2 files changed, 26 insertions, 0 deletions

diff --git a/Digitigrade/GlobalSettings.php b/Digitigrade/GlobalSettings.php
index 435c85a..52c6582 100644
--- a/Digitigrade/GlobalSettings.php
+++ b/Digitigrade/GlobalSettings.php
@@ -26,6 +26,19 @@ class GlobalSettings extends Singleton {
     }
 
     /**
+     * Gets a boolean setting's value.
+     * @param string $key which setting to get
+     * @return ?bool the value, or null if not set
+     */
+    public function getBool(string $key): ?bool {
+        return match ($this->get($key)) {
+            '', 'false' => false,
+            '1', 'true' => true,
+            default => null
+        };
+    }
+
+    /**
      * Sets the value of a setting.
      * @param string $key which setting to modify
      * @param string $value the new value
diff --git a/Digitigrade/Model/UserAccount.php b/Digitigrade/Model/UserAccount.php
index d0fa94b..37e0c7e 100644
--- a/Digitigrade/Model/UserAccount.php
+++ b/Digitigrade/Model/UserAccount.php
@@ -1,6 +1,7 @@
 <?php
 namespace Digitigrade\Model;
 
+use Digitigrade\HttpResponseStatus\Forbidden;
 use Digitigrade\HttpResponseStatus\Unauthorized;
 use Digitigrade\Model;
 
@@ -10,6 +11,7 @@ class UserAccount extends Model {
     public string $passwordHash;
     public ?Actor $actor;
     public bool $banned = false;
+    public bool $isAdmin = false;
 
     public static function create(string $email, #[\SensitiveParameter] string $password): self {
         $user = new self();
@@ -66,4 +68,15 @@ class UserAccount extends Model {
     public function verifyPassword(#[\SensitiveParameter] $attemptedPassword): bool {
         return password_verify($attemptedPassword, $this->passwordHash);
     }
+
+    /**
+     * Throws if this user isn't an admin.
+     * @return self this user (so you can use it in chains)
+     */
+    public function requireAdmin(): self {
+        if (!$this->isAdmin) {
+            throw new Forbidden();
+        }
+        return $this;
+    }
 }
\ No newline at end of file