src/Security/Voter/OrthancAnnotationVoter.php line 14

Open in your IDE?
  1. <?php
  3. namespace MedBrief\MSR\Security\Voter;
  5. use InvalidArgumentException;
  6. use MedBrief\MSR\Entity\OrthancAnnotation;
  7. use Override;
  8. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  12. use Symfony\Component\Security\Core\User\UserInterface;
  14. class OrthancAnnotationVoter implements VoterInterface
  15. {
  16. public const CREATE = 'CREATE';
  17. public const READ = 'READ';
  18. public const UPDATE = 'UPDATE';
  19. public const DELETE = 'DELETE';
  20. public const ADMINISTRATION = 'ADMINISTRATION';
  22. public function __construct(private readonly AuthorizationCheckerInterface $authorizationChecker)
  23. {
  24. }
  26. public function supportsAttribute($attribute): bool
  27. {
  28. return in_array($attribute, [
  29. self::CREATE,
  30. self::READ,
  31. self::UPDATE,
  32. self::DELETE,
  33. self::ADMINISTRATION,
  34. ]);
  35. }
  37. public function supportsClass($class): bool
  38. {
  39. $supportedClass = OrthancAnnotation::class;
  41. return $supportedClass === $class || is_subclass_of($class, $supportedClass);
  42. }
  44. /**
  45. *
  46. * @param mixed $entity
  47. */
  48. #[Override]
  49. public function vote(TokenInterface $token, $entity, array $attributes)
  50. {
  51. /**
  52. * START: This is common code for all Voter::vote() methods
  53. */
  54. // check if class of this object is supported by this voter
  55. if (!$this->supportsClass($entity && !is_array($entity) ? $entity::class : '')) {
  56. return VoterInterface::ACCESS_ABSTAIN;
  57. }
  59. // check if the voter is used correct, only allow one attribute
  60. // this isn't a requirement, it's just one easy way for you to
  61. // design your voter
  62. if (1 !== count($attributes)) {
  63. throw new InvalidArgumentException(
  64. 'Only one attribute is allowed for medbrief Voters.'
  65. );
  66. }
  68. // set the attribute to check against
  69. $attribute = $attributes[0];
  71. // check if the given attribute is covered by this voter
  72. if (!$this->supportsAttribute($attribute)) {
  73. return VoterInterface::ACCESS_ABSTAIN;
  74. }
  76. // get current logged in user
  77. $user = $token->getUser();
  79. // make sure there is a user object (i.e. that the user is logged in)
  80. if (!$user instanceof UserInterface) {
  81. return VoterInterface::ACCESS_DENIED;
  82. }
  84. // Admin and Super admin users can do everything.
  85. if ($this->authorizationChecker->isGranted('ROLE_ADMIN')) {
  86. return VoterInterface::ACCESS_GRANTED;
  87. }
  88. /**
  89. * END: Common code for all Voter:vote() methods. Put custom logic below.
  90. */
  92. // Check if the user has access to the Document in order to determine if they can see the annotations.
  93. if ($entity->getDocument()) {
  94. // Retrieve the Document...
  95. $document = $entity->getDocument();
  97. // You need to be able to read the Project the Document
  98. if ($document && $document->getProject() && $this->authorizationChecker->isGranted('READ', $document->getProject())) {
  99. // The basic permissions for a Project is enough to allow CREATE of annotations.
  100. if ($attribute === self::CREATE) {
  101. return VoterInterface::ACCESS_GRANTED;
  102. }
  103. // If you can see an annotation, you can update or delete it at this time, due to a limitation of the
  104. // Osimis viewer.
  105. if ($attribute === self::READ || $attribute === self::UPDATE || $attribute === self::DELETE) {
  106. // If the annotation is public, everyone can see it.
  107. if ($user->isAccountAdministrator()) {
  108. // If the user is an account level administrator, they can see all annotations.
  109. return VoterInterface::ACCESS_GRANTED;
  110. } elseif ($this->authorizationChecker->isGranted('ROLE_PROJECT_' . $document->getProject()->getId() . '_PROJECTMANAGER')) {
  111. // If the user is a project manager for the Matter the document belongs to, they can see all annotations.
  112. return VoterInterface::ACCESS_GRANTED;
  113. } elseif ($entity->getCreator()->getId() == $user->getId()) {
  114. // Everyone can see their annotations
  115. return VoterInterface::ACCESS_GRANTED;
  116. }
  117. }
  118. }
  119. }
  121. // If we get to the end of this function, then no decisions have been
  122. // made so we deny access
  123. return VoterInterface::ACCESS_DENIED;
  124. }
  125. }