<?php
/*********************************************************************************
 *
 * TimeTrex is a Workforce Management program developed by
 * TimeTrex Software Inc. Copyright (C) 2003 - 2021 TimeTrex Software Inc.
 *
 * This program is free software; you can redistribute it and/or modify it under
 * the terms of the GNU Affero General Public License version 3 as published by
 * the Free Software Foundation with the addition of the following permission
 * added to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED
 * WORK IN WHICH THE COPYRIGHT IS OWNED BY TIMETREX, TIMETREX DISCLAIMS THE
 * WARRANTY OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
 * details.
 *
 *
 * You should have received a copy of the GNU Affero General Public License along
 * with this program; if not, see http://www.gnu.org/licenses or write to the Free
 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301 USA.
 *
 *
 * You can contact TimeTrex headquarters at Unit 22 - 2475 Dobbin Rd. Suite
 * #292 West Kelowna, BC V4T 2E9, Canada or at email address info@timetrex.com.
 *
 *
 * The interactive user interfaces in modified source and object code versions
 * of this program must display Appropriate Legal Notices, as required under
 * Section 5 of the GNU Affero General Public License version 3.
 *
 *
 * In accordance with Section 7(b) of the GNU Affero General Public License
 * version 3, these Appropriate Legal Notices must retain the display of the
 * "Powered by TimeTrex" logo. If the display of the logo is not reasonably
 * feasible for technical reasons, the Appropriate Legal Notices must display
 * the words "Powered by TimeTrex".
 *
 ********************************************************************************/


/**
 * @package Core
 */
class Permission {
	private $cached_permissions = [];
	private $cached_permission_children_ids = [];
	private $cached_permission_levels = [];

	/**
	 * @param string $user_id    UUID
	 * @param string $company_id UUID
	 * @return array
	 */
	function getPermissions( $user_id, $company_id ) {
		//When Permission->Check() is used in a tight loop, even getCache() can be slow as it has to load a large array.
		//So cache the permissions in even faster access memory when possible.
		if ( isset( $this->cached_permissions[$user_id][$company_id] ) && $this->cached_permissions[$user_id][$company_id] != false ) {
			return $this->cached_permissions[$user_id][$company_id];
		}

		$plf = TTnew( 'PermissionListFactory' ); /** @var PermissionListFactory $plf */

		$cache_id = 'permission_all_' . $user_id . '_' . $company_id; //This is also in UserFactory->postSave()
		$perm_arr = $plf->getCache( $cache_id );
		//Debug::Arr($perm_arr, 'Cached Perm Arr:', __FILE__, __LINE__, __METHOD__, 9);
		if ( $perm_arr === false ) {
			$perm_arr = []; //Initialize blank array to prevent: Automatic conversion of false to array

			$plf->getAllPermissionsByCompanyIdAndUserId( $company_id, $user_id );
			if ( $plf->getRecordCount() > 0 ) {
				//Debug::Text('Found Permissions in DB!', __FILE__, __LINE__, __METHOD__, 9);
				$perm_arr['_system']['last_updated_date'] = null;
				foreach ( $plf as $p_obj ) {
					//Debug::Text('Perm -  Section: '. $p_obj->getSection() .' Name: '. $p_obj->getName() .' Value: '. (int)$p_obj->getValue(), __FILE__, __LINE__, __METHOD__, 9);
					if ( $p_obj->getUpdatedDate() > $perm_arr['_system']['last_updated_date'] ) {
						$perm_arr['_system']['last_updated_date'] = $p_obj->getUpdatedDate();
					}
					$perm_arr[$p_obj->getSection()][$p_obj->getName()] = $p_obj->getValue();
				}
				//Last iteration, grab the permission level.
				$perm_arr['_system']['level'] = $p_obj->getColumn( 'level' );

				$plf->saveCache( $perm_arr, $cache_id );
				//Debug::Text('  Caching permissions for: User ID: '. $user_id .' Company ID: '. $company_id .' Total Permissions: '. $plf->getRecordCount(), __FILE__, __LINE__, __METHOD__, 9);
			}
		}

		$this->cached_permissions[$user_id][$company_id] = $perm_arr; //Populate local cache.

		return $perm_arr;
	}

	/**
	 * Check to make sure the authentication type is at least this level.
	 * @param int $type_id
	 * @return bool
	 */
	function checkAuthenticationType( $type_id ) {
		global $authentication;

		if ( is_object( $authentication ) ) {
			if ( $authentication->getType() >= $type_id ) {
				return true;
			} else {
				Debug::Text( 'Authentication Type MisMatch: Session Type: '. $authentication->getType() .' must be equal or greater than: '. $type_id, __FILE__, __LINE__, __METHOD__, 10 );
			}
		} else {
			return true; //No authentication object to check against, return TRUE.
		}

		return false;
	}

	/**
	 * @param $section
	 * @param $name
	 * @param string $user_id    UUID
	 * @param string $company_id UUID
	 * @return bool
	 */
	function Check( $section, $name, $user_id = null, $company_id = null ) {
		//Use Cache_Lite class once we need performance.
		if ( $user_id == null || $user_id == '' ) {
			global $current_user;
			if ( is_object( $current_user ) ) {
				$user_id = $current_user->getId();
			} else {
				return false;
			}
		}

		if ( $company_id == null || $company_id == '' ) {
			global $current_company;
			$company_id = $current_company->getId();
		}

		//Debug::Text('Permission Check - Section: '. $section .' Name: '. $name .' User ID: '. $user_id .' Company ID: '. $company_id, __FILE__, __LINE__, __METHOD__, 9);
		$permission_arr = $this->getPermissions( $user_id, $company_id );

		if ( isset( $permission_arr[$section][$name] ) ) {
			//Debug::Text('Permission is Set!', __FILE__, __LINE__, __METHOD__, 9);
			$result = $permission_arr[$section][$name];
		} else {
			//Debug::Text('Permission is NOT Set!', __FILE__, __LINE__, __METHOD__, 9);
			$result = false;
		}

		return $result;
	}

	/**
	 * @param string $user_id    UUID
	 * @param string $company_id UUID
	 * @return bool|int
	 */
	function getLevel( $user_id = null, $company_id = null ) {
		//Use Cache_Lite class once we need performance.
		if ( $user_id == null || $user_id == '' ) {
			global $current_user;
			if ( is_object( $current_user ) ) {
				$user_id = $current_user->getId();
			} else {
				return false;
			}
		}

		if ( $company_id == null || $company_id == '' ) {
			global $current_company;
			$company_id = $current_company->getId();
		}

		$cache_id = 'permission_level_' . $user_id . '_' . $company_id; //This is cleared in PermissionFactory->clearCache() which is also called from PermissionControlFactory->postSave()

		$plf = TTnew( 'PermissionListFactory' ); /** @var PermissionListFactory $plf */
		$retval = $plf->getCache( $cache_id );
		if ( $retval === false ) {
			//Check if permissions are already cached, if so just grab the level directly from that.
			if ( isset( $this->cached_permissions[$user_id][$company_id] ) && $this->cached_permissions[$user_id][$company_id] != false ) {
				$permission_arr = $this->getPermissions( $user_id, $company_id );
				if ( isset( $permission_arr['_system']['level'] ) ) {
					$retval = (int)$permission_arr['_system']['level'];
				}
			} else {
				//If permissions are not cached, rather than getting all permissions when we just need to the level, just grab the level itself and cache that separately.

				//Because caching is disabled when inside a RetryTransaction() add local memory caching to getting permission levels
				if ( isset( $this->cached_permission_levels[$user_id][$company_id] ) && $this->cached_permission_levels[$user_id][$company_id] != false ) {
					$retval = $this->cached_permission_levels[$user_id][$company_id];
				} else {
					$pcf = new PermissionControlListFactory();
					$pcf->getByCompanyIdAndUserId( $company_id, $user_id );
					if ( $pcf->getRecordCount() == 1 ) {
						$retval = (int)$pcf->getCurrent()->getLevel();
						$this->cached_permission_levels[$user_id][$company_id] = $retval;
					}
				}
			}

			if ( $retval !== false ) {
				$plf->saveCache( $retval, $cache_id ); //Only save cache if there is a permission level to return, so we aren't caching negative values in cases where a new user may be created.
			} else {
				$retval = 1; //Lowest level.
			}
		}

		return $retval;
	}

	/**
	 * @param $result
	 * @return bool
	 */
	function Redirect( $result ) {
		if ( $result !== true ) {
			Redirect::Page( URLBuilder::getURL( null, Environment::getBaseURL() . '/permission/PermissionDenied.php' ) );
		}

		return true;
	}

	/**
	 * @param bool $result
	 * @param string $description
	 * @return bool
	 */
	function AuthenticationTypeDenied( $result = false, $description = null ) {
		return $this->PermissionDenied( false, TTi18n::getText( 'Authentication Method is not secure enough to perform this action.' ) );
	}

	/**
	 * @param bool $result
	 * @param string $description
	 * @return bool
	 */
	function PermissionDenied( $result = false, $description = null ) {
		if ( $description === null ) {
			$description = TTi18n::getText( 'Permission Denied' );
		}

		if ( $result !== true ) {
			Debug::Text( 'Permission Denied! Description: ' . $description, __FILE__, __LINE__, __METHOD__, 10 );
			$af = TTnew( 'APIPermission' ); /** @var APIPermission $af */
			return $af->returnHandler( false, 'PERMISSION', $description );
		}

		return true;
	}


	/**
	 * @param $user_obj UserFactory
	 * @param null $force_mfa_type_id
	 * @param bool $result
	 * @param null $description
	 * @return array|bool
	 */
	function ReauthenticationRequired( $user_obj, $force_mfa_type_id = null, $result = false, $description = null ) {
		global $authentication, $config_vars;

		if ( $description === null ) {
			$description = TTi18n::getText( 'Reauthentication Required' );
		}

		if ( $result !== true ) {
			Debug::Text( 'Reauthentication Required to Continue! Description: ' . $description, __FILE__, __LINE__, __METHOD__, 10 );
			$af = TTnew( 'APIPermission' ); /** @var APIPermission $af */

			//Determine reauthentication type.
			//Force MFA type allows using a different MFA type than the one the user is currently using.
			$mfa_type_id = $force_mfa_type_id ?? $user_obj->getMultiFactorType();

			$session_type = $authentication->getTypeName();

			if ( isset( $config_vars['other']['disable_mfa'] ) && $config_vars['other']['disable_mfa'] == true ) {
				//Forcing $mfa_type_id to 0 so that reauthentication only asks for a password and not further MFA.
				$mfa_type_id = 0;
				$session_type = 'user_name';
				Debug::Text( 'MFA is disabled. User has MFA enabled but the session has been forced to user_name (800) for reauthentication.', __FILE__, __LINE__, __METHOD__, 10 );
			}

			$mfa_data = [
					'status'       => false,
					'session_id'   => $authentication->getSessionId(),
					'session_type' => $session_type,
					'mfa'          => [
							'step'                => 'password', //All current MFA types require a password to be entered first, but other steps in the future may not.
							'type_id'             => $mfa_type_id,
							'user_action_message' => TTi18n::getText( 'Please check your device to verify your identity' ),
					],
			];

			return $af->returnHandler( $mfa_data, 'REAUTHENTICATE', $description );
		}

		return true;
	}

	/**
	 * @param $section
	 * @param $name
	 * @param string $user_id    UUID
	 * @param string $company_id UUID
	 * @return bool
	 */
	function Query( $section, $name, $user_id = null, $company_id = null ) {
		Debug::Text( 'Permission Query!', __FILE__, __LINE__, __METHOD__, 9 );
		if ( $user_id == null || $user_id == '' ) {
			global $current_user;
			if ( is_object( $current_user ) ) {
				$user_id = $current_user->getId();
			} else {
				return false;
			}
		}

		if ( $company_id == null || $company_id == '' ) {
			global $current_company;
			$company_id = $current_company->getId();
		}

		$plf = TTnew( 'PermissionListFactory' ); /** @var PermissionListFactory $plf */

		return $plf->getBySectionAndNameAndUserIdAndCompanyId( $section, $name, $user_id, $company_id )->getCurrent();
	}

	/**
	 * Checks if the row_object_id is created by the current user
	 * @param $object_created_by
	 * @param null $object_assigned_to
	 * @param string $current_user_id UUID
	 * @return bool
	 */
	function isOwner( $object_created_by, $object_assigned_to = null, $current_user_id = null ) {
		if ( $current_user_id == null || $current_user_id == '' ) {
			global $current_user;
			if ( is_object( $current_user ) ) {
				$current_user_id = $current_user->getId();
			} else {
				return false;
			}
		}

		//Allow object_assigned_to to be an array, then make sure *all* records in the array match.
		if ( ( $object_created_by != '' && $object_created_by == $current_user_id )
				|| ( $object_assigned_to != '' && $object_assigned_to == $current_user_id )
				|| ( is_array( $object_assigned_to ) && count( array_unique( $object_assigned_to ) ) == 1 && $object_assigned_to[0] == $current_user_id ) ) {
			return true;
		}

		return false;
	}

	/**
	 * Checks if the row_object_id is in the src_object_list array,
	 * @param string $row_object_id   UUID
	 * @param $src_object_list
	 * @param string $current_user_id UUID
	 * @return bool
	 */
	function isChild( $row_object_id, $src_object_list, $current_user_id = null ) {
		if ( !TTUUID::isUUID( $row_object_id ) && !is_array( $row_object_id ) ) {
			return false;
		}

		if ( $current_user_id == null || $current_user_id == '' ) {
			global $current_user;
			if ( is_object( $current_user ) ) {
				$current_user_id = $current_user->getId();
			} else {
				return false;
			}
		}
		//Can never be a child of themselves, so remove the current user from the child list.
		if ( $row_object_id == $current_user_id ) {
			return false;
		}

		if ( !is_array( $src_object_list ) && $src_object_list != '' ) {
			$src_object_list = [ $src_object_list ];
		}

		//If row_object_id is an array (ie: a subordinate list), then they must *all* match the src_object_list for this to be valid.
		//This is used by recurring_schedule for supervisor (subordinates only)
		if ( is_array( $row_object_id ) && is_array( $src_object_list ) ) {
			foreach ( $row_object_id as $tmp_row_object_id ) {
				if ( !in_array( $tmp_row_object_id, $src_object_list ) ) {
					return false;
				}
			}

			//All items match, return TRUE.
			return true;
		} else if ( is_array( $src_object_list ) && in_array( $row_object_id, $src_object_list ) ) {
			return true;
		}

		return false;
	}

	/**
	 * @param string $id UUID
	 * @param $inner_column
	 * @param bool $append_comma
	 * @param null $special_child_id
	 * @return string
	 */
	static function getPermissionIsChildIsOwnerSQL( $id, $inner_column, $append_comma = true, $special_child_id = null ) {
		$query = "\n";

		//Attendance -> Schedule needs to pass this special_child_id so all records assigned to the OPEN employee are considered "children".
		if ( $special_child_id != '' ) {
			$query .= ' CASE WHEN ( phc.is_child is NOT NULL OR ' . $inner_column . ' = \'' . TTUUID::getZeroID() . '\' ) THEN 1 ELSE 0 END as is_child,';
		} else {
			$query .= ' CASE WHEN phc.is_child is NOT NULL THEN 1 ELSE 0 END as is_child,';
		}

		$query .= ' CASE WHEN ' . $inner_column . ' = \'' . TTUUID::castUUID( $id ) . '\' THEN 1 ELSE 0 END as is_owner';

		if ( $append_comma == true ) {
			$query .= ', ';
		}

		return $query;
	}

	/**
	 * @param string $company_id UUID
	 * @param string $user_id    UUID
	 * @param $outer_column
	 * @return string
	 */
	static function getPermissionHierarchySQL( $company_id, $user_id, $outer_column ) {
		$hlf = new HierarchyLevelFactory();
		$huf = new HierarchyUserFactory();
		$hotf = new HierarchyObjectTypeFactory();
		$hcf = new HierarchyControlFactory();

		$query = '
						LEFT JOIN (
							select phc_huf.user_id as user_id, 1 as is_child
							from ' . $huf->getTable() . ' as phc_huf
							LEFT JOIN ' . $hlf->getTable() . ' as phc_hlf ON phc_huf.hierarchy_control_id = phc_hlf.hierarchy_control_id
							LEFT JOIN ' . $hotf->getTable() . ' as phc_hotf ON phc_huf.hierarchy_control_id = phc_hotf.hierarchy_control_id
							LEFT JOIN ' . $hcf->getTable() . ' as phc_hcf ON phc_huf.hierarchy_control_id = phc_hcf.id
							WHERE
								phc_hlf.user_id = \'' . TTUUID::castUUID( $user_id ) . '\'
								AND phc_hcf.company_id = \'' . TTUUID::castUUID( $company_id ) . '\'
								AND phc_hotf.object_type_id = 100
								AND phc_huf.user_id != phc_hlf.user_id
								AND ( phc_hlf.deleted = 0 AND phc_hcf.deleted = 0 )
						) as phc ON ' . $outer_column . ' = phc.user_id
					';

		return $query;
	}

	/**
	 * @param $filter_data
	 * @param $outer_column_name
	 * @return array|bool|string
	 */
	static function getPermissionIsChildIsOwnerFilterSQL( $filter_data, $outer_column_name ) {
		if ( isset( $filter_data['permission_invalid'] ) ) {
			Debug::Text( '  Potential security bypass, permission invalid...', __FILE__, __LINE__, __METHOD__, 10 );
			$query = ' AND ' . $outer_column_name . ' = \'' . TTUUID::getNotExistID() . '\''; //Bogus permissions, don't return any data.

			return $query;
		} else {
			$query = [];
			if ( isset( $filter_data['permission_is_own'] ) && $filter_data['permission_is_own'] == true && isset( $filter_data['permission_current_user_id'] ) ) {
				$query[] = $outer_column_name . ' = \'' . TTUUID::castUUID( $filter_data['permission_current_user_id'] ) . '\'';
			}
			if ( isset( $filter_data['permission_is_child'] ) && $filter_data['permission_is_child'] == true ) {
				$query[] = 'phc.is_child = 1';
			}

			//Don't add this filter unless we have already added a is_own or is_child filter above because it will restrict to just the permission_is_id rather than it along with other children IDs.
			if ( count( $query ) > 0 && isset( $filter_data['permission_is_id'] ) && TTUUID::isUUID( $filter_data['permission_is_id'] ) ) {
				$query[] = $outer_column_name . ' = \'' . TTUUID::castUUID( $filter_data['permission_is_id'] ) . '\'';
			}

			if ( empty( $query ) == false ) {
				return ' AND ( ' . implode( ' OR ', $query ) . ') ';
			}
		}

		return false;
	}

	/**
	 * @param $section
	 * @param $name
	 * @param string $user_id UUID
	 * @return array|bool
	 */
	function getPermissionFilterData( $section, $name, $user_id = null ) {
		//Use Cache_Lite class once we need performance.
		if ( $user_id == null || $user_id == '' ) {
			global $current_user;
			if ( is_object( $current_user ) ) {
				$user_id = $current_user->getId();
			} else {
				return false;
			}
		}

//		if ( $company_id == NULL OR $company_id == '') {
//			global $current_company;
//			$company_id = $current_company->getId();
//		}

		/*
			permission_children_ids
			permission_current_user_id
			permission_is_child = 1
			permission_is_own = 1
		*/
		$retarr = [];
		$retarr['permission_current_user_id'] = $user_id;
		if ( $this->Check( $section, $name ) == false ) {
			if ( $this->Check( $section, $name . '_child' ) ) {
				$retarr['permission_is_child'] = true;
			}
			if ( $this->Check( $section, $name . '_own' ) ) {
				$retarr['permission_is_own'] = true; //Return user_id so we can match that specifically
			}

			//#2242 - If a invalid/bogus $section is passed in from the user, be sure to default to no permissions.
			// With permission checks we shouldnt ever get here unless at least one of the three
			// permissions ( view, view_own, view_child ) are TRUE otherwise treat it as bogus/invalid and don't return anything.
			if ( !isset( $retarr['permission_is_child'] ) && !isset( $retarr['permission_is_own'] ) ) {
				Debug::Text( 'ERROR: Potential security bypass, permission section/name is invalid: Section: ' . $section . ' Name: ' . $name . ' User ID: ' . $user_id, __FILE__, __LINE__, __METHOD__, 10 );
				$retarr = [ 'permission_invalid' => true ];
			}
		}

		if ( empty( $retarr ) == false ) {
			return $retarr;
		}

		return [];
	}

	/**
	 * @param string $company_id UUID
	 * @param string $user_id    UUID
	 * @return mixed
	 */
	function getPermissionHierarchyChildren( $company_id, $user_id ) {
		if ( isset( $this->cached_permission_children_ids[$company_id][$user_id] ) ) {
			return $this->cached_permission_children_ids[$company_id][$user_id];
		} else {
			Debug::Text( '  Getting hierarchy children for User ID: ' . $user_id, __FILE__, __LINE__, __METHOD__, 10 );
			$hlf = TTnew( 'HierarchyListFactory' ); /** @var HierarchyListFactory $hlf */
			$this->cached_permission_children_ids[$company_id][$user_id] = $hlf->getHierarchyChildrenByCompanyIdAndUserIdAndObjectTypeID( $company_id, $user_id, 100 );

			//Debug::Arr($this->cached_permission_children_ids[$company_id][$user_id], 'Permission Child IDs: ', __FILE__, __LINE__, __METHOD__, 10);

			return $this->cached_permission_children_ids[$company_id][$user_id];
		}
	}

	/**
	 * @param $section
	 * @param $name
	 * @param string $user_id    UUID
	 * @param string $company_id UUID
	 * @return array|bool|mixed|null
	 */
	function getPermissionChildren( $section, $name, $user_id = null, $company_id = null ) {
		//Use Cache_Lite class once we need performance.
		if ( $user_id == null || $user_id == '' ) {
			global $current_user;
			if ( is_object( $current_user ) ) {
				$user_id = $current_user->getId();
			} else {
				return false;
			}
		}

		if ( $company_id == null || $company_id == '' ) {
			global $current_company;
			$company_id = $current_company->getId();
		}

		//If 'view' is FALSE, we are not returning children to check for edit/delete permissions, so those are denied.
		//This can be tested with 'users', 'view', 'users', 'edit_subordinate' allowed. They won't be able to edit subordinates.
		if ( $this->Check( $section, $name, $user_id, $company_id ) == false ) {
			if ( $this->Check( $section, $name . '_child', $user_id, $company_id ) == true ) {
				$retarr = $this->getPermissionHierarchyChildren( $company_id, $user_id );
			}
			//Why are we including the current user in the "child" list, if they can view their own records.
			//This essentially makes edit_child permissions include edit_own as well. Which for the editing punches
			//there may be cases where they can edit subordinates but not themselves.
			//Because in the SQL query, we restrict to just the child_ids.
			//Its different view view_own/view_child as compared to edit_own/edit_child.
			//	So we need to include the current user if they can only view their own, but exclude the current user when doing is_child checks above.
			//Another way we could handle this is to return an array of children and owner separately, then in SQL queries combine them together.
			if ( $this->Check( $section, $name . '_own', $user_id, $company_id ) == true ) {
				$retarr[] = TTUUID::castUUID( $user_id );
			}

			//If they don't have permissions to view anything, make sure we return a blank array, so all in_array() or isPermissionChild() returns FALSE.
			if ( !isset( $retarr ) ) {
				$retarr = [];
			}
		} else {
			//This must return TRUE, otherwise the SQL query will restrict returned records just to the children.
			//Used to be NULL, but isset() doesn't work on NULL. Using TRUE though caused is_array() to always return TRUE too, which may not be a bad thing.
			//   However using TRUE causing other PHP warnings when trying to add values to it as if it were an array.
			$retarr = null;
		}

		return $retarr;
	}

	/**
	 * @param string $user_id                 UUID
	 * @param string|string[] $permission_children_ids UUID
	 * @return bool
	 */
	function isPermissionChild( $user_id, $permission_children_ids ) {
		if ( $permission_children_ids === null || in_array( TTUUID::castUUID( $user_id ), (array)$permission_children_ids, true ) ) { //Make sure we do a STRICT in_array() match, so $user_id=TRUE isn't matched.
			return true;
		}

		return false;
	}

	/**
	 * @param string $user_id    UUID
	 * @param string $company_id UUID
	 * @return bool
	 */
	function getLastUpdatedDate( $user_id = null, $company_id = null ) {
		//Use Cache_Lite class once we need performance.
		if ( $user_id == null || $user_id == '' ) {
			global $current_user;
			if ( isset( $current_user ) ) {
				$user_id = $current_user->getId();
			} else {
				return false;
			}
		}

		if ( $company_id == null || $company_id == '' ) {
			global $current_company;
			$company_id = $current_company->getId();
		}

		//Debug::Text('Permission Check - Section: '. $section .' Name: '. $name .' User ID: '. $user_id .' Company ID: '. $company_id, __FILE__, __LINE__, __METHOD__, 9);
		$permission_arr = $this->getPermissions( $user_id, $company_id );

		if ( isset( $permission_arr['_system']['last_updated_date'] ) ) {
			return $permission_arr['_system']['last_updated_date'];
		}

		return false;
	}
}

?>