src/Security/Voter/ProjectVoter.php line 20

Open in your IDE?
  1. <?php
  3. namespace MedBrief\MSR\Security\Voter;
  5. use InvalidArgumentException;
  6. use MedBrief\MSR\Entity\Account;
  7. use MedBrief\MSR\Entity\Firm;
  8. use MedBrief\MSR\Entity\InterpartyDisclosure;
  9. use MedBrief\MSR\Entity\Project;
  10. use MedBrief\MSR\Entity\User;
  11. use MedBrief\MSR\Service\EntityHelper\UserHelper;
  12. use MedBrief\MSR\Service\Role\RoleParserService;
  13. use MedBrief\MSR\Traits\Security\Authorization\Voter\ClientSortingSessionTrait;
  14. use Override;
  15. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  16. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  17. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  18. use Symfony\Component\Security\Core\User\UserInterface;
  20. class ProjectVoter implements VoterInterface
  21. {
  22. use ClientSortingSessionTrait;
  24. // CONSTANTS
  26. public const CREATE = 'CREATE';
  27. public const READ = 'READ';
  28. public const UPDATE = 'UPDATE';
  29. public const DELETE = 'DELETE';
  30. public const ADMINISTRATION = 'ADMINISTRATION';
  32. public const MEDICAL_RECORDS_ADMINISTRATION = 'MEDICAL_RECORDS_ADMINISTRATION';
  33. public const RADIOLOGY_ADMINISTRATION = 'RADIOLOGY_ADMINISTRATION';
  35. // Determines if a user may view the "File details" panel for a project document.
  36. // Matter-level Expert, Expert - View Only, Scanner and Scanner - Download Enabled roles are excluded.
  37. public const VIEW_FILE_DETAILS = 'VIEW_FILE_DETAILS';
  39. public const USER_ADMINISTRATION = 'USER_ADMINISTRATION';
  40. public const CLINICAL_SUMMARY_PROJECT_ADMINISTRATION = 'CLINICAL_SUMMARY_PROJECT_ADMINISTRATION';
  42. public const PROJECT_USER_LIST = 'PROJECT_USER_LIST';
  44. public const VIEW_DASHBOARD = 'VIEW_DASHBOARD';
  45. public const TOGGLE_STATUS = 'TOGGLE_STATUS';
  46. public const ARCHIVE = 'ARCHIVE';
  47. public const CANCEL_DELETE = 'CANCEL_DELETE';
  49. public const RADIOLOGY_DOWNLOAD = 'RADIOLOGY_DOWNLOAD';
  50. public const RADIOLOGY_DOWNLOAD_AUDIT_REPORT = 'RADIOLOGY_DOWNLOAD_AUDIT_REPORT';
  51. public const MEDICAL_RECORD_DOWNLOAD = 'MEDICAL_RECORD_DOWNLOAD';
  52. public const DELETION_REPORT_DOWNLOAD = 'DELETION_REPORT_DOWNLOAD';
  53. public const INTERNAL_USER_ACCESS_REPORT_DOWNLOAD = 'INTERNAL_USER_ACCESS_REPORT_DOWNLOAD';
  55. public const CHRONOLOGY_ADMINISTRATION = 'CHRONOLOGY_ADMINISTRATION';
  57. // This permission determines if a user sees an inactive notice message
  58. // when an inactive Project is accessed.
  59. public const BYPASS_INACTIVE_NOTICE = 'BYPASS_INACTIVE_NOTICE';
  61. // This permission determines if a user can view a closed project
  62. public const BYPASS_CLOSED_NOTICE = 'BYPASS_CLOSED_NOTICE';
  64. // Keep these permissions on a Project, as creating any of these
  65. // directly affects a Project.
  66. public const CREATE_BATCH_REQUEST = 'CREATE_BATCH_REQUEST';
  67. public const CREATE_BATCH_REQUEST_SIMPLE = 'CREATE_BATCH_REQUEST_SIMPLE';
  68. public const CREATE_CHRONOLOGY_REQUEST = 'CREATE_CHRONOLOGY_REQUEST';
  69. public const CREATE_ADDITIONAL_REQUEST = 'CREATE_ADDITIONAL_REQUEST';
  70. public const CREATE_EXPERT_REPORT = 'CREATE_EXPERT_REPORT';
  71. public const LIST_EXPERT_REPORTS = 'LIST_EXPERT_REPORTS';
  73. // Sorting Session
  74. public const SORTING_SESSION_LIST = 'SORTING_SESSION_LIST';
  75. public const CREATE_SORTING_SESSION = 'CREATE_SORTING_SESSION';
  76. public const CREATE_SORTING_SESSION_SIMPLE = 'CREATE_SORTING_SESSION_SIMPLE';
  78. // Creating a matter note
  79. public const CREATE_MATTER_NOTE = 'CREATE_MATTER_NOTE';
  80. // Allow list of matter notes
  81. public const LIST_MATTER_NOTES = 'LIST_MATTER_NOTES';
  83. // Allow view of matter communications
  84. public const VIEW_MATTER_COMMUNICATIONS = 'VIEW_MATTER_COMMUNICATIONS';
  86. // Disclosure permissions
  87. public const MEDICAL_RECORDS_DISCLOSE = 'MEDICAL_RECORDS_DISCLOSE';
  88. public const DISCLOSE_DISC = 'DISCLOSE_DISC';
  90. public const BYPASS_AUTHENTICATION = 'BYPASS_AUTHENTICATION';
  92. // Allows changing the account value of a Matter
  93. public const CHANGE_ACCOUNT = 'CHANGE_ACCOUNT';
  95. // Allows user to create a record request letter
  96. public const MANAGE_REQUEST_LETTERS = 'MANAGE_REQUEST_LETTERS';
  98. // Allows a user to see the 'Unsorted' records for a Project
  99. public const VIEW_UNSORTED_RECORDS = 'VIEW_UNSORTED_RECORDS';
  101. // Project Closure Permissions
  102. public const CREATE_PROJECT_CLOSURE = 'CREATE_PROJECT_CLOSURE';
  103. public const DOWNLOAD_ALL_PROJECT_FILES = 'DOWNLOAD_ALL_PROJECT_FILES';
  104. public const DOWNLOAD_PROJECT_CLOSURE_REPORT = 'DOWNLOAD_PROJECT_CLOSURE_REPORT';
  106. // Allows the user to see a modal showing important notes on the matter, if any.
  107. public const VIEW_IMPORTANT_NOTES = 'VIEW_IMPORTANT_NOTES';
  109. // Allows the user to see the service request requirement banners on the matter dashboard.
  110. public const VIEW_SERVICE_REQUEST_REQUIREMENT_BANNERS = 'VIEW_SERVICE_REQUEST_REQUIREMENT_BANNERS';
  112. // Inter-party Disclosure
  113. public const CREATE_INTERPARTY_DISCLOSURE = 'CREATE_INTERPARTY_DISCLOSURE';
  114. public const LIST_INTERPARTY_DISCLOSURE = 'LIST_INTERPARTY_DISCLOSURE';
  116. // Allows by passing the disabled state of service requests when a matter/project is closed or in the process of being closed.
  117. public const BYPASS_SERVICE_REQUEST_DISABLED = 'BYPASS_SERVICE_REQUEST_DISABLED';
  119. // Allows the user to download the 'user download medical records viewed report'
  120. public const VIEW_THIRD_PARTY_ACCESS_REPORT = 'VIEW_THIRD_PARTY_ACCESS_REPORT';
  122. public function __construct(private AuthorizationCheckerInterface $authorizationChecker, private UserHelper $userHelper)
  123. {
  124. }
  126. /**
  127. * Whether or not this User is allowed to perform specific actions on this Entity
  128. *
  129. * @param mixed $attribute
  130. */
  131. public function supportsAttribute(mixed $attribute): bool
  132. {
  133. return in_array($attribute, [
  134. self::CREATE,
  135. self::READ,
  136. self::UPDATE,
  137. self::DELETE,
  138. self::ADMINISTRATION,
  139. self::MEDICAL_RECORDS_ADMINISTRATION,
  140. self::RADIOLOGY_ADMINISTRATION,
  141. self::USER_ADMINISTRATION,
  142. self::VIEW_DASHBOARD,
  143. self::TOGGLE_STATUS,
  144. self::PROJECT_USER_LIST,
  145. self::RADIOLOGY_DOWNLOAD,
  146. self::RADIOLOGY_DOWNLOAD_AUDIT_REPORT,
  147. self::MEDICAL_RECORD_DOWNLOAD,
  148. self::DELETION_REPORT_DOWNLOAD,
  149. self::INTERNAL_USER_ACCESS_REPORT_DOWNLOAD,
  150. self::CHRONOLOGY_ADMINISTRATION,
  151. self::ARCHIVE,
  152. self::CANCEL_DELETE,
  153. self::BYPASS_INACTIVE_NOTICE,
  154. self::BYPASS_CLOSED_NOTICE,
  155. self::CREATE_BATCH_REQUEST,
  156. self::CREATE_BATCH_REQUEST_SIMPLE,
  157. self::CREATE_CHRONOLOGY_REQUEST,
  158. self::CREATE_ADDITIONAL_REQUEST,
  159. self::SORTING_SESSION_LIST,
  160. self::CREATE_SORTING_SESSION,
  161. self::CREATE_SORTING_SESSION_SIMPLE,
  162. self::CREATE_MATTER_NOTE,
  163. self::LIST_MATTER_NOTES,
  164. self::VIEW_MATTER_COMMUNICATIONS,
  165. self::MEDICAL_RECORDS_DISCLOSE,
  166. self::DISCLOSE_DISC,
  167. self::BYPASS_AUTHENTICATION,
  168. self::CHANGE_ACCOUNT,
  169. self::MANAGE_REQUEST_LETTERS,
  170. self::VIEW_UNSORTED_RECORDS,
  171. self::CREATE_PROJECT_CLOSURE,
  172. self::DOWNLOAD_ALL_PROJECT_FILES,
  173. self::DOWNLOAD_PROJECT_CLOSURE_REPORT,
  174. self::VIEW_IMPORTANT_NOTES,
  175. self::VIEW_SERVICE_REQUEST_REQUIREMENT_BANNERS,
  176. self::CREATE_INTERPARTY_DISCLOSURE,
  177. self::LIST_INTERPARTY_DISCLOSURE,
  178. self::BYPASS_SERVICE_REQUEST_DISABLED,
  179. self::VIEW_THIRD_PARTY_ACCESS_REPORT,
  180. self::CLINICAL_SUMMARY_PROJECT_ADMINISTRATION,
  181. self::CREATE_EXPERT_REPORT,
  182. self::LIST_EXPERT_REPORTS,
  183. self::VIEW_FILE_DETAILS,
  184. ]);
  185. }
  187. /**
  188. * Whether or not this is a supported Class
  189. *
  190. * @param string $class
  191. */
  192. public function supportsClass($class): bool
  193. {
  194. $supportedClass = Project::class;
  196. return $supportedClass === $class || is_subclass_of($class, $supportedClass);
  197. }
  199. /**
  200. * @param Project $entity
  201. *
  202. * @return int
  203. */
  204. #[Override]
  205. public function vote(TokenInterface $token, $entity, array $attributes)
  206. {
  207. /**
  208. * START: This is common code for all Voter::vote() methods
  209. */
  210. // check if class of this object is supported by this voter
  211. if (!$this->supportsClass($entity && !is_array($entity) ? $entity::class : '')) {
  212. return VoterInterface::ACCESS_ABSTAIN;
  213. }
  215. // check if the voter is used correct, only allow one attribute
  216. // this isn't a requirement, it's just one easy way for you to
  217. // design your voter
  218. if (1 !== count($attributes)) {
  219. throw new InvalidArgumentException(
  220. 'Only one attribute is allowed for medbrief Voters.'
  221. );
  222. }
  224. // set the attribute to check against
  225. $attribute = $attributes[0];
  227. // check if the given attribute is covered by this voter
  228. if (!$this->supportsAttribute($attribute)) {
  229. return VoterInterface::ACCESS_ABSTAIN;
  230. }
  232. // get current logged in user
  233. /** @var User $user */
  234. $user = $token->getUser();
  236. // make sure there is a user object (i.e. that the user is logged in)
  237. if (!$user instanceof UserInterface) {
  238. return VoterInterface::ACCESS_DENIED;
  239. }
  241. // Only allow Super Admins and Admins to change accounts
  242. if ($attribute === self::CHANGE_ACCOUNT && !$this->authorizationChecker->isGranted('ROLE_ADMIN')) {
  243. return VoterInterface::ACCESS_DENIED;
  244. }
  246. // Only allow Super Admins to delete a project
  247. if ($attribute === self::DELETE && !$this->authorizationChecker->isGranted('ROLE_SUPER_ADMIN')) {
  248. return VoterInterface::ACCESS_DENIED;
  249. }
  251. // Only super admins can update service requests when the project is in a closed or closing state
  252. if ($attribute === self::BYPASS_SERVICE_REQUEST_DISABLED) {
  253. if ($this->authorizationChecker->isGranted('ROLE_SUPER_ADMIN') === true) {
  254. return VoterInterface::ACCESS_GRANTED;
  255. }
  256. return VoterInterface::ACCESS_DENIED;
  257. }
  259. /**
  260. * Clinical Summary Access Control with project entity passed in as the subject
  261. *
  262. * We need to put this before we grant admin users rights to everything otherwise the
  263. * isCloseInProgressOrComplete check has no effect
  264. */
  265. if ($attribute === self::CLINICAL_SUMMARY_PROJECT_ADMINISTRATION) {
  266. if ($this->canAccessClinicalSummaryWizard($entity)) {
  267. return VoterInterface::ACCESS_GRANTED;
  268. }
  269. return VoterInterface::ACCESS_DENIED;
  270. }
  272. /**
  273. * Deny access to expert report actions if the project does not have a matter request associated with it (Classic matter).
  274. */
  275. if (in_array($attribute, [self::CREATE_EXPERT_REPORT,self::LIST_EXPERT_REPORTS]) && $entity instanceof Project && $entity->getMatterRequest() == null) {
  276. return VoterInterface::ACCESS_DENIED;
  277. }
  279. // Admin users can do everything
  280. if ($this->authorizationChecker->isGranted('ROLE_ADMIN')) {
  281. return VoterInterface::ACCESS_GRANTED;
  282. }
  283. /**
  284. * END: Common code for all Voter:vote() methods. Put custom logic below.
  285. */
  287. /**
  288. * API (Firm) Access Control
  289. */
  290. if ($user instanceof Firm) {
  291. // If the account that belongs to the project is allocated to the firm's client areas, allow everything.
  292. if ($entity->getAccount() instanceof Account && $user->getClientAreas()->contains($entity->getAccount()) === true) {
  293. return self::ACCESS_GRANTED;
  294. }
  295. return self::ACCESS_DENIED;
  296. }
  298. /**
  299. * Disclosure matter access control
  300. */
  301. // Grab all project levels roles related to this project.
  302. $allProjectRoles = RoleParserService::getAllRolesForProject($entity->getId());
  304. // Users that have been directly invited to the Disclosure will have permission granted
  305. $isDirectlyInvitedToDisclosureMatter = array_filter($allProjectRoles, fn ($role) => $this->authorizationChecker->isGranted($role)) !== [];
  307. // Check if the project is a disclosure, and exclude anyone who has been directly invited to the disclosure matter (i.e. those that were
  308. // added when creating the disclosure). Project level project managers of the original project will not have a project role on the disclosure target project.
  309. if ($entity->isTypeDisclosure() && $isDirectlyInvitedToDisclosureMatter === false) {
  310. $allowedAttributes = [
  311. self::READ,
  312. self::RADIOLOGY_DOWNLOAD,
  313. self::MEDICAL_RECORD_DOWNLOAD,
  314. self::BYPASS_INACTIVE_NOTICE,
  315. self::VIEW_THIRD_PARTY_ACCESS_REPORT,
  316. ];
  318. // Disclosure matters only allow certain actions for the those who can VIEW the source disclosure entity
  319. if (in_array($attribute, $allowedAttributes) && $entity->getDisclosureSources()->count() > 0) {
  320. // Grant access if the user has access to VIEW the original source disclosure (we take the latest one in the chain of sources)
  321. /** @var InterpartyDisclosure $disclosure */
  322. $disclosure = $entity->getDisclosureSources()->last();
  323. if ($this->authorizationChecker->isGranted(InterpartyDisclosureVoter::VIEW, $disclosure)) {
  324. return self::ACCESS_GRANTED;
  325. }
  326. }
  328. return self::ACCESS_DENIED;
  329. }
  331. //Checks if user can download radiology audit report
  332. if ($attribute === self::RADIOLOGY_DOWNLOAD_AUDIT_REPORT) {
  333. return $this->canRadiologyDownloadAuditReport($entity);
  334. }
  336. if ($attribute === self::LIST_EXPERT_REPORTS && $this->canViewExpertReports($entity, $user)) {
  337. return VoterInterface::ACCESS_GRANTED;
  338. }
  340. $this->userHelper->setUser($user);
  342. $denyAccess = [
  343. self::CREATE_SORTING_SESSION,
  344. self::LIST_MATTER_NOTES,
  345. self::CREATE_MATTER_NOTE,
  346. self::MEDICAL_RECORDS_DISCLOSE,
  347. self::DISCLOSE_DISC,
  348. self::VIEW_MATTER_COMMUNICATIONS,
  349. self::DELETION_REPORT_DOWNLOAD,
  350. self::INTERNAL_USER_ACCESS_REPORT_DOWNLOAD,
  351. self::MANAGE_REQUEST_LETTERS,
  352. self::DELETE,
  353. self::VIEW_IMPORTANT_NOTES,
  354. self::VIEW_SERVICE_REQUEST_REQUIREMENT_BANNERS,
  355. self::LIST_EXPERT_REPORTS,
  356. ];
  357. // Deny all other roles these permissions
  358. if (in_array($attribute, $denyAccess)) {
  359. return VoterInterface::ACCESS_DENIED;
  360. }
  362. // Permissions related to the creation and management of sorting sessions and batches.
  363. $attributeGroup = [
  364. self::CREATE_BATCH_REQUEST_SIMPLE,
  365. self::SORTING_SESSION_LIST,
  366. self::CREATE_SORTING_SESSION_SIMPLE,
  367. ];
  368. if (in_array($attribute, $attributeGroup)) {
  369. if ($this->hasClientSessionAccess($entity, $user)) {
  370. return VoterInterface::ACCESS_GRANTED;
  371. };
  372. return VoterInterface::ACCESS_DENIED;
  373. }
  375. // Deny all other roles from creating these ServiceRequests
  376. $serviceRequestCreateAttributes = [
  377. self::CREATE_BATCH_REQUEST,
  378. self::CREATE_CHRONOLOGY_REQUEST,
  379. self::CREATE_ADDITIONAL_REQUEST,
  380. self::CREATE_EXPERT_REPORT,
  381. ];
  382. if (in_array($attribute, $serviceRequestCreateAttributes)) {
  383. return VoterInterface::ACCESS_DENIED;
  384. }
  386. if ($attribute === self::VIEW_DASHBOARD && $user->getMatterDashboardEnabled()) {
  388. // then they have access to do anything
  389. return VoterInterface::ACCESS_GRANTED;
  390. }
  392. // if this user is a Super Administrator for the Account for which this Project belongs
  393. if ($this->authorizationChecker->isGranted('ROLE_ACCOUNT_' . $entity->getAccount()->getId() . '_SUPERADMINISTRATOR')) {
  395. // then they have access to do anything, except delete.
  396. return VoterInterface::ACCESS_GRANTED;
  397. }
  399. // Otherwise if this user is a Client Administrator for the Account then they can
  400. // do everything else except for User Administration and Deletion.
  401. if ($this->authorizationChecker->isGranted('ROLE_ACCOUNT_' . $entity->getAccount()->getId() . '_ADMINISTRATOR')) {
  403. // Commenting this out for now because Kennedy's actually need
  404. // regular Client Administrators to still have this access for now. - RR
  405. //if ($attribute != self::USER_ADMINISTRATION) {
  406. // then they have access
  407. return VoterInterface::ACCESS_GRANTED;
  408. //}
  409. }
  411. // if this user is a Sorter for the Account for which this Project belongs
  412. // if we are looking for access other than delete, full administration and user management abilities
  413. if ($this->authorizationChecker->isGranted('ROLE_ACCOUNT_' . $entity->getAccount()->getId() . '_SORTER') && ($attribute != self::DELETE
  414. && $attribute != self::ADMINISTRATION
  415. && $attribute != self::PROJECT_USER_LIST
  416. && $attribute != self::USER_ADMINISTRATION
  417. && $attribute != self::CREATE_PROJECT_CLOSURE
  418. && $attribute != self::CANCEL_DELETE
  419. && $attribute != self::ARCHIVE
  420. && $attribute != self::DOWNLOAD_ALL_PROJECT_FILES
  421. && $attribute != self::DOWNLOAD_PROJECT_CLOSURE_REPORT
  422. && $attribute != self::CREATE_INTERPARTY_DISCLOSURE
  423. && $attribute != self::LIST_INTERPARTY_DISCLOSURE)) {
  425. // then account level sorters have this access
  426. return VoterInterface::ACCESS_GRANTED;
  427. }
  429. // if we are looking for any access other than delete and full administration.
  430. // Note: Project managers ARE allowed closure-related permissions (CREATE_PROJECT_CLOSURE,
  431. // CANCEL_DELETE, ARCHIVE, DOWNLOAD_ALL_PROJECT_FILES, DOWNLOAD_PROJECT_CLOSURE_REPORT)
  432. // to match client admin + super admin access. See MSR-5782.
  433. if ($attribute != self::DELETE
  434. && $attribute != self::ADMINISTRATION
  435. ) {
  437. // then project managers may do this
  438. if ($this->authorizationChecker->isGranted('ROLE_PROJECT_' . $entity->getId() . '_PROJECTMANAGER')) {
  439. return VoterInterface::ACCESS_GRANTED;
  440. }
  442. // Grant project manager access to a Project's manager, which will likely be a
  443. // ACCOUNT_PROJECT_MANAGER
  444. if ($entity->getManager() && $entity->getManager()->getId() === $user->getId()) {
  445. return VoterInterface::ACCESS_GRANTED;
  446. }
  447. }
  449. // if we are looking for the medical records administration or radiology administration attribute
  450. if ($attribute == self::MEDICAL_RECORDS_ADMINISTRATION || $attribute == self::RADIOLOGY_ADMINISTRATION || $attribute === self::VIEW_UNSORTED_RECORDS) {
  452. // any of the following roles will grant access
  453. $allowedRoles = [
  454. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNER',
  455. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNERDOWNLOAD',
  456. 'ROLE_PROJECT_' . $entity->getId() . '_PROJECTMANAGER',
  457. ];
  459. // so if the user has any one of these
  460. foreach ($allowedRoles as $role) {
  461. if ($this->authorizationChecker->isGranted($role)) {
  463. // then they have access
  464. return VoterInterface::ACCESS_GRANTED;
  465. }
  466. }
  467. }
  469. // If the project allows experts to see the unsorted records, and the user has an export role on the project.
  470. if ($attribute === self::VIEW_UNSORTED_RECORDS && ($entity->getAllowExpertViewUnsortedRecords() === true
  471. && ($this->authorizationChecker->isGranted('ROLE_PROJECT_' . $entity->getId() . '_EXPERT') || $this->authorizationChecker->isGranted('ROLE_PROJECT_' . $entity->getId() . '_EXPERTVIEWER')))) {
  472. return VoterInterface::ACCESS_GRANTED;
  473. }
  475. // Certain roles will allow you to bypass the inactive notice on an inactive Project's related controller.
  476. if ($attribute == self::BYPASS_INACTIVE_NOTICE) {
  478. // any of the following roles will grant access
  479. $allowedRoles = [
  480. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNER',
  481. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNERDOWNLOAD',
  482. 'ROLE_PROJECT_' . $entity->getId() . '_PROJECTMANAGER',
  483. ];
  485. // so if the user has any one of these
  486. foreach ($allowedRoles as $role) {
  487. if ($this->authorizationChecker->isGranted($role)) {
  489. // then they have access
  490. return VoterInterface::ACCESS_GRANTED;
  491. }
  492. }
  493. }
  495. // Certain roles will allow you to bypass the closed notice on a closed Project's related controller.
  496. if ($attribute == self::BYPASS_CLOSED_NOTICE) {
  498. // any of the following roles will grant access
  499. $allowedRoles = [
  500. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNER',
  501. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNERDOWNLOAD',
  502. 'ROLE_PROJECT_' . $entity->getId() . '_PROJECTMANAGER',
  503. ];
  505. // so if the user has any one of these
  506. foreach ($allowedRoles as $role) {
  507. if ($this->authorizationChecker->isGranted($role)) {
  509. // then they have access
  510. return VoterInterface::ACCESS_GRANTED;
  511. }
  512. }
  513. }
  515. if ($attribute == self::RADIOLOGY_DOWNLOAD || $attribute == self::MEDICAL_RECORD_DOWNLOAD) {
  517. // Experts may do this, but EXPERTVIEWER's may not
  518. if ($this->authorizationChecker->isGranted('ROLE_PROJECT_' . $entity->getId() . '_EXPERT')) {
  519. return VoterInterface::ACCESS_GRANTED;
  520. }
  522. // Scanner - Download Enabled may do this, but Scanner's may not
  523. if ($attribute == self::MEDICAL_RECORD_DOWNLOAD && $this->authorizationChecker->isGranted('ROLE_PROJECT_' . $entity->getId() . '_SCANNERDOWNLOAD')) {
  524. return VoterInterface::ACCESS_GRANTED;
  525. }
  527. // Certain roles may have access to Radiology
  528. if ($attribute == self::RADIOLOGY_DOWNLOAD) {
  530. // Array of permitted/allowed roles
  531. $allowedRoles = [
  532. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNER',
  533. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNERDOWNLOAD',
  534. ];
  536. // Iterate through them and...
  537. foreach ($allowedRoles as $role) {
  539. // ... if they have the role...
  540. if ($this->authorizationChecker->isGranted($role)) {
  542. // SHAZAM!
  543. return VoterInterface::ACCESS_GRANTED;
  544. }
  545. }
  546. }
  547. }
  549. // These project-level roles must not view the "File details" panel.
  550. // Any user reaching this block without one of these roles is granted access.
  551. if ($attribute === self::VIEW_FILE_DETAILS) {
  552. $excludedRoles = [
  553. 'ROLE_PROJECT_' . $entity->getId() . '_EXPERT',
  554. 'ROLE_PROJECT_' . $entity->getId() . '_EXPERTVIEWER',
  555. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNER',
  556. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNERDOWNLOAD',
  557. ];
  559. foreach ($excludedRoles as $role) {
  560. if ($this->authorizationChecker->isGranted($role)) {
  561. return VoterInterface::ACCESS_DENIED;
  562. }
  563. }
  565. return VoterInterface::ACCESS_GRANTED;
  566. }
  568. // if the user is wanting to read information about this Project
  569. if ($attribute == self::READ) {
  571. // if the user is an expert agency administrator let them pass.
  572. // this should probably be done in a better way, tying permissions
  573. // to an entity in one place somehow....
  574. if ($user->isExpertAgencyAdministrator()) {
  575. return VoterInterface::ACCESS_GRANTED;
  576. }
  578. // if the user has any role related to this project
  579. if ($this->userHelper->hasProjectRole($entity)) {
  581. // then they have access
  582. return VoterInterface::ACCESS_GRANTED;
  583. }
  584. }
  586. // if we are looking for updating a project
  587. // if the user is a project manager
  588. if ($attribute == self::UPDATE && $this->authorizationChecker->isGranted('ROLE_PROJECT_' . $entity->getId() . '_PROJECTMANAGER')) {
  590. // then they have access
  591. return VoterInterface::ACCESS_GRANTED;
  592. }
  594. // if we are checking to see if we can bypass authentication
  595. if ($attribute == self::BYPASS_AUTHENTICATION && $this->authorizationChecker->isGranted('USER_ADMINISTRATION', $entity)) {
  596. return VoterInterface::ACCESS_GRANTED;
  597. }
  599. // If we get to the end of this function, then no decisions have been
  600. // made so we deny access
  601. return VoterInterface::ACCESS_DENIED;
  602. }
  604. /**
  605. * Checks whether a user can view expert reports for a given project.
  606. *
  607. * @param Project $project
  608. * @param UserInterface $user
  609. *
  610. * @return bool
  611. */
  612. private function canViewExpertReports(Project $project, UserInterface $user): bool
  613. {
  614. $account = $project->getAccount();
  616. $matterRequest = $project->getMatterRequest();
  618. // If there is no matter request associated with the project, deny access
  619. if ($matterRequest == null) {
  620. return false;
  621. }
  623. if (!$account->isMatchOptInAllClientUsers()
  624. && (!$account->isMatchOptInSpecificUsers() || !$user instanceof User || !$user->getMatchOptIn())) {
  625. return false;
  626. }
  628. $accountId = $account->getId();
  629. $projectId = $project->getId();
  631. $allowedRoles = [
  632. 'ROLE_ACCOUNT_' . $accountId . '_ADMINISTRATOR',
  633. 'ROLE_ACCOUNT_' . $accountId . '_SUPERADMINISTRATOR',
  634. 'ROLE_ACCOUNT_' . $accountId . '_PROJECTMANAGER',
  635. 'ROLE_PROJECT_' . $projectId . '_PROJECTMANAGER',
  636. 'ROLE_PROJECT_' . $projectId . '_EXPERT',
  637. ];
  639. foreach ($allowedRoles as $role) {
  640. if ($this->authorizationChecker->isGranted($role)) {
  641. return true;
  642. }
  643. }
  645. return $project->getManager() === $user;
  646. }
  648. /**
  649. * Checks whether user has administrative rights for a clinical summary
  650. *
  651. *
  652. *
  653. * @param Project $entity
  654. *
  655. * @return int
  656. */
  657. private function canAccessClinicalSummaryWizard(Project $entity)
  658. {
  659. // Deny access if the project is in the process of being closed or is closed
  660. if ($entity->isCloseInProgressOrComplete()) {
  661. return false;
  662. }
  663. // Allow access if the user has the ROLE_ADMIN or ROLE_SUPER_ADMIN role
  664. return $this->authorizationChecker->isGranted('ROLE_ADMIN');
  665. }
  667. /**
  668. * Checks whether user can download radiology audit report
  669. *
  670. * @todo: Not type hinting this method now as this may change later
  671. *
  672. * @param Project $entity
  673. */
  674. private function canRadiologyDownloadAuditReport(Project $entity): int
  675. {
  676. $deniedRoles = [
  677. 'ROLE_PROJECT_' . $entity->getId() . '_EXPERT',
  678. 'ROLE_PROJECT_' . $entity->getId() . '_EXPERTVIEWER',
  679. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNER',
  680. 'ROLE_PROJECT_' . $entity->getId() . '_SCANNERDOWNLOAD',
  681. ];
  683. foreach ($deniedRoles as $role) {
  684. if ($this->authorizationChecker->isGranted($role)) {
  685. return VoterInterface::ACCESS_DENIED;
  686. }
  687. }
  689. return VoterInterface::ACCESS_GRANTED;
  690. }
  691. }