src/Security/Voter/InsightsVoter.php line 14

Open in your IDE?
  1. <?php
  3. namespace MedBrief\MSR\Security\Voter;
  5. use MedBrief\MSR\Entity\Account;
  6. use MedBrief\MSR\Entity\Project;
  7. use MedBrief\MSR\Entity\User;
  8. use Override;
  9. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. use Symfony\Component\Security\Core\User\UserInterface;
  14. class InsightsVoter extends Voter
  15. {
  16. public const VIEW_RECORDS_INSIGHTS = 'VIEW_RECORDS_INSIGHTS';
  18. public function __construct(private readonly AuthorizationCheckerInterface $auth)
  19. {
  20. }
  22. #[Override]
  23. protected function supports(string $attribute, mixed $subject): bool
  24. {
  25. return $attribute === self::VIEW_RECORDS_INSIGHTS && $subject instanceof Project;
  26. }
  28. #[Override]
  29. protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
  30. {
  31. $user = $token->getUser();
  32. if (!$user instanceof UserInterface) {
  33. return false;
  34. }
  36. /** @var Project $project */
  37. $project = $subject;
  39. return match ($attribute) {
  40. self::VIEW_RECORDS_INSIGHTS => $this->canViewRecordsInsights($user, $project),
  41. default => false,
  42. };
  43. }
  45. /**
  46. * Determines if the user can view the insights button and panel.
  47. * User roles allowed:
  48. * - MB super admins (ROLE_SUPER_ADMIN)
  49. * - MB admins (ROLE_ADMIN)
  50. * - Client super admins (ROLE_ACCOUNT_{accountId}_SUPERADMINISTRATOR)
  51. * - Client admins (ROLE_ACCOUNT_{accountId}_ADMINISTRATOR)
  52. * - Matter/Project managers:
  53. * - Role-based: ROLE_PROJECT_{projectId}_PROJECTMANAGER
  54. * - Entity-based: $project->getManager() === $user
  55. *
  56. * @param UserInterface $user
  57. * @param Project $project
  58. *
  59. * @return bool Returns true if the user can view records insights, false otherwise
  60. */
  61. private function canViewRecordsInsights(UserInterface $user, Project $project): bool
  62. {
  63. $account = $project->getAccount();
  65. // Only consider Client matters (no Disclosures or other non-matter projects)
  66. if ($project->getType() !== Project::TYPE_MATTER_FIRM) {
  67. return false;
  68. }
  70. // MB admins always have access to insights, regardless of account settings or user opt-in
  71. if ($this->auth->isGranted('ROLE_SUPER_ADMIN') || $this->auth->isGranted('ROLE_ADMIN')) {
  72. return true;
  73. }
  75. // If insights is not enabled at the account level, then only MB admins can access insights
  76. if (!$account instanceof Account || !$account->isInsightsEnabled()) {
  77. return false;
  78. }
  80. // For client users, check if they have insights access based on account settings
  81. if (!$this->hasUserInsightsAccess($account, $user)) {
  82. return false;
  83. }
  85. // For client users, they must have an eligible role and insights must be enabled for the account, then we check opt-in settings
  86. if (!$this->hasEligibleInsightsRole($user, $project, $account)) {
  87. return false;
  88. }
  90. // At this point, the project is eligible for Insights and the client user has
  91. // both an allowed role and the required opt-in access, so access is granted.
  92. return true;
  93. }
  95. /**
  96. * Checks if the user has an eligible role for insights access based on their relationship to the project and account.
  97. *
  98. * @param UserInterface $user The user for whom we are checking roles
  99. * @param Project $project The project associated with the insights access
  100. * @param Account $account The account associated with the project
  101. *
  102. * @return bool Returns true if the user has an eligible role for insights access, false otherwise
  103. */
  104. private function hasEligibleInsightsRole(UserInterface $user, Project $project, Account $account): bool
  105. {
  106. // Client-level admins
  107. if ($this->auth->isGranted('ROLE_ACCOUNT_' . $account->getId() . '_SUPERADMINISTRATOR')) {
  108. return true;
  109. }
  110. if ($this->auth->isGranted('ROLE_ACCOUNT_' . $account->getId() . '_ADMINISTRATOR')) {
  111. return true;
  112. }
  114. // Matter/Project manager (role-based)
  115. if ($this->auth->isGranted('ROLE_PROJECT_' . $project->getId() . '_PROJECTMANAGER')) {
  116. return true;
  117. }
  119. // Matter/Project manager (entity relationship fallback)
  120. if ($project->getManager() instanceof User && $project->getManager() === $user) {
  121. return true;
  122. }
  124. return false;
  125. }
  127. /**
  128. * Checks if the user has access to insights based on account level and user level opt-in settings.
  129. *
  130. * @param UserInterface $user The user for whom we are checking access
  131. * @param Account $account The account associated with the project for which we are checking access
  132. *
  133. * @return bool Returns true if the user has access to insights, false otherwise
  134. */
  135. private function hasUserInsightsAccess(Account $account, UserInterface $user): bool
  136. {
  137. // If insights is enabled for all client users, then any user with an eligible role
  138. // can access,otherwise we check the user's individual opt-in setting
  139. if ($account->isInsightsOptInAllClientUsers()) {
  140. return true;
  141. }
  143. // If insights is only enabled for specific users, then we check the user's opt-in setting
  144. if ($account->isInsightsOptInSpecificUsers() && $user instanceof User) {
  145. return $user->getInsightsOptIn();
  146. }
  148. return false;
  149. }
  150. }