src/Security/Core/PublicationVoter.php line 14

Open in your IDE?
  1. <?php
  3. namespace App\Security\Core;
  5. use App\Entity\Core\Publication;
  6. use App\Entity\Core\PublisherPermission;
  7. use App\Entity\Core\PublisherPermissionRepository;
  8. use Doctrine\ORM\EntityManagerInterface;
  9. use LogicException;
  10. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. use Symfony\Component\Security\Core\Security;
  14. class PublicationVoter extends Voter
  15. {
  16. const PERMISSION = 'publicationEntityPermission';
  17. const INDEX_ACTION = 'publicationIndexAction';
  18. const NEW_ACTION = 'publicationNewAction';
  19. const EDIT_ACTION = 'publicationEditAction';
  20. const DELETE_ACTION = 'publicationDeleteAction';
  22. private EntityManagerInterface $em;
  23. private Security $security;
  25. public function __construct(EntityManagerInterface $em, Security $security)
  26. {
  27. $this->em = $em;
  28. $this->security = $security;
  29. }
  31. protected function supports(string $attribute, $subject): bool
  32. {
  33. // For index and new, $subject will always be null. For permission, it will be null when trying to create a new entity.
  34. if (in_array($attribute, [self::INDEX_ACTION, self::NEW_ACTION, self::PERMISSION])) {
  35. return true;
  36. }
  38. if (in_array($attribute, [self::EDIT_ACTION, self::DELETE_ACTION])) {
  39. return $subject instanceof Publication;
  40. }
  42. return false;
  43. }
  45. protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  46. {
  47. if ($attribute === self::INDEX_ACTION) {
  48. // Allow everyone to list - the entity permissions will still apply and hide entities you are not allowed
  49. // to access.
  50. return true;
  51. }
  53. if ($attribute === self::NEW_ACTION || $attribute === self::PERMISSION && $subject === null) {
  54. // Includes ROLE_SUPER_ADMIN by inheritance.
  55. // Authors should not be allowed to create new publications.
  56. return $this->security->isGranted('ROLE_ADMIN') ||
  57. $this->security->isGranted('ROLE_EDITOR');
  58. }
  60. if (!$subject instanceof Publication) {
  61. throw new LogicException("Invalid type for voter and attribute.");
  62. }
  64. return $this->checkEntityPermissions($attribute, $subject, $token);
  66. }
  68. public function checkEntityPermissions(string $attribute, Publication $subject, TokenInterface $token): bool
  69. {
  70. if ($subject->isDeleted() || $subject->isHidden() || $subject->getPublisher()->isDeleted()
  71. || $subject->getPublisher()->isHidden() || !$subject->isAvailableForBackendUserCreation()) {
  72. return false;
  73. }
  75. // ROLE_SUPER_ADMIN inherits ROLE_ADMIN, and will also be included here.
  76. if ($this->security->isGranted('ROLE_ADMIN')) {
  77. return true;
  78. }
  80. /** @var PublisherPermissionRepository $permissionRepo */
  81. $permissionRepo = $this->em->getRepository(PublisherPermission::class);
  83. if ($this->security->isGranted('ROLE_EDITOR')) {
  84. return $permissionRepo->hasEditorPermission($token->getUser(), $subject->getPublisher()) ||
  85. $permissionRepo->hasAuthorPermission($token->getUser(), $subject);
  86. }
  88. if ($this->security->isGranted('ROLE_AUTHOR')) {
  90. if ($attribute !== self::PERMISSION) {
  91. // Don't allow authors to edit or delete publications.
  92. return false;
  93. }
  95. return $permissionRepo->hasAuthorPermission($token->getUser(), $subject);
  96. }
  98. // Should not get here due to EasyAdmin firewall on any other roles.
  99. return false;
  100. }
  101. }