src/CoreBundle/Security/PublisherVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace CoreBundle\Security;
  5. use CoreBundle\Entity\Publisher;
  6. use CoreBundle\Entity\PublisherPermission;
  7. use CoreBundle\Entity\PublisherPermissionRepository;
  8. use Doctrine\ORM\EntityManagerInterface;
  9. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. use Symfony\Component\Security\Core\Security;
  13. class PublisherVoter extends Voter
  14. {
  15. const PERMISSION = 'publisherEntityPermission';
  16. const INDEX_ACTION = 'publisherIndexAction';
  17. const NEW_ACTION = 'publisherNewAction';
  18. const EDIT_ACTION = 'publisherEditAction';
  19. const DELETE_ACTION = 'publisherDeleteAction';
  21. private EntityManagerInterface $em;
  22. private Security $security;
  24. public function __construct(EntityManagerInterface $em, Security $security)
  25. {
  26. $this->em = $em;
  27. $this->security = $security;
  28. }
  30. protected function supports(string $attribute, $subject): bool
  31. {
  32. // For index and new, $subject will always be null. For permission, it will be null when trying to create a new entity.
  33. if (in_array($attribute, [self::INDEX_ACTION, self::NEW_ACTION, self::PERMISSION])) {
  34. return true;
  35. }
  37. if (in_array($attribute, [self::EDIT_ACTION, self::DELETE_ACTION])) {
  38. return $subject instanceof Publisher;
  39. }
  41. return false;
  42. }
  44. protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  45. {
  46. if ($attribute === self::INDEX_ACTION) {
  47. // Allow everyone to list - the entity permissions will still apply and hide entities you are not allowed
  48. // to access.
  49. return true;
  50. }
  52. if ($attribute === self::NEW_ACTION || $attribute === self::PERMISSION && $subject === null) {
  53. // Includes ROLE_SUPER_ADMIN by inheritance.
  54. // Editors and authors should not be allowed to create new publishers.
  55. return $this->security->isGranted('ROLE_ADMIN');
  56. }
  58. if (!$subject instanceof Publisher) {
  59. throw new \LogicException("Invalid type for voter and attribute.");
  60. }
  62. return $this->checkEntityPermissions($attribute, $subject, $token);
  63. }
  65. public function checkEntityPermissions(string $attribute, Publisher $subject, TokenInterface $token): bool
  66. {
  67. if ($subject->isDeleted() || $subject->isHidden()) {
  68. return false;
  69. }
  71. // ROLE_SUPER_ADMIN inherits ROLE_ADMIN, and will also be included here.
  72. if ($this->security->isGranted('ROLE_ADMIN')) {
  73. return true;
  74. }
  76. if ($attribute !== self::PERMISSION) {
  77. // Don't allow editors or authors to edit or delete publishers.
  78. return false;
  79. }
  81. if ($this->security->isGranted('ROLE_EDITOR')) {
  82. /** @var PublisherPermissionRepository $repo */
  83. $repo = $this->em->getRepository(PublisherPermission::class);
  84. return $repo->hasEditorPermission($token->getUser(), $subject);
  85. }
  87. if ($this->security->isGranted('ROLE_AUTHOR')) {
  88. /** @var PublisherPermissionRepository $repo */
  89. $repo = $this->em->getRepository(PublisherPermission::class);
  90. return $repo->hasAuthorPermissionForPublisher($token->getUser(), $subject);
  91. }
  93. return false;
  94. }
  95. }