Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/AccessVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Services\Config\ModuleTools;
class AccessVoter extends Voter
{
//--------------------------------------------------------------------------------
// is_granted constants
const IS_ACTIVE = "access_is_active";
const EDIT = "edit_access";
const ADD_FROM = "add_access_from";
const LISTING = "list_accesses";
const LISTING_SOCIETY = "list_accesses_society";
const LISTING_ANY = "list_accesses_any";
const ASSIGNING = "assign_access_societies";
const ASSIGNING_SOCIETY = "assign_access_societies_society";
const ASSIGNING_ANY = "assign_access_societies_any";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::EDIT,
self::ADD_FROM,
self::LISTING,
self::LISTING_SOCIETY,
self::LISTING_ANY,
self::ASSIGNING,
self::ASSIGNING_SOCIETY,
self::ASSIGNING_ANY,
);
//--------------------------------------------------------------------------------
const ACL_PERM_ADD_FROM = "access_add_from";
const ACL_PERM_LISTING = "access_list";
const ACL_PERM_LISTING_SOCIETY = "access_list_society";
const ACL_PERM_ASSIGN = "access_assign";
const ACL_PERM_ASSIGN_SOCIETY = "access_assign_society";
const ACL_PERM_EDIT = "access_edit";
const ACL_PERM_EDIT_SOCIETY = "access_edit_society";
const ACL_PERM_EDIT_OWN = "access_edit_own";
//--------------------------------------------------------------------------------
public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools)
{
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453
// This method returns true if the voter applies to the given attribute;
// if it returns false, Symfony won't call it again for this attribute
// https://symfony.com/blog/new-in-symfony-5-4-faster-security-voters
// https://symfony.com/doc/current/security/voters.html#improving-voter-performance
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// only vote on Access objects inside this voter
if ($subject !== null && !$subject instanceof Access)
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// ROLE_USER must have a function; if not deny access
if ($user->isUser())
{
$function = $user->getFunction();
if ($function === null) return false;
}
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_ACCESS))
{
return false;
}
// Module human_resource should also be activated
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_HUMAN_RESOURCE))
{
return false;
}
// you know $subject is an Access object, thanks to supports
/** @var Access $access */
$access = $subject;
switch ($attribute)
{
case self::IS_ACTIVE:
return true;
case self::EDIT:
return $this->canEdit($access, $user, $function);
case self::ADD_FROM:
return $this->canAddFrom($access, $user, $function);
case self::LISTING:
return $this->canList($access, $user, $function);
case self::LISTING_SOCIETY:
return $this->canListSociety($access, $user, $function);
case self::LISTING_ANY:
return $this->canListAny($access, $user, $function);
case self::ASSIGNING:
return $this->canAssign($access, $user, $function);
case self::ASSIGNING_SOCIETY:
return $this->canAssignSociety($access, $user, $function);
case self::ASSIGNING_ANY:
return $this->canAssignAny($access, $user, $function);
}
throw new \LogicException('This code should not be reached!');
}
// $access is the thing that we are doing stuff on
// $user is the logged in user
private function checkSociety(Access $access, Access $user)
{
// Get all the societies of the user
$societies = $user->getSocieties();
// Get the Society of the Access
$accessSociety = $access->getSociety();
if ($accessSociety === null)
return false;
$found = false;
foreach ($societies as $society)
{
if ($society->getId() == $accessSociety->getId())
{
$found = true;
break;
}
}
return $found;
}
// $access is the thing that we are doing stuff on
// $user is the logged in user
private function canEdit(Access $access, Access $user, $function)
{
// Get Acl_Perdemands
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SOCIETY);
$aclPermOwn = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_OWN);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermOwn)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// Check Society
if ($this->checkSociety($access, $user))
{
return true;
}
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermOwn !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermOwn
));
if ($acl !== null)
{
if ($acl->getValue())
{
// Check Own
if ($user->equals($access, $user))
{
return true;
}
}
}
}
// If we are here, all hope is lost
return false;
}
private function canAddFrom(Access $access = null, Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD_FROM);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one list type can exist for the Applications,
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canAssign(Access $access = null, Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ASSIGN);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one list type can exist for the Applications,
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canAssignSociety(Access $access = null, Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ASSIGN_SOCIETY);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canAssignAny(Access $access = null, Access $user, AccessFunction $function)
{
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ASSIGN);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ASSIGN_SOCIETY);
// If both are null, exit
if ($aclPerm === null && $aclPermSociety === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canList(Access $access = null, Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListSociety(Access $access = null, Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListAny(Access $access = null, Access $user, AccessFunction $function)
{
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
// If both are null, exit
if ($aclPerm === null && $aclPermSociety === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
}

src/Security/AccessVoter.php line 71