src/Security/Voter/ProjectClosureVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace MedBrief\MSR\Security\Voter;
  5. use MedBrief\MSR\Entity\ProjectClosure;
  6. use MedBrief\MSR\Entity\User;
  7. use Override;
  8. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  9. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. use Symfony\Component\Security\Core\User\UserInterface;
  13. class ProjectClosureVoter extends Voter
  14. {
  15. public const READ = 'READ';
  17. public function __construct(private readonly AuthorizationCheckerInterface $authorizationChecker)
  18. {
  19. }
  21. #[Override]
  22. protected function supports($attribute, $subject)
  23. {
  24. return $attribute == self::READ
  25. && ($subject instanceof ProjectClosure || is_subclass_of($subject, ProjectClosure::class));
  26. }
  28. /**
  29. * Checks if a user can read a ProjectClosure.
  30. *
  31. * @param ProjectClosure $projectClosure
  32. * @param User $user
  33. */
  34. protected function canRead(ProjectClosure $projectClosure, User $user): bool
  35. {
  36. if ($projectClosure->getProject() && true === $user->isAccountAdministratorForAccount($projectClosure->getProject()->getAccount())) {
  37. return self::ACCESS_GRANTED;
  38. }
  39. return self::ACCESS_DENIED;
  40. }
  42. #[Override]
  43. protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
  44. {
  45. // get current logged in user
  46. /** @var User $user */
  47. $user = $token->getUser();
  49. /** @var ProjectClosure $projectClosure */
  50. $projectClosure = $subject;
  52. // if the user is anonymous, do not grant access
  53. if (!$user instanceof UserInterface) {
  54. return self::ACCESS_DENIED;
  55. }
  57. // SuperAdmin and Administrator for Medbrief users can do everything
  58. if ($this->authorizationChecker->isGranted('ROLE_ADMIN')) {
  59. return self::ACCESS_GRANTED;
  60. }
  62. if ($attribute === self::READ) {
  63. return $this->canRead($projectClosure, $user);
  64. }
  66. return self::ACCESS_DENIED;
  67. }
  68. }