<?php//------------------------------------------------------------------------------// src/Security/InodeVoter.php//------------------------------------------------------------------------------namespace App\Security;use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;use Symfony\Component\Security\Core\Authorization\Voter\Voter;use Doctrine\Persistence\ManagerRegistry;use App\Entity\Access;use App\Entity\Cloud\Inode;use App\Entity\Config\Config;use App\Entity\Config\Module;use App\Entity\HR\AccessFunction;use App\Entity\Security\Acl;use App\Entity\Security\AclPermission;use App\Services\Config\ModuleTools;class InodeVoter extends Voter{ const IS_ACTIVE = "cloud_is_active"; const ADD = "add_inode"; const VIEW = "view_inode"; const EDIT = "edit_inode"; const MOVE = "move_inode"; const SHARE = "share_inode"; const DELETE = "delete_inode"; const ACL_PERM_ADD = "inode_add"; const ACL_PERM_SHARE = "inode_share"; const ACL_PERM_EDIT_SHARED = "inode_edit_shared"; const ACL_PERM_DELETE_SHARED = "inode_delete_shared"; const IS_GRANTED_CONSTANTS = array( self::IS_ACTIVE, self::ADD, self::VIEW, self::EDIT, self::MOVE, self::SHARE, self::DELETE, self::ACL_PERM_ADD, self::ACL_PERM_SHARE, self::ACL_PERM_EDIT_SHARED, self::ACL_PERM_DELETE_SHARED, ); public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools) { $this->em = $doctrine->getManager(); $this->moduleTools = $moduleTools; $this->aclRepository = $this->em->getRepository(Acl::class); $this->aclPermissionRepository = $this->em->getRepository(AclPermission::class); } // Plan.io Task #4453 [See AccessVoter for details] public function supportsAttribute(string $attribute): bool { return in_array($attribute, self::IS_GRANTED_CONSTANTS, true); } protected function supports(string $attribute, $subject): bool { // if the attribute isn't one we support, return false if (!in_array($attribute, self::IS_GRANTED_CONSTANTS)) { return false; } // only vote on Inode objects inside this voter if ($subject !== null) { if (!$subject instanceof Inode) { return false; } } return true; } protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool { $user = $token->getUser(); if (!$user instanceof Access) { // the user must be logged in; if not, deny access return false; } // The user must have a function; if not deny access $function = $user->getFunction(); if ($function === null) return false; // Plan.io Task #3710 : Get current group $currentGroup = $user->getSocietyGroup(); if ($currentGroup === null) return false; // Module activated ? if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_CLOUD)) { return false; } // you know $subject is a Inode object, thanks to supports /** @var Inode $inode */ $inode = $subject; // Check current group affectation if ($subject !== null) { $subjectGroup = $subject->getSocietyGroup(); if ($subjectGroup === null) return false; if (!$currentGroup->equals($subjectGroup)) return false; } switch ($attribute) { case self::IS_ACTIVE: return true; case self::ADD: return $this->canAdd($inode, $user, $function); case self::VIEW: return $this->canView($inode, $user, $function); case self::EDIT: return $this->canEdit($inode, $user, $function); case self::MOVE: return $this->canMove($inode, $user, $function); case self::SHARE: return $this->canShare($inode, $user, $function); case self::DELETE: return $this->canDelete($inode, $user, $function); } throw new \LogicException('This code should not be reached!'); } private function canAdd(Inode $inode = null, Access $access, AccessFunction $function) { // This should not happen if ($inode === null) { // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; return $acl->getValue(); } // Case 1 : Inode is root or owned by the access // => Check ADD permission from the acl if ($inode->isRoot() || $inode->isOwnedBy($access)) { // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; return $acl->getValue(); } // Case 2 : Inode is not root, and not owned by the access // => Check if one of its parents is shared with the access // In this case, we need to chekc acl EDIT permission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SHARED); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; if ($acl->getValue()) { // The access has permission to edit shared inodes return $inode->isSharedWith($access); } // All hope is lost return false; } private function canShare(Inode $inode = null, Access $access, AccessFunction $function) { // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_SHARE); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one list type can exist for the Inodes, // we can return the result of the acl_permission return $acl->getValue(); } private function canView(Inode $inode = null, Access $access, AccessFunction $function) { // All users can view root if ($inode->isRoot()) return true; // All user can view own Inodes if ($inode->isOwnedBy($access)) return true; // All user can view shared Inodes if ($inode->isSharedWith($access)) return true; return false; } private function canMove(Inode $inode = null, Access $access, AccessFunction $function) { // Deny for root if ($inode->isRoot()) return false; // All user can move own Inodes if ($inode->isOwnedBy($access)) return true; // All user can move shared Inodes if ($inode->isSharedWith($access)) return true; return false; } private function canEdit(Inode $inode = null, Access $access, AccessFunction $function) { if ($inode->isRoot()) return false; // All user can edit own Inodes if ($inode->isOwnedBy($access)) return true; // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SHARED); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; if ($acl->getValue()) { // The access has permission to edit shared inodes return $inode->isSharedWith($access); } // All hope is lost return false; } private function canDelete(Inode $inode = null, Access $access, AccessFunction $function) { if ($inode->isRoot()) return false; // All user can delete own Inodes if ($inode->isOwnedBy($access)) return true; // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE_SHARED); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; if ($acl->getValue()) { // The access has permission to delete shared inodes return $inode->isSharedWith($access); } // All hope is lost return false; }}