Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/DocumentVoter.php
// OK #4453 : VoterCache (isActive, listings)
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\APIRest\AccessAPI;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\Config\OptionConfig;
use App\Entity\HR\AccessFunction;
use App\Entity\Mission\MissionTarget;
use App\Entity\Planning\Task;
use App\Entity\Security\AccessCacheAcl;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Entity\Webapp\Document;
use App\Entity\Webapp\Components\DocumentRule;
use App\Entity\Webapp\Components\DocumentTargetRule;
use App\Entity\Webapp\Components\DocumentType;
use App\Services\Config\ModuleTools;
use App\Services\Config\OptionConfigTools;
class DocumentVoter extends Voter
{
// Allow authors as managers
//--------------------------------------------------------------------------------
// is_granted constants
const IS_ACTIVE = "document_is_active";
const ADD = "add_document";
const ADD_RFI = "add_document_rfi";
const ADD_RFI_GC = "add_document_rfi_gc";
const ADD_ANOMALY = "add_document_anomaly";
const ADD_ANOMALY_GC = "add_document_anomaly_gc";
const ADD_REPORT = "add_document_report";
const ADD_KVISIT = "add_document_kvisit";
const ADD_CUSTOM_REPORT = "add_document_custom_report";
const LISTING = "list_documents";
const LISTING_SOCIETY = "list_documents_society";
const LISTING_MANAGER = "list_documents_manager";
const LISTING_ANY = "list_documents_any";
const LISTING_ARCHIVED = "list_archived_documents";
const LISTING_ARCHIVED_SOCIETY = "list_archived_documents_society";
const LISTING_ARCHIVED_MANAGER = "list_archived_documents_manager";
const LISTING_ARCHIVED_ANY = "list_archived_documents_any";
const VIEW_PDF = "view_pdf_document";
const ARCHIVE = "archive_document";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::ADD,
self::ADD_RFI,
self::ADD_RFI_GC,
self::ADD_ANOMALY,
self::ADD_ANOMALY_GC,
self::ADD_REPORT,
self::ADD_KVISIT,
self::ADD_CUSTOM_REPORT,
self::LISTING,
self::LISTING_SOCIETY,
self::LISTING_MANAGER,
self::LISTING_ANY,
self::LISTING_ARCHIVED,
self::LISTING_ARCHIVED_SOCIETY,
self::LISTING_ARCHIVED_MANAGER,
self::LISTING_ARCHIVED_ANY,
self::VIEW_PDF,
self::ARCHIVE,
);
const IS_GRANTED_CONSTANTS_SHARING_EXCEPTION = array(
self::VIEW_PDF,
);
// Plan.io Task #4453
const IS_GRANTED_FROM_CACHE = [
self::IS_ACTIVE,
self::LISTING,
self::LISTING_SOCIETY,
self::LISTING_MANAGER,
self::LISTING_ANY,
self::LISTING_ARCHIVED,
self::LISTING_ARCHIVED_SOCIETY,
self::LISTING_ARCHIVED_MANAGER,
self::LISTING_ARCHIVED_ANY,
];
//--------------------------------------------------------------------------------
// acl constants
const ACL_PERM_ADD = "webapp_doc_add";
const ACL_PERM_LISTING = "webapp_doc_list";
const ACL_PERM_LISTING_SOCIETY = "webapp_doc_list_society";
const ACL_PERM_LISTING_MANAGER = "webapp_doc_list_manager";
const ACL_PERM_VIEW_PDF = "webapp_doc_pdf_view";
const ACL_PERM_VIEW_PDF_SOCIETY = "webapp_doc_pdf_view_society";
const ACL_PERM_VIEW_PDF_MANAGER = "webapp_doc_pdf_view_manager";
const ACL_PERM_VIEW_PDF_CLIENT_MANAGER = "webapp_doc_pdf_view_ind_manager";
// Archive
const ACL_PERM_ARCHIVE = "webapp_doc_archive";
const ACL_PERM_ARCHIVE_SOCIETY = "webapp_doc_archive_society";
const ACL_PERM_ARCHIVE_MANAGER = "webapp_doc_archive_manager";
// Archived : List
const ACL_PERM_LISTING_ARCHIVED = "webapp_doc_list_archived";
const ACL_PERM_LISTING_ARCHIVED_SOCIETY = "webapp_doc_list_archived_society";
const ACL_PERM_LISTING_ARCHIVED_MANAGER = "webapp_doc_list_archived_manager";
// Archived : View
const ACL_PERM_VIEW_PDF_ARCHIVED = "webapp_doc_pdf_view_archived";
const ACL_PERM_VIEW_PDF_ARCHIVED_SOCIETY = "webapp_doc_pdf_view_archived_society";
const ACL_PERM_VIEW_PDF_ARCHIVED_MANAGER = "webapp_doc_pdf_view_archived_manager";
const ACL_PERM_VIEW_PDF_ARCHIVED_CLIENT_MANAGER = "webapp_doc_pdf_view_archived_ind_manager";
//--------------------------------------------------------------------------------
public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools, OptionConfigTools $optionConfigTools)
{
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->optionConfigTools = $optionConfigTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453 [See AccessVoter for details]
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject = null): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// only vote on Document or Task objects inside this voter
if ($subject !== null && !($subject instanceof Document || $subject instanceof Task))
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
$originalUserIsAccess = true;
// Plan.io Task #3707
if ($user instanceof AccessAPI)
{
if ($user->getAccess() === null)
{
return false;
}
$user = $user->getAccess();
$originalUserIsAccess = false;
}
// Plan.io Task #4453 : Bypass everything, but only for Access users
// if ($originalUserIsAccess && AccessCacheAcl::voterCacheIsActive())
// {
// if (in_array($attribute, self::IS_GRANTED_FROM_CACHE))
// {
// $accessCacheAcl = $this->em->getRepository(AccessCacheAcl::class)->findOneBy(array(
// 'access' => $user,
// 'aclKey' => $attribute,
// ));
// if ($accessCacheAcl !== null)
// {
// return $accessCacheAcl->isActive();
// }
// }
// }
// Plan.io Task #3707
// At this point $user is an object of Access type
// even if the $token->getUser() is AccessAPI
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
$this->currentGroup = $currentGroup;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_DOCUMENT))
{
return false;
}
// This one also needs the planning
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_PLANNING))
{
return false;
}
// This one also needs clients or clients light
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_CLIENT) && $this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_CLIENT_LIGHT))
{
return false;
}
// you know $subject is a Document object, thanks to supports
/** @var Document $doc */
$doc = $subject;
// Check current group affectation
if ($subject !== null && $subject instanceof Document)
{
$docSociety = $subject->getSociety();
if ($docSociety === null)
return false;
$docSocietyGroup = $docSociety->getGroup();
if ($docSocietyGroup === null)
return false;
// if (!$currentGroup->equals($docSocietyGroup))
// return false;
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS_SHARING_EXCEPTION))
{
// Just check currentGroup
if (!$currentGroup->equals($docSocietyGroup))
return false;
}
else
{
// Take sharing into account
// If the document belongs to a mission that was created by the currentGroup
// (document.mission.societyGroupAuthor == currentGroup)
// Then it can see the document
if (!$currentGroup->equals($docSocietyGroup))
{
if ($doc->getMission() !== null)
{
$missionSocietyGroupAuthor = $doc->getMission()->getSocietyGroupAuthor();
if (!$currentGroup->equals($missionSocietyGroupAuthor))
{
return false;
}
}
}
}
}
switch ($attribute)
{
case self::IS_ACTIVE:
return true;
case self::ADD:
{
if ($subject !== null && $subject instanceof Task)
{
$task = $subject;
return $this->canAdd($user, $function, $task);
}
return $this->canAdd($user, $function);
}
case self::ADD_RFI:
{
if ($subject !== null && $subject instanceof Task)
{
$task = $subject;
if ($this->canAdd($user, $function, $task))
{
return $this->canAddDocumentType($user, $function, $task, DocumentType::CODE_RFI);
}
}
return false;
}
case self::ADD_RFI_GC:
{
if ($subject !== null && $subject instanceof Task)
{
$task = $subject;
if ($this->canAdd($user, $function, $task))
{
return $this->canAddDocumentType($user, $function, $task, DocumentType::CODE_RFI_GC);
}
}
return false;
}
case self::ADD_ANOMALY:
{
if ($subject !== null && $subject instanceof Task)
{
$task = $subject;
if ($this->canAdd($user, $function, $task))
{
return $this->canAddDocumentType($user, $function, $task, DocumentType::CODE_ANOMALY);
}
}
return false;
}
case self::ADD_ANOMALY_GC:
{
if ($subject !== null && $subject instanceof Task)
{
$task = $subject;
if ($this->canAdd($user, $function, $task))
{
return $this->canAddDocumentType($user, $function, $task, DocumentType::CODE_ANOMALY_GC);
}
}
return false;
}
case self::ADD_REPORT:
{
if ($subject !== null && $subject instanceof Task)
{
$task = $subject;
if ($this->canAdd($user, $function, $task))
{
return $this->canAddDocumentType($user, $function, $task, DocumentType::CODE_REPORT);
}
}
return false;
}
case self::ADD_KVISIT:
{
if ($this->optionConfigTools->isActive_webappKvisitReport($this->currentGroup))
{
if ($subject !== null && $subject instanceof Task)
{
$task = $subject;
if ($this->canAdd($user, $function, $task))
{
return $this->canAddDocumentType($user, $function, $task, DocumentType::CODE_KVISIT_REPORT);
}
}
}
return false;
}
case self::ADD_CUSTOM_REPORT:
{
if ($subject !== null && $subject instanceof Task)
{
$task = $subject;
if ($this->canAdd($user, $function, $task))
{
return $this->canAddCustomReport($user, $function, $task);
}
}
return false;
}
case self::LISTING:
return $this->canList($user, $function);
case self::LISTING_SOCIETY:
return $this->canListSociety($user, $function);
case self::LISTING_MANAGER:
return $this->canListManager($user, $function);
case self::LISTING_ANY:
return $this->canListAny($user, $function);
case self::VIEW_PDF:
return $this->canViewPdf($doc, $user, $function);
case self::ARCHIVE:
return $this->canArchive($doc, $user, $function);
case self::LISTING_ARCHIVED:
return $this->canListArchived($user, $function);
case self::LISTING_ARCHIVED_SOCIETY:
return $this->canListArchivedSociety($user, $function);
case self::LISTING_ARCHIVED_MANAGER:
return $this->canListArchivedManager($user, $function);
case self::LISTING_ARCHIVED_ANY:
return $this->canListArchivedAny($user, $function);
}
throw new \LogicException('This code should not be reached!');
}
// $access is the user trying to load the resource
// $doc is the resource being loaded
// Check if the Society of the resource
// belongs to the societies of the $access
private function checkSociety(Document $doc, Access $access)
{
// Get all the societies of the access
$societies = $access->getSocieties();
// Get the Society of the Document
$docSociety = $doc->getSociety();
if ($docSociety === null)
return false;
$found = false;
foreach ($societies as $society)
{
if ($society->getId() == $docSociety->getId())
{
$found = true;
break;
}
}
return $found;
}
// Check if the $access is the manager of the $doc
private function checkManager(Document $doc, Access $access)
{
// Get manager
$manager = $doc->getManager();
$author = $doc->getAuthor();
if ($manager === null)
return false;
if ($manager === null && $author === null)
return false;
if ($manager !== null)
if ($manager->getId() === $access->getId())
return true;
if ($author !== null)
if ($author->getId() === $access->getId())
return true;
return false;
}
// Check if the $access is the manager of the client of the $doc
private function checkClientManager(Document $doc, Access $access)
{
// Get manager
if ($doc->getReceiver() === null)
return null;
$client = $doc->getReceiver();
if ($client->getIndividual() !== null)
{
// Only Individuals have managers
// Get manager
$manager = $client->getIndividual()->getManager();
if ($manager === null)
return false;
if ($manager->getId() === $access->getId())
return true;
}
return false;
}
private function canAdd(Access $user, AccessFunction $function, $task = null)
{
// Plan.io Task #3323 + #4302
if ($task !== null)
{
if ($task->isArchivedRefused())
{
return false;
}
if ($task->isHelp())
{
return false;
}
if ($task->isAbsence())
{
return false;
}
// It's child recurrence
if ($task->getRecurrenceParent() !== null)
{
return false;
}
}
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
// Updated by Plan.io Task #4224 : Added DocumentTargetRule logic
private function canAddDocumentType(Access $user, AccessFunction $function, Task $task, $docCode)
{
// Get DocumentType
$docType = $this->em->getRepository(DocumentType::class)
->findOneByCode($docCode);
if ($docType === null)
{
return false;
}
// Get TaskType
$taskType = $task->getType();
if ($taskType === null)
{
return false;
}
// Do we need to take the MissionTarget into account ?
if (!$taskType->getHasDocTargetRule())
{
// Nope
// Just do the DocumentRule check
$docRule = $this->em->getRepository(DocumentRule::class)
->findOneBy(array(
'documentType' => $docType,
'taskType' => $taskType,
'state' => 1,
));
if ($docRule !== null)
{
return true;
}
return false;
}
// If we are here it means that we have DocumentTargetRules for this TaskType
// Get MissionTarget, if any
$missionTarget = null;
$mission = $task->getMission();
if ($mission !== null)
{
$missionTarget = $mission->getTarget();
}
if ($missionTarget === null)
{
// Simplest case : No Target, everything is possible ;)
return true;
}
// Apply both MissionTarget and TaskType rule
$docRule = $this->em->getRepository(DocumentTargetRule::class)
->findOneBy(array(
'documentType' => $docType,
'taskType' => $taskType,
'missionTarget' => $missionTarget,
'state' => 1,
));
if ($docRule !== null)
{
return true;
}
// If we are here, all hope is lost
return false;
}
// We need to pass two arguments to the Security :: DocumentVoter
// So add the second argument as a property of the first
// https://stackoverflow.com/questions/39999301/symfony2-pass-a-second-object-to-a-voter
private function canAddCustomReport(Access $user, AccessFunction $function, Task $task)
{
// Get DocumentType
$docType = $task->getDocType();
if ($docType === null)
{
return false;
}
// Get TaskType
$taskType = $task->getType();
if ($taskType === null)
{
return false;
}
// Do we need to take the MissionTarget into account ?
if (!$taskType->getHasDocTargetRule())
{
// Nope
// Just do the DocumentRule check
$docRule = $this->em->getRepository(DocumentRule::class)
->findOneBy(array(
'documentType' => $docType,
'taskType' => $taskType,
'state' => 1,
));
if ($docRule !== null)
{
return true;
}
return false;
}
// If we are here it means that we have DocumentTargetRules for this TaskType
// Get MissionTarget, if any
$missionTarget = null;
$mission = $task->getMission();
if ($mission !== null)
{
$missionTarget = $mission->getTarget();
}
if ($missionTarget === null)
{
// Simplest case : No Target, everything is possible ;)
return true;
}
// Apply both MissionTarget and TaskType rule
$docRule = $this->em->getRepository(DocumentTargetRule::class)
->findOneBy(array(
'documentType' => $docType,
'taskType' => $taskType,
'missionTarget' => $missionTarget,
'state' => 1,
));
if ($docRule !== null)
{
return true;
}
// If we are here, all hope is lost
return false;
}
private function canList(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canListSociety(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListManager(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_MANAGER);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListAny(Access $user, AccessFunction $function)
{
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_MANAGER);
// If both are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canViewPdf(Document $doc, Access $user, AccessFunction $function)
{
if ($doc->isArchived())
{
return $this->canViewArchivedPdf($doc, $user, $function);
}
// Many Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_MANAGER);
$aclPermClientManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_CLIENT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null && $aclPermClientManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
// However, we don't want to stop if the answer is no, but look further
// This is the case when the client is in society A and the document is in society B
if ($this->checkSociety($doc, $user))
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
if ($this->checkManager($doc, $user))
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermClientManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermClientManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
if ($this->checkClientManager($doc, $user))
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canArchive(Document $doc, Access $user, AccessFunction $function)
{
// Many Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ARCHIVE);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ARCHIVE_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ARCHIVE_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
// However, we don't want to stop if the answer is no, but look further
// This is the case when the client is in society A and the document is in society B
if ($this->checkSociety($doc, $user))
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
if ($this->checkManager($doc, $user))
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canViewArchivedPdf(Document $doc, Access $user, AccessFunction $function)
{
if ($doc->isNotArchived())
{
return $this->canViewPdf($doc, $user, $function);
}
// Many Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_ARCHIVED);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_ARCHIVED_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_ARCHIVED_MANAGER);
$aclPermClientManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_ARCHIVED_CLIENT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null && $aclPermClientManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
// However, we don't want to stop if the answer is no, but look further
// This is the case when the client is in society A and the document is in society B
if ($this->checkSociety($doc, $user))
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
if ($this->checkManager($doc, $user))
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermClientManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermClientManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
if ($this->checkClientManager($doc, $user))
return true;
// "Voir les PDF de tous les documents archivés des clients dont il est le gestionnaire et tous les documents archivés dont il est l'auteur"
// Also check if author / manager of this particular document
if ($this->checkManager($doc, $user))
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canListArchived(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_ARCHIVED);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canListArchivedSociety(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_ARCHIVED_SOCIETY);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListArchivedManager(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_ARCHIVED_MANAGER);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListArchivedAny(Access $user, AccessFunction $function)
{
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_ARCHIVED);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_ARCHIVED_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_ARCHIVED_MANAGER);
// If both are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
}

src/Security/DocumentVoter.php line 139