scope aware workflow controller and manager

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

6 files changed, 511 insertions, 154 deletions

diff --git a/apps/workflowengine/lib/Command/Index.php b/apps/workflowengine/lib/Command/Index.php
index 8098bc5d5ea..7f3af3c0811 100644
--- a/apps/workflowengine/lib/Command/Index.php
+++ b/apps/workflowengine/lib/Command/Index.php
@@ -24,6 +24,7 @@ declare(strict_types=1);
 
 namespace OCA\WorkflowEngine\Command;
 
+use OCA\WorkflowEngine\Helper\ScopeContext;
 use OCA\WorkflowEngine\Manager;
 use OCP\WorkflowEngine\IManager;
 use Symfony\Component\Console\Command\Command;
@@ -69,8 +70,10 @@ class Index extends Command {
 
 	protected function execute(InputInterface $input, OutputInterface $output) {
 		$ops = $this->manager->getAllOperations(
-			$this->mappedScope($input->getArgument('scope')),
-			$input->getArgument('scopeId')
+			new ScopeContext(
+				$this->mappedScope($input->getArgument('scope')),
+				$input->getArgument('scopeId')
+			)
 		);
 		$output->writeln(\json_encode($ops));
 	}
diff --git a/apps/workflowengine/lib/Controller/AWorkflowController.php b/apps/workflowengine/lib/Controller/AWorkflowController.php
new file mode 100644
index 00000000000..2e54e417a34
--- /dev/null
+++ b/apps/workflowengine/lib/Controller/AWorkflowController.php
@@ -0,0 +1,148 @@
+<?php
+declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2019 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\WorkflowEngine\Controller;
+
+use Doctrine\DBAL\DBALException;
+use OCA\WorkflowEngine\Helper\ScopeContext;
+use OCA\WorkflowEngine\Manager;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\AppFramework\OCS\OCSBadRequestException;
+use OCP\AppFramework\OCS\OCSException;
+use OCP\AppFramework\OCS\OCSForbiddenException;
+use OCP\AppFramework\OCSController;
+use OCP\IRequest;
+
+abstract class AWorkflowController extends OCSController {
+
+	/** @var Manager */
+	protected $manager;
+
+	public function __construct(
+		$appName,
+		IRequest $request,
+		Manager $manager
+	) {
+		parent::__construct($appName, $request);
+
+		$this->manager = $manager;
+	}
+
+	/**
+	 * @throws OCSForbiddenException
+	 */
+	abstract protected function getScopeContext(): ScopeContext;
+
+	/**
+	 * Example: curl -u joann -H "OCS-APIREQUEST: true" "http://my.nc.srvr/ocs/v2.php/apps/workflowengine/api/v1/workflows/global?format=json"
+	 *
+	 * @throws OCSForbiddenException
+	 */
+	public function index(): DataResponse {
+		$operationsByClass = $this->manager->getAllOperations($this->getScopeContext());
+
+		foreach ($operationsByClass as &$operations) {
+			foreach ($operations as &$operation) {
+				$operation = $this->manager->formatOperation($operation);
+			}
+		}
+
+		return new DataResponse($operationsByClass);
+	}
+
+	/**
+	 * Example: curl -u joann -H "OCS-APIREQUEST: true" "http://my.nc.srvr/ocs/v2.php/apps/workflowengine/api/v1/workflows/global/OCA\\Workflow_DocToPdf\\Operation?format=json"
+	 *
+	 * @throws OCSForbiddenException
+	 */
+	public function show(string $id): DataResponse {
+		$context = $this->getScopeContext();
+
+		// The ID corresponds to a class name
+		$operations = $this->manager->getOperations($id, $context);
+
+		foreach ($operations as &$operation) {
+			$operation = $this->manager->formatOperation($operation);
+		}
+
+		return new DataResponse($operations);
+	}
+
+	/**
+	 * @throws OCSBadRequestException
+	 * @throws OCSForbiddenException
+	 * @throws OCSException
+	 */
+	public function create(string $class, string $name, array $checks, string $operation): DataResponse {
+		$context = $this->getScopeContext();
+		try {
+			$operation = $this->manager->addOperation($class, $name, $checks, $operation, $context);
+			$operation = $this->manager->formatOperation($operation);
+			return new DataResponse($operation);
+		} catch (\UnexpectedValueException $e) {
+			throw new OCSBadRequestException($e->getMessage(), $e);
+		} catch (\DomainException $e) {
+			throw new OCSForbiddenException($e->getMessage(), $e);
+		} catch(DBALException $e) {
+			throw new OCSException('An internal error occurred', $e);
+		}
+	}
+
+	/**
+	 * @throws OCSBadRequestException
+	 * @throws OCSForbiddenException
+	 * @throws OCSException
+	 */
+	public function update(int $id, string $name, array $checks, string $operation): DataResponse {
+		try {
+			$operation = $this->manager->updateOperation($id, $name, $checks, $operation, $this->getScopeContext());
+			$operation = $this->manager->formatOperation($operation);
+			return new DataResponse($operation);
+		} catch (\UnexpectedValueException $e) {
+			throw new OCSBadRequestException($e->getMessage(), $e);
+		} catch (\DomainException $e) {
+			throw new OCSForbiddenException($e->getMessage(), $e);
+		} catch(DBALException $e) {
+			throw new OCSException('An internal error occurred', $e);
+		}
+	}
+
+	/**
+	 * @throws OCSBadRequestException
+	 * @throws OCSForbiddenException
+	 * @throws OCSException
+	 */
+	public function destroy(int $id): DataResponse {
+		try {
+			$deleted = $this->manager->deleteOperation($id, $this->getScopeContext());
+			return new DataResponse($deleted);
+		} catch (\UnexpectedValueException $e) {
+			throw new OCSBadRequestException($e->getMessage(), $e);
+		} catch (\DomainException $e) {
+			throw new OCSForbiddenException($e->getMessage(), $e);
+		} catch(DBALException $e) {
+			throw new OCSException('An internal error occurred', $e);
+		}
+	}
+}
diff --git a/apps/workflowengine/lib/Controller/GlobalWorkflowsController.php b/apps/workflowengine/lib/Controller/GlobalWorkflowsController.php
index e4321b9c0b6..6d49c87b83e 100644
--- a/apps/workflowengine/lib/Controller/GlobalWorkflowsController.php
+++ b/apps/workflowengine/lib/Controller/GlobalWorkflowsController.php
@@ -24,88 +24,18 @@ declare(strict_types=1);
 
 namespace OCA\WorkflowEngine\Controller;
 
-use OCA\WorkflowEngine\Manager;
-use OCP\AppFramework\Http\DataResponse;
-use OCP\AppFramework\OCS\OCSBadRequestException;
-use OCP\AppFramework\OCSController;
-use OCP\IRequest;
+use OCA\WorkflowEngine\Helper\ScopeContext;
+use OCP\WorkflowEngine\IManager;
 
-class GlobalWorkflowsController extends OCSController {
+class GlobalWorkflowsController extends AWorkflowController {
 
-	/** @var Manager */
-	private $manager;
+	/** @var ScopeContext */
+	private $scopeContext;
 
-	public function __construct(
-		$appName,
-		IRequest $request,
-		Manager $manager
-	) {
-		parent::__construct($appName, $request);
-
-		$this->manager = $manager;
-	}
-
-	/**
-	 * Example: curl -u joann -H "OCS-APIREQUEST: true" "http://my.nc.srvr/ocs/v2.php/apps/workflowengine/api/v1/workflows/global?format=json"
-	 */
-	public function index(): DataResponse {
-		$operationsByClass = $this->manager->getAllOperations();
-
-		foreach ($operationsByClass as &$operations) {
-			foreach ($operations as &$operation) {
-				$operation = $this->manager->formatOperation($operation);
-			}
-		}
-
-		return new DataResponse($operationsByClass);
-	}
-
-	/**
-	 * @throws OCSBadRequestException
-	 *
-	 * Example: curl -u joann -H "OCS-APIREQUEST: true" "http://my.nc.srvr/ocs/v2.php/apps/workflowengine/api/v1/workflows/global/OCA\\Workflow_DocToPdf\\Operation?format=json"
-	 */
-	public function show(string $id): DataResponse {
-		// The ID corresponds to a class name
-		$operations = $this->manager->getOperations($id);
-
-		foreach ($operations as &$operation) {
-			$operation = $this->manager->formatOperation($operation);
+	protected function getScopeContext(): ScopeContext {
+		if($this->scopeContext === null) {
+			$this->scopeContext = new ScopeContext(IManager::SCOPE_ADMIN);
 		}
-
-		return new DataResponse($operations);
-	}
-
-	/**
-	 * @throws OCSBadRequestException
-	 */
-	public function create(string $class, string $name, array $checks, string $operation): DataResponse {
-		try {
-			$operation = $this->manager->addOperation($class, $name, $checks, $operation);
-			$operation = $this->manager->formatOperation($operation);
-			return new DataResponse($operation);
-		} catch (\UnexpectedValueException $e) {
-			throw new OCSBadRequestException($e->getMessage(), $e);
-		}
-	}
-
-	/**
-	 * @throws OCSBadRequestException
-	 */
-	public function update(int $id, string $name, array $checks, string $operation): DataResponse {
-		try {
-			$operation = $this->manager->updateOperation($id, $name, $checks, $operation);
-			$operation = $this->manager->formatOperation($operation);
-			return new DataResponse($operation);
-		} catch (\UnexpectedValueException $e) {
-			throw new OCSBadRequestException($e->getMessage(), $e);
-		}
-	}
-
-	/**
-	 */
-	public function destroy(int $id): DataResponse {
-		$deleted = $this->manager->deleteOperation((int) $id);
-		return new DataResponse($deleted);
+		return $this->scopeContext;
 	}
 }
diff --git a/apps/workflowengine/lib/Controller/UserWorkflowsController.php b/apps/workflowengine/lib/Controller/UserWorkflowsController.php
new file mode 100644
index 00000000000..179e6b1ad11
--- /dev/null
+++ b/apps/workflowengine/lib/Controller/UserWorkflowsController.php
@@ -0,0 +1,117 @@
+<?php
+declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2019 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\WorkflowEngine\Controller;
+
+use OCA\WorkflowEngine\Helper\ScopeContext;
+use OCA\WorkflowEngine\Manager;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\AppFramework\OCS\OCSBadRequestException;
+use OCP\AppFramework\OCS\OCSForbiddenException;
+use OCP\IRequest;
+use OCP\IUserSession;
+use OCP\WorkflowEngine\IManager;
+
+class UserWorkflowsController extends AWorkflowController {
+
+	/** @var IUserSession */
+	private $session;
+
+	/** @var ScopeContext */
+	private $scopeContext;
+
+	public function __construct(
+		$appName,
+		IRequest $request,
+		Manager $manager,
+		IUserSession $session
+	) {
+		parent::__construct($appName, $request, $manager);
+
+		$this->session = $session;
+	}
+
+	/**
+	 * Retrieve all configured workflow rules
+	 *
+	 * Example: curl -u joann -H "OCS-APIREQUEST: true" "http://my.nc.srvr/ocs/v2.php/apps/workflowengine/api/v1/workflows/user?format=json"
+	 *
+	 * @NoAdminRequired
+	 * @throws OCSForbiddenException
+	 */
+	public function index(): DataResponse {
+		return parent::index();
+	}
+
+	/**
+	 * @NoAdminRequired
+	 *
+	 * Example: curl -u joann -H "OCS-APIREQUEST: true" "http://my.nc.srvr/ocs/v2.php/apps/workflowengine/api/v1/workflows/user/OCA\\Workflow_DocToPdf\\Operation?format=json"
+	 * @throws OCSForbiddenException
+	 */
+	public function show(string $id): DataResponse {
+		return parent::show($id);
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @throws OCSBadRequestException
+	 * @throws OCSForbiddenException
+	 */
+	public function create(string $class, string $name, array $checks, string $operation): DataResponse {
+		return parent::create($class, $name, $checks, $operation);
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @throws OCSBadRequestException
+	 * @throws OCSForbiddenException
+	 */
+	public function update(int $id, string $name, array $checks, string $operation): DataResponse {
+		return parent::update($id, $name, $checks, $operation);
+	}
+
+	/**
+	 * @NoAdminRequired
+	 * @throws OCSForbiddenException
+	 */
+	public function destroy(int $id): DataResponse {
+		return parent::destroy($id);
+	}
+
+	/**
+	 * @throws OCSForbiddenException
+	 */
+	protected function getScopeContext(): ScopeContext {
+		if($this->scopeContext === null) {
+			$user = $this->session->getUser();
+			if(!$user) {
+				throw new OCSForbiddenException('User not logged in');
+			}
+			$this->scopeContext = new ScopeContext(IManager::SCOPE_USER, $user->getUID());
+		}
+		return $this->scopeContext;
+	}
+
+}
diff --git a/apps/workflowengine/lib/Helper/ScopeContext.php b/apps/workflowengine/lib/Helper/ScopeContext.php
new file mode 100644
index 00000000000..fecc4db0ed7
--- /dev/null
+++ b/apps/workflowengine/lib/Helper/ScopeContext.php
@@ -0,0 +1,78 @@
+<?php
+declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2019 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\WorkflowEngine\Helper;
+
+use OCP\WorkflowEngine\IManager;
+
+class ScopeContext {
+	/** @var int */
+	private $scope;
+	/** @var string */
+	private $scopeId;
+	/** @var string */
+	private $hash;
+
+	public function __construct(int $scope, string $scopeId = null) {
+		$this->scope = $this->evaluateScope($scope);
+		$this->scopeId = $this->evaluateScopeId($scopeId);
+	}
+
+	private function evaluateScope(int $scope): int {
+		if(in_array($scope, [IManager::SCOPE_ADMIN, IManager::SCOPE_USER], true)) {
+			return $scope;
+		}
+		throw new \InvalidArgumentException('Invalid scope');
+	}
+
+	private function evaluateScopeId(string $scopeId = null): string {
+		if($this->scope === IManager::SCOPE_USER
+			&& trim((string)$scopeId) === '')
+		{
+			throw new \InvalidArgumentException('user scope requires a user id');
+		}
+		return trim((string)$scopeId);
+	}
+
+	/**
+	 * @return int
+	 */
+	public function getScope(): int {
+		return $this->scope;
+	}
+
+	/**
+	 * @return string
+	 */
+	public function getScopeId(): string {
+		return $this->scopeId;
+	}
+
+	public function getHash(): string {
+		if($this->hash === null) {
+			$this->hash = \hash('sha256', $this->getScope() . '::' . $this->getScopeId());
+		}
+		return $this->hash;
+	}
+}
diff --git a/apps/workflowengine/lib/Manager.php b/apps/workflowengine/lib/Manager.php
index 3bfedfbfbf4..ecf3f24bda1 100644
--- a/apps/workflowengine/lib/Manager.php
+++ b/apps/workflowengine/lib/Manager.php
@@ -23,7 +23,10 @@ namespace OCA\WorkflowEngine;
 
 
 use OC\Files\Storage\Wrapper\Jail;
+use Doctrine\DBAL\DBALException;
+use OC\Cache\CappedMemoryCache;
 use OCA\WorkflowEngine\Entity\File;
+use OCA\WorkflowEngine\Helper\ScopeContext;
 use OCP\AppFramework\QueryException;
 use OCP\DB\QueryBuilder\IQueryBuilder;
 use OCP\Files\Storage\IStorage;
@@ -74,6 +77,10 @@ class Manager implements IManager, IEntityAware {
 
 	/** @var ILogger */
 	protected $logger;
+
+	/** @var CappedMemoryCache */
+	protected $operationsByScope = [];
+
 	/** @var IUserSession */
 	protected $session;
 
@@ -95,6 +102,7 @@ class Manager implements IManager, IEntityAware {
 		$this->l = $l;
 		$this->eventDispatcher = $eventDispatcher;
 		$this->logger = $logger;
+		$this->operationsByScope = new CappedMemoryCache(64);
 		$this->session = $session;
 	}
 
@@ -114,7 +122,16 @@ class Manager implements IManager, IEntityAware {
 	 * @inheritdoc
 	 */
 	public function getMatchingOperations($class, $returnFirstMatchingOperationOnly = true) {
-		$operations = $this->getOperations($class);
+		$scopes[] = new ScopeContext(IManager::SCOPE_ADMIN);
+		$user = $this->session->getUser();
+		if($user !== null) {
+			$scopes[] = new ScopeContext(IManager::SCOPE_USER, $user->getUID());
+		}
+
+		$operations = [];
+		foreach ($scopes as $scope) {
+			$operations = array_merge($operations, $this->getOperations($class, $scope));
+		}
 
 		$matches = [];
 		foreach ($operations as $operation) {
@@ -160,19 +177,10 @@ class Manager implements IManager, IEntityAware {
 			throw new \UnexpectedValueException($this->l->t('Check %s is invalid or does not exist', $check['class']));
 		}
 	}
-	public function getAllOperations(int $scope = IManager::SCOPE_ADMIN, string $scopeId = null): array {
-		if(!in_array($scope, [IManager::SCOPE_ADMIN, IManager::SCOPE_USER])) {
-			throw new \InvalidArgumentException('Provided value for scope is not supported');
+	public function getAllOperations(ScopeContext $scopeContext): array {
+		if(isset($this->operations[$scopeContext->getHash()])) {
+			return $this->operations[$scopeContext->getHash()];
 		}
-		if($scope === IManager::SCOPE_USER && $scopeId === null) {
-			$user = $this->session->getUser();
-			if($user === null) {
-				throw new \InvalidArgumentException('No user ID was provided');
-			}
-			$scopeId = $user->getUID();
-		}
-
-		$this->operations = [];
 
 		$query = $this->connection->getQueryBuilder();
 
@@ -181,48 +189,29 @@ class Manager implements IManager, IEntityAware {
 			->leftJoin('o', 'flow_operations_scope', 's', $query->expr()->eq('o.id', 's.operation_id'))
 			->where($query->expr()->eq('s.type', $query->createParameter('scope')));
 
-		if($scope === IManager::SCOPE_USER) {
+		if($scopeContext->getScope() === IManager::SCOPE_USER) {
 			$query->andWhere($query->expr()->eq('s.value', $query->createParameter('scopeId')));
 		}
 
-		$query->setParameters(['scope' => $scope, 'scopeId' => $scopeId]);
-
+		$query->setParameters(['scope' => $scopeContext->getScope(), 'scopeId' => $scopeContext->getScopeId()]);
 		$result = $query->execute();
 
+		$this->operations[$scopeContext->getHash()] = [];
 		while ($row = $result->fetch()) {
-			if(!isset($this->operations[$row['class']])) {
-				$this->operations[$row['class']] = [];
+			if(!isset($this->operations[$scopeContext->getHash()][$row['class']])) {
+				$this->operations[$scopeContext->getHash()][$row['class']] = [];
 			}
-			$this->operations[$row['class']][] = $row;
+			$this->operations[$scopeContext->getHash()][$row['class']][] = $row;
 		}
 
-		return $this->operations;
+		return $this->operations[$scopeContext->getHash()];
 	}
 
-
-	/**
-	 * @param string $class
-	 * @return array[]
-	 */
-	public function getOperations($class) {
-		if (isset($this->operations[$class])) {
-			return $this->operations[$class];
-		}
-
-		$query = $this->connection->getQueryBuilder();
-
-		$query->select('*')
-			->from('flow_operations')
-			->where($query->expr()->eq('class', $query->createNamedParameter($class)));
-		$result = $query->execute();
-
-		$this->operations[$class] = [];
-		while ($row = $result->fetch()) {
-			$this->operations[$class][] = $row;
+	public function getOperations(string $class, ScopeContext $scopeContext): array {
+		if (!isset($this->operations[$scopeContext->getHash()])) {
+			$this->getAllOperations($scopeContext);
 		}
-		$result->closeCursor();
-
-		return $this->operations[$class];
+		return $this->operations[$scopeContext->getHash()][$class] ?? [];
 	}
 
 	/**
@@ -246,6 +235,20 @@ class Manager implements IManager, IEntityAware {
 		throw new \UnexpectedValueException($this->l->t('Operation #%s does not exist', [$id]));
 	}
 
+	protected function insertOperation(string $class, string $name, array $checkIds, string $operation): int {
+		$query = $this->connection->getQueryBuilder();
+		$query->insert('flow_operations')
+			->values([
+				'class' => $query->createNamedParameter($class),
+				'name' => $query->createNamedParameter($name),
+				'checks' => $query->createNamedParameter(json_encode(array_unique($checkIds))),
+				'operation' => $query->createNamedParameter($operation),
+			]);
+		$query->execute();
+
+		return $query->getLastInsertId();
+	}
+
 	/**
 	 * @param string $class
 	 * @param string $name
@@ -253,29 +256,58 @@ class Manager implements IManager, IEntityAware {
 	 * @param string $operation
 	 * @return array The added operation
 	 * @throws \UnexpectedValueException
+	 * @throws DBALException
 	 */
-	public function addOperation($class, $name, array $checks, $operation) {
+	public function addOperation($class, $name, array $checks, $operation, ScopeContext $scope) {
 		$this->validateOperation($class, $name, $checks, $operation);
 
-		$checkIds = [];
-		foreach ($checks as $check) {
-			$checkIds[] = $this->addCheck($check['class'], $check['operator'], $check['value']);
-		}
+		$this->connection->beginTransaction();
 
-		$query = $this->connection->getQueryBuilder();
-		$query->insert('flow_operations')
-			->values([
-				'class' => $query->createNamedParameter($class),
-				'name' => $query->createNamedParameter($name),
-				'checks' => $query->createNamedParameter(json_encode(array_unique($checkIds))),
-				'operation' => $query->createNamedParameter($operation),
-			]);
-		$query->execute();
+		try {
+			$checkIds = [];
+			foreach ($checks as $check) {
+				$checkIds[] = $this->addCheck($check['class'], $check['operator'], $check['value']);
+			}
+
+			$id = $this->insertOperation($class, $name, $checkIds, $operation);
+			$this->addScope($id, $scope);
+
+			$this->connection->commit();
+		} catch (DBALException $e) {
+			$this->connection->rollBack();
+			throw $e;
+		}
 
-		$id = $query->getLastInsertId();
 		return $this->getOperation($id);
 	}
 
+	protected function canModify(int $id, ScopeContext $scopeContext):bool {
+		if(isset($this->operationsByScope[$scopeContext->getHash()])) {
+			return in_array($id, $this->operationsByScope[$scopeContext->getHash()], true);
+		}
+
+		$qb = $this->connection->getQueryBuilder();
+		$qb = $qb->select('o.id')
+			->from('flow_operations', 'o')
+			->leftJoin('o', 'flow_operations_scope', 's', $qb->expr()->eq('o.id', 's.operation_id'))
+			->where($qb->expr()->eq('s.type', $qb->createParameter('scope')));
+
+		if($scopeContext->getScope() !== IManager::SCOPE_ADMIN) {
+			$qb->where($qb->expr()->eq('s.value', $qb->createParameter('scopeId')));
+		}
+
+		$qb->setParameters(['scope' => $scopeContext->getScope(), 'scopeId' => $scopeContext->getScopeId()]);
+		$result = $qb->execute();
+
+		$this->operationsByScope[$scopeContext->getHash()] = [];
+		while($opId = $result->fetchColumn(0)) {
+			$this->operationsByScope[$scopeContext->getHash()][] = (int)$opId;
+		}
+		$result->closeCursor();
+
+		return in_array($id, $this->operationsByScope[$scopeContext->getHash()], true);
+	}
+
 	/**
 	 * @param int $id
 	 * @param string $name
@@ -283,23 +315,36 @@ class Manager implements IManager, IEntityAware {
 	 * @param string $operation
 	 * @return array The updated operation
 	 * @throws \UnexpectedValueException
+	 * @throws \DomainException
+	 * @throws DBALException
 	 */
-	public function updateOperation($id, $name, array $checks, $operation) {
+	public function updateOperation($id, $name, array $checks, $operation, ScopeContext $scopeContext): array {
+		if(!$this->canModify($id, $scopeContext)) {
+			throw new \DomainException('Target operation not within scope');
+		};
 		$row = $this->getOperation($id);
 		$this->validateOperation($row['class'], $name, $checks, $operation);
 
 		$checkIds = [];
-		foreach ($checks as $check) {
-			$checkIds[] = $this->addCheck($check['class'], $check['operator'], $check['value']);
-		}
+		try {
+			$this->connection->beginTransaction();
+			foreach ($checks as $check) {
+				$checkIds[] = $this->addCheck($check['class'], $check['operator'], $check['value']);
+			}
 
-		$query = $this->connection->getQueryBuilder();
-		$query->update('flow_operations')
-			->set('name', $query->createNamedParameter($name))
-			->set('checks', $query->createNamedParameter(json_encode(array_unique($checkIds))))
-			->set('operation', $query->createNamedParameter($operation))
-			->where($query->expr()->eq('id', $query->createNamedParameter($id)));
-		$query->execute();
+			$query = $this->connection->getQueryBuilder();
+			$query->update('flow_operations')
+				->set('name', $query->createNamedParameter($name))
+				->set('checks', $query->createNamedParameter(json_encode(array_unique($checkIds))))
+				->set('operation', $query->createNamedParameter($operation))
+				->where($query->expr()->eq('id', $query->createNamedParameter($id)));
+			$query->execute();
+			$this->connection->commit();
+		} catch (DBALException $e) {
+			$this->connection->rollBack();
+			throw $e;
+		}
+		unset($this->operations[$scopeContext->getHash()]);
 
 		return $this->getOperation($id);
 	}
@@ -308,12 +353,36 @@ class Manager implements IManager, IEntityAware {
 	 * @param int $id
 	 * @return bool
 	 * @throws \UnexpectedValueException
+	 * @throws DBALException
+	 * @throws \DomainException
 	 */
-	public function deleteOperation($id) {
+	public function deleteOperation($id, ScopeContext $scopeContext) {
+		if(!$this->canModify($id, $scopeContext)) {
+			throw new \DomainException('Target operation not within scope');
+		};
 		$query = $this->connection->getQueryBuilder();
-		$query->delete('flow_operations')
-			->where($query->expr()->eq('id', $query->createNamedParameter($id)));
-		return (bool) $query->execute();
+		try {
+			$this->connection->beginTransaction();
+			$result = (bool)$query->delete('flow_operations')
+				->where($query->expr()->eq('id', $query->createNamedParameter($id)))
+				->execute();
+			if($result) {
+				$qb = $this->connection->getQueryBuilder();
+				$result &= (bool)$qb->delete('flow_operations_scope')
+					->where($qb->expr()->eq('operation_id', $query->createNamedParameter($id)))
+					->execute();
+			}
+			$this->connection->commit();
+		} catch (DBALException $e) {
+			$this->connection->rollBack();
+			throw $e;
+		}
+
+		if(isset($this->operations[$scopeContext->getHash()])) {
+			unset($this->operations[$scopeContext->getHash()]);
+		}
+
+		return $result;
 	}
 
 	/**
@@ -427,6 +496,18 @@ class Manager implements IManager, IEntityAware {
 		return $query->getLastInsertId();
 	}
 
+	protected function addScope(int $operationId, ScopeContext $scope): void {
+		$query = $this->connection->getQueryBuilder();
+
+		$insertQuery = $query->insert('flow_operations_scope');
+		$insertQuery->values([
+			'operation_id' => $query->createNamedParameter($operationId),
+			'type' => $query->createNamedParameter($scope->getScope()),
+			'value' => $query->createNamedParameter($scope->getScopeId()),
+		]);
+		$insertQuery->execute();
+	}
+
 	public function formatOperation(array $operation): array {
 		$checkIds = json_decode($operation['checks'], true);
 		$checks = $this->getChecks($checkIds);