<?php//------------------------------------------------------------------------------// src/Security/PlanningResourceVoter.php//------------------------------------------------------------------------------namespace App\Security;use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;use Symfony\Component\Security\Core\Authorization\Voter\Voter;use Doctrine\Persistence\ManagerRegistry;use App\Entity\Access;use App\Entity\Config\Config;use App\Entity\Config\Module;use App\Entity\HR\AccessFunction;use App\Entity\Planning\PlanningResource;use App\Entity\Security\Acl;use App\Entity\Security\AclPermission;use App\Services\Config\ModuleTools;class PlanningResourceVoter extends Voter{ //-------------------------------------------------------------------------------- // is_granted constants const ADD = "add_planning_resource"; const ADD_SOCIETY = "add_planning_resource_society"; const ADD_ANY = "add_planning_resource_any"; const LISTING = "list_planning_resources"; const LISTING_SOCIETY = "list_planning_resources_society"; const LISTING_ANY = "list_planning_resources_any"; const EDIT = "edit_planning_resource"; // Needed for altering the order of the planning resources const EDIT_ANY = "edit_planning_resource_any"; const IS_GRANTED_CONSTANTS = array( self::ADD, self::ADD_SOCIETY, self::ADD_ANY, self::LISTING, self::LISTING_SOCIETY, self::LISTING_ANY, self::EDIT, self::EDIT_ANY, ); //-------------------------------------------------------------------------------- // acl constants const ACL_PERM_ADD = "planning_resource_add"; const ACL_PERM_ADD_SOCIETY = "planning_resource_add_society"; const ACL_PERM_LISTING = "planning_resource_list"; const ACL_PERM_LISTING_SOCIETY = "planning_resource_list_society"; const ACL_PERM_EDIT = "planning_resource_edit"; const ACL_PERM_EDIT_SOCIETY = "planning_resource_edit_society"; //-------------------------------------------------------------------------------- public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools) { $this->em = $doctrine->getManager(); $this->moduleTools = $moduleTools; $this->aclRepository = $this->em->getRepository(Acl::class); $this->aclPermissionRepository = $this->em->getRepository(AclPermission::class); } // Plan.io Task #4453 [See AccessVoter for details] public function supportsAttribute(string $attribute): bool { return in_array($attribute, self::IS_GRANTED_CONSTANTS, true); } protected function supports(string $attribute, $subject): bool { // if the attribute isn't one we support, return false if (!in_array($attribute, self::IS_GRANTED_CONSTANTS)) { return false; } // only vote on PlanningResource objects inside this voter if ($subject !== null && !$subject instanceof PlanningResource) { return false; } return true; } protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool { $user = $token->getUser(); if (!$user instanceof Access) { // the user must be logged in; if not, deny access return false; } // The user must have a function; if not deny access $function = $user->getFunction(); if ($function === null) return false; // Plan.io Task #3710 : Get current group $currentGroup = $user->getSocietyGroup(); if ($currentGroup === null) return false; // you know $subject is a PlanningResource object, thanks to supports /** @var PlanningResource $planningResource */ $planningResource = $subject; // Check current group affectation if ($subject !== null) { $subjectSociety = $subject->getSociety(); if ($subjectSociety === null) return false; $subjectGroup = $subjectSociety->getGroup(); if ($subjectGroup === null) return false; if (!$currentGroup->equals($subjectGroup)) return false; } switch ($attribute) { case self::ADD: return $this->canAdd($user, $function); case self::ADD_SOCIETY: return $this->canAddSociety($user, $function); case self::ADD_ANY: return $this->canAddAny($user, $function); case self::LISTING: return $this->canList($user, $function); case self::LISTING_SOCIETY: return $this->canListSociety($user, $function); case self::LISTING_ANY: return $this->canListAny($user, $function); case self::EDIT: return $this->canEdit($planningResource, $user, $function); case self::EDIT_ANY: return $this->canEditAny($user, $function); } throw new \LogicException('This code should not be reached!'); } // $access is the user trying to load the resource // $planningResource is the resource being loaded // Check if the Society of the resource // belongs to the societies of the $access private function checkSociety(PlanningResource $planningResource, Access $access) { // Get all the societies of the access $societies = $access->getSocieties(); // Get the Society of the PlanningResource $planningResourceSociety = $planningResource->getSociety(); if ($planningResourceSociety === null) return false; $found = false; foreach ($societies as $society) { if ($society->getId() == $planningResourceSociety->getId()) { $found = true; break; } } return $found; } private function canAdd(Access $user, AccessFunction $function) { // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission return $acl->getValue(); } private function canAddSociety(Access $user, AccessFunction $function) { // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD_SOCIETY); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission // Further filtering is done in the Controller return $acl->getValue(); } private function canAddAny(Access $user, AccessFunction $function) { // Two AclPermission may exist $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD); $aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD_SOCIETY); // If both are null, exit if ($aclPerm === null && $aclPermSociety === null) return false; // Get First one if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here it means that nothing good has been found // Load second permission if ($aclPermSociety !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermSociety )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here, all hope is lost return false; } private function canList(Access $user, AccessFunction $function) { // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission return $acl->getValue(); } private function canListSociety(Access $user, AccessFunction $function) { // Get AclPermission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission // Further filtering is done in the Controller return $acl->getValue(); } private function canListAny(Access $user, AccessFunction $function) { // Two AclPermission may exist $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING); $aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY); // If both are null, exit if ($aclPerm === null && $aclPermSociety === null) return false; // Get First one if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here it means that nothing good has been found // Load second permission if ($aclPermSociety !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermSociety )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here, all hope is lost return false; } private function canEdit(PlanningResource $planningResource = null, Access $user, AccessFunction $function) { // Two AclPermission may exist $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT); $aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SOCIETY); // If both are null, exit if ($aclPerm === null && $aclPermSociety === null) return false; // Get First one if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here it means that nothing good has been found // Load second permission if ($aclPermSociety !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermSociety )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough // In this case the good answer will be provided by the checkSociety return $this->checkSociety($planningResource, $user); } } } // If we are here, all hope is lost return false; } private function canEditAny(Access $user, AccessFunction $function) { // Two AclPermission may exist $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT); $aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SOCIETY); // If both are null, exit if ($aclPerm === null && $aclPermSociety === null) return false; // Get First one if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here it means that nothing good has been found // Load second permission if ($aclPermSociety !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermSociety )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here, all hope is lost return false; }}