src/Security/TaskItemVoter.php line 20

Open in your IDE?
  1. <?php
  2. //------------------------------------------------------------------------------
  3. // src/Security/TaskItemVoter.php
  4. //------------------------------------------------------------------------------
  5. namespace App\Security;
  7. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  8. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  9. use Doctrine\Persistence\ManagerRegistry;
  11. use App\Entity\Access;
  12. use App\Entity\APIRest\AccessAPI;
  13. use App\Entity\Config\Config;
  14. use App\Entity\Config\Module;
  15. use App\Entity\HR\AccessFunction;
  16. use App\Entity\Security\Acl;
  17. use App\Entity\Security\AclPermission;
  18. use App\Services\Config\ModuleTools;
  20. class TaskItemVoter extends Voter
  21. {
  22.     //--------------------------------------------------------------------------------
  23.     // is_granted / acl constants
  24.     const ACL_PERM_DEVIS_PDF = "item_planning_task_devis_pdf";
  25.     const ACL_PERM_DEVIS_TOTAL = "item_planning_task_devis_total";
  26.     // const ACL_PERM_FILES = "item_planning_task_client_attachments";
  27.     // const ACL_PERM_FORMS = "item_planning_task_client_webapp_forms";
  28.     // const ACL_PERM_IA = "item_planning_task_intervention_address";
  29.     // const ACL_PERM_TYPE = "item_planning_task_type";
  30.     // const ACL_PERM_STATUS = "item_planning_task_status";
  31.     // const ACL_PERM_INFO = "item_planning_task_info";
  32.     // const ACL_PERM_DEVIS_FILES = "item_planning_task_devis_attachments";
  33.     const ACL_PERM_TH_DURATION = "item_planning_task_theoretical_duration";
  35.     const IS_GRANTED_CONSTANTS = array(
  36.         self::ACL_PERM_DEVIS_PDF,
  37.         self::ACL_PERM_DEVIS_TOTAL,
  38.         self::ACL_PERM_TH_DURATION,
  39.     );
  41.     //--------------------------------------------------------------------------------
  43.     public function __construct(ManagerRegistry $doctrine, ModuleTools $moduleTools)
  44.     {
  45.         $this->em = $doctrine->getManager();
  46.         $this->moduleTools = $moduleTools;
  48.         $this->aclRepository = $this->em->getRepository(Acl::class);
  49.         $this->aclPermissionRepository = $this->em->getRepository(AclPermission::class);
  50.     }
  52.     // Plan.io Task #4453 [See AccessVoter for details]
  53.     public function supportsAttribute(string $attribute): bool
  54.     {
  55.         return in_array($attribute, self::IS_GRANTED_CONSTANTS, true);
  56.     }
  58.     protected function supports(string $attribute, $subject = null): bool
  59.     {
  60.         // if the attribute isn't one we support, return false
  61.         if (!in_array($attribute, self::IS_GRANTED_CONSTANTS))
  62.         {
  63.             return false;
  64.         }
  66.         return true;
  67.     }
  69.     protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  70.     {
  71.         $user = $token->getUser();
  73.         // Plan.io Task #3707
  74.         if ($user instanceof AccessAPI)
  75.         {
  76.             if ($user->getAccess() === null)
  77.             {
  78.                 return false;
  79.             }
  80.             $user = $user->getAccess();
  81.         }
  83.         // Plan.io Task #3707
  84.         // At this point $user is an object of Access type
  85.         // even if the $token->getUser() is AccessAPI
  86.         if (!$user instanceof Access)
  87.         {
  88.             // the user must be logged in; if not, deny access
  89.             return false;
  90.         }
  92.         // The user must have a function; if not deny access
  93.         $function = $user->getFunction();
  94.         if ($function === null)        return false;
  96.         // Plan.io Task #3710 : Get current group
  97.         $currentGroup = $user->getSocietyGroup();
  98.         if ($currentGroup === null)
  99.             return false;
  101.         // Module activated ?
  102.         if ($this->moduleTools->isInactiveByCode($currentGroup, Module::MODULE_PLANNING))
  103.         {
  104.             return false;
  105.         }
  107.         return $this->canViewItem($attribute, $function);
  109.         throw new \LogicException('This code should not be reached!');
  110.     }
  112.     private function canViewItem($attribute, AccessFunction $function)
  113.     {
  114.         // Get Acl_Permission
  115.         $aclPerm = $this->aclPermissionRepository->findOneByName($attribute);
  116.         if ($aclPerm === null)        return false;
  118.         // Get Acl
  119.         $acl = $this->aclRepository->findOneBy(array(
  120.             'function'        =>    $function,
  121.             'permission'    =>    $aclPerm
  122.         ));
  123.         if ($acl === null)        return false;
  125.         return $acl->getValue();
  126.     }
  127. }