<?php//------------------------------------------------------------------------------// src/Security/WebappMakerVoter.php//------------------------------------------------------------------------------namespace App\Security;use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;use Symfony\Component\Security\Core\Authorization\Voter\Voter;use Doctrine\Persistence\ManagerRegistry;use App\Entity\Access;use App\Entity\Config\Config;use App\Entity\Config\Module;use App\Entity\Config\OptionConfig;use App\Entity\HR\AccessFunction;use App\Entity\Security\Acl;use App\Entity\Security\AclPermission;use App\Entity\WebappMaker\Template as WebappTemplate;use App\Services\Config\ModuleTools;use App\Services\Config\OptionConfigTools;class WebappMakerVoter extends Voter{ // Allow authors as managers //-------------------------------------------------------------------------------- // is_granted constants const IS_ACTIVE = "webapp_maker_is_active"; const ADD = "add_webapp_template"; const EDIT = "edit_webapp_template"; const DELETE = "delete_webapp_template"; const DO_ANY = "do_any_webapp_template"; const IS_GRANTED_CONSTANTS = array( self::IS_ACTIVE, self::ADD, self::EDIT, self::DELETE, self::DO_ANY, ); //-------------------------------------------------------------------------------- // acl constants const ACL_PERM_ADD = "webapp_maker_template_add"; const ACL_PERM_EDIT = "webapp_maker_template_edit"; const ACL_PERM_DELETE = "webapp_maker_template_delete"; //-------------------------------------------------------------------------------- public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools, OptionConfigTools $optionConfigTools) { $this->em = $doctrine->getManager(); $this->moduleTools = $moduleTools; $this->optionConfigTools = $optionConfigTools; $this->aclRepository = $this->em->getRepository(Acl::class); $this->aclPermissionRepository = $this->em->getRepository(AclPermission::class); } // Plan.io Task #4453 [See AccessVoter for details] public function supportsAttribute(string $attribute): bool { return in_array($attribute, self::IS_GRANTED_CONSTANTS, true); } protected function supports(string $attribute, $subject = null): bool { // if the attribute isn't one we support, return false if (!in_array($attribute, self::IS_GRANTED_CONSTANTS)) { return false; } // only vote on WebappTemplate or Task objects inside this voter if ($subject !== null && !($subject instanceof WebappTemplate)) { return false; } return true; } protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool { $user = $token->getUser(); if (!$user instanceof Access) { // the user must be logged in; if not, deny access return false; } // The user must have a function; if not deny access $function = $user->getFunction(); if ($function === null) return false; // Plan.io Task #3710 : Get current group $currentGroup = $user->getSocietyGroup(); if ($currentGroup === null) return false; $this->currentGroup = $currentGroup; // Module activated ? if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_DOCUMENT)) { return false; } // Option activated for this SocietyGroup ? $userSocietyGroup = $user->getSocietyGroup(); if ($userSocietyGroup === null) { return false; } if (!$this->optionConfigTools->isActive_WebappMaker($userSocietyGroup)) { return false; } // you know $subject is a WebappTemplate object, thanks to supports /** @var WebappTemplate $template */ $template = $subject; // Check current group affectation if ($subject !== null && $subject instanceof WebappTemplate) { $subjectGroup = $subject->getSocietyGroup(); if ($subjectGroup === null) return false; if (!$currentGroup->equals($subjectGroup)) return false; } switch ($attribute) { case self::IS_ACTIVE: return true; case self::ADD: { return $this->canAdd($user, $function); } case self::EDIT: { return $this->canEdit($template, $user, $function); } case self::DELETE: { return $this->canDelete($template, $user, $function); } case self::DO_ANY: { return $this->canDoAny($user, $function); } } throw new \LogicException('This code should not be reached!'); } private function canDoAny(Access $user, AccessFunction $function) { // Several AclPermission may exist $aclPermAdd = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD); $aclPermEdit = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT); $aclPermDelete = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE); // If both are null, exit if ($aclPermAdd === null && $aclPermEdit === null && $aclPermDelete === null) return false; // Get First one if ($aclPermAdd !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermAdd )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here it means that nothing good has been found // Load second permission if ($aclPermEdit !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermEdit )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here it means that nothing good has been found // Load third permission if ($aclPermDelete !== null) { $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPermDelete )); if ($acl !== null) { if ($acl->getValue()) { // A single positive answer is enough return true; } } } // If we are here, all hope is lost return false; } private function canAdd(Access $user, AccessFunction $function) { // Get Acl_Permission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission return $acl->getValue(); } private function canEdit(WebappTemplate $template, Access $user, AccessFunction $function) { // Allow authors to edit their own templates if ($template->getAuthor() !== null && $template->getAuthor()->equals($user)) { return true; } // Get Acl_Permission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission return $acl->getValue(); } private function canDelete(WebappTemplate $template, Access $user, AccessFunction $function) { // Allow authors to delete their own templates if ($template->getAuthor() !== null && $template->getAuthor()->equals($user)) { return true; } // Get Acl_Permission $aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE); if ($aclPerm === null) return false; // Get Acl $acl = $this->aclRepository->findOneBy(array( 'function' => $function, 'permission' => $aclPerm )); if ($acl === null) return false; // Since only one acl type can exist // we can return the result of the acl_permission return $acl->getValue(); }}