Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/ArticleVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\APIRest\AccessAPI;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Media\Article;
use App\Entity\Security\Acl;
use App\Entity\Security\AclArticle;
use App\Entity\Security\AclPermission;
use App\Services\Config\ModuleTools;
class ArticleVoter extends Voter
{
//--------------------------------------------------------------------------------
// is_granted constants
const IS_ACTIVE = "article_is_active";
const ADD = "add_article";
const VIEW = "view_article";
const EDIT = "edit_article";
const APPROVE = "approve_article";
const DELETE = "delete_article";
const ADD_COMMENT = "add_comment";
const MODERATION = "article_moderation";
const LIST_ANY = "list_article_any";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::ADD,
self::VIEW,
self::EDIT,
self::APPROVE,
self::DELETE,
self::ADD_COMMENT,
self::MODERATION,
self::LIST_ANY,
);
//--------------------------------------------------------------------------------
// acl constants
const ACL_PERM_ADD = "article_add";
const ACL_PERM_EDIT = "article_edit";
//const ACL_PERM_EDIT_OWN = "article_edit_own";
const ACL_PERM_APPROVE = "article_approve";
//const ACL_PERM_APPROVE_OWN = "article_approve_own";
const ACL_PERM_DELETE = "article_delete";
//const ACL_PERM_DELETE_OWN = "article_delete_own";
const ACL_PERM_ADD_COMMENT = "article_comment_add";
//--------------------------------------------------------------------------------
public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools)
{
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453 [See AccessVoter for details]
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// only vote on Article objects inside this voter
if ($subject !== null && !$subject instanceof Article)
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
// Plan.io Task #3707
if ($user instanceof AccessAPI)
{
if ($user->getAccess() === null)
{
return false;
}
$user = $user->getAccess();
}
// Plan.io Task #3707
// At this point $user is an object of Access type
// even if the $token->getUser() is AccessAPI
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_ARTICLE))
{
return false;
}
// you know $subject is a Article object, thanks to supports
/** @var Article $article */
$article = $subject;
// Check current group affectation
if ($subject !== null)
{
$subjectGroup = $subject->getSocietyGroup();
if ($subjectGroup === null)
return false;
if (!$currentGroup->equals($subjectGroup))
return false;
}
switch ($attribute)
{
case self::IS_ACTIVE:
return true;
case self::ADD:
return $this->canAdd($user, $function);
case self::VIEW:
return $this->canView($article, $user, $function);
case self::EDIT:
return $this->canEdit($article, $user, $function);
case self::DELETE:
return $this->canDelete($article, $user, $function);
case self::APPROVE:
return $this->canApprove($article, $user, $function);
case self::ADD_COMMENT:
return $this->canAddComment($article, $user, $function);
case self::MODERATION:
return $this->canModerate($user, $function);
case self::LIST_ANY:
return $this->canListAny($user, $function);
}
throw new \LogicException('This code should not be reached!');
}
// $access is the user trying to load the resource
// $article is the resource being loaded
private function checkAuthor(Article $article, Access $access)
{
$author = $article->getAuthor();
if ($author === null)
return false;
if ($author->getId() == $access->getId())
return true;
return false;
}
private function canAdd(Access $user, AccessFunction $function)
{
// Get AclPermission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canView(Article $article, Access $user, AccessFunction $function)
{
if ($this->checkAuthor($article, $user))
return true;
$acl = $this->em->getRepository(AclArticle::class)
->findOneBy(array(
'article' => $article,
'accessFunction' => $function,
));
if ($acl === null)
return false;
return $acl->canView();
}
private function canEdit(Article $article, Access $user, AccessFunction $function)
{
// Always allow editing own's articles
if ($this->checkAuthor($article, $user))
return true;
// Get AclPermissions
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT);
// If all are null, exit
if ($aclPerm === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canApprove(Article $article, Access $user, AccessFunction $function)
{
// Get AclPermissions
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_APPROVE);
// If all are null, exit
if ($aclPerm === null && $aclPermOwn === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canDelete(Article $article, Access $user, AccessFunction $function)
{
// Always allow deleting own's articles
if ($this->checkAuthor($article, $user))
return true;
// Get AclPermissions
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE);
// If all are null, exit
if ($aclPerm === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canAddComment(Article $article, Access $user, AccessFunction $function)
{
// Get AclPermissions
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD_COMMENT);
// If all are null, exit
if ($aclPerm === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canModerate(Access $user, AccessFunction $function)
{
// Get AclPermissions
$acls = array();
$acls[] = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_APPROVE);
//$acls[] = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_APPROVE_OWN);
$acls[] = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT);
//$acls[] = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_OWN);
$acls[] = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE);
//$acls[] = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE_OWN);
// If all are null, exit
$allNull = true;
foreach ($acls as $acl)
{
if ($acl !== null)
{
$allNull = false;
break;
}
}
if ($allNull)
return false;
// Test
foreach ($acls as $aclPerm)
{
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
}
// If we are here, all hope is lost
return false;
}
public function canListAny(Access $user, AccessFunction $function)
{
return true;
}
}

src/Security/ArticleVoter.php line 72