src/Security/Voter/Resource/AdminGroupVoter.php line 12

  1. <?php
  2. namespace App\Security\Voter\Resource;
  4. use Symfony\Component\Security\Core\Authorization\Voter\Voter,
  5.     Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface,
  6.     Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  8. use App\Entity\AdminGroup,
  9.     App\Lib\Actions,
  10.     App\Lib\Roles;
  12. final class AdminGroupVoter extends Voter
  13. {
  14.     const VOTABLE_ATTRIBUTES = [
  15.         Actions::VIEW,
  16.         Actions::EDIT,
  17.         Actions::DELETE
  18.     ];
  20.     private AuthorizationCheckerInterface $authorizationChecker;
  22.     public function __construct(AuthorizationCheckerInterface $authorizationChecker)
  23.     {
  24.         $this->authorizationChecker = $authorizationChecker;
  25.     }
  27.     protected function supports($attribute, $subject): bool
  28.     {
  29.         if (
  30.             ! $subject instanceof AdminGroup
  31.             || ! in_array($attribute, self::VOTABLE_ATTRIBUTES)
  32.         ) {
  33.             return false;
  34.         }
  36.         return true;
  37.     }
  39.     protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
  40.     {
  41.         if (Actions::VIEW === $attribute) {
  42.             return true;
  43.         }
  45.         if ($this->isSubjectCurrentGroup($subject, $token)) {
  46.             return false;
  47.         }
  49.         if ($this->isSubjectAccessable($subject)) {
  50.             return true;
  51.         }
  53.         return false;
  54.     }
  56.     private function isSubjectCurrentGroup(AdminGroup $subject, TokenInterface $token): bool
  57.     {
  58.         /** @var Admin */
  59.         $current = $token->getUser();
  61.         if ($current->getGroup()->getUuid() !== $subject->getUuid()) {
  62.             return false;
  63.         }
  65.         return true;
  66.     }
  68.     private function isSubjectAccessable(AdminGroup $subject): bool
  69.     {
  70.         if ($this->authorizationChecker->isGranted(Roles::ROLE_OPENFORM)) {
  71.             return true;
  72.         }
  74.         return ! $subject->getIsOpenform();
  75.     }
  76. }