Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/PunchOutVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Platform\Command\Command;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Services\Config\ModuleTools;
class PunchOutVoter extends Voter
{
//--------------------------------------------------------------------------------
// is_granted constants
const IS_ACTIVE = "punchout_is_active";
const LIST_OWN = "list_own_punchout_commands";
const APPROVE = "approve_punchout_command";
const LIST_WAITING_VALIDATION = "list_waiting_validation_punchout_commands";
const LIST_WAITING_VALIDATION_SOCIETY = "list_waiting_validation_punchout_commands_society";
const LIST_WAITING_VALIDATION_ANY = "list_waiting_validation_punchout_commands_any";
const DELETE = "delete_punchout_command";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::LIST_OWN,
self::APPROVE,
self::LIST_WAITING_VALIDATION,
self::LIST_WAITING_VALIDATION_SOCIETY,
self::LIST_WAITING_VALIDATION_ANY,
self::DELETE,
);
//--------------------------------------------------------------------------------
// acl constants
const ACL_PERM_DELETE_PUNCHOUT = "punchout_command_delete";
const ACL_PERM_DELETE_PUNCHOUT_SOCIETY = "punchout_command_delete_society";
const ACL_PERM_DELETE_PUNCHOUT_MANAGER = "punchout_command_delete_manager";
const ACL_PERM_APPROVE_PUNCHOUT = "punchout_command_approve";
const ACL_PERM_APPROVE_PUNCHOUT_SOCIETY = "punchout_command_approve_society";
//--------------------------------------------------------------------------------
public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools)
{
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453 [See AccessVoter for details]
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject = null): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// only vote on Command objects inside this voter
if ($subject !== null && !$subject instanceof Command)
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
// Module activated ?
if ($attribute != self::LIST_OWN)
{
// Make an Exception for list own
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_PUNCHOUT))
{
return false;
}
}
// you know $subject is a Command object, thanks to supports
/** @var Command $command */
$command = $subject;
// This Voter is for PunchOut Commands only
if ($command !== null)
{
if ($command->isNotPunchOut())
{
return false;
}
}
// Check current group affectation
if ($subject !== null)
{
$subjectSociety = $subject->getSociety();
if ($subjectSociety === null)
return false;
$subjectGroup = $subjectSociety->getGroup();
if ($subjectGroup === null)
return false;
if (!$currentGroup->equals($subjectGroup))
return false;
}
switch ($attribute)
{
// Check is done before, in the voteOnAttribute
case self::IS_ACTIVE:
return true;
case self::LIST_OWN:
return $this->canListOwn($user, $function);
case self::LIST_WAITING_VALIDATION:
return $this->canListWaitingValidation($user, $function);
case self::LIST_WAITING_VALIDATION_SOCIETY:
return $this->canListWaitingValidationSociety($user, $function);
case self::LIST_WAITING_VALIDATION_ANY:
return $this->canListWaitingValidationAny($user, $function);
case self::APPROVE:
return $this->canApprove($command, $user, $function);
case self::DELETE:
return $this->canDelete($command, $user, $function);
}
throw new \LogicException('This code should not be reached!');
}
// $access is the user trying to load the resource
// $command is the resource being loaded
// Check if the Society of the resource
// belongs to the societies of the $access
private function checkSociety(Command $command, Access $access)
{
// Get all the societies of the access
$societies = $access->getSocieties();
// Get the Society of the Command
$commandSociety = $command->getSociety();
if ($commandSociety === null)
return false;
$found = false;
foreach ($societies as $society)
{
if ($society->getId() == $commandSociety->getId())
{
$found = true;
break;
}
}
return $found;
}
// Check if the $access is the manager / author of the $command
private function checkManager(Command $command, Access $access)
{
// Get manager
$manager = $command->getManager();
$author = $command->getAuthor();
$accessCommand = $command->getAccess();
if ($manager === null && $author === null)
return false;
if ($manager !== null)
if ($manager->getId() === $access->getId())
return true;
if ($author !== null)
if ($author->getId() === $access->getId())
return true;
if ($accessCommand !== null)
if ($accessCommand->getId() === $access->getId())
return true;
return false;
}
private function canListOwn(Access $user, AccessFunction $function)
{
// $this->denyAccessUnlessGranted('punchout_is_active');
// Actually no ... display the list in the following cases
// - module is active
// - module is inactive, but the user has at least one PunchOutCommand
$userSocietyGroup = $user->getSocietyGroup();
$nbPunchOutCommands = intval($this->em->getRepository(Command::class)->countPunchOutForAuthor($userSocietyGroup, $user));
if ($nbPunchOutCommands > 0)
{
// If the user has at least one PunchOutCommand
// the list should be available
return true;
}
// If we are here it means that the user has no PunchOutCommands
// Decide access based on module activation
if ($this->moduleTools->isActiveByCode($userSocietyGroup, Module::MODULE_PUNCHOUT))
{
return true;
}
// All hope is lost
return false;
}
private function canDelete(Command $command, Access $user, AccessFunction $function)
{
// Deny on all punchOut Commands that have already beed sent to the Supplier
if ($command->hasBeenSentToPunchOutSupplier())
{
return false;
}
// Allow Authors to delete their own commands
$author = $command->getAuthor();
if ($user->equals($author))
{
return true;
}
// Three Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE_PUNCHOUT);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE_PUNCHOUT_SOCIETY);
$aclPermManager = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE_PUNCHOUT_MANAGER);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermManager === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($command, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermManager !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermManager
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkOwn
return $this->checkManager($command, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
// Plan.io task #4261
public function canApprove(Command $command, Access $user, AccessFunction $function)
{
// Authorize approve only if command is waiting validation
if (!$command->isPunchOutValidation())
{
return false;
}
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_APPROVE_PUNCHOUT);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_APPROVE_PUNCHOUT_SOCIETY);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($command, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
// Plan.io task #4261
public function canListWaitingValidationAny(Access $user, AccessFunction $function)
{
$canListWaitingValidation = $this->canListWaitingValidation($user, $function);
if ($canListWaitingValidation)
{
// Access granted
return true;
}
$canListWaitingValidationSociety = $this->canListWaitingValidationSociety($user, $function);
if ($canListWaitingValidationSociety)
{
// Access granted
return true;
}
// If we are here, all hope is lost
return false;
}
// Plan.io task #4261
public function canListWaitingValidation(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_APPROVE_PUNCHOUT);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
// Plan.io task #4261
public function canListWaitingValidationSociety(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_APPROVE_PUNCHOUT_SOCIETY);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
}

src/Security/PunchOutVoter.php line 60