Add optional automatic revocation of user group memberships for assignments

wcfsetup/install/files/acp/database/update_com.woltlab.wcf_6.3_step1.php

@@ -365,6 +365,7 @@
     PartialDatabaseTable::create('wcf1_user_group_assignment')
         ->columns([
             JsonDatabaseTableColumn::create('conditions'),
+            DefaultFalseBooleanDatabaseTableColumn::create('revokeAutomatically'),
         ]),
     PartialDatabaseTable::create('wcf1_notice')
         ->columns([

wcfsetup/install/files/lib/acp/form/UserGroupAssignmentAddForm.class.php

@@ -7,6 +7,7 @@
 use wcf\data\DatabaseObjectBuilder;
 use wcf\data\user\group\assignment\UserGroupAssignment;
 use wcf\data\user\group\assignment\UserGroupAssignmentBuilder;
+use wcf\data\user\group\assignment\UserGroupAssignmentList;
 use wcf\data\user\group\UserGroup;
 use wcf\form\AbstractDatabaseObjectBuilderForm;
 use wcf\system\form\builder\container\FormContainer;
@@ -15,12 +16,15 @@
 use wcf\system\form\builder\field\ObjectFilterFormField;
 use wcf\system\form\builder\field\SelectFormField;
 use wcf\system\form\builder\field\TitleFormField;
+use wcf\system\form\builder\field\validation\FormFieldValidationError;
+use wcf\system\form\builder\field\validation\FormFieldValidator;
 use wcf\system\object\filter\builder\UserGroupAssignmentObjectFilterBuilder;
+use wcf\system\user\group\assignment\UserGroupAssignmentHandler;
 
 /**
  * Shows the form to create a new automatic user group assignment.
  *
- * @author      Alexander Ebert, Matthias Schmidt
+ * @author      Alexander Ebert, Matthias Schmidt, Marcel Werk
  * @copyright   2001-2026 WoltLab GmbH
  * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
  *
@@ -80,6 +84,7 @@ protected function createForm(): void
                         ->label('wcf.user.group')
                         ->options($this->getAvailableUserGroups())
                         ->required()
+                        ->addValidator($this->getGroupIDValidator())
                         ->saveValueCallback(static function (UserGroupAssignmentBuilder $builder, IFormField $field) {
                             $builder->setGroupID((int)$field->getSaveValue());
                         }),
@@ -88,6 +93,13 @@ protected function createForm(): void
                         ->saveValueCallback(static function (UserGroupAssignmentBuilder $builder, IFormField $field) {
                             $builder->setIsDisabled((bool)$field->getSaveValue());
                         }),
+                    BooleanFormField::create('revokeAutomatically')
+                        ->label('wcf.acp.group.assignment.revokeAutomatically')
+                        ->description('wcf.acp.group.assignment.revokeAutomatically.description')
+                        ->addValidator($this->getRevokeAutomaticallyValidator())
+                        ->saveValueCallback(static function (UserGroupAssignmentBuilder $builder, IFormField $field) {
+                            $builder->setRevokeAutomatically((bool)$field->getSaveValue());
+                        }),
                 ]),
             FormContainer::create('conditionsContainer')
                 ->label('wcf.acp.group.assignment.conditions')
@@ -103,6 +115,98 @@ protected function createForm(): void
         ]);
     }
 
+    /**
+     * Rejects additional assignments for user groups whose assignment
+     * automatically removes users, which only supports a single assignment.
+     */
+    private function getGroupIDValidator(): FormFieldValidator
+    {
+        return new FormFieldValidator('revokeAutomatically', function (SelectFormField $field) {
+            $revokeField = $field->getDocument()->getNodeById('revokeAutomatically');
+            \assert($revokeField instanceof BooleanFormField);
+            if ($revokeField->getValue() === true) {
+                // Conflicts are reported by the validator of the automatic revocation.
+                return;
+            }
+
+            foreach ($this->getOtherAssignments((int)$field->getSaveValue()) as $assignment) {
+                if ($assignment->revokeAutomatically === 1) {
+                    $field->addValidationError(new FormFieldValidationError(
+                        'revokeAutomatically',
+                        'wcf.acp.group.assignment.groupID.error.revokeAutomatically'
+                    ));
+
+                    return;
+                }
+            }
+        });
+    }
+
+    /**
+     * Rejects the automatic revocation for user groups that grant administrative
+     * access or have other assignments and for conditions that exclude members
+     * of the target user group, which would repeatedly add and remove the same
+     * users.
+     */
+    private function getRevokeAutomaticallyValidator(): FormFieldValidator
+    {
+        return new FormFieldValidator('revokeAutomatically', function (BooleanFormField $field) {
+            if ($field->getValue() !== true) {
+                return;
+            }
+
+            $groupField = $field->getDocument()->getNodeById('groupID');
+            \assert($groupField instanceof SelectFormField);
+            $groupID = (int)$groupField->getSaveValue();
+
+            $group = UserGroup::getGroupByID($groupID);
+            if ($group !== null && !UserGroupAssignmentHandler::isRevocableGroup($group)) {
+                $field->addValidationError(new FormFieldValidationError(
+                    'adminGroup',
+                    'wcf.acp.group.assignment.revokeAutomatically.error.adminGroup'
+                ));
+
+                return;
+            }
+
+            if ($this->getOtherAssignments($groupID) !== []) {
+                $field->addValidationError(new FormFieldValidationError(
+                    'otherAssignments',
+                    'wcf.acp.group.assignment.revokeAutomatically.error.otherAssignments'
+                ));
+
+                return;
+            }
+
+            $conditionsField = $field->getDocument()->getNodeById('conditions');
+            \assert($conditionsField instanceof ObjectFilterFormField);
+            if (UserGroupAssignmentHandler::excludesTargetGroup($groupID, $conditionsField->getValue())) {
+                $field->addValidationError(new FormFieldValidationError(
+                    'notInTargetGroup',
+                    'wcf.acp.group.assignment.revokeAutomatically.error.notInTargetGroup'
+                ));
+            }
+        });
+    }
+
+    /**
+     * Returns the other assignments for the given user group, including the
+     * disabled ones because they can be enabled without using this form.
+     *
+     * @return array<int, UserGroupAssignment>
+     */
+    private function getOtherAssignments(int $groupID): array
+    {
+        $assignmentList = new UserGroupAssignmentList();
+        $assignmentList->getConditionBuilder()->add('groupID = ?', [$groupID]);
+        if ($this->formObject !== null) {
+            $assignmentList->getConditionBuilder()->add('assignmentID <> ?', [$this->formObject->assignmentID]);
+        }
+        $assignmentList->readObjects();
+
+        return $assignmentList->getObjects();
+    }
+
     /**
      * @return array<int, UserGroup>
      */

wcfsetup/install/files/lib/command/user/RemoveUserFromGroups.class.php

@@ -21,6 +21,7 @@ final class RemoveUserFromGroups
     public function __construct(
         private readonly User $user,
         private readonly array $groupIDs,
+        private readonly bool $ignoreUserGroupAssignments = false,
     ) {}
 
     public function __invoke(): void
@@ -33,7 +34,8 @@ public function __invoke(): void
         }
 
         new UpdateUser(
-            UserBuilder::forUpdate($this->user)->setGroupIDs($groupIDs)
+            UserBuilder::forUpdate($this->user)->setGroupIDs($groupIDs),
+            $this->ignoreUserGroupAssignments
         )();
     }
 }

wcfsetup/install/files/lib/data/user/group/assignment/UserGroupAssignment.class.php

@@ -20,6 +20,7 @@
  * @property-read   string  $title          title of the automatic user group assignment
  * @property-read   0|1     $isDisabled     is `1` if the user group assignment is disabled and thus not checked for automatic assignments, otherwise `0`
  * @property-read   string  $conditions
+ * @property-read   0|1     $revokeAutomatically    is `1` if members of the user group are automatically removed once they no longer fulfill the conditions of this assignment, otherwise `0`
  */
 class UserGroupAssignment extends DatabaseObject implements IRouteController
 {

wcfsetup/install/files/lib/data/user/group/assignment/UserGroupAssignmentBuilder.class.php

@@ -44,6 +44,17 @@ public function setIsDisabled(bool $isDisabled): static
         return $this;
     }
 
+    /**
+     * Sets whether members of the user group are automatically removed once
+     * they no longer fulfill the conditions of this assignment.
+     */
+    public function setRevokeAutomatically(bool $revokeAutomatically): static
+    {
+        $this->properties['revokeAutomatically'] = (int)$revokeAutomatically;
+
+        return $this;
+    }
+
     /**
      * Sets the serialized object filters that a user must match.
      */

wcfsetup/install/files/lib/system/cronjob/UserGroupAssignmentCronjob.class.php

@@ -8,7 +8,8 @@
 use wcf\system\user\group\assignment\UserGroupAssignmentHandler;
 
 /**
- * Executes automatic user group assignments.
+ * Executes automatic user group assignments and removes users who no longer
+ * fulfill the assignment of user groups with automatic revocation.
  *
  * @author  Matthias Schmidt
  * @copyright   2001-2019 WoltLab GmbH
@@ -23,10 +24,14 @@ public function execute(Cronjob $cronjob)
     {
         parent::execute($cronjob);
 
+        $assignmentCount = UserGroupAssignmentHandler::getInstance()->revokeUsers(self::MAXIMUM_ASSIGNMENTS);
+        if ($assignmentCount >= self::MAXIMUM_ASSIGNMENTS) {
+            return;
+        }
+
         $assignments = UserGroupAssignmentCacheBuilder::getInstance()->getData();
         $usersToGroup = [];
 
-        $assignmentCount = 0;
         foreach ($assignments as $assignment) {
             if (!isset($usersToGroup[$assignment->groupID])) {
                 $usersToGroup[$assignment->groupID] = [];

wcfsetup/install/files/lib/system/object/filter/builder/UserGroupAssignmentObjectFilterBuilder.class.php

@@ -94,13 +94,14 @@ public function isAccessible(): bool
     }
 
     /**
-     * Adds the filters of the assignment to the given user list.
+     * Adds the filters of the assignment to the given user list. Returns
+     * whether any active filter has been applied.
      *
      * An assignment without any active filters matches no users.
      */
-    public function applyFilters(UserGroupAssignment $assignment, UserList $userList): void
+    public function applyFilters(UserGroupAssignment $assignment, UserList $userList): bool
     {
-        $this->getHandler()->applyFilters(
+        return $this->getHandler()->applyFilters(
             $userList,
             $assignment->conditions,
         );