src/Security/Voter/InterpartyDisclosureVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace MedBrief\MSR\Security\Voter;
  5. use MedBrief\MSR\Entity\InterpartyDisclosure;
  6. use MedBrief\MSR\Entity\Project;
  7. use Override;
  8. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  9. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. use Symfony\Component\Security\Core\User\UserInterface;
  13. class InterpartyDisclosureVoter extends Voter
  14. {
  15. public const UPDATE = 'UPDATE';
  16. public const VIEW = 'VIEW';
  17. public const CANCEL = 'CANCEL';
  18. public const REACTIVATE = 'REACTIVATE';
  19. public const PUSH = 'PUSH';
  20. public const FORCE_EXPIRY_DATE = 'FORCE_EXPIRY_DATE';
  21. public const VIEW_THIRD_PARTY_ACCESS_REPORT = 'VIEW_THIRD_PARTY_ACCESS_REPORT';
  23. public function __construct(private readonly AuthorizationCheckerInterface $authorizationChecker)
  24. {
  25. }
  27. #[Override]
  28. protected function supports($attribute, $subject): bool
  29. {
  30. return in_array($attribute, [
  31. self::UPDATE,
  32. self::VIEW,
  33. self::CANCEL,
  34. self::REACTIVATE,
  35. self::PUSH,
  36. self::FORCE_EXPIRY_DATE,
  37. self::VIEW_THIRD_PARTY_ACCESS_REPORT,
  38. ])
  39. && $subject instanceof InterpartyDisclosure;
  40. }
  42. #[Override]
  43. protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
  44. {
  45. $user = $token->getUser();
  46. // if the user is anonymous, do not grant access
  47. if (!$user instanceof UserInterface) {
  48. return false;
  49. }
  51. /** @var InterpartyDisclosure $interpartyDisclosure */
  52. $interpartyDisclosure = $subject;
  53. $project = $interpartyDisclosure->getProject();
  54. // ... (check conditions and return true to grant permission) ...
  55. return match ($attribute) {
  56. self::UPDATE => $this->canUpdate($user, $project),
  57. self::VIEW => $this->canView($user, $project),
  58. self::CANCEL => $this->canCancel($user, $project),
  59. self::REACTIVATE => $this->canReactivate($user, $project),
  60. self::PUSH => $this->canPush($user),
  61. self::FORCE_EXPIRY_DATE => $this->canForceExpiryDate($user),
  62. self::VIEW_THIRD_PARTY_ACCESS_REPORT => $this->canThirdPartyAccessView($user, $project),
  63. default => false,
  64. };
  65. }
  67. protected function canUpdate(UserInterface $user, Project $project): bool
  68. {
  69. // MEDBRIEF ADMIN
  70. if ($this->authorizationChecker->isGranted('ROLE_ADMIN')) {
  71. return true;
  72. }
  74. // CLIENT SUPER ADMIN
  75. if ($this->authorizationChecker->isGranted('ROLE_ACCOUNT_' . $project->getAccount()->getId() . '_SUPERADMINISTRATOR')) {
  76. return true;
  77. }
  79. // CLIENT ADMIN
  80. if ($this->authorizationChecker->isGranted('ROLE_ACCOUNT_' . $project->getAccount()->getId() . '_ADMINISTRATOR')) {
  81. return true;
  82. }
  84. // MATTER LEVEL PROJECT MANAGER
  85. if ($this->authorizationChecker->isGranted('ROLE_PROJECT_' . $project->getId() . '_PROJECTMANAGER')) {
  86. return true;
  87. }
  88. // MANAGER ON A PROJECT/MATTER
  89. return $project->getManager() && $project->getManager() === $user;
  90. }
  92. protected function canView(UserInterface $user, Project $project): bool
  93. {
  94. // If the user can update, then they can also view.
  95. return $this->canUpdate($user, $project);
  96. }
  98. /**
  99. * Grants permission to users to access the 'Third party disclosure access modal'
  100. *
  101. * @param UserInterface $user
  102. * @param Project $project
  103. */
  104. protected function canThirdPartyAccessView(UserInterface $user, Project $project): bool
  105. {
  106. // If the user can update, then they can also view third party access.
  107. return $this->canUpdate($user, $project);
  108. }
  110. protected function canCancel(UserInterface $user, Project $project): bool
  111. {
  112. // If the user can update, then they can also cancel.
  113. return $this->canUpdate($user, $project);
  114. }
  116. protected function canReactivate(UserInterface $user, Project $project): bool
  117. {
  118. // If the user can update, then they can also reactivate.
  119. return $this->canUpdate($user, $project);
  120. }
  122. protected function canPush(UserInterface $user): bool
  123. {
  124. // MEDBRIEF ADMIN
  125. return $this->authorizationChecker->isGranted('ROLE_ADMIN');
  126. }
  128. protected function canForceExpiryDate(UserInterface $user): bool
  129. {
  130. // MEDBRIEF SUPER ADMIN
  131. return $this->authorizationChecker->isGranted('ROLE_SUPER_ADMIN');
  132. }
  133. }