src/Security/Voter/ExpertReportRequestDetailVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace MedBrief\MSR\Security\Voter;
  5. use InvalidArgumentException;
  6. use MedBrief\MSR\Entity\ExpertReportRequestDetail;
  7. use Override;
  8. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  9. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  11. use Symfony\Component\Security\Core\User\UserInterface;
  13. class ExpertReportRequestDetailVoter implements VoterInterface
  14. {
  15. public const UPDATE = 'UPDATE';
  16. public const DELETE = 'DELETE';
  18. public function __construct(private readonly AuthorizationCheckerInterface $authorizationChecker)
  19. {
  20. }
  22. public function supportsAttribute($attribute): bool
  23. {
  24. return in_array($attribute, [
  25. self::UPDATE,
  26. self::DELETE,
  27. ]);
  28. }
  30. public function supportsClass($class): bool
  31. {
  32. $supportedClass = ExpertReportRequestDetail::class;
  34. return $supportedClass === $class || is_subclass_of($class, $supportedClass);
  35. }
  37. #[Override]
  38. public function vote(TokenInterface $token, $entity, array $attributes)
  39. {
  40. if (!$this->supportsClass($entity && !is_array($entity) ? $entity::class : '')) {
  41. return VoterInterface::ACCESS_ABSTAIN;
  42. }
  44. if (1 !== count($attributes)) {
  45. throw new InvalidArgumentException(
  46. 'Only one attribute is allowed for Medbrief Voters.'
  47. );
  48. }
  50. $attribute = $attributes[0];
  52. if (!$this->supportsAttribute($attribute)) {
  53. return VoterInterface::ACCESS_ABSTAIN;
  54. }
  56. $user = $token->getUser();
  58. if (!$user instanceof UserInterface) {
  59. return VoterInterface::ACCESS_DENIED;
  60. }
  62. // Admin users can do everything
  63. if ($this->authorizationChecker->isGranted('ROLE_ADMIN')) {
  64. return VoterInterface::ACCESS_GRANTED;
  65. }
  67. // Follow other *RequestDetailVoter patterns: only the creator (or ROLE_ADMIN above) may UPDATE/DELETE.
  68. if (in_array($attribute, [self::UPDATE, self::DELETE], true)
  69. && $entity->getCreator()
  70. && $entity->getCreator()->getId() === $user->getId()
  71. ) {
  72. return VoterInterface::ACCESS_GRANTED;
  73. }
  75. return VoterInterface::ACCESS_DENIED;
  76. }
  77. }