src/Security/Core/PublisherVoter.php line 14

Open in your IDE?
  1. <?php
  3. namespace App\Security\Core;
  5. use App\Entity\Core\Publisher;
  6. use App\Entity\Core\PublisherPermission;
  7. use App\Entity\Core\PublisherPermissionRepository;
  8. use Doctrine\ORM\EntityManagerInterface;
  9. use LogicException;
  10. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. use Symfony\Component\Security\Core\Security;
  14. class PublisherVoter extends Voter
  15. {
  16. const PERMISSION = 'publisherEntityPermission';
  17. const INDEX_ACTION = 'publisherIndexAction';
  18. const NEW_ACTION = 'publisherNewAction';
  19. const EDIT_ACTION = 'publisherEditAction';
  20. const DELETE_ACTION = 'publisherDeleteAction';
  22. private EntityManagerInterface $em;
  23. private Security $security;
  25. public function __construct(EntityManagerInterface $em, Security $security)
  26. {
  27. $this->em = $em;
  28. $this->security = $security;
  29. }
  31. protected function supports(string $attribute, $subject): bool
  32. {
  33. // For index and new, $subject will always be null. For permission, it will be null when trying to create a new entity.
  34. if (in_array($attribute, [self::INDEX_ACTION, self::NEW_ACTION, self::PERMISSION])) {
  35. return true;
  36. }
  38. if (in_array($attribute, [self::EDIT_ACTION, self::DELETE_ACTION])) {
  39. return $subject instanceof Publisher;
  40. }
  42. return false;
  43. }
  45. protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  46. {
  47. if ($attribute === self::INDEX_ACTION) {
  48. // Allow everyone to list - the entity permissions will still apply and hide entities you are not allowed
  49. // to access.
  50. return true;
  51. }
  53. if ($attribute === self::NEW_ACTION || $attribute === self::PERMISSION && $subject === null) {
  54. // Includes ROLE_SUPER_ADMIN by inheritance.
  55. // Editors and authors should not be allowed to create new publishers.
  56. return $this->security->isGranted('ROLE_ADMIN');
  57. }
  59. if (!$subject instanceof Publisher) {
  60. throw new LogicException("Invalid type for voter and attribute.");
  61. }
  63. return $this->checkEntityPermissions($attribute, $subject, $token);
  64. }
  66. public function checkEntityPermissions(string $attribute, Publisher $subject, TokenInterface $token): bool
  67. {
  68. if ($subject->isDeleted() || $subject->isHidden()) {
  69. return false;
  70. }
  72. // ROLE_SUPER_ADMIN inherits ROLE_ADMIN, and will also be included here.
  73. if ($this->security->isGranted('ROLE_ADMIN')) {
  74. return true;
  75. }
  77. if ($attribute !== self::PERMISSION) {
  78. // Don't allow editors or authors to edit or delete publishers.
  79. return false;
  80. }
  82. if ($this->security->isGranted('ROLE_EDITOR')) {
  83. /** @var PublisherPermissionRepository $repo */
  84. $repo = $this->em->getRepository(PublisherPermission::class);
  85. return $repo->hasEditorPermission($token->getUser(), $subject);
  86. }
  88. if ($this->security->isGranted('ROLE_AUTHOR')) {
  89. /** @var PublisherPermissionRepository $repo */
  90. $repo = $this->em->getRepository(PublisherPermission::class);
  91. return $repo->hasAuthorPermissionForPublisher($token->getUser(), $subject);
  92. }
  94. return false;
  95. }
  96. }