<?php//------------------------------------------------------------------------------// src/Security/InstallmentVoter.php//------------------------------------------------------------------------------namespace App\Security;use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;use Symfony\Component\Security\Core\Authorization\Voter\Voter;use Doctrine\Persistence\ManagerRegistry;use App\Entity\Access;use App\Entity\Config\Config;use App\Entity\Config\Module;use App\Entity\HR\AccessFunction;use App\Entity\Platform\Command\Command;use App\Entity\Platform\Devis\Devis;use App\Entity\Platform\Installment;use App\Entity\Platform\Invoice\Invoice;use App\Entity\Security\Acl;use App\Entity\Security\AclPermission;use App\Services\Config\ModuleTools;use App\Services\Config\OptionConfigTools;class InstallmentVoter extends Voter{ //-------------------------------------------------------------------------------- // is_granted constants // This depends of the Devis Module, not the Payments, // which design the Online payment option (Paypal, Stripe) // It also depends on the Commands const IS_ACTIVE = "installment_is_active"; const LISTING = "list_installments"; const LISTING_SOCIETY = "list_installments_society"; const LISTING_ANY = "list_installments_any"; const IMPORT = "import_installments"; // Plan.io Task #4326 const ADD = "add_installment"; const EDIT = "edit_installment"; const DELETE = "delete_installment"; // Plan.io Task #4653 const IS_ACTIVE_INSTALLMENT_AUTO_ACCOUNT = "installment_auto_account_is_active"; const IS_GRANTED_CONSTANTS = array( self::IS_ACTIVE, self::LISTING, self::LISTING_SOCIETY, self::LISTING_ANY, self::IMPORT, self::ADD, self::EDIT, self::DELETE, self::IS_ACTIVE_INSTALLMENT_AUTO_ACCOUNT, ); //-------------------------------------------------------------------------------- // acl constants const ACL_PERM_LISTING = "installment_list"; const ACL_PERM_LISTING_SOCIETY = "installment_list_society"; const ACL_PERM_IMPORT = "installment_import"; //-------------------------------------------------------------------------------- public function __construct(AccessDecisionManagerInterface $accessDecisionManager, ManagerRegistry $doctrine, ModuleTools $moduleTools, OptionConfigTools $optionConfigTools) { $this->accessDecisionManager = $accessDecisionManager; $this->em = $doctrine->getManager(); $this->moduleTools = $moduleTools; $this->optionConfigTools = $optionConfigTools; $this->aclRepository = $this->em->getRepository(Acl::class); $this->aclPermissionRepository = $this->em->getRepository(AclPermission::class); } // Plan.io Task #4453 [See AccessVoter for details] public function supportsAttribute(string $attribute): bool { return in_array($attribute, self::IS_GRANTED_CONSTANTS, true); } protected function supports(string $attribute, $subject = null): bool { // if the attribute isn't one we support, return false if (!in_array($attribute, self::IS_GRANTED_CONSTANTS)) { return false; } // only vote on Installment objects inside this voter // ... and Invoice / Devis / Command if ($subject !== null && !($subject instanceof Installment || $subject instanceof Devis || $subject instanceof Invoice || $subject instanceof Command )) { return false; } return true; } protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool { $user = $token->getUser(); if (!$user instanceof Access) { // the user must be logged in; if not, deny access return false; } // The user must have a function; if not deny access $function = $user->getFunction(); if ($function === null) return false; // Plan.io Task #3710 : Get current group $currentGroup = $user->getSocietyGroup(); if ($currentGroup === null) return false; // Module activated ? // This depends of the Devis Module, not the Payments, // which design the PayPal payment option // It also depends on the Commands if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_DEVIS) && $this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_COMMAND)) { return false; } // $subject can be Installment object, // or Devis / Invoice / Command (Plan.io Task #4326) $installment = null; $otherThanInstallment = null; if ($subject instanceof Installment) { $installment = $subject; } if ($subject instanceof Devis || $subject instanceof Invoice || $subject instanceof Command) { $otherThanInstallment = $subject; } // Check current group affectation if ($subject !== null) { $subjectSociety = $subject->getSociety(); if ($subjectSociety === null) return false; $subjectGroup = $subjectSociety->getGroup(); if ($subjectGroup === null) return false; if (!$currentGroup->equals($subjectGroup)) return false; } switch ($attribute) { case self::IS_ACTIVE: return true; case self::IS_ACTIVE_INSTALLMENT_AUTO_ACCOUNT: { return $this->optionConfigTools->isActive_InstallmentAutoAccount($currentGroup); } case self::IMPORT: return $this->canImport($user, $function); case self::LISTING: return $this->canList($user, $function); case self::LISTING_SOCIETY: return $this->canListSociety($user, $function); case self::LISTING_ANY: return $this->canListAny($user, $function); case self::ADD: return $this->canAdd($user, $function, $token, $otherThanInstallment); // For edit and delete subject can be both Installment or Object linked to installment case self::EDIT: return $this->canEdit($user, $function, $token, $subject); case self::DELETE: return $this->canDelete($user, $function, $token, $subject); } throw new \LogicException('This code should not be reached!'); } private function canAdd(Access $user, AccessFunction $function, $token, $subject) { if ($subject instanceof Command) { return $this->accessDecisionManager->decide($token, ['edit_command'], $subject); } if ($subject instanceof Devis) { return $this->accessDecisionManager->decide($token, ['edit_devis'], $subject); } if ($subject instanceof Invoice) { // Plan.io Task #4326 // Deny on Drafts if ($subject->isDraft()) { return false; } // Allow on Invoices based on edit permissions return $this->accessDecisionManager->decide($token, ['handle_installment_for_invoice'], $subject); } return false; } private function canEdit(Access $user, AccessFunction $function, $token, $subject) { if ($subject instanceof Installment) { $installment = $subject; // Plan.io Task #4653 if ($installment->isEffectivelyAccounted()) { return false; } if ($installment->getCommand() !== null) { return $this->accessDecisionManager->decide($token, ['edit_command'], $installment->getCommand()); } if ($installment->getDevis() !== null) { return $this->accessDecisionManager->decide($token, ['edit_devis'], $installment->getDevis()); } if ($installment->getInvoice() instanceof Invoice) { $invoice = $installment->getInvoice(); // Plan.io Task #4326 // Deny on Drafts if ($invoice->isDraft()) { return false; } // Allow on Invoices based on edit permissions return $this->accessDecisionManager->decide($token, ['handle_installment_for_invoice'], $invoice); } } if ($subject instanceof Command) { return $this->accessDecisionManager->decide($token, ['edit_command'], $subject); } if ($subject instanceof Devis) { return $this->accessDecisionManager->decide($token, ['edit_devis'], $subject); } if ($subject instanceof Invoice) { $invoice = $subject; // Plan.io Task #4326 // Deny on Drafts if ($invoice->isDraft()) { return false; } // Allow on Invoices based on edit permissions return $this->accessDecisionManager->decide($token, ['handle_installment_for_invoice'], $invoice); } return false; } private function canDelete(Access $user, AccessFunction $function, $token, $subject) { if ($subject instanceof Installment) { $installment = $subject; // Plan.io Task #4653 if ($installment->isEffectivelyAccounted()) { return false; } if ($installment->getCommand() !== null) { return $this->accessDecisionManager->decide($token, ['edit_command'], $installment->getCommand()); } if ($installment->getDevis() !== null) { return $this->accessDecisionManager->decide($token, ['edit_devis'], $installment->getDevis()); } if ($installment->getInvoice() instanceof Invoice) { // Always allow deleting installments on invoices // Needed by Plan.io Task #2849 return true; } } if ($subject instanceof Command) { return $this->accessDecisionManager->decide($token, ['edit_command'], $subject); } if ($subject instanceof Devis) { return $this->accessDecisionManager->decide($token, ['edit_devis'], $subject); } if ($subject instanceof Invoice) { // Always allow deleting installments on invoices // Needed by Plan.io Task #2849 return true; } return false; } private function canImport(Access $access, AccessFunction $function) { // Restrictions are also applied in the Controller // But this helps speeding page loading if the access is not even allowed to load the page // (ie. if it has no list privileges whatsoever) // Get Acl_Permission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_IMPORT); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one list type can exist, // we can return the result of the acl_permission return $acl->getValue(); } private function canList(Access $user, AccessFunction $function) { // Get Acl_Permission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission return $acl->getValue(); } private function canListSociety(Access $user, AccessFunction $function) { // Get Acl_Permission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission // Further filtering is done in the Controller return $acl->getValue(); } private function canListAny(Access $user, AccessFunction $function) { // Two Acl_Permission may exist $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING); $aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY); // If all are null, exit if ($aclPerm === null && $aclPermSociety === null) return false; // Get First one if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here it means that nothing good has been found // Load second permission if ($aclPermSociety !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermSociety )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here, all hope is lost return false; }}