<?php//------------------------------------------------------------------------------// src/Security/SocietyGroupVoter.php//------------------------------------------------------------------------------namespace App\Security;use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;use Symfony\Component\Security\Core\Authorization\Voter\Voter;use Doctrine\Persistence\ManagerRegistry;use App\Entity\Access;use App\Entity\SocietyGroup;use App\Entity\Config\Config;use App\Entity\Config\Module;use App\Entity\HR\AccessFunction;use App\Entity\Security\Acl;use App\Entity\Security\AclPermission;use App\Services\Config\ModuleTools;class SocietyGroupVoter extends Voter{ const VIEW = "view_society_group"; const EDIT = "edit_society_group"; const EDIT_ADMIN = "edit_society_group_admin"; const IS_GRANTED_CONSTANTS = array( self::VIEW, self::EDIT, self::EDIT_ADMIN, ); //-------------------------------------------------------------------------------- // acl constants const ACL_PERM_VIEW = "society_group_view"; const ACL_PERM_EDIT = "society_group_edit"; const ACL_PERM_EDIT_ADMIN = "society_group_edit_admin"; public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools) { $this->em = $doctrine->getManager(); $this->moduleTools = $moduleTools; $this->aclRepository = $this->em->getRepository(Acl::class); $this->aclPermissionRepository = $this->em->getRepository(AclPermission::class); } // Plan.io Task #4453 [See AccessVoter for details] public function supportsAttribute(string $attribute): bool { return in_array($attribute, self::IS_GRANTED_CONSTANTS, true); } protected function supports(string $attribute, $subject): bool { // if the attribute isn't one we support, return false if (!in_array($attribute, self::IS_GRANTED_CONSTANTS)) { return false; } // only vote on SocietyGroup objects inside this voter if ($subject !== null && !$subject instanceof SocietyGroup) { return false; } return true; } protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool { $user = $token->getUser(); if (!$user instanceof Access) { // the user must be logged in; if not, deny access return false; } // The user must have a function; if not deny access $function = $user->getFunction(); if ($function === null) return false; // Plan.io Task #3710 : Get current group $currentGroup = $user->getSocietyGroup(); if ($currentGroup === null) return false; // you know $subject is a SocietyGroup object, thanks to supports /** @var SocietyGroup $society_group */ $society_group = $subject; // Check current group affectation if ($subject !== null) { $subjectGroup = $subject; if ($subjectGroup === null) return false; if (!$currentGroup->equals($subjectGroup)) return false; } switch ($attribute) { case self::VIEW: return $this->canView($society_group, $user, $function); case self::EDIT: return $this->canEdit($society_group, $user, $function); case self::EDIT_ADMIN: return $this->canEditAdmin($society_group, $user, $function); } throw new \LogicException('This code should not be reached!'); } private function canView(SocietyGroup $society_group, Access $access, AccessFunction $function) { // Several Acl_Permission exist $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW); // If all are null, exit if ($aclPerm === null) return false; // Get First one (view all) if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here, all hope is lost return false; } private function canEdit(SocietyGroup $society_group, Access $access, AccessFunction $function) { // Several Acl_Permission exist $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT); // If all are null, exit if ($aclPerm === null) return false; // Get First one (view all) if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here, all hope is lost return false; } private function canEditAdmin(SocietyGroup $society_group, Access $access, AccessFunction $function) { // Several Acl_Permission exist $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_ADMIN); // If all are null, exit if ($aclPerm === null) return false; // Get First one (view all) if ($aclPerm !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here, all hope is lost return false; }}