Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/AccessApiVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\APIRest\AccessAPI;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Services\Config\ModuleTools;
class AccessApiVoter extends Voter
{
//--------------------------------------------------------------------------------
// is_granted constants
const IS_ACTIVE = "mobile_api_is_active";
const ACTIVATE_DEACTIVATE = "activate_deactivate_mobile_api_user";
const ACTIVATE_DEACTIVATE_FOR_ACCESS = "activate_deactivate_mobile_api_user_for_access";
const LISTING = "list_api_accesses";
const LISTING_SOCIETY = "list_api_accesses_society";
const LISTING_ANY = "list_api_accesses_any";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::ACTIVATE_DEACTIVATE,
self::ACTIVATE_DEACTIVATE_FOR_ACCESS,
self::LISTING,
self::LISTING_SOCIETY,
self::LISTING_ANY,
);
//--------------------------------------------------------------------------------
// acl constants
const ACL_PERM_ACTIVATE_DEACTIVATE = 'mobile_api_activate_deactivate_user';
const ACL_PERM_ACTIVATE_DEACTIVATE_SOCIETY = 'mobile_api_activate_deactivate_user_society';
//--------------------------------------------------------------------------------
public function __construct(AccessDecisionManagerInterface $accessDecisionManager, ManagerRegistry $doctrine, ModuleTools $moduleTools)
{
$this->accessDecisionManager = $accessDecisionManager;
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
protected function supports(string $attribute, $subject = null): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// only vote on Access / AccessAPI objects inside this voter
if ($subject !== null && !($subject instanceof Access || $subject instanceof AccessAPI))
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_MOBILE_API))
{
return false;
}
$subjectAccess = null;
$subjectAccessApi = null;
if ($subject instanceof Access)
{
$subjectAccess = $subject;
$subjectAccessApi = $subject->getAccessAPI();
}
if ($subject instanceof AccessAPI)
{
$subjectAccess = $subject->getAccess();
$subjectAccessApi = $subject;
}
// Check current group affectation
if ($subjectAccess !== null)
{
$subjectSociety = $subjectAccess->getSociety();
if ($subjectSociety === null)
return false;
$subjectGroup = $subjectSociety->getGroup();
if ($subjectGroup === null)
return false;
if (!$currentGroup->equals($subjectGroup))
return false;
}
switch ($attribute)
{
case self::IS_ACTIVE:
return true;
case self::ACTIVATE_DEACTIVATE:
{
return $this->canChangeState($subjectAccessApi, $user, $function);
}
case self::ACTIVATE_DEACTIVATE_FOR_ACCESS:
{
if ($subjectAccess !== null && $subjectAccessApi === null)
{
// Creation case
return $this->canAddForAccess($subjectAccess, $user, $function);
}
return $this->canChangeState($subjectAccessApi, $user, $function);
}
case self::LISTING:
{
return $this->accessDecisionManager->decide($token, ['list_accesses']);
}
case self::LISTING_SOCIETY:
{
return $this->accessDecisionManager->decide($token, ['list_accesses_society']);
}
case self::LISTING_ANY:
{
return $this->accessDecisionManager->decide($token, ['list_accesses_any']);
}
}
throw new \LogicException('This code should not be reached!');
}
// $access is the user trying to load the resource
// $cost is the resource being loaded
// Check if the Society of the resource
// belongs to the societies of the $access
private function checkSociety(Access $subject, Access $access)
{
// Get all the societies of the access
$societies = $access->getSocieties();
// Get the Society of the Demand
$subjectSociety = $subject->getSociety();
if ($subjectSociety === null)
return false;
$found = false;
foreach ($societies as $society)
{
if ($society->getId() == $subjectSociety->getId())
{
$found = true;
break;
}
}
return $found;
}
private function canChangeState(AccessAPI $accessApi, Access $user, AccessFunction $function)
{
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ACTIVATE_DEACTIVATE);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ACTIVATE_DEACTIVATE_SOCIETY);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
return $this->checkSociety($accessApi->getAccess(), $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canAddForAccess(Access $access, Access $user, AccessFunction $function)
{
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ACTIVATE_DEACTIVATE);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ACTIVATE_DEACTIVATE_SOCIETY);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
return $this->checkSociety($access, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
}

src/Security/AccessApiVoter.php line 56