Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/IndividualVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\Client\Individual;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Planning\Task;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Services\Config\ModuleTools;
class IndividualVoter extends Voter
{
//--------------------------------------------------------------------------------
// is_granted constants
const ADD = "add_individual";
const LISTING = "list_individuals";
const LISTING_SOCIETY = "list_individuals_society";
const LISTING_MANAGER = "list_individuals_manager";
const LISTING_ANY = "list_individuals_any";
const VIEW = "view_individual";
const EDIT = "edit_individual";
const ANONYMIZE = "anonymize_individual";
const EDIT_SOCIETY = "edit_individual_society";
const IMPORT = "import_individuals";
// Plan.Io Task #3747
const MERGE = "merge_individual";
const MERGE_TOOL = "merge_tool_individual";
const IS_GRANTED_CONSTANTS = array(
self::ADD,
self::LISTING,
self::LISTING_SOCIETY,
self::LISTING_MANAGER,
self::LISTING_ANY,
self::VIEW,
self::EDIT,
self::ANONYMIZE,
self::EDIT_SOCIETY,
self::IMPORT,
self::MERGE,
self::MERGE_TOOL,
);
//--------------------------------------------------------------------------------
// acl constants
const ACL_PERM_ADD = "ind_add";
const ACL_PERM_LISTING = "ind_list";
const ACL_PERM_LISTING_SOCIETY = "ind_list_society";
const ACL_PERM_LISTING_MANAGER = "ind_list_manager";
const ACL_PERM_VIEW = "ind_view";
const ACL_PERM_VIEW_SOCIETY = "ind_view_society";
const ACL_PERM_VIEW_MANAGER = "ind_view_manager";
const ACL_PERM_VIEW_IF_TASK = "ind_view_if_task";
const ACL_PERM_EDIT = "ind_edit";
const ACL_PERM_EDIT_SOCIETY = "ind_edit_society";
const ACL_PERM_EDIT_MANAGER = "ind_edit_manager";
const ACL_PERM_ANONYMIZE = "ind_anonymize";
const ACL_PERM_ANONYMIZE_SOCIETY = "ind_anonymize_society";
const ACL_PERM_ANONYMIZE_MANAGER = "ind_anonymize_manager";
const ACL_PERM_SOCIETY_EDIT = "ind_society_edit";
const ACL_PERM_SOCIETY_EDIT_SOCIETY = "ind_society_edit_society";
const ACL_PERM_SOCIETY_EDIT_MANAGER = "ind_society_edit_manager";
const ACL_PERM_IMPORT = "ind_import";
// Plan.io Task #3747
const ACL_PERM_MERGE = "ind_merge";
const ACL_PERM_MERGE_SOCIETY = "ind_merge_society";
//--------------------------------------------------------------------------------
public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools)
{
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453 [See AccessVoter for details]
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// only vote on Individual objects inside this voter
if ($subject !== null && !$subject instanceof Individual)
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
$this->currentGroup = $currentGroup;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_CLIENT) && $this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_CLIENT_LIGHT))
{
return false;
}
if ($attribute == self::EDIT || $attribute == self::EDIT_SOCIETY)
{
if ($subject->getAnonymized())
{
return false;
}
}
// you know $subject is a Individual object, thanks to supports
/** @var Individual $individual */
$individual = $subject;
// Check current group affectation
if ($individual !== null)
{
$individualSociety = $individual->getSociety();
if ($individualSociety === null)
return false;
$individualSocietyGroup = $individualSociety->getGroup();
if ($individualSocietyGroup === null)
return false;
// Checking ...
// Do not allow viewing/editing the client of a shared mission
if (!$currentGroup->equals($individualSocietyGroup))
{
return false;
}
}
switch ($attribute)
{
case self::ADD:
return $this->canAdd($user, $function);
case self::LISTING:
return $this->canList($individual, $user, $function);
case self::LISTING_SOCIETY:
return $this->canListSociety($individual, $user, $function);
case self::LISTING_MANAGER:
return $this->canListManager($individual, $user, $function);
case self::LISTING_ANY:
return $this->canListAny($individual, $user, $function);
case self::VIEW:
return $this->canView($individual, $user, $function);
case self::EDIT:
return $this->canEdit($individual, $user, $function);
case self::ANONYMIZE:
return $this->canAnonymize($individual, $user, $function);
case self::EDIT_SOCIETY:
return $this->canEditSociety($individual, $user, $function);
case self::IMPORT:
return $this->canImport($user, $function);
case self::MERGE:
return $this->canMerge($individual, $user, $function);
case self::MERGE_TOOL:
return $this->canUseMergeTool($user, $function);
}
throw new \LogicException('This code should not be reached!');
}
// $access is the user trying to load the resource
// $individual is the resource being loaded
// Check if the Society of the resource
// belongs to the societies of the $access
private function checkSociety(Individual $individual, Access $access)
{
// Get all the societies of the access
$societies = $access->getSocieties();
// Get the Society of the Individual
$individualSociety = $individual->getSociety();
if ($individualSociety === null)
return false;
$found = false;
foreach ($societies as $society)
{
if ($society->getId() == $individualSociety->getId())
{
$found = true;
break;
}
}
return $found;
}
// Check if the $access is the manager / author of the $individual
private function checkManager(Individual $individual, Access $access)
{
// Get manager and author
$manager = $individual->getManager();
$author = $individual->getAuthor();
if ($manager === null && $author === null)
return false;
if ($manager !== null)
if ($manager->getId() === $access->getId())
return true;
if ($author !== null)
if ($author->getId() === $access->getId())
return true;
return false;
}
// Check if there is at least one task
// having this access as resource and this individual as client
private function checkTask(Individual $individual, Access $access)
{
$taskRep = $this->em->getRepository(Task::class);
$resources = $access->getPlanningResources();
$client = $individual->getClient();
if ($client === null)
return false;
foreach ($resources as $r)
{
$tasks = $taskRep->findForClientAndResource($client, $r);
if (count($tasks) > 0)
return true;
}
return false;
}
private function canAdd(Access $user, AccessFunction $function)
{
// Module activated ?
// CLIENT_LIGHT cannot add Clients / Stores
if ($this->moduleTools->isInactiveByCode($this->currentGroup, Module::MODULE_CLIENT))
{
return false;
}
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canList(Individual $individual = null, Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canListSociety(Individual $individual = null, Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListManager(Individual $individual = null, Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_MANAGER);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListAny(Individual $individual = null, Access $user, AccessFunction $function)
{
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_MANAGER);
// If both are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canView(Individual $individual = null, Access $user, AccessFunction $function)
{
// Get Acl_Permissions
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_MANAGER);
$aclPermIfTask = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_IF_TASK);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null && $aclPermIfTask === null)
return false;
// The aclPermIfTask should be checked first, and if it is false, the others should be cheked
// ($aclPerm ^ $aclPermSociety ^ $aclPermManager) = empty
// ($aclPerm ^ $aclPermSociety ^ $aclPermManager) ^ $aclPermIfTask = not empty
// This means that an user can have access to the clients of his society
// and also have access to the individuals realted to his tasks
if ($aclPermIfTask !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermIfTask
));
if ($acl !== null)
{
if ($acl->getValue())
{
if ($this->checkTask($individual, $user))
return true;
}
}
}
// If we are here it means that the user doesn't have access to the Individual
// by the bias of one of his tasks
// So check regular permissions next
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($individual, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkManager($individual, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canEdit(Individual $individual = null, Access $user, AccessFunction $function)
{
if($individual->getAnonymized())
{
return false;
}
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($individual, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkManager($individual, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canAnonymize(Individual $individual = null, Access $user, AccessFunction $function)
{
// Three Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ANONYMIZE);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ANONYMIZE_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ANONYMIZE_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($individual, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkManager($individual, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canEditSociety(Individual $individual = null, Access $user, AccessFunction $function)
{
if($individual->getAnonymized())
{
return false;
}
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_SOCIETY_EDIT);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_SOCIETY_EDIT_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_SOCIETY_EDIT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($individual, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkManager($individual, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canImport(Access $user, AccessFunction $function)
{
// Module activated ?
// CLIENT_LIGHT cannot add Clients / Stores
if ($this->moduleTools->isInactiveByCode($this->currentGroup, Module::MODULE_CLIENT))
{
return false;
}
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_IMPORT);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
// Plan.io Task #3747
private function canMerge(Individual $individual, Access $user, AccessFunction $accessFunction)
{
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_MERGE);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_MERGE_SOCIETY);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $accessFunction,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $accessFunction,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($individual, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
// Plan.io Task #3747
// We need to know if the user can access the merge tool
// Specific merge permissions will be checked later
private function canUseMergeTool(Access $user, AccessFunction $accessFunction)
{
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_MERGE);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_MERGE_SOCIETY);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $accessFunction,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $accessFunction,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
}

src/Security/IndividualVoter.php line 92