Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/InvoiceVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\APIRest\AccessAPI;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Platform\Devis\Devis;
use App\Entity\Platform\Invoice\Invoice;
use App\Entity\Mission\Mission;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Services\LogTools;
use App\Services\Config\ModuleTools;
use App\Services\Config\OptionConfigTools;
class InvoiceVoter extends Voter
{
// For now manager = author (both)
//--------------------------------------------------------------------------------
// is_granted constants
const IS_ACTIVE = "invoice_is_active";
// addSimple :: $devis
// addCredit :: $invoice
// addFree :: $mission
const ADD = "add_invoice";
// addPartial :: $devis
// addPartialForSociety :: $devis
const ADD_PART = "add_partial_invoice";
// addFromDraft :: $draft instanceof Invoice
const CONVERT_DRAFT = "add_invoice_from_draft";
const DELETE_DRAFT = "delete_draft";
const LISTING = "list_invoices";
const LISTING_SOCIETY = "list_invoices_society";
const LISTING_MANAGER = "list_invoices_manager";
const LISTING_ANY = "list_invoices_any";
const VIEW = "view_invoice";
const VIEW_PDF = "view_pdf_invoice";
const EDIT = "edit_invoice";
const EDIT_ANNULLED = "edit_invoice_annulled";
const DELETE = "delete_invoice";
const ANNUL = "annul_invoice";
const REVIVE = "revive_invoice";
const IS_ACTIVE_INVOICE_AUTO_ACCOUNT = "invoice_auto_account_is_active";
// Plan.io Task #4326
const HANDLE_INSTALLMENT = "handle_installment_for_invoice";
// Plan.io Task #4326
// I need some restrictions on the actions that can be done via the invoices list
// ie. convert drafts, delete drafts (for now at least ...)
// So check if the user has at least one edit permission active
const EDIT_SOME_INVOICES = "edit_some_invoices";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::ADD,
self::ADD_PART, // Plan.io Task #3605
self::CONVERT_DRAFT, // Plan.io Task #4326
self::DELETE_DRAFT, // Plan.io Task #4326
self::LISTING,
self::LISTING_SOCIETY,
self::LISTING_MANAGER,
self::LISTING_ANY,
self::VIEW,
self::VIEW_PDF,
self::EDIT,
self::EDIT_ANNULLED,
self::DELETE,
self::ANNUL,
self::REVIVE,
self::IS_ACTIVE_INVOICE_AUTO_ACCOUNT,
self::HANDLE_INSTALLMENT, // Plan.io Task #4326
self::EDIT_SOME_INVOICES, // Plan.io Task #4326
);
const IS_GRANTED_CONSTANTS_SHARING_EXCEPTION = array(
self::VIEW,
self::VIEW_PDF,
);
//--------------------------------------------------------------------------------
// acl constants
const ACL_PERM_ADD = "invoice_add";
const ACL_PERM_LISTING = "invoice_list";
const ACL_PERM_LISTING_SOCIETY = "invoice_list_society";
const ACL_PERM_LISTING_MANAGER = "invoice_list_manager";
const ACL_PERM_VIEW = "invoice_view";
const ACL_PERM_VIEW_SOCIETY = "invoice_view_society";
const ACL_PERM_VIEW_MANAGER = "invoice_view_manager";
const ACL_PERM_VIEW_CLIENT_MANAGER = "invoice_view_ind_manager";
const ACL_PERM_VIEW_PDF = "invoice_view_pdf";
const ACL_PERM_VIEW_PDF_SOCIETY = "invoice_view_pdf_society";
const ACL_PERM_VIEW_PDF_MANAGER = "invoice_view_pdf_manager";
const ACL_PERM_VIEW_PDF_CLIENT_MANAGER = "invoice_view_pdf_ind_manager";
const ACL_PERM_EDIT = "invoice_edit";
const ACL_PERM_EDIT_SOCIETY = "invoice_edit_society";
const ACL_PERM_EDIT_MANAGER = "invoice_edit_manager";
const ACL_PERM_EDIT_CLIENT_MANAGER = "invoice_edit_ind_manager";
const ACL_PERM_EDIT_ANNULLED = "invoice_edit_annulled";
const ACL_PERM_ANNUL = "invoice_annul";
const ACL_PERM_ANNUL_SOCIETY = "invoice_annul_society";
const ACL_PERM_REVIVE = "invoice_revive";
const ACL_PERM_REVIVE_SOCIETY = "invoice_revive_society";
//--------------------------------------------------------------------------------
public function __construct(AccessDecisionManagerInterface $accessDecisionManager, ManagerRegistry $doctrine, ModuleTools $moduleTools, OptionConfigTools $optionConfigTools, LogTools $logTools)
{
$this->accessDecisionManager = $accessDecisionManager;
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->optionConfigTools = $optionConfigTools;
$this->logTools = $logTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453 [See AccessVoter for details]
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// Only vote on Invoice and Mission objects inside this voter
// ... and Devis (Plan.io #3605)
if ($subject !== null && !($subject instanceof Invoice || $subject instanceof Mission || $subject instanceof Devis))
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
// Plan.io Task #3707
if ($user instanceof AccessAPI)
{
if ($user->getAccess() === null)
{
return false;
}
$user = $user->getAccess();
}
// Plan.io Task #3707
// At this point $user is an object of Access type
// even if the $token->getUser() is AccessAPI
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
$this->currentGroup = $currentGroup;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_INVOICE))
{
return false;
}
$invoice = null;
$mission = null;
if ($subject instanceof Invoice)
{
/** @var Invoice $invoice */
$invoice = $subject;
// Check current group affectation
// Make an exception for "view/pdf" : take sharing into account
if ($invoice !== null)
{
$invoiceSociety = $invoice->getSociety();
if ($invoiceSociety === null)
return false;
$invoiceSocietyGroup = $invoiceSociety->getGroup();
if ($invoiceSocietyGroup === null)
return false;
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS_SHARING_EXCEPTION))
{
// Just check currentGroup
if (!$currentGroup->equals($invoiceSocietyGroup))
return false;
}
else
{
// Take sharing into account
// If the invoice belongs to a mission that was created by the currentGroup
// (invoice.mission.societyGroupAuthor == currentGroup)
// Then it can see the invoice
if (!$currentGroup->equals($invoiceSocietyGroup))
{
if ($invoice->getMission() !== null)
{
$missionSocietyGroupAuthor = $invoice->getMission()->getSocietyGroupAuthor();
if (!$currentGroup->equals($missionSocietyGroupAuthor))
{
return false;
}
}
}
}
}
}
else
{
if ($subject instanceof Mission)
{
/** @var Mission $mission */
$mission = $subject;
// Plan.io Task #3517
// Adding an invoice counts as editing a mission
// So check if the current user has access to this mission
// If this is too restrictive, change 'edit_mission' with 'view_mission'
// 'view_mission' is better ;)
if (!$this->accessDecisionManager->decide($token, ['view_mission'], $mission))
{
return false;
}
}
}
switch ($attribute)
{
case self::IS_ACTIVE:
return true;
case self::IS_ACTIVE_INVOICE_AUTO_ACCOUNT:
{
return $this->optionConfigTools->isActive_InvoiceAutoAccount($currentGroup);
}
case self::ADD:
{
// addSimple :: $devis
// addCredit :: $invoice
// addFree :: $mission
return $this->canAdd($subject, $user, $function);
}
case self::EDIT_SOME_INVOICES:
{
// Plan.io Task #4326
return $this->canEditSomeInvoices($user, $function);
}
case self::CONVERT_DRAFT:
{
// Plan.io Task #4326
// addFromDraft :: $draft instanceof Invoice
return $this->canConvertDraft($subject, $user, $function);
}
case self::DELETE_DRAFT:
{
// Plan.io Task #4326
// addFromDraft :: $draft instanceof Invoice
return $this->canDeleteDraft($subject, $user, $function);
}
// Plan.io Task #3605
case self::ADD_PART:
{
// addPartial :: $devis
// addPartialForSociety :: $devis
return $this->canAddPart($subject, $user, $function);
}
case self::LISTING:
return $this->canList($invoice, $user, $function);
case self::LISTING_SOCIETY:
return $this->canListSociety($invoice, $user, $function);
case self::LISTING_MANAGER:
return $this->canListManager($invoice, $user, $function);
case self::LISTING_ANY:
return $this->canListAny($invoice, $user, $function);
case self::VIEW:
return $this->canView($invoice, $user, $function);
case self::VIEW_PDF:
return $this->canViewPdf($invoice, $user, $function);
case self::EDIT:
return $this->canEdit($invoice, $user, $function);
case self::EDIT_ANNULLED:
return $this->canEditAnnulled($invoice, $user, $function);
case self::DELETE:
return $this->canDelete($invoice, $user, $function);
case self::ANNUL:
return $this->canAnnul($invoice, $user, $function);
case self::REVIVE:
return $this->canRevive($invoice, $user, $function);
case self::HANDLE_INSTALLMENT:
return $this->canHandleInstallment($invoice, $user, $function);
}
throw new \LogicException('This code should not be reached!');
}
// $access is the user trying to load the resource
// $invoice is the resource being loaded
// Check if the Society of the resource
// belongs to the societies of the $access
private function checkSociety(Invoice $invoice, Access $access)
{
// Get all the societies of the access
$societies = $access->getSocieties();
// Get the Society of the Invoice
$invoiceSociety = $invoice->getSociety();
if ($invoiceSociety === null)
return false;
$found = false;
foreach ($societies as $society)
{
if ($society->getId() == $invoiceSociety->getId())
{
$found = true;
break;
}
}
return $found;
}
// Check if the $access is the manager / author of the $invoice
private function checkManager(Invoice $invoice, Access $access)
{
// Get manager
$manager = $invoice->getManager();
$author = $invoice->getManager();
if ($manager === null && $author === null)
return false;
if ($manager !== null)
if ($manager->getId() === $access->getId())
return true;
if ($author !== null)
if ($author->getId() === $access->getId())
return true;
return false;
}
// Check if the $access is the manager of the $invoice
private function checkClientManager(Invoice $invoice, Access $access)
{
// Get Client
$client = $invoice->getReceiver();
if ($client === null)
return false;
if ($client->getIndividual() !== null)
{
// Only Individuals have managers
// Get manager
$manager = $invoice->getReceiver()->getIndividual()->getManager();
if ($manager === null)
return false;
if ($manager->getId() === $access->getId())
return true;
}
return false;
}
private function canAdd($subject, Access $user, AccessFunction $function)
{
if ($subject instanceof Invoice)
{
// Plan.io Task #4326
// No adding invoices for drafts
if ($subject->isDraft())
{
return false;
}
}
return $this->commonAddConditions($subject, $user, $function);
}
// Plan.io Task #4326
private function canDeleteDraft(Invoice $draft, Access $user, AccessFunction $function)
{
// No deleting invoices
if ($draft->isNotDraft())
{
return false;
}
return $this->commonEditConditions($draft, $user, $function);
}
// Plan.io Task #4326
private function canConvertDraft(Invoice $draft, Access $user, AccessFunction $function)
{
// No converting invoices
if ($draft->isNotDraft())
{
return false;
}
return $this->commonAddConditions($draft, $user, $function);
}
private function commonAddConditions($subject, Access $user, AccessFunction $function)
{
if ($subject instanceof Invoice)
{
$mission = $subject->getMission();
}
else
{
if ($subject instanceof Devis)
{
$mission = $subject->getMission();
}
else
{
if ($subject instanceof Mission)
{
$mission = $subject;
}
else
{
return false;
}
}
}
if ($mission === null)
{
return false;
}
// Deny actions on archivedRefused objects
if ($mission->isArchivedRefused())
{
return false;
}
// If the mission is shared and the author is the current group, deny adding devis
// When a mission is shared, the author cannot edit it
if ($mission->isShared())
{
if ($mission->isSharedBySocietyGroup($this->currentGroup))
{
return false;
}
}
// Get AclPermission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
// Plan.io Task #3605
private function canAddPart(Devis $devis, Access $user, AccessFunction $function)
{
if (!$this->canAdd($devis->getMission(), $user, $function))
{
// Deny if no permission to add any kind of invoices
return false;
}
if ($devis->getGhost() !== null)
{
// Deny permission if devis has a ghost
return false;
}
// Plan.io Task #4328
if ($devis->hasEcoBonus())
{
// Deny permission if devis has ecobonus
return false;
}
// Allow
return true;
}
private function canEditAnnulled(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Plan.io Task #4326 : Deny on everything that is not a Draft
if ($invoice->isNotDraft())
{
return false;
}
// Plan.io Task #3897 : Deny on Group Invoices
if ($invoice->isGroup())
{
return false;
}
// Deny edit on archivedRefused objects
if ($invoice->isArchivedRefused())
{
return false;
}
// Get AclPermission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_ANNULLED);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canList(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Get AclPermission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canListSociety(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Get AclPermission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListManager(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Get AclPermission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_MANAGER);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListAny(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Three AclPermission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canView(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Four AclPermission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_MANAGER);
$aclPermClientManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_CLIENT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null && $aclPermClientManager)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($invoice, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkManager($invoice, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load fourth permission
if ($aclPermClientManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermClientManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkClientManager($invoice, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canViewPdf(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Four AclPermission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_MANAGER);
$aclPermClientManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_CLIENT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null && $aclPermClientManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($invoice, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkManager($invoice, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load fourth permission
if ($aclPermClientManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermClientManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkClientManager($invoice, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canHandleInstallment(Invoice $invoice, Access $user, AccessFunction $function)
{
return $this->commonEditConditions($invoice, $user, $function);
}
private function canEdit(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Plan.io Task #4326 : Deny on everything that is not a Draft
if ($invoice->isNotDraft())
{
return false;
}
// Plan.io Task #4328
if ($this->moduleTools->isInactiveByCode($this->currentGroup, Module::MODULE_ECO_BONUS) && $invoice->hasEcoBonus())
{
// Deny permission if devis has ecobonus
return false;
}
return $this->commonEditConditions($invoice, $user, $function);
}
private function commonEditConditions(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// Plan.io Task #3897 : Deny on Group Invoices
if ($invoice->isGroup())
{
return false;
}
// Deny edit on archivedRefused objects
if ($invoice->isArchivedRefused())
{
return false;
}
// No edditing on annulled invoices
if ($invoice->isAnnulled())
{
return false;
}
// Plan.io Task #4208 : Invoices should never be annulled,
// so even if the Invoice has a Credit, allow editing it
// No edditing on invoices that have been "annuled" (with credit)
// $credit = $this->em->getRepository(Invoice::class)->findOneByCreditInvoice($invoice);
// if ($credit !== null)
// return false;
// Four AclPermission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_MANAGER);
$aclPermClientManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_CLIENT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null && $aclPermClientManager)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($invoice, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkManager($invoice, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load fourth permission
if ($aclPermClientManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermClientManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkClientManager($invoice, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canDelete(Invoice $invoice = null, Access $user, AccessFunction $function)
{
return false;
}
private function canAnnul(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// We no longer annul invoices
return false;
}
private function canRevive(Invoice $invoice = null, Access $user, AccessFunction $function)
{
// We no longer annul & revive invoices
return false;
}
// Plan.io Task #4326
// I need some restrictions on the actions that can be done via the invoices list
// ie. convert drafts, delete drafts (for now at least ...)
// So check if the user has at least one edit permission active
private function canEditSomeInvoices(Access $user, AccessFunction $function)
{
// Four AclPermission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_MANAGER);
$aclPermClientManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_CLIENT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null && $aclPermClientManager)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load fourth permission
if ($aclPermClientManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermClientManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
}

src/Security/InvoiceVoter.php line 143