src/Security/Voter/Resource/AdminVoter.php line 14

  1. <?php
  2. namespace App\Security\Voter\Resource;
  4. use Doctrine\ORM\EntityManagerInterface;
  6. use Symfony\Component\Security\Core\Authorization\Voter\Voter,
  7.     Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface,
  8.     Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use App\Entity\Admin,
  11.     App\Lib\Actions,
  12.     App\Lib\Roles;
  14. final class AdminVoter extends Voter
  15. {
  16.     const VOTABLE_ATTRIBUTES = [
  17.         Actions::CREATE,
  18.         Actions::VIEW,
  19.         Actions::EDIT,
  20.         Actions::DELETE
  21.     ];
  23.     private AuthorizationCheckerInterface $authorizationChecker;
  24.     private EntityManagerInterface $em;
  26.     public function __construct(
  27.         AuthorizationCheckerInterface $authorizationChecker,
  28.         EntityManagerInterface $em
  29.     ) {
  30.         $this->authorizationChecker = $authorizationChecker;
  31.         $this->em = $em;
  32.     }
  34.     protected function supports($attribute, $subject): bool
  35.     {
  36.         if (
  37.             ! $subject instanceof Admin
  38.             || ! in_array($attribute, self::VOTABLE_ATTRIBUTES)
  39.         ) {
  40.             return false;
  41.         }
  43.         return true;
  44.     }
  46.     protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
  47.     {
  48.         if ($this->isSubjectCurrentAdmin($subject, $token)) {
  49.             return false;
  50.         }
  52.         if ($this->isSubjectAccessable($subject)) {
  53.             return true;
  54.         }
  56.         return false;
  57.     }
  59.     private function isSubjectCurrentAdmin(Admin $subject, TokenInterface $token): bool
  60.     {
  61.         /** @var Admin */
  62.         $current = $token->getUser();
  64.         if ($current->getUuid() !== $subject->getUuid()) {
  65.             return false;
  66.         }
  68.         return true;
  69.     }
  71.     private function isSubjectAccessable(Admin $subject): bool
  72.     {
  73.         if ($this->authorizationChecker->isGranted(Roles::ROLE_OPENFORM)) {
  74.             return true;
  75.         }
  77.         $original = $this->em->getUnitOfWork()->getOriginalEntityData($subject);
  79.         if (
  80.             ! ($original['group'] ?? null)?->getIsOpenform()
  81.             && ! $subject->getGroup()?->getIsOpenform()
  82.          ) {
  83.             return false;
  84.         }
  86.         return true;
  87.     }
  88. }