src/Security/Core/PublicationVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace App\Security\Core;
  5. use App\Entity\Core\Publication;
  6. use App\Entity\Core\PublisherPermission;
  7. use App\Entity\Core\PublisherPermissionRepository;
  8. use Doctrine\ORM\EntityManagerInterface;
  9. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. use Symfony\Component\Security\Core\Security;
  13. class PublicationVoter extends Voter
  14. {
  15. const PERMISSION = 'publicationEntityPermission';
  16. const INDEX_ACTION = 'publicationIndexAction';
  17. const NEW_ACTION = 'publicationNewAction';
  18. const EDIT_ACTION = 'publicationEditAction';
  19. const DELETE_ACTION = 'publicationDeleteAction';
  21. private EntityManagerInterface $em;
  22. private Security $security;
  24. public function __construct(EntityManagerInterface $em, Security $security)
  25. {
  26. $this->em = $em;
  27. $this->security = $security;
  28. }
  30. protected function supports(string $attribute, $subject): bool
  31. {
  32. // For index and new, $subject will always be null. For permission, it will be null when trying to create a new entity.
  33. if (in_array($attribute, [self::INDEX_ACTION, self::NEW_ACTION, self::PERMISSION])) {
  34. return true;
  35. }
  37. if (in_array($attribute, [self::EDIT_ACTION, self::DELETE_ACTION])) {
  38. return $subject instanceof Publication;
  39. }
  41. return false;
  42. }
  44. protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  45. {
  46. if ($attribute === self::INDEX_ACTION) {
  47. // Allow everyone to list - the entity permissions will still apply and hide entities you are not allowed
  48. // to access.
  49. return true;
  50. }
  52. if ($attribute === self::NEW_ACTION || $attribute === self::PERMISSION && $subject === null) {
  53. // Includes ROLE_SUPER_ADMIN by inheritance.
  54. // Authors should not be allowed to create new publications.
  55. return $this->security->isGranted('ROLE_ADMIN') ||
  56. $this->security->isGranted('ROLE_EDITOR');
  57. }
  59. if (!$subject instanceof Publication) {
  60. throw new \LogicException("Invalid type for voter and attribute.");
  61. }
  63. return $this->checkEntityPermissions($attribute, $subject, $token);
  65. }
  67. public function checkEntityPermissions(string $attribute, Publication $subject, TokenInterface $token): bool
  68. {
  69. if ($subject->isDeleted() || $subject->isHidden() || $subject->getPublisher()->isDeleted()
  70. || $subject->getPublisher()->isHidden() || !$subject->isAvailableForBackendUserCreation()) {
  71. return false;
  72. }
  74. // ROLE_SUPER_ADMIN inherits ROLE_ADMIN, and will also be included here.
  75. if ($this->security->isGranted('ROLE_ADMIN')) {
  76. return true;
  77. }
  79. /** @var PublisherPermissionRepository $permissionRepo */
  80. $permissionRepo = $this->em->getRepository(PublisherPermission::class);
  82. if ($this->security->isGranted('ROLE_EDITOR')) {
  83. return $permissionRepo->hasEditorPermission($token->getUser(), $subject->getPublisher()) ||
  84. $permissionRepo->hasAuthorPermission($token->getUser(), $subject);
  85. }
  87. if ($this->security->isGranted('ROLE_AUTHOR')) {
  89. if ($attribute !== self::PERMISSION) {
  90. // Don't allow authors to edit or delete publications.
  91. return false;
  92. }
  94. return $permissionRepo->hasAuthorPermission($token->getUser(), $subject);
  95. }
  97. // Should not get here due to EasyAdmin firewall on any other roles.
  98. return false;
  99. }
  100. }