src/Security/DashboardVoter.php line 18

Open in your IDE?
  1. <?php
  2. //------------------------------------------------------------------------------
  3. // src/Security/DashboardVoter.php
  4. //------------------------------------------------------------------------------
  5. namespace App\Security;
  7. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  8. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  9. use Doctrine\Persistence\ManagerRegistry;
  11. use App\Entity\Access;
  12. use App\Entity\Config\Module;
  13. use App\Entity\HR\AccessFunction;
  14. use App\Entity\Security\Acl;
  15. use App\Entity\Security\AclPermission;
  16. use App\Services\Config\ModuleTools;
  18. class DashboardVoter extends Voter
  19. {
  20.     //--------------------------------------------------------------------------------
  21.     // is_granted constants
  22.     const VIEW = "view_dashboard";
  24.     const IS_ACTIVE = "dashboard_is_active";
  26.     const IS_GRANTED_CONSTANTS = array(
  27.         self::VIEW,
  28.         self::IS_ACTIVE,
  29.     );
  31.     //--------------------------------------------------------------------------------
  32.     // acl constants
  33.     const ACL_PERM_VIEW = "dashboard_view";
  34.     //--------------------------------------------------------------------------------
  36.     public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools)
  37.     {
  38.         $this->em = $doctrine->getManager();
  39.         $this->moduleTools = $moduleTools;
  41.         $this->aclRepository = $this->em->getRepository(Acl::class);
  42.         $this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
  43.     }
  45.     // Plan.io Task #4453 [See AccessVoter for details]
  46.     public function supportsAttribute(string $attribute): bool
  47.     {
  48.         return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
  49.     }
  51.     protected function supports(string $attribute, $subject = null): bool
  52.     {
  53.         // if the attribute isn't one we support, return false
  54.         if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
  55.         {
  56.             return false;
  57.         }
  59.         return true;
  60.     }
  62.     protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  63.     {
  64.         $user = $token->getUser();
  66.         if (!$user instanceof Access)
  67.         {
  68.             // the user must be logged in; if not, deny access
  69.             return false;
  70.         }
  72.         // The user must have a function; if not deny access
  73.         $function = $user->getFunction();
  74.         if ($function === null)        return false;
  76.         // Plan.io Task #3710 : Get current group
  77.         $currentGroup = $user->getSocietyGroup();
  78.         if ($currentGroup === null)
  79.             return false;
  81.         // Module activated ?
  82.         if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_DASHBOARD))
  83.         {
  84.             return false;
  85.         }
  87.         // // you know $subject is a Dashboard object, thanks to supports
  88.         // /** @var Dashboard $devis */
  89.         // $devis = $subject;
  90.         //
  91.         // // Check current group affectation
  92.         // if ($subject !== null)
  93.         // {
  94.         //     $subjectSociety = $subject->getSociety();
  95.         //     if ($subjectSociety === null)
  96.         //         return false;
  97.         //     $subjectGroup = $subjectSociety->getGroup();
  98.         //     if ($subjectGroup === null)
  99.         //         return false;
  100.         //     if (!$currentGroup->equals($subjectGroup))
  101.         //         return false;
  102.         // }
  104.         switch ($attribute)
  105.         {
  106.             case self::IS_ACTIVE:
  107.                 return true;
  109.             case self::VIEW:
  110.                 return $this->canView($user, $function);
  111.         }
  113.         throw new \LogicException('This code should not be reached!');
  114.     }
  116.     private function canView(Access $user, AccessFunction $function)
  117.     {
  118.         // Get Acl_Permission
  119.         $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW);
  120.         if ($aclPerm === null)        return false;
  122.         // Get Acl
  123.         $acl = $this->aclRepository->findOneBy(array(
  124.             'function'        =>    $function,
  125.             'permission'    =>    $aclPerm
  126.         ));
  127.         if ($acl === null)        return false;
  129.         // Since only one acl type can exist
  130.         // we can return the result of the acl_permission
  131.         return $acl->getValue();
  132.     }
  133. }