src/Security/Voter/FileVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace App\Security\Voter;
  5. use App\Entity\Client\Client;
  6. use App\Entity\File;
  7. use App\Entity\User;
  8. use Doctrine\ORM\EntityManagerInterface;
  9. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. use Symfony\Component\Security\Core\Security;
  13. class FileVoter extends Voter
  14. {
  15. // these strings are just invented: you can use anything
  16. const VIEW = 'view';
  17. const EDIT = 'edit';
  18. const DELETE = 'delete';
  19. /**
  20. * @var Security
  21. */
  22. private Security $security;
  23. /**
  24. * @var EntityManagerInterface
  25. */
  26. private EntityManagerInterface $entityManager;
  28. public function __construct(Security $security, EntityManagerInterface $entityManager)
  29. {
  30. $this->security = $security;
  31. $this->entityManager = $entityManager;
  32. }
  34. protected function supports(string $attribute, $subject): bool
  35. {
  36. // if the attribute isn't one we support, return false
  37. if (!in_array($attribute, [self::VIEW, self::EDIT, self::DELETE], true)) {
  38. return false;
  39. }
  41. // only vote on `File` objects
  42. if (!$subject instanceof File) {
  43. return false;
  44. }
  46. return true;
  47. }
  49. protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  50. {
  51. $loggedUser = $token->getUser();
  53. if (!$loggedUser instanceof User) {
  54. // the user must be logged in; if not, deny access
  55. return false;
  56. }
  58. // you know $subject is a Post object, thanks to `supports()`
  59. /** @var File $targetFile */
  60. $targetFile = $subject;
  62. switch ($attribute) {
  63. case self::VIEW:
  64. return $this->canSee($targetFile, $loggedUser);
  65. case self::EDIT:
  66. return $this->canEdit($targetFile, $loggedUser);
  67. case self::DELETE:
  68. return $this->canDelete($targetFile, $loggedUser);
  69. }
  71. throw new \LogicException('This code should not be reached!');
  72. }
  74. /**
  75. * @param File $targetFile
  76. * @param User $loggedUser
  77. * @return bool
  78. */
  79. private function canSee(File $targetFile, User $loggedUser): bool
  80. {
  81. if ($targetFile->isCommon() && $this->security->isGranted('IS_AUTHENTICATED_FULLY')) {
  82. return true;
  83. }
  85. // file has no client
  86. if ($targetFile->getClient() === null) {
  87. return false;
  88. }
  90. /** @var Client $fileClient */
  91. $fileClient = $targetFile->getClient();
  93. // sanity check (different client than logged user client)
  94. if ($fileClient->getId() !== $loggedUser->getClient()->getId()) {
  95. return false;
  96. }
  98. /** user who created this file is granted */
  99. if ($targetFile->getCreatedBy() === $loggedUser) {
  100. return true;
  101. }
  103. // vote by sharing options - context client
  104. if ($targetFile->getContext() === File::CONTEXT_CLIENT) {
  105. return in_array($targetFile->getSharedWith(), File::getSharedWithOptionsByRole($loggedUser->getRole()->getName()), true);
  106. }
  108. // vote by buildings
  109. if ($this->security->isGranted('ROLE_CAN_SEE_ALL_BUILDINGS')) {
  110. return true;
  111. }
  113. if (!$targetFile->getBuildings()->isEmpty()) {
  114. foreach ($targetFile->getBuildings() as $building) {
  115. if ($loggedUser->getBuildings()->contains($building)) {
  116. return true;
  117. }
  118. }
  119. }
  121. if (!$targetFile->getGauges()->isEmpty()) {
  122. foreach ($targetFile->getGauges() as $gauge) {
  123. if ($loggedUser->getBuildings()->contains($gauge->getBuilding())) {
  124. return true;
  125. }
  126. }
  127. }
  129. return false;
  130. }
  132. /**
  133. * @param File $targetFile
  134. * @param User $loggedUser
  135. * @return bool
  136. */
  137. private function canEdit(File $targetFile, User $loggedUser):bool
  138. {
  139. if ($targetFile->isCommon()) {
  140. return $this->security->isGranted('ROLE_CAN_EDIT_COMMON_FILE') && $this->canSee($targetFile, $loggedUser);
  141. }
  143. return $this->security->isGranted('ROLE_CAN_EDIT_FILE') && $this->canSee($targetFile, $loggedUser);
  144. }
  146. /**
  147. * @param File $targetFile
  148. * @param User $loggedUser
  149. * @return bool
  150. */
  151. private function canDelete(File $targetFile, User $loggedUser):bool
  152. {
  153. if ($targetFile->isCommon()) {
  154. return $this->security->isGranted('ROLE_CAN_DELETE_COMMON_FILE') && $this->canSee($targetFile, $loggedUser);
  155. }
  157. return $this->security->isGranted('ROLE_CAN_DELETE_FILE') && $this->canSee($targetFile, $loggedUser);
  158. }
  159. }