Profiles and Permissions

// From inc/profile.class.php:40-80
class Profile extends CommonDBTM {
    // Common fields for all profiles
    public static $common_fields = [
        'id',           // Profile identifier
        'interface',    // 'central' or 'helpdesk'
        'is_default',   // Default profile for new users
        'name'          // Profile name
    ];
}

// Helpdesk-specific rights (inc/profile.class.php:46-70)
public static $helpdesk_rights = [
    'create_ticket_on_login',  // Auto-create ticket on login
    'ticket',                   // Ticket management
    'followup',                 // Add followups
    'task',                     // Create tasks
    'ticketvalidation',         // Validate tickets
    'helpdesk_hardware',        // Link hardware to tickets
    'knowbase',                 // Access knowledge base
    'reservation',              // Reserve items
    'reminder_public',          // Public reminders
    'rssfeed_public',           // Public RSS feeds
];

READ    = 1;    // View items
UPDATE  = 2;    // Modify existing items  
CREATE  = 4;    // Create new items
DELETE  = 8;    // Delete items (move to trash)
PURGE   = 16;   // Permanently delete

// Read + Create = 1 + 4 = 5
$profile['computer'] = READ | CREATE;  // Can view and create computers

// Full rights = 1 + 2 + 4 + 8 + 16 = 31
$profile['ticket'] = READ | UPDATE | CREATE | DELETE | PURGE;

// Check if user has specific right
Session::haveRight('computer', CREATE);  // Can create computers?
Session::haveRight('ticket', UPDATE);    // Can update tickets?

// Check multiple rights
Session::haveRightsOr('entity', [UPDATE, CREATE]);  // Has either right?
Session::haveRightsAnd('ticket', [READ, UPDATE]);   // Has both rights?

// From inc/profile.class.php:703-763
'name'                      // Profile name
'interface'                 // 'central' or 'helpdesk'
'is_default'                // Default profile for new users
'password_update'           // Can update own password
'create_ticket_on_login'    // Show ticket form on login
'comment'                   // Profile description

'computer'              // Computers
'monitor'               // Monitors
'software'              // Software
'networking'            // Network equipment
'printer'               // Printers
'peripheral'            // Peripherals
'phone'                 // Phones
'cartridge'             // Cartridges
'consumable'            // Consumables
'internet'              // Network management
'devicesimcard_pinpuk'  // SIM card PIN/PUK (READ, UPDATE only)

'ticket'                // Tickets
'followup'              // Followups
'task'                  // Tasks
'ticketvalidation'      // Ticket validation
'ticketcost'            // Ticket costs
'ticketrecurrent'       // Recurrent tickets
'itiltemplate'          // ITIL templates
'tickettemplates_id'    // Default ticket template
'changetemplates_id'    // Default change template
'problemtemplates_id'   // Default problem template

'license'               // Software licenses
'contact_enterprise'    // Contacts and suppliers
'document'              // Documents
'contract'              // Contracts
'infocom'               // Financial information
'budget'                // Budgets
'line'                  // Lines
'certificate'           // Certificates
'datacenter'            // Datacenters
'cluster'               // Clusters
'domain'                // Domains
'appliance'             // Appliances

'reminder_public'       // Public reminders
'rssfeed_public'        // Public RSS feeds
'bookmark_public'       // Public saved searches
'reports'               // Reports
'knowbase'              // Knowledge base
'reservation'           // Reservations
'project'               // Projects
'projecttask'           // Project tasks

'entity'                // Entities
'profile'               // Profiles
'user'                  // Users
'group'                 // Groups
'rule_ldap'             // LDAP rules
'rule_import'           // Import rules
'config'                // General configuration

'dropdown'              // Dropdowns management
'backup'                // Backups
'transfer'              // Entity transfers
'queuednotification'    // Notification queue
'logs'                  // System logs

// From inc/profile.class.php:775-865
'helpdesk_hardware'     // Link hardware (bitwise flags)
'helpdesk_item_type'    // Allowed item types (serialized array)
'show_group_hardware'   // See group members' hardware

// What hardware can be linked to tickets
1   // Own items
2   // Group items
4   // All items

// From inc/profile.class.php:316-363
'ticket_status'         // Allowed status transitions (serialized)
'problem_status'        // Problem status transitions
'change_status'         // Change status transitions

// Define allowed transitions
$cycle = [
    Ticket::INCOMING => [
        Ticket::ASSIGNED => 1,    // Can assign incoming tickets
        Ticket::PLANNED => 1,     // Can plan incoming tickets
    ],
    Ticket::ASSIGNED => [
        Ticket::PLANNED => 1,     // Can plan assigned tickets
        Ticket::SOLVED => 1,      // Can solve assigned tickets
    ]
];

'statistic'             // View statistics
'planning'              // Access planning/calendar
'externalevent'         // Manage external events in planning

// A user can have multiple profile-entity combinations
User ID: 42
  ├─ Profile: Technician, Entity: IT Department (recursive)
  ├─ Profile: Supervisor,  Entity: Helpdesk (not recursive)
  └─ Profile: Self-Service, Entity: Root Entity (recursive)

$_SESSION['glpiactiveprofile']  // Current profile data

# Via API (apirest.md:298-324)
curl -X POST \
  -H 'Session-Token: xxx' \
  -d '{"profiles_id": 4}' \
  'http://glpi/apirest.php/changeActiveProfile'

Super-Admin Profile: Full rights (31 on all modules)
Technician Profile:  Limited rights (7 on tickets, 1 on assets)
End-User Profile:    Minimal rights (5 on tickets only)

// From inc/profile.class.php:557-611
// Profiles can only be assigned to users with EQUAL or LESSER rights
public static function currentUserHaveMoreRightThan($profile_ids) {
    // Compares all rights between current user and target profiles
    // Returns true only if current user has >= rights on ALL modules
}

// From inc/profile.class.php:212-222
'is_default' = 1  // Automatically assigned to new users

// Only ONE profile can be default
// Setting a new default removes flag from others

                 Read  Update  Create  Delete  Purge
Computer         [✓]   [✓]     [✓]     [✓]     [ ]
Ticket           [✓]   [✓]     [✓]     [ ]     [ ]
Contract         [✓]   [ ]     [ ]     [ ]     [ ]

// From inc/entity.class.php:67-121
private static $field_right = [
    'entity' => ['address', 'email', 'phone', ...],
    'infocom' => ['autofill_buy_date', ...],
    'notification' => ['admin_email', ...],
    'entity_helpdesk' => ['tickettemplates_id', ...],
    'config' => ['enable_custom_css', ...]
];

// Example: Can only delete OWN tickets
if ($ticket->fields['users_id_recipient'] == Session::getLoginUserID()) {
    // Allow deletion
}

// From inc/profile.class.php:401-446
// Cannot delete last profile with UPDATE rights on profiles
// Prevents locking yourself out of profile management
public function pre_deleteItem() {
    if (last_profile_with_rights('profile', UPDATE)) {
        return false;  // Deletion refused
    }
}

// From inc/profile.class.php:490-503
public function cleanProfile() {
    if ($this->fields['interface'] == 'helpdesk') {
        // Remove non-helpdesk rights
        // Keep only $helpdesk_rights fields
    }
}