src/Security/Voter/InsightsVoter.php line 14

Open in your IDE?
  1. <?php
  3. namespace MedBrief\MSR\Security\Voter;
  5. use MedBrief\MSR\Entity\Account;
  6. use MedBrief\MSR\Entity\Project;
  7. use MedBrief\MSR\Entity\User;
  8. use Override;
  9. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. use Symfony\Component\Security\Core\User\UserInterface;
  14. class InsightsVoter extends Voter
  15. {
  16. public const VIEW_RECORDS_INSIGHTS = 'VIEW_RECORDS_INSIGHTS';
  17. public const EDIT_RECORDS_INSIGHTS = 'EDIT_RECORDS_INSIGHTS';
  19. public function __construct(private readonly AuthorizationCheckerInterface $auth)
  20. {
  21. }
  23. #[Override]
  24. protected function supports(string $attribute, mixed $subject): bool
  25. {
  26. return in_array($attribute, [self::VIEW_RECORDS_INSIGHTS, self::EDIT_RECORDS_INSIGHTS], true)
  27. && $subject instanceof Project;
  28. }
  30. #[Override]
  31. protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
  32. {
  33. $user = $token->getUser();
  34. if (!$user instanceof UserInterface) {
  35. return false;
  36. }
  38. /** @var Project $project */
  39. $project = $subject;
  41. return match ($attribute) {
  42. self::VIEW_RECORDS_INSIGHTS => $this->canViewRecordsInsights($user, $project),
  43. self::EDIT_RECORDS_INSIGHTS => $this->canViewRecordsInsights($user, $project),
  44. default => false,
  45. };
  46. }
  48. /**
  49. * Determines if the user can view the insights button and panel.
  50. * User roles allowed:
  51. * - MB super admins (ROLE_SUPER_ADMIN)
  52. * - MB admins (ROLE_ADMIN)
  53. * - Client super admins (ROLE_ACCOUNT_{accountId}_SUPERADMINISTRATOR)
  54. * - Client admins (ROLE_ACCOUNT_{accountId}_ADMINISTRATOR)
  55. * - Client project managers (ROLE_ACCOUNT_{accountId}_PROJECTMANAGER)
  56. * - Matter experts (ROLE_PROJECT_{projectId}_EXPERT)
  57. * - Matter expert viewers (ROLE_PROJECT_{projectId}_EXPERTVIEWER)
  58. * - Matter/Project managers:
  59. * - Role-based: ROLE_PROJECT_{projectId}_PROJECTMANAGER
  60. * - Entity-based: $project->getManager() === $user
  61. *
  62. * @param UserInterface $user
  63. * @param Project $project
  64. *
  65. * @return bool Returns true if the user can view records insights, false otherwise
  66. */
  67. private function canViewRecordsInsights(UserInterface $user, Project $project): bool
  68. {
  69. $account = $project->getAccount();
  71. // Only consider Client matters (no Disclosures or other non-matter projects)
  72. if ($project->getType() !== Project::TYPE_MATTER_FIRM) {
  73. return false;
  74. }
  76. // MB admins always have access to insights, regardless of account settings or user opt-in
  77. if ($this->auth->isGranted('ROLE_SUPER_ADMIN') || $this->auth->isGranted('ROLE_ADMIN')) {
  78. return true;
  79. }
  81. // If insights is not enabled at the account level, then only MB admins can access insights
  82. if (!$account instanceof Account || !$account->isInsightsEnabled()) {
  83. return false;
  84. }
  86. // For client users, check if they have insights access based on account settings
  87. if (!$this->hasUserInsightsAccess($account, $user)) {
  88. return false;
  89. }
  91. // For client users, they must have an eligible role and insights must be enabled for the account, then we check opt-in settings
  92. if (!$this->hasEligibleInsightsRole($user, $project, $account)) {
  93. return false;
  94. }
  96. // At this point, the project is eligible for Insights and the client user has
  97. // both an allowed role and the required opt-in access, so access is granted.
  98. return true;
  99. }
  101. /**
  102. * Checks if the user has an eligible role for insights access based on their relationship to the project and account.
  103. *
  104. * @param UserInterface $user The user for whom we are checking roles
  105. * @param Project $project The project associated with the insights access
  106. * @param Account $account The account associated with the project
  107. *
  108. * @return bool Returns true if the user has an eligible role for insights access, false otherwise
  109. */
  110. private function hasEligibleInsightsRole(UserInterface $user, Project $project, Account $account): bool
  111. {
  112. // Client-level admins
  113. if ($this->auth->isGranted('ROLE_ACCOUNT_' . $account->getId() . '_SUPERADMINISTRATOR')) {
  114. return true;
  115. }
  116. if ($this->auth->isGranted('ROLE_ACCOUNT_' . $account->getId() . '_ADMINISTRATOR')) {
  117. return true;
  118. }
  119. if ($this->auth->isGranted('ROLE_ACCOUNT_' . $account->getId() . '_PROJECTMANAGER')) {
  120. return true;
  121. }
  123. // Project-level experts and expert viewers
  124. if ($this->auth->isGranted('ROLE_PROJECT_' . $project->getId() . '_EXPERT')) {
  125. return true;
  126. }
  127. if ($this->auth->isGranted('ROLE_PROJECT_' . $project->getId() . '_EXPERTVIEWER')) {
  128. return true;
  129. }
  131. // Matter/Project manager (role-based)
  132. if ($this->auth->isGranted('ROLE_PROJECT_' . $project->getId() . '_PROJECTMANAGER')) {
  133. return true;
  134. }
  136. // Matter/Project manager (entity relationship fallback)
  137. if ($project->getManager() instanceof User && $project->getManager() === $user) {
  138. return true;
  139. }
  141. return false;
  142. }
  144. /**
  145. * Checks if the user has access to insights based on account level and user level opt-in settings.
  146. *
  147. * @param Account $account The account associated with the project for which we are checking access
  148. * @param UserInterface $user The user for whom we are checking access
  149. *
  150. * @return bool Returns true if the user has access to insights, false otherwise
  151. */
  152. private function hasUserInsightsAccess(Account $account, UserInterface $user): bool
  153. {
  154. // If insights is enabled for all client users, then any user with an eligible role
  155. // can access,otherwise we check the user's individual opt-in setting
  156. if ($account->isInsightsOptInAllClientUsers()) {
  157. return true;
  158. }
  160. // If insights is only enabled for specific users, then we check the user's opt-in setting
  161. if ($account->isInsightsOptInSpecificUsers() && $user instanceof User) {
  162. return $user->getInsightsOptIn();
  163. }
  165. return false;
  166. }
  167. }