<?php//------------------------------------------------------------------------------// src/Security/InvoiceProformaVoter.php//------------------------------------------------------------------------------namespace App\Security;use Doctrine\Persistence\ManagerRegistry;use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;use Symfony\Component\Security\Core\Authorization\Voter\Voter;use App\Entity\Access;use App\Entity\APIRest\AccessAPI;use App\Entity\Config\Module;use App\Entity\HR\AccessFunction;use App\Entity\Platform\Devis\Devis;use App\Entity\Security\Acl;use App\Entity\Security\AclPermission;use App\Services\LogTools;use App\Services\Config\ModuleTools;use App\Services\Config\OptionConfigTools;// Task plan.io #3892class InvoiceProformaVoter extends Voter{ // For now manager = author (both) //-------------------------------------------------------------------------------- // is_granted constants const IS_ACTIVE = "invoice_proforma_is_active"; const VIEW_PDF = "view_pdf_invoice_proforma"; const IS_GRANTED_CONSTANTS = array( self::IS_ACTIVE, self::VIEW_PDF ); //-------------------------------------------------------------------------------- // acl constants const ACL_PERM_VIEW_PDF = "invoice_proforma_view_pdf"; const ACL_PERM_VIEW_PDF_SOCIETY = "invoice_proforma_view_pdf_society"; const ACL_PERM_VIEW_PDF_MANAGER = "invoice_proforma_view_pdf_manager"; const ACL_PERM_VIEW_PDF_CLIENT_MANAGER = "invoice_proforma_view_pdf_ind_manager"; //-------------------------------------------------------------------------------- public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools, OptionConfigTools $optionConfigTools, LogTools $logTools) { $this->em = $doctrine->getManager(); $this->moduleTools = $moduleTools; $this->optionConfigTools = $optionConfigTools; $this->logTools = $logTools; $this->aclRepository = $this->em->getRepository(Acl::class); $this->aclPermissionRepository = $this->em->getRepository(AclPermission::class); } // Plan.io Task #4453 [See AccessVoter for details] public function supportsAttribute(string $attribute): bool { return in_array($attribute, self::IS_GRANTED_CONSTANTS, true); } protected function supports(string $attribute, $subject): bool { // if the attribute isn't one we support, return false if (!in_array($attribute, self::IS_GRANTED_CONSTANTS)) { return false; } // Only vote on Devis and Mission objects inside this voter if ($subject !== null && !($subject instanceof Devis)) { return false; } return true; } protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool { $user = $token->getUser(); // Plan.io Task #3707 if ($user instanceof AccessAPI) { if ($user->getAccess() === null) { return false; } $user = $user->getAccess(); } // Plan.io Task #3707 // At this point $user is an object of Access type // even if the $token->getUser() is AccessAPI if (!$user instanceof Access) { // the user must be logged in; if not, deny access return false; } // The user must have a function; if not deny access $function = $user->getFunction(); if ($function === null) return false; // Plan.io Task #3710 : Get current group $currentGroup = $user->getSocietyGroup(); if ($currentGroup === null) return false; $this->currentGroup = $currentGroup; // Module activated ? if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_DEVIS)) { return false; } if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_INVOICE)) { return false; } /** @var Devis */ $devis = $subject; switch ($attribute) { case self::IS_ACTIVE: return true; case self::VIEW_PDF: { if ($devis !== null) { return $this->viewPdf($devis, $user, $function); } else { return false; } } } throw new \LogicException('This code should not be reached!'); } // $access is the user trying to load the resource // $devis is the resource being loaded // Check if the Society of the resource // belongs to the societies of the $access private function checkSociety(Devis $devis, Access $access) { // Get all the societies of the access $societies = $access->getSocieties(); // Get the Society of the Devis $devisSociety = $devis->getSociety(); if ($devisSociety === null) return false; $found = false; foreach ($societies as $society) { if ($society->getId() == $devisSociety->getId()) { $found = true; break; } } return $found; } // Check if the $access is the manager / author of the $devis private function checkManager(Devis $devis, Access $access) { // Get manager $manager = $devis->getManager(); $author = $devis->getAuthor(); if ($manager === null && $author === null) return false; if ($manager !== null) if ($manager->getId() === $access->getId()) return true; if ($author !== null) if ($author->getId() === $access->getId()) return true; return false; } // Check if the $access is the manager of the $devis->getIndividual() private function checkClientManager(Devis $devis, Access $access) { // Get Client $client = $devis->getReceiver(); if ($client === null) return false; if ($client->getIndividual() !== null) { // Only Individuals have managers // Get manager $manager = $devis->getReceiver()->getIndividual()->getManager(); if ($manager === null) return false; if ($manager->getId() === $access->getId()) return true; } return false; } public function viewPdf(Devis $devis, Access $access, AccessFunction $function) { // Get Acl_Permissions $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF); $aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_SOCIETY); $aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_MANAGER); $aclPermClientManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_CLIENT_MANAGER); // If all are null, exit if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null && $aclPermClientManager === null) { return false; } // Get First one if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here it means that nothing good has been found // Load second permission if ($aclPermSociety !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermSociety )); if ($acl !== null) { if ($acl->getValue()) { return $this->checkSociety($devis, $access); } } } // If we are here it means that nothing good has been found // Load third permission if ($aclPermManager !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermManager )); if ($acl !== null) { if ($acl->getValue()) { return $this->checkManager($devis, $access); } } } // If we are here it means that nothing good has been found // Load fourth permission if ($aclPermClientManager !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermClientManager )); if ($acl !== null) { if ($acl->getValue()) { return $this->checkClientManager($devis, $access); } } } // If we are here, all hope is lost return false; }}