src/Security/SectionVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace App\Security;
  5. use App\Entity\Section;
  6. use App\Entity\SectionAcl;
  7. use App\Entity\User;
  8. use App\Entity\UserGroup;
  9. use Doctrine\ORM\EntityManagerInterface;
  10. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  13. class SectionVoter extends Voter
  14. {
  15.     /**
  16.      * @var EntityManagerInterface
  17.      */
  18.     private $em;
  20.     /**
  21.      * SectionVoter constructor.
  22.      * @param EntityManagerInterface $em
  23.      */
  24.     public function __construct(EntityManagerInterface $em)
  25.     {
  26.         $this->em = $em;
  27.     }
  29.     /**
  30.      * {@inheritdoc}
  31.      */
  32.     protected function supports($attribute, $subject)
  33.     {
  34.         if (!in_array($attribute, SectionAcl::getPermissions())) {
  35.             return false;
  36.         }
  38.         if (!$subject instanceof Section) {
  39.             return false;
  40.         }
  42.         return true;
  43.     }
  45.     /**
  46.      * {@inheritdoc}
  47.      */
  48.     protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
  49.     {
  50.         /** @var Section $section */
  51.         $section = $subject;
  53.         $user = $token->getUser();
  54.         $group = ($user instanceof User) ?
  55.             $user->getGroup() :
  56.             $this->em->getRepository(UserGroup::class)->findOneBy(['role' => UserGroup::ROLE_ANONYMOUS]);
  58.         $acl = $this->em->getRepository(SectionAcl::class)->findOneBy([
  59.             'section' => $section,
  60.             'userGroup' => $group,
  61.         ]);
  63.         if (!$acl instanceof SectionAcl) {
  64.             return false;
  65.         }
  67.         switch ($attribute) {
  68.             case SectionAcl::PERMISSION_READ:
  69.                 return $this->canRead($acl);
  70.             case SectionAcl::PERMISSION_READ_WRITE:
  71.                 return $this->canWrite($acl);
  72.         }
  74.         throw new \LogicException("This code should not be reached.");
  75.     }
  77.     /**
  78.      * @return bool
  79.      */
  80.     private function canRead(SectionAcl $acl): bool
  81.     {
  82.         if ($this->canWrite($acl)) {
  83.             return true;
  84.         }
  86.         return $acl->getPermission() === SectionAcl::PERMISSION_READ;
  87.     }
  89.     /**
  90.      * @return bool
  91.      */
  92.     private function canWrite(SectionAcl $acl): bool
  93.     {
  94.         return $acl->getPermission() === SectionAcl::PERMISSION_READ_WRITE;
  95.     }
  96. }