src/Security/Voter/RoleInvitationVoter.php line 18

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace MedBrief\MSR\Security\Voter;
  7. use InvalidArgumentException;
  8. use MedBrief\MSR\Entity\Account;
  9. use MedBrief\MSR\Entity\Project;
  10. use MedBrief\MSR\Entity\RoleInvitation;
  11. use MedBrief\MSR\Entity\User;
  12. use MedBrief\MSR\Service\Role\RoleParserService;
  13. use Override;
  14. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  15. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  16. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  18. final class RoleInvitationVoter implements VoterInterface
  19. {
  20. public const REMIND = 'REMIND_ROLE_INVITATION';
  22. public function __construct(
  23. private readonly AuthorizationCheckerInterface $authorizationChecker,
  24. private readonly RoleParserService $roleParser
  25. ) {
  26. }
  28. public function supportsAttribute($attribute): bool
  29. {
  30. return self::REMIND === $attribute;
  31. }
  33. public function supportsClass($class): bool
  34. {
  35. return RoleInvitation::class === $class || is_subclass_of($class, RoleInvitation::class);
  36. }
  38. #[Override]
  39. public function vote(TokenInterface $token, $subject, array $attributes): int
  40. {
  41. if (!$subject instanceof RoleInvitation) {
  42. return self::ACCESS_ABSTAIN;
  43. }
  45. if (1 !== count($attributes)) {
  46. throw new InvalidArgumentException('Only one attribute is allowed for MedBrief voters.');
  47. }
  49. if (!$this->supportsAttribute($attributes[0])) {
  50. return self::ACCESS_ABSTAIN;
  51. }
  53. if (!$token->getUser() instanceof User) {
  54. return self::ACCESS_DENIED;
  55. }
  57. if ($this->authorizationChecker->isGranted('ROLE_SUPER_ADMIN')
  58. || $this->authorizationChecker->isGranted('ROLE_ADMIN')) {
  59. return self::ACCESS_GRANTED;
  60. }
  62. $parsedRole = $this->roleParser->parseRole($subject->getRole());
  63. if (false === $parsedRole) {
  64. return self::ACCESS_DENIED;
  65. }
  67. $roleSubject = $parsedRole->getSubject();
  68. if ($roleSubject instanceof Account
  69. && $this->authorizationChecker->isGranted('USER_ADMINISTRATION', $roleSubject)) {
  70. return self::ACCESS_GRANTED;
  71. }
  73. if ($roleSubject instanceof Project
  74. && ($this->authorizationChecker->isGranted('USER_ADMINISTRATION', $roleSubject)
  75. || $this->authorizationChecker->isGranted('MEDICAL_RECORDS_ADMINISTRATION', $roleSubject))) {
  76. return self::ACCESS_GRANTED;
  77. }
  79. return self::ACCESS_DENIED;
  80. }
  81. }