src/Security/Voter/ExpertReportRequestVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace MedBrief\MSR\Security\Voter;
  5. use InvalidArgumentException;
  6. use MedBrief\MSR\Entity\ExpertReportRequest;
  7. use Override;
  8. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  9. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  11. use Symfony\Component\Security\Core\User\UserInterface;
  13. class ExpertReportRequestVoter implements VoterInterface
  14. {
  15. public const CREATE = 'CREATE';
  16. public const READ = 'READ';
  17. public const UPDATE = 'UPDATE';
  18. public const DELETE = 'DELETE';
  19. public const ADMINISTRATION = 'ADMINISTRATION';
  21. public function __construct(private readonly AuthorizationCheckerInterface $authorizationChecker)
  22. {
  23. }
  25. public function supportsAttribute($attribute): bool
  26. {
  27. return in_array($attribute, [
  28. self::CREATE,
  29. self::READ,
  30. self::UPDATE,
  31. self::DELETE,
  32. self::ADMINISTRATION,
  33. ]);
  34. }
  36. public function supportsClass($class): bool
  37. {
  38. $supportedClass = ExpertReportRequest::class;
  40. return $supportedClass === $class || is_subclass_of($class, $supportedClass);
  41. }
  43. #[Override]
  44. public function vote(TokenInterface $token, $entity, array $attributes)
  45. {
  46. if (!$this->supportsClass($entity && !is_array($entity) ? $entity::class : '')) {
  47. return VoterInterface::ACCESS_ABSTAIN;
  48. }
  50. if (1 !== count($attributes)) {
  51. throw new InvalidArgumentException(
  52. 'Only one attribute is allowed for Medbrief Voters.'
  53. );
  54. }
  56. $attribute = $attributes[0];
  58. if (!$this->supportsAttribute($attribute)) {
  59. return VoterInterface::ACCESS_ABSTAIN;
  60. }
  62. $user = $token->getUser();
  64. if (!$user instanceof UserInterface) {
  65. return VoterInterface::ACCESS_DENIED;
  66. }
  68. // Admin users can do everything
  69. if ($this->authorizationChecker->isGranted('ROLE_ADMIN')) {
  70. return VoterInterface::ACCESS_GRANTED;
  71. }
  73. // Grab Project this ExpertReportRequestRequest belongs to
  74. $project = $entity->getProject();
  76. // If you can READ the project, you can read the ExpertReportRequestRequest
  77. if ($attribute === self::READ && $this->authorizationChecker->isGranted('READ', $project)) {
  78. return VoterInterface::ACCESS_GRANTED;
  79. }
  81. return VoterInterface::ACCESS_DENIED;
  82. }
  83. }