Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/ProjectManagerVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Doctrine\Persistence\ManagerRegistry;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use App\Entity\Access;
use App\Entity\APIRest\AccessAPI;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Mission\Mission;
use App\Entity\ProjectManager\Blueprint;
use App\Entity\ProjectManager\BlueprintPdf;
use App\Entity\ProjectManager\ProjectNotebook;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Services\Config\ModuleTools;
class ProjectManagerVoter extends Voter
{
const IS_ACTIVE = "project_manager_is_active";
const CAN_ACCESS = "can_access_project_manager";
const LIST = "list_project_manager_notebooks";
const VIEW_PDF_CLIENT = "view_project_manager_notebook_pdf_client";
const VIEW_PDF_IKEA = "view_project_manager_notebook_pdf_ikea";
const VIEW_PDF_INSTALLER = "view_project_manager_notebook_pdf_installer";
const DELETE = "delete_project_manager_notebook";
// Same as CAN_ACCESS if mission !== null
// If mission === null checks isGranted('rekapp_admin')
const DELETE_KP = "delete_kitchen_planner_project";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::CAN_ACCESS,
self::VIEW_PDF_CLIENT,
self::VIEW_PDF_IKEA,
self::VIEW_PDF_INSTALLER,
self::LIST,
self::DELETE,
self::DELETE_KP,
);
//--------------------------------------------------------------------------------
// acl constants
//--------------------------------------------------------------------------------
const ACL_PERM_CAN_ACCESS = "project_manager_can_access";
const ACL_PERM_LIST = "project_manager_notebook_list";
const ACL_PERM_VIEW_PDF_CLIENT = "project_manager_notebook_view_pdf_client";
const ACL_PERM_VIEW_PDF_IKEA = "project_manager_notebook_view_pdf_ikea";
const ACL_PERM_VIEW_PDF_INSTALLER = "project_manager_notebook_view_pdf_installer";
public function __construct(AccessDecisionManagerInterface $accessDecisionManager, ManagerRegistry $doctrine,
ModuleTools $moduleTools)
{
$this->accessDecisionManager = $accessDecisionManager;
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453 [See AccessVoter for details]
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// only vote on Mission|ProjectNotebook objects inside this voter
if ($subject !== null && !$subject instanceof Mission && !$subject instanceof ProjectNotebook)
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
$originalUserIsAccess = true;
// Plan.io Task #3707
if ($user instanceof AccessAPI)
{
if ($user->getAccess() === null)
{
return false;
}
$user = $user->getAccess();
$originalUserIsAccess = false;
}
// Plan.io Task #3707
// At this point $user is an object of Access type
// even if the $token->getUser() is AccessAPI
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
$this->currentGroup = $currentGroup;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_PROJECT_MANAGER))
{
return false;
}
$mission = null;
$notebook = null;
$subjectGroup = null;
if ($subject !== null)
{
if ($subject instanceof Mission)
{
$mission = $subject;
$notebook = $mission->getProjectNotebook();
$subjectGroup = $mission->getSocietyGroupAuthor();
}
elseif ($subject instanceof ProjectNotebook)
{
$mission = $subject->getMission();
$notebook = $subject;
$subjectGroup = $notebook->getSocietyGroup();
}
}
// Deny for shared missions for now
if ($mission !== null && $mission->isShared())
{
return false;
}
// Check current group affectation
if ($subjectGroup !== null)
{
if (!$currentGroup->equals($subjectGroup))
{
return false;
}
}
switch ($attribute)
{
case self::IS_ACTIVE:
return true;
case self::CAN_ACCESS:
return $this->canAccess($mission, $user, $function);
case self::LIST:
return $this->canList($user, $function);
case self::VIEW_PDF_CLIENT:
{
if ($mission === null || $notebook === null)
{
return false;
}
return $this->canViewPdf($mission, $notebook, $user, $function, $token, BlueprintPdf::pdf_type_client);
}
case self::VIEW_PDF_IKEA:
{
if ($mission === null || $notebook === null)
{
return false;
}
return $this->canViewPdf($mission, $notebook, $user, $function, $token, BlueprintPdf::pdf_type_ikea);
}
case self::VIEW_PDF_INSTALLER:
{
if ($mission === null || $notebook === null)
{
return false;
}
return $this->canViewPdf($mission, $notebook, $user, $function, $token, BlueprintPdf::pdf_type_installer);
}
case self::DELETE:
return $this->canDelete($token);
case self::DELETE_KP:
return $this->canDeleteKp($mission, $user, $function, $token);
}
throw new \LogicException('This code should not be reached!');
}
private function canAccess(?Mission $mission, Access $user, AccessFunction $function)
{
if ($mission === null)
{
// This should not happen
return false;
}
// Get AclPermission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_CAN_ACCESS);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
// If we are here, all hope is lost
return false;
}
private function canList(Access $user, AccessFunction $function)
{
// Get AclPermission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LIST);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
// If we are here, all hope is lost
return false;
}
private function canViewPdf(Mission $mission, ProjectNotebook $projectNotebook, Access $user, AccessFunction $function, $token, $type)
{
// If the user can access the ProjectManager => It can view the PDFs
if ($this->canAccess($mission, $user, $function))
{
return true;
}
// If the user can access the Mission => It can view the PDFs
$mission = $projectNotebook->getMission();
if ($this->accessDecisionManager->decide($token, ['view_mission'], $mission))
{
return true;
}
// Load correct permission based on type
switch ($type) {
case BlueprintPdf::pdf_type_client:
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_CLIENT);
break;
case BlueprintPdf::pdf_type_ikea:
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_IKEA);
break;
case BlueprintPdf::pdf_type_installer:
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_PDF_INSTALLER);
break;
default:
return false;
break;
}
// If all are null, exit
if ($aclPerm === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canDelete($token)
{
return $this->accessDecisionManager->decide($token, ['rekapp_admin']);
}
private function canDeleteKp(?Mission $mission, Access $user, AccessFunction $function, $token)
{
if ($mission === null)
{
// This should not happen
return $this->accessDecisionManager->decide($token, ['rekapp_admin']);
}
return $this->canAccess($mission, $user, $function);
}
}

src/Security/ProjectManagerVoter.php line 64