit/AgileDashboard/Milestone/Backlog/AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactoryTest.php
+++ b/plugins/agiledashboard/tests/unit/AgileDashboard/Milestone/Backlog/AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactoryTest.php
@@ -45,10 +45,11 @@ use Tuleap\Test\Builders\ProjectTestBuilder;
 use Tuleap\Test\Builders\UserTestBuilder;
 use Tuleap\Test\PHPUnit\TestCase;
 use Tuleap\Tracker\Artifact\Artifact;
 use Tuleap\Tracker\Test\Builders\ArtifactTestBuilder;
 use Tuleap\Tracker\Test\Builders\TrackerTestBuilder;
+use Tuleap\Tracker\Test\Stub\Tracker\Permission\TrackersPermissionsPassthroughRetriever;
 
 final class AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactoryTest extends TestCase //phpcs:ignore Squiz.Classes.ValidClassName.NotCamelCaps
 {
     private Tracker_Artifact_PriorityDao&MockObject $artifact_priority_dao;
     private AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactory&MockObject $collection_factory;
@@ -81,10 +82,11 @@ final class AgileDashboard_Milestone_Backlog_BacklogItemCollectionFactoryTest ex
                 $this->planning_factory,
                 $this->backlog_item_builder,
                 $this->remaining_effort_value_retriever,
                 $this->artifacts_in_explicit_backlog_dao,
                 $this->artifact_priority_dao,
+                new TrackersPermissionsPassthroughRetriever(),
             ])
             ->onlyMethods([
                 'userCanReadBacklogTitleField',
                 'userCanReadBacklogStatusField',
                 'userCanReadInitialEffortField',
diff --git a/plugins/cardwall/include/Pane.class.php b/plugins/cardwall/include/Pane.class.php
index f3b20bdda00e8..f4e188f8eb27f 100644
--- a/plugins/cardwall/include/Pane.class.php
+++ b/plugins/cardwall/include/Pane.class.php
@@ -223,11 +223,12 @@ class Cardwall_Pane extends AgileDashboard_Pane
             new AgileDashboard_Milestone_Backlog_BacklogItemBuilder(),
             new RemainingEffortValueRetriever(
                 $this->tracker_form_element_factory
             ),
             new ArtifactsInExplicitBacklogDao(),
-            new Tracker_Artifact_PriorityDao()
+            new Tracker_Artifact_PriorityDao(),
+            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
         );
 
         $backlog_factory = new AgileDashboard_Milestone_Backlog_BacklogFactory(
             new AgileDashboard_BacklogItemDao(),
             $this->artifact_factory,
diff --git a/plugins/projectmilestones/include/Widget/ProjectMilestonesPresenterBuilder.php b/plugins/projectmilestones/include/Widget/ProjectMilestonesPresenterBuilder.php
index df7879b529f4d..eb79d7b35028d 100644
--- a/plugins/projectmilestones/include/Widget/ProjectMilestonesPresenterBuilder.php
+++ b/plugins/projectmilestones/include/Widget/ProjectMilestonesPresenterBuilder.php
@@ -167,11 +167,12 @@ class ProjectMilestonesPresenterBuilder
                 $milestone_factory,
                 $planning_factory,
                 new AgileDashboard_Milestone_Backlog_BacklogItemBuilder(),
                 new RemainingEffortValueRetriever(Tracker_FormElementFactory::instance()),
                 new ArtifactsInExplicitBacklogDao(),
-                new Tracker_Artifact_PriorityDao()
+                new Tracker_Artifact_PriorityDao(),
+                \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
             ),
             $milestone_factory,
             new ExplicitBacklogDao(),
             new ArtifactsInExplicitBacklogDao(),
             $semantic_timeframe_builder,
diff --git a/plugins/tracker/include/Tracker/Permission/TrackersPermissionsRetriever.php b/plugins/tracker/include/Tracker/Permission/TrackersPermissionsRetriever.php
index 0e316b42b1264..86f857a250d12 100644
--- a/plugins/tracker/include/Tracker/Permission/TrackersPermissionsRetriever.php
+++ b/plugins/tracker/include/Tracker/Permission/TrackersPermissionsRetriever.php
@@ -199,14 +199,10 @@ final readonly class TrackersPermissionsRetriever implements RetrieveUserPermiss
         return false;
     }
 
     public function retrieveUserPermissionOnArtifacts(PFUser $user, array $artifacts, ArtifactPermissionType $permission): UserPermissionsOnItems
     {
-        if (! self::isEnabled()) {
-            throw new LogicException('Trackers permissions on tracker are disabled by feature flag.');
-        }
-
         if ($artifacts === []) {
             return new UserPermissionsOnItems($user, $permission, [], []);
         }
 
         if ($permission === ArtifactPermissionType::PERMISSION_UPDATE && $user->isAnonymous()) {
diff --git a/plugins/tracker/tests/unit/Stub/Tracker/Permission/TrackersPermissionsPassthroughRetriever.php b/plugins/tracker/tests/unit/Stub/Tracker/Permission/TrackersPermissionsPassthroughRetriever.php
new file mode 100644
index 0000000000000..63a76c0c3f106
--- /dev/null
+++ b/plugins/tracker/tests/unit/Stub/Tracker/Permission/TrackersPermissionsPassthroughRetriever.php
@@ -0,0 +1,59 @@
+<?php
+/**
+ * Copyright (c) Enalean, 2024-Present. All Rights Reserved.
+ *
+ * This file is a part of Tuleap.
+ *
+ * Tuleap is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Tuleap is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Tuleap. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+declare(strict_types=1);
+
+namespace Tuleap\Tracker\Test\Stub\Tracker\Permission;
+
+use PFUser;
+use Tuleap\Tracker\Permission\ArtifactPermissionType;
+use Tuleap\Tracker\Permission\FieldPermissionType;
+use Tuleap\Tracker\Permission\RetrieveUserPermissionOnArtifacts;
+use Tuleap\Tracker\Permission\RetrieveUserPermissionOnFields;
+use Tuleap\Tracker\Permission\RetrieveUserPermissionOnTrackers;
+use Tuleap\Tracker\Permission\TrackerPermissionType;
+use Tuleap\Tracker\Permission\UserPermissionsOnItems;
+
+final readonly class TrackersPermissionsPassthroughRetriever implements RetrieveUserPermissionOnFields, RetrieveUserPermissionOnTrackers, RetrieveUserPermissionOnArtifacts
+{
+    public function retrieveUserPermissionOnArtifacts(
+        PFUser $user,
+        array $artifacts,
+        ArtifactPermissionType $permission,
+    ): UserPermissionsOnItems {
+        return new UserPermissionsOnItems($user, $permission, $artifacts, []);
+    }
+
+    public function retrieveUserPermissionOnFields(
+        PFUser $user,
+        array $fields,
+        FieldPermissionType $permission,
+    ): UserPermissionsOnItems {
+        return new UserPermissionsOnItems($user, $permission, $fields, []);
+    }
+
+    public function retrieveUserPermissionOnTrackers(
+        PFUser $user,
+        array $trackers,
+        TrackerPermissionType $permission,
+    ): UserPermissionsOnItems {
+        return new UserPermissionsOnItems($user, $permission, $trackers, []);
+    }
+}

Vulnerable code:         foreach ($item_collection as $artifact) {
        $backlog_item_ids  = [];
            $backlog_item_ids[]            = $artifact->getId();
            $backlog_item_ids,
        $backlog_item_ids = [];
        $artifacts        = [];
            $backlog_item_ids[]            = $artifact->getId();
            $backlog_item_ids,
        array $backlog_item_ids,
        foreach ($open_artifacts as $artifact) {
                new Tracker_Artifact_PriorityDao()
            new Tracker_Artifact_PriorityDao()
            new Tracker_Artifact_PriorityDao()
            new \Tracker_Artifact_PriorityDao()
            new Tracker_Artifact_PriorityDao()
            new Tracker_Artifact_PriorityDao()
                new Tracker_Artifact_PriorityDao()
        if (! self::isEnabled()) {
            throw new LogicException('Trackers permissions on tracker are disabled by feature flag.');
        }

Fixed code: use Tuleap\Tracker\Permission\RetrieveUserPermissionOnArtifacts;
        private readonly RetrieveUserPermissionOnArtifacts $user_permission_on_artifacts_retriever,
        $permissions_on_items = $this->user_permission_on_artifacts_retriever->retrieveUserPermissionOnArtifacts(
            $user,
            iterator_to_array($item_collection),
            \Tuleap\Tracker\Permission\ArtifactPermissionType::PERMISSION_VIEW
        );

        foreach ($permissions_on_items->allowed as $artifact) {
        $artifacts = [];
    /**
     * @param Artifact[] $open_artifacts
     */
        $permissions_on_items = $this->user_permission_on_artifacts_retriever->retrieveUserPermissionOnArtifacts(
            $user,
            $open_artifacts,
            \Tuleap\Tracker\Permission\ArtifactPermissionType::PERMISSION_VIEW,
        );

        $backlog_item_ids = [];
        foreach ($permissions_on_items->allowed as $artifact) {
            $backlog_item_ids[] = $artifact->getId();
        }

        foreach ($permissions_on_items->allowed as $artifact) {
                new Tracker_Artifact_PriorityDao(),
                \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
            new Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
            new Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
            new \Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
            new Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
use Tuleap\Tracker\Test\Stub\Tracker\Permission\TrackersPermissionsPassthroughRetriever;
                new TrackersPermissionsPassthroughRetriever(),
            new Tracker_Artifact_PriorityDao(),
            \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
                new Tracker_Artifact_PriorityDao(),
                \Tuleap\Tracker\Permission\TrackersPermissionsRetriever::build(),
<?php
/**
 * Copyright (c) Enalean, 2024-Present. All Rights Reserved.
 *
 * This file is a part of Tuleap.
 *
 * Tuleap is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * Tuleap is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Tuleap. If not, see <http://www.gnu.org/licenses/>.
 */

declare(strict_types=1);

namespace Tuleap\Tracker\Test\Stub\Tracker\Permission;

use PFUser;
use Tuleap\Tracker\Permission\ArtifactPermissionType;
use Tuleap\Tracker\Permission\FieldPermissionType;
use Tuleap\Tracker\Permission\RetrieveUserPermissionOnArtifacts;
use Tuleap\Tracker\Permission\RetrieveUserPermissionOnFields;
use Tuleap\Tracker\Permission\RetrieveUserPermissionOnTrackers;
use Tuleap\Tracker\Permission\TrackerPermissionType;
use Tuleap\Tracker\Permission\UserPermissionsOnItems;

final readonly class TrackersPermissionsPassthroughRetriever implements RetrieveUserPermissionOnFields, RetrieveUserPermissionOnTrackers, RetrieveUserPermissionOnArtifacts
{
    public function retrieveUserPermissionOnArtifacts(
        PFUser $user,
        array $artifacts,
        ArtifactPermissionType $permission,
    ): UserPermissionsOnItems {
        return new UserPermissionsOnItems($user, $permission, $artifacts, []);
    }

    public function retrieveUserPermissionOnFields(
        PFUser $user,
        array $fields,
        FieldPermissionType $permission,
    ): UserPermissionsOnItems {
        return new UserPermissionsOnItems($user, $permission, $fields, []);
    }

    public function retrieveUserPermissionOnTrackers(
        PFUser $user,
        array $trackers,
        TrackerPermissionType $permission,
    ): UserPermissionsOnItems {
        return new UserPermissionsOnItems($user, $permission, $trackers, []);
    }
}