Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/CostVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\APIRest\AccessAPI;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Platform\Cost\Cost;
use App\Entity\Platform\Cost\CostNote;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Services\LogTools;
use App\Services\Config\OptionConfigTools;
use App\Services\Config\ModuleTools;
class CostVoter extends Voter
{
//--------------------------------------------------------------------------------
// is_granted constants
const IS_ACTIVE = "cost_is_active";
const ADD = "add_cost";
const ADD_FOR_OTHERS = "add_cost_for_others";
const ADD_WITH_EDITABLE_STATUS = "add_cost_with_editable_status";
// Plan.io Task #4507
const ADD_COST_VENDOR_INVOICE = "add_cost_vendor_invoice";
const LISTING = "list_costs";
const LISTING_SOCIETY = "list_costs_society";
const LISTING_OWN = "list_costs_own";
const LISTING_ANY = "list_costs_any";
const VIEW = "view_cost";
const EDIT = "edit_cost";
const EDIT_STATUS = "edit_cost_status";
const EDIT_TYPE = "edit_cost_type";
const DELETE = "delete_cost";
const SEEN = "mark_seen_cost";
const ADD_COST_NOTE = "add_cost_note";
const EDIT_COST_NOTE = "edit_cost_note";
const DELETE_COST_NOTE = "delete_cost_note";
// Plan.io Task #4426
const IS_ACTIVE_COST_AUTO_ACCOUNT = "cost_auto_account_is_active";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::ADD,
self::ADD_FOR_OTHERS,
self::ADD_WITH_EDITABLE_STATUS,
self::ADD_COST_VENDOR_INVOICE,
self::LISTING,
self::LISTING_SOCIETY,
self::LISTING_OWN,
self::LISTING_ANY,
self::VIEW,
self::EDIT,
self::EDIT_STATUS,
self::EDIT_TYPE,
self::DELETE,
self::SEEN,
self::ADD_COST_NOTE,
self::EDIT_COST_NOTE,
self::DELETE_COST_NOTE,
self::IS_ACTIVE_COST_AUTO_ACCOUNT,
);
//--------------------------------------------------------------------------------
// acl constants
const ACL_PERM_ADD = "cost_add";
const ACL_PERM_ADD_FOR_OTHERS = "cost_add_for_others";
const ACL_PERM_ADD_WITH_EDITABLE_STATUS = "cost_add_with_editable_status";
// Plan.io Task #4507
const ACL_PERM_ADD_VENDOR_INVOICE = "cost_vendor_invoice_add";
const ACL_PERM_LISTING = "cost_list";
const ACL_PERM_LISTING_SOCIETY = "cost_list_society";
const ACL_PERM_LISTING_OWN = "cost_list_own";
const ACL_PERM_VIEW = "cost_view";
const ACL_PERM_VIEW_SOCIETY = "cost_view_society";
const ACL_PERM_VIEW_OWN = "cost_view_own";
const ACL_PERM_EDIT = "cost_edit";
const ACL_PERM_EDIT_SOCIETY = "cost_edit_society";
const ACL_PERM_EDIT_OWN = "cost_edit_own";
const ACL_PERM_EDIT_STATUS = "cost_edit_status";
const ACL_PERM_EDIT_STATUS_SOCIETY = "cost_edit_status_society";
const ACL_PERM_DELETE = "cost_delete";
const ACL_PERM_DELETE_SOCIETY = "cost_delete_society";
const ACL_PERM_DELETE_OWN = "cost_delete_own";
const ACL_PERM_SEEN = "cost_seen";
//--------------------------------------------------------------------------------
public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools, OptionConfigTools $optionConfigTools, LogTools $logTools)
{
$this->em = $doctrine->getManager();
$this->optionConfigTools = $optionConfigTools;
$this->moduleTools = $moduleTools;
$this->logTools = $logTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453 [See AccessVoter for details]
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject = null): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// only vote on Cost objects inside this voter
if ($subject !== null && (!$subject instanceof Cost && !$subject instanceof CostNote))
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
// Plan.io Task #3707
if ($user instanceof AccessAPI)
{
if ($user->getAccess() === null)
{
return false;
}
$user = $user->getAccess();
}
// Plan.io Task #3707
// At this point $user is an object of Access type
// even if the $token->getUser() is AccessAPI
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_COST))
{
return false;
}
// you know $subject is a Cost/CostNote object, thanks to supports
$costNote = null;
if ($subject instanceof CostNote)
{
/** @var CostNote $costNote */
$costNote = $subject;
/** @var Cost $cost */
$cost = $costNote->getCost();
}
else
{
/** @var Cost $cost */
$cost = $subject;
}
// Check current group affectation
if ($subject !== null)
{
$subjectSociety = $subject->getSociety();
if ($subjectSociety === null)
return false;
$subjectGroup = $subjectSociety->getGroup();
if ($subjectGroup === null)
return false;
if (!$currentGroup->equals($subjectGroup))
return false;
}
switch ($attribute)
{
case self::IS_ACTIVE:
return true;
case self::IS_ACTIVE_COST_AUTO_ACCOUNT:
{
return $this->optionConfigTools->isActive_CostAutoAccount($currentGroup);
}
case self::ADD:
return $this->canAdd($user, $function);
case self::ADD_FOR_OTHERS:
return $this->canAddForOthers($user, $function);
case self::ADD_WITH_EDITABLE_STATUS:
return $this->canAddWithEditableStatus($user, $function);
// Plan.io Task #4507
case self::ADD_COST_VENDOR_INVOICE:
return $this->canAddVendorInvoice($user, $function);
case self::LISTING:
return $this->canList($user, $function);
case self::LISTING_SOCIETY:
return $this->canListSociety($user, $function);
case self::LISTING_OWN:
return $this->canListOwn($user, $function);
case self::LISTING_ANY:
return $this->canListAny($user, $function);
case self::VIEW:
return $this->canView($cost, $user, $function);
case self::EDIT:
return $this->canEdit($cost, $user, $function);
case self::EDIT_STATUS:
return $this->canEditStatus($cost, $user, $function);
case self::EDIT_TYPE:
return $this->canEditType($cost, $user, $function);
case self::DELETE:
return $this->canDelete($cost, $user, $function);
case self::SEEN:
return $this->canMarkAsSeen($cost, $user, $function);
case self::ADD_COST_NOTE:
return $this->canAddCostNote($cost, $user, $function);
case self::EDIT_COST_NOTE:
return $this->canEditCostNote($costNote, $user, $function);
case self::DELETE_COST_NOTE:
return $this->canDeleteCostNote($costNote, $user, $function);
}
throw new \LogicException('This code should not be reached!');
}
// $access is the user trying to load the resource
// $cost is the resource being loaded
// Check if the Society of the resource
// belongs to the societies of the $access
private function checkSociety(Cost $cost, Access $access)
{
// Get all the societies of the access
$societies = $access->getSocieties();
// Get the Society of the Cost
$costSociety = $cost->getSociety();
if ($costSociety === null)
return false;
$found = false;
foreach ($societies as $society)
{
if ($society->getId() == $costSociety->getId())
{
$found = true;
break;
}
}
return $found;
}
// Check if the $access is the manager / author of the $cost
private function checkOwn(Cost $cost, Access $access)
{
// Get author
$author = $cost->getAuthor();
if ($author === null)
return false;
if ($author->getId() === $access->getId())
return true;
// Get access
$theOne = $cost->getAccess();
if ($theOne === null)
return false;
if ($theOne->getId() === $access->getId())
return true;
return false;
}
private function canAdd(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
public function canAddForOthers(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD_FOR_OTHERS);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
public function canAddWithEditableStatus(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD_WITH_EDITABLE_STATUS);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
// Plan.io Task #4507
/**
* Vendor invoices are now entered through the received invoices module, so this legacy
* creation path is closed for everyone whatever the ACL says. Existing vendor invoice
* costs stay viewable and editable through the regular cost attributes.
*
* Plan.io Task #4683
*/
public function canAddVendorInvoice(Access $user, AccessFunction $function)
{
return false;
}
private function canList(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canListSociety(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListOwn(Access $user, AccessFunction $function)
{
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_OWN);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
// Further filtering is done in the Controller
return $acl->getValue();
}
private function canListAny(Access $user, AccessFunction $function)
{
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_SOCIETY);
$aclPermOwn = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_LISTING_OWN);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermOwn === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermOwn !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermOwn
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
private function canView(Cost $cost, Access $user, AccessFunction $function)
{
// Get Acl_Permissions
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_SOCIETY);
$aclPermOwn = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_VIEW_OWN);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermOwn === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($cost, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermOwn !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermOwn
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkOwn
return $this->checkOwn($cost, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canEdit(Cost $cost, Access $user, AccessFunction $function)
{
// Children only
// Plan.io Task #4416 => VendorInvoice also
if ($cost->getParent() === null && $cost->isNotVendorInvoice())
{
return false;
}
// If the initial status has changed => Deny editing
if ($cost->getStatus() === null)
{
// This should not happen
return false;
}
else
{
if ($cost->getStatus()->isNotDefaultValue())
{
return false;
}
}
// Three Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_SOCIETY);
$aclPermOwn = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_OWN);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermOwn === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($cost, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermOwn !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermOwn
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkOwn
return $this->checkOwn($cost, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
private function canEditStatus(Cost $cost, Access $user, AccessFunction $function)
{
// Parent only
if (!$cost->isParent())
{
return false;
}
// Two Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_STATUS);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_EDIT_STATUS_SOCIETY);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($cost, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
public function canEditType(Cost $cost, Access $user, AccessFunction $function)
{
// Parents only
if ($cost->getParent() !== null)
{
return false;
}
// No Acl_Permissions for now (Same as Rekto version)
if ($cost->getStatus() === null)
{
return false;
}
if ($cost->getStatus()->isDefaultValue())
{
return true;
}
// If we are here, all hope is lost
return false;
}
public function canDelete(Cost $cost, Access $user, AccessFunction $function)
{
// Children only
// Plan.io Task #4416 => VendorInvoice also
if ($cost->getParent() === null && $cost->isNotVendorInvoice())
{
return false;
}
// Check status (children only => avoid error when dealing with VendorInvoice Costs)
if ($cost->getParent() !== null)
{
if ($cost->getParent()->getStatus() === null)
{
// This should not happen
return false;
}
if ($cost->getParent()->getStatus()->deniesDelete())
{
return false;
}
}
else
{
// Parent is null, so this is a Cost VendorInvoice
// => Check status directly
if ($cost->getStatus()->deniesDelete())
{
return false;
}
}
// Three Acl_Permission may exist
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE);
$aclPermSociety = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE_SOCIETY);
$aclPermOwn = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE_OWN);
// If all are null, exit
if ($aclPerm === null && $aclPermSociety === null && $aclPermOwn === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here it means that nothing good has been found
// Load second permission
if ($aclPermSociety !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermSociety
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkSociety
return $this->checkSociety($cost, $user);
}
}
}
// If we are here it means that nothing good has been found
// Load third permission
if ($aclPermOwn !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPermOwn
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
// In this case the good answer will be provided by the checkOwn
return $this->checkOwn($cost, $user);
}
}
}
// If we are here, all hope is lost
return false;
}
public function canMarkAsSeen(Cost $cost, Access $user, AccessFunction $function)
{
// Children only
if ($cost->getParent() === null)
{
return false;
}
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_SEEN);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
public function canAddCostNote(Cost $cost, Access $user, AccessFunction $function)
{
// Only parent case
if ($cost->isChild())
{
return false;
}
// In all cases (Plan.io Task #3001)
return true;
}
public function canEditCostNote(CostNote $costNote, Access $user, AccessFunction $function)
{
if ($costNote->getCost() === null || $costNote->getAuthor() === null)
{
// Should never happen
return false;
}
// Author case
if ($costNote->getAuthor()->equals($user))
{
return true;
}
// In all cases (Plan.io Task #3001)
return true;
}
public function canDeleteCostNote(CostNote $costNote, Access $user, AccessFunction $function)
{
if ($costNote->getCost() === null || $costNote->getAuthor() === null)
{
// Should never happen
return false;
}
// Author case
if ($costNote->getAuthor()->equals($user))
{
return true;
}
// In all cases (Plan.io Task #3001)
return true;
}
}

src/Security/CostVoter.php line 116