Symfony Profiler

<?php
//------------------------------------------------------------------------------
// src/Security/DevisSimulationVoter.php
//------------------------------------------------------------------------------
namespace App\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Doctrine\Persistence\ManagerRegistry;
use App\Entity\Access;
use App\Entity\Config\Config;
use App\Entity\Config\Module;
use App\Entity\HR\AccessFunction;
use App\Entity\Mission\Mission;
use App\Entity\Planning\Task;
use App\Entity\Platform\Devis\Devis;
use App\Entity\Security\Acl;
use App\Entity\Security\AclPermission;
use App\Services\Config\ModuleTools;
class DevisSimulationVoter extends Voter
{
// For now manager = author (both)
//--------------------------------------------------------------------------------
// is_granted constants
const IS_ACTIVE = "devis_simulation_is_active";
const ADD_SIMULATION = "add_devis_simulation";
const CONVERT_SIMULATION = "convert_devis_simulation";
const DELETE_SIMULATION = "delete_devis_simulation";
// Listing / Viewing is based on adding for now
// Since simulations are not society based,
// the users adding them should also be able to view them
// Maybe later make a distinction on whether all users should see all simulations
// or some users should only see their own simulations
const LIST_SIMULATION = "list_devis_simulation";
const VIEW_SIMULATION = "view_devis_simulation";
const IS_GRANTED_CONSTANTS = array(
self::IS_ACTIVE,
self::ADD_SIMULATION,
self::CONVERT_SIMULATION,
self::DELETE_SIMULATION,
self::LIST_SIMULATION,
self::VIEW_SIMULATION,
);
//--------------------------------------------------------------------------------
// acl constants
const ACL_PERM_ADD_SIMULATION = "devis_simulation_add";
const ACL_PERM_CONVERT_SIMULATION = "devis_simulation_convert";
const ACL_PERM_DELETE_SIMULATION = "devis_simulation_delete";
//--------------------------------------------------------------------------------
public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools)
{
$this->em = $doctrine->getManager();
$this->moduleTools = $moduleTools;
$this->aclRepository = $this->em->getRepository(Acl::class);
$this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
}
// Plan.io Task #4453 [See AccessVoter for details]
public function supportsAttribute(string $attribute): bool
{
return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
}
protected function supports(string $attribute, $subject): bool
{
// if the attribute isn't one we support, return false
if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
{
return false;
}
// Only vote on Devis and Mission objects inside this voter
if ($subject !== null && !($subject instanceof Devis || $subject instanceof Mission))
{
return false;
}
return true;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
if (!$user instanceof Access)
{
// the user must be logged in; if not, deny access
return false;
}
// The user must have a function; if not deny access
$function = $user->getFunction();
if ($function === null) return false;
// Plan.io Task #3710 : Get current group
$currentGroup = $user->getSocietyGroup();
if ($currentGroup === null)
return false;
$this->currentGroup = $currentGroup;
// Module activated ?
if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_DEVIS_SIMULATION))
{
return false;
}
$devis = null;
$mission = null;
if ($subject instanceof Devis)
{
/** @var Devis $devis */
$devis = $subject;
// Check current group affectation
if ($subject !== null)
{
$subjectSociety = $subject->getSociety();
if ($subjectSociety === null)
return false;
$subjectGroup = $subjectSociety->getGroup();
if ($subjectGroup === null)
return false;
if (!$currentGroup->equals($subjectGroup))
return false;
}
}
else
{
if ($subject instanceof Mission)
{
/** @var Mission $mission */
$mission = $subject;
}
}
switch ($attribute)
{
case self::IS_ACTIVE:
return true;
// This is different from the Devis, because we can create a simulation outside a mission
// So the mission parameter is optional
case self::ADD_SIMULATION:
return $this->canAddSimulation($user, $function, $mission);
case self::CONVERT_SIMULATION:
return $this->canConvertSimulation($user, $function);
case self::DELETE_SIMULATION:
return $this->canDeleteSimulation($devis, $user, $function);
// Listing / Viewing is based on adding for now
// Since simulations are not society based,
// the users adding them should also be able to view them
// Maybe later make a distinction on whether all users should see all simulations
// or some users should only see their own simulations
case self::LIST_SIMULATION:
return $this->canAddSimulation($user, $function);
case self::VIEW_SIMULATION:
return $this->canAddSimulation($user, $function);
}
throw new \LogicException('This code should not be reached!');
}
// $access is the user trying to load the resource
// $devis is the resource being loaded
// Check if the Society of the resource
// belongs to the societies of the $access
private function checkSociety(Devis $devis, Access $access)
{
// Get all the societies of the access
$societies = $access->getSocieties();
// Get the Society of the Devis
$devisSociety = $devis->getSociety();
if ($devisSociety === null)
return false;
$found = false;
foreach ($societies as $society)
{
if ($society->getId() == $devisSociety->getId())
{
$found = true;
break;
}
}
return $found;
}
// Check if the $access is the manager / author of the $devis
private function checkManager(Devis $devis, Access $access)
{
// Get manager
$manager = $devis->getManager();
$author = $devis->getAuthor();
if ($manager === null && $author === null)
return false;
if ($manager !== null)
if ($manager->getId() === $access->getId())
return true;
if ($author !== null)
if ($author->getId() === $access->getId())
return true;
return false;
}
// Check if the $access is the manager of the $devis
private function checkClientManager(Devis $devis, Access $access)
{
// Get Client
$client = $devis->getReceiver();
if ($client === null)
return false;
if ($client->getIndividual() !== null)
{
// Only Individuals have managers
// Get manager
$manager = $devis->getReceiver()->getIndividual()->getManager();
if ($manager === null)
return false;
if ($manager->getId() === $access->getId())
return true;
}
return false;
}
// Check if there is at least one task
// having this access as resource and this devis
private function checkTask(Devis $devis, Access $access)
{
$taskRep = $this->em->getRepository(Task::class);
$resources = $access->getPlanningResources();
foreach ($resources as $r)
{
$tasks = $taskRep->findForDevisAndResource($devis, $r);
if (count($tasks) > 0)
return true;
}
return false;
}
private function canAddSimulation(Access $user, AccessFunction $function, $mission = null)
{
// If the mission is shared and the author is the current group, deny adding devis
// When a mission is shared, the author cannot edit it
if ($mission !== null)
{
// Deny actions on archivedRefused objects
if ($mission->isArchivedRefused())
{
return false;
}
if ($mission->isShared())
{
if ($mission->isSharedBySocietyGroup($this->currentGroup))
{
return false;
}
}
}
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_ADD_SIMULATION);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canConvertSimulation(Access $user, AccessFunction $function)
{
// Converting simulations to devis, requires the devis module to be activated
// Module activated ?
if ($this->moduleTools->isInactiveByCode($this->currentGroup, Module::MODULE_DEVIS))
{
return false;
}
// Get Acl_Permission
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_CONVERT_SIMULATION);
if ($aclPerm === null) return false;
// Get Acl
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl === null) return false;
// Since only one acl type can exist
// we can return the result of the acl_permission
return $acl->getValue();
}
private function canDeleteSimulation(Devis $devis = null, Access $user, AccessFunction $function)
{
// Only allow deleteing simulations without a client [Why ?!]
if ($devis->isNotSimulation())
return false;
if ($devis->getReceiver() !== null)
return false;
// Get Acl_Permissions
$aclPerm = $this->aclPermissionRepository->findOneByName(self::ACL_PERM_DELETE_SIMULATION);
// If all are null, exit
if ($aclPerm === null)
return false;
// Get First one
if ($aclPerm !== null)
{
$acl = $this->aclRepository->findOneBy(array(
'function' => $function,
'permission' => $aclPerm
));
if ($acl !== null)
{
if ($acl->getValue())
{
// A single positive answer is enough
return true;
}
}
}
// If we are here, all hope is lost
return false;
}
}

src/Security/DevisSimulationVoter.php line 22