Symfony Profiler

<?php
namespace MedBrief\MSR\Security\Voter;
use MedBrief\MSR\Entity\Account;
use MedBrief\MSR\Entity\Expert;
use MedBrief\MSR\Entity\MatchLetter;
use MedBrief\MSR\Entity\Project;
use MedBrief\MSR\Entity\User;
use MedBrief\MSR\Repository\AccountRepository;
use MedBrief\MSR\Repository\ExpertRepository;
use MedBrief\MSR\Repository\ExpertUserRepository;
use MedBrief\MSR\Repository\MatchLetterResponseRepository;
use MedBrief\MSR\Repository\MessageThreadParticipantRepository;
use MedBrief\MSR\Repository\ProjectRepository;
use MedBrief\MSR\Service\EntityHelper\UserHelper;
use MedBrief\MSR\Service\ProjectMatch\ConversationStatusResolver;
use MedBrief\MSR\Service\ProjectMatch\MatchExpertUser;
use MedBrief\MSR\Service\ProjectMatch\MatchMyExpertsThreadBuilder;
use Override;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\User\UserInterface;
class MatchVoter extends Voter
{
public const VIEW_FIRM = 'MATCH_VIEW_FIRM';
public const VIEW_EXPERT = 'MATCH_VIEW_EXPERT';
public const VIEW_EXPERT_TERMS_ACCEPTED = 'MATCH_VIEW_EXPERT_TERMS_ACCEPTED';
public const VIEW_MESSAGES_NAV = 'MATCH_VIEW_MESSAGES_NAV';
public const VIEW_RECORDS_RADIOLOGY_TABS = 'MATCH_VIEW_RECORDS_RADIOLOGY_TABS';
public const VIEW_LETTER_PRIMARY_OR_SECONDARY_EXPERT = 'MATCH_VIEW_LETTER_PRIMARY_OR_SECONDARY_EXPERT';
public const VIEW_PRIMARY_OR_SECONDARY_EXPERT = 'MATCH_VIEW_PRIMARY_OR_SECONDARY_EXPERT';
public const EXPERT_UPLOAD_TYPE = 'MATCH_EXPERT_UPLOAD_TYPE';
public function __construct(
private readonly AuthorizationCheckerInterface $auth,
private readonly AccountRepository $accountRepository,
private readonly ExpertRepository $expertRepository,
private readonly MessageThreadParticipantRepository $messageThreadParticipantRepository,
private readonly ProjectRepository $projectRepository,
private readonly MatchLetterResponseRepository $matchLetterResponseRepository,
private readonly ExpertUserRepository $expertUserRepository,
private readonly MatchExpertUser $matchExpertUserService,
private readonly UserHelper $userHelperService,
private readonly ConversationStatusResolver $conversationStatusResolver,
) {
}
#[Override]
protected function supports(string $attribute, mixed $subject): bool
{
if ($attribute === self::VIEW_MESSAGES_NAV || $attribute === self::VIEW_EXPERT_TERMS_ACCEPTED) {
return $subject === null;
}
if ($attribute === self::VIEW_LETTER_PRIMARY_OR_SECONDARY_EXPERT) {
return $subject instanceof MatchLetter;
}
return \in_array($attribute, [self::VIEW_FIRM, self::VIEW_EXPERT, self::VIEW_RECORDS_RADIOLOGY_TABS, self::VIEW_PRIMARY_OR_SECONDARY_EXPERT, self::EXPERT_UPLOAD_TYPE], true)
&& $subject instanceof Project;
}
#[Override]
protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
{
$user = $token->getUser();
if (!$user instanceof UserInterface) {
return false;
}
if ($attribute === self::VIEW_LETTER_PRIMARY_OR_SECONDARY_EXPERT) {
return $subject instanceof MatchLetter && $this->canViewMatchLetterAsPrimaryOrSecondaryExpert($user, $subject);
}
if ($attribute === self::VIEW_EXPERT_TERMS_ACCEPTED) {
return $this->canViewExpertTermsAccepted($user);
}
if ($attribute === self::VIEW_MESSAGES_NAV) {
return $this->canViewMessagesNavigation($user);
}
if (!$subject instanceof Project) {
return false;
}
return match ($attribute) {
self::VIEW_FIRM => $this->canViewAsFirm($user, $subject),
self::VIEW_EXPERT => $this->canViewAsExpert($user, $subject),
self::VIEW_RECORDS_RADIOLOGY_TABS => $this->canViewRecordsRadiologyTabs($user, $subject),
self::VIEW_PRIMARY_OR_SECONDARY_EXPERT => $this->canViewAsPrimaryOrSecondaryExpert($user, $subject),
self::EXPERT_UPLOAD_TYPE => $this->canUploadAsExpert($user, $subject),
default => false,
};
}
/**
* Determines if the user can view the match tab.
* User roles allowed:
* - MB super admins (ROLE_SUPER_ADMIN)
* - MB admins (ROLE_ADMIN)
* - Client super admins (ROLE_ACCOUNT_{accountId}_SUPERADMINISTRATOR)
* - Client admins (ROLE_ACCOUNT_{accountId}_ADMINISTRATOR)
* - Matter/Project managers:
* - Role-based: ROLE_PROJECT_{projectId}_PROJECTMANAGER
* - Entity-based: $project->getManager() === $user
*
* @param UserInterface $user
* @param Project $project
*
* @return bool
*/
private function canViewAsFirm(UserInterface $user, Project $project): bool
{
$account = $project->getAccount();
// Check if the matter is of type Clinical Negligence and is a client matter
if ($project->getMatterType() !== Project::MATTER_TYPE_CLINICAL_NEGLIGENCE
|| $project->getType() !== Project::TYPE_MATTER_FIRM
|| $project->getMatterRequest() === null
) {
return false;
}
// Check if account has match enabled at all
if (!$account->isMatchEnabled()) {
return false;
}
// MB admins - only need account-level match enabled
if ($this->auth->isGranted('ROLE_SUPER_ADMIN') || $this->auth->isGranted('ROLE_ADMIN')) {
return true;
}
// For client users, check if they have match access based on account settings
if (!$this->hasUserMatchAccess($account, $user)) {
return false;
}
// Client-level admins
if ($this->auth->isGranted('ROLE_ACCOUNT_' . $account->getId() . '_SUPERADMINISTRATOR')) {
return true;
}
if ($this->auth->isGranted('ROLE_ACCOUNT_' . $account->getId() . '_ADMINISTRATOR')) {
return true;
}
// Matter/Project manager (role-based)
if ($this->auth->isGranted('ROLE_PROJECT_' . $project->getId() . '_PROJECTMANAGER')) {
return true;
}
// Matter/Project manager (entity relationship fallback)
if ($project->getManager() && $project->getManager() === $user) {
return true;
}
return false;
}
/**
* Check if a user has match access for an account based on account-level and user-level settings.
*
* @param Account $account
* @param UserInterface $user
*
* @return bool
*/
private function hasUserMatchAccess(Account $account, UserInterface $user): bool
{
// If account allows all client users, grant access
if ($account->isMatchOptInAllClientUsers()) {
return true;
}
// If account is set to specific users, check user's individual matchOptIn
if ($account->isMatchOptInSpecificUsers() && $user instanceof User) {
return $user->getMatchOptIn();
}
return false;
}
/**
* Determines if a user can view as an Expert.
* Allows access to secondary users linked to an expert, but only if the expert has not confirmed a primary user yet.
* Once a primary user is confirmed, only that user can view as the expert.
*
* @param UserInterface $user
* @param Project $project
*
* @return bool
*/
private function canViewAsExpert(UserInterface $user, Project $project): bool
{
// Invited Experts
if ($this->auth->isGranted('ROLE_PROJECT_' . $project->getId() . '_EXPERT')) {
return true;
}
if ($this->auth->isGranted('ROLE_PROJECT_' . $project->getId() . '_EXPERTVIEWER')) {
return true;
}
$isPrimaryUserForExpert = $this->matchExpertUserService->isPrimaryUserForExpert($user);
if ($isPrimaryUserForExpert) {
// If the expert has not confirmed a primary user yet, secondary users are treated as primary
$user = $this->matchExpertUserService->getPrimaryUserForExpert($user);
}
// Uninvited Experts can only view if they are participants in the message thread for the project
if (!$user instanceof User) {
return false;
}
return $this->messageThreadParticipantRepository->isUserParticipantInProject($project, $user);
}
/**
* Determines if a user can view as an Expert.
* Allows access to secondary users linked to an expert, but only have the primary is a participant in the project threads
*
* @param UserInterface $user
* @param Project $project
*
* @return bool
*/
private function canViewAsPrimaryOrSecondaryExpert(UserInterface $user, Project $project): bool
{
//If the expert has not confirmed a primary user yet, secondary users are treated as primary
$user = $this->matchExpertUserService->getPrimaryUserForExpert($user);
// Uninvited Experts can only view if they are participants in the message thread for the project
if (!$user instanceof User) {
return false;
}
// Check if the user is a participant in any thread for the project
return $this->messageThreadParticipantRepository->isUserParticipantInProject($project, $user);
}
/**
* Determines if the user can view or update this expert's match letter
* based on the expert's primary user and the user's participation in the project.
* MB admins and super admins have unrestricted access.
*
* @param UserInterface $user
* @param MatchLetter $matchLetter
*
* @return bool
*/
private function canViewMatchLetterAsPrimaryOrSecondaryExpert(UserInterface $user, MatchLetter $matchLetter): bool
{
// Check if the user is an admin or super admin
if ($this->auth->isGranted('ROLE_SUPER_ADMIN') || $this->auth->isGranted('ROLE_ADMIN')) {
return true;
}
$project = $matchLetter->getProject();
$matchLetterUser = $matchLetter->getUser();
// Ensure both the project and the match letter user and the current user are valid before proceeding
if (!$project instanceof Project || !$matchLetterUser instanceof User || !$user instanceof User) {
return false;
}
// Get the primary user for the current user
$primaryUser = $this->matchExpertUserService->getPrimaryUserForExpert($user);
if (!$primaryUser instanceof User) {
return false;
}
// Get the primary user for the match letter user
$matchLetterPrimaryUser = $this->matchExpertUserService->getPrimaryUserForExpert($matchLetterUser);
if (!$matchLetterPrimaryUser instanceof User) {
return false;
}
$primaryUserId = $primaryUser->getId();
$matchLetterPrimaryUserId = $matchLetterPrimaryUser->getId();
// Compare the primary user IDs to ensure they match
if ($primaryUserId === null || $matchLetterPrimaryUserId === null || $primaryUserId !== $matchLetterPrimaryUserId) {
return false;
}
// Finally, check if the primary user is a participant in the project
return $this->messageThreadParticipantRepository->isUserParticipantInProject($project, $primaryUser);
}
/**
* Limits access to certain project related functionality in the event that they are an expert,
* but have no expert roles for the project yet.
* Can be coupled with canViewAsExpert to show specific information, but limit others
*
* @param UserInterface $user
* @param Project $project
*
* @return bool
*/
private function canViewRecordsRadiologyTabs(UserInterface $user, Project $project): bool
{
$this->userHelperService->setUser($user);
$userType = $this->matchExpertUserService->getUserType($user);
// If the user is an expert, we need to check if they have roles for the project
if ($userType === MatchMyExpertsThreadBuilder::USER_TYPE_EXPERT) {
// Experts without project roles are denied view access to the records and radiology tabs
// We check for any project role, as scanners and scanner download might also have Expert profiles.
if ($this->userHelperService->hasProjectRole($project) || $this->userHelperService->hasAccountRole($project->getAccount())) {
return true;
}
// Return false if they are an expert but don't have the expert role for the project
return false;
}
// Currently there are no specific restrictions on viewing these tabs outside of this for now
// so we return true
return true;
}
/**
* Determines if a user can see the messages navigation tab
*
* @param UserInterface $user
*
* @return bool
*/
private function canViewMessagesNavigation(UserInterface $user): bool
{
// MB admins
if ($this->auth->isGranted('ROLE_SUPER_ADMIN') || $this->auth->isGranted('ROLE_ADMIN')) {
return true;
}
// If the user has the expert or expert viewer role, allow access
if ($this->matchExpertUserService->isUserExpert($user)) {
// Only experts with an expert profile
if ($this->expertUserRepository->getExpertByUser($user) instanceof Expert) {
return true;
}
}
// Extract account IDs and project IDs from user roles
$userRoles = $user->getRoles();
$accountIds = [];
$projectIds = [];
foreach ($userRoles as $role) {
if (preg_match('/^ROLE_ACCOUNT_(\d+)_/', $role, $matches)) {
$accountIds[] = (int) $matches[1];
}
if (preg_match('/^ROLE_PROJECT_(\d+)_/', $role, $matches)) {
$projectIds[] = (int) $matches[1];
}
}
// Remove duplicates
$accountIds = array_unique($accountIds);
$projectIds = array_unique($projectIds);
// Check if any accounts have match enabled and user has access
if (!empty($accountIds)) {
$accounts = $this->accountRepository->findBy(['id' => $accountIds]);
foreach ($accounts as $account) {
if ($account->isMatchEnabled() && $this->hasUserMatchAccess($account, $user)) {
return true;
}
}
}
// Check if any projects with accounts have match enabled and user has access
if (!empty($projectIds)) {
$projects = $this->projectRepository->findBy(['id' => $projectIds]);
foreach ($projects as $project) {
$account = $project->getAccount();
if ($account && $account->isMatchEnabled() && $this->hasUserMatchAccess($account, $user)) {
return true;
}
}
}
return false;
}
/**
* Determines if an expert user has accepted the expert terms.
*
* @param UserInterface $user
*
* @return bool
*/
private function canViewExpertTermsAccepted(UserInterface $user): bool
{
// If the user has the expert or expert viewer role, allow access
if ($this->matchExpertUserService->isUserExpert($user)) {
// Only experts with an expert profile
if ($this->expertUserRepository->getExpertByUser($user) instanceof Expert) {
// Check if the expert has accepted the terms
if ($this->matchLetterResponseRepository->hasExpertAcceptedTerms($user)) {
return true;
}
}
}
// Default deny
return false;
}
/**
* Determines if an expert user can upload as an expert.
*
* @param UserInterface $user
* @param Project $subject
*
* @return bool
*/
private function canUploadAsExpert(UserInterface $user, Project $subject): bool
{
if (!$user instanceof User) {
return false;
}
// Linked users act as the primary expert until a primary is confirmed; the MatchLetter belongs to the primary
$expertUser = $this->matchExpertUserService->isPrimaryUserForExpert($user)
? ($this->matchExpertUserService->getPrimaryUserForExpert($user) ?? $user)
: $user;
// Check if the expert is instructed in the project before allowing expanded upload
return $this->conversationStatusResolver->isExpertInstructed($expertUser, $subject);
}
}

src/Security/Voter/MatchVoter.php line 26