src/Security/Voter/GroupVoter.php line 14

Open in your IDE?
  1. <?php
  3. namespace App\Security\Voter;
  5. use App\Entity\Authorization;
  6. use App\Entity\Group;
  7. use App\Entity\RealEstate;
  8. use App\Entity\User;
  9. use App\Manager\GroupManager;
  10. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. use Symfony\Component\Security\Core\Security;
  14. class GroupVoter extends Voter
  15. {
  16.     public const CREATE = 'CAN_CREATE';
  17.     public const READ = 'CAN_READ';
  18.     public const EDIT = 'CAN_EDIT';
  19.     public const DELETE = 'CAN_DELETE';
  21.     public function __construct(
  22.         private Security $security,
  23.         private GroupManager $groupRepository
  24.     ) {
  25.     }
  27.     protected function supports($attribute, $subject): bool
  28.     {
  29.         $supportsAttribute = in_array($attribute, [self::CREATE, self::DELETE, self::EDIT, self::READ]);
  30.         $supportsSubject = $subject instanceof Group;
  32.         return $supportsAttribute && $supportsSubject;
  33.     }
  35.     /**
  36.      * @param mixed $subject
  37.      */
  38.     protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  39.     {
  40.         $user = $this->security->getUser();
  41.         if (!$user) {
  42.             return false;
  43.         }
  45.         switch ($attribute) {
  46.             case self::CREATE:
  47.                 return $this->canCreate($subject, $user);
  48.             case self::READ:
  49.                 return $this->canRead($subject, $user);
  50.             case self::EDIT:
  51.                 return $this->canEdit($subject, $user);
  52.             case self::DELETE:
  53.                 return $this->canDelete($subject, $user);
  54.         }
  56.         return false;
  57.     }
  59.     private function canCreate(Group $group, User $user): bool
  60.     {
  61.         if ($this->security->isGranted(Authorization::ROLE_ADMIN)
  62.             || $this->security->isGranted(Authorization::ROLE_OWNER_ADMIN)
  63.         ) {
  64.             return true;
  65.         }
  67.         return false;
  68.     }
  70.     private function canRead(Group $group, User $user): bool
  71.     {
  72.         if ($this->security->isGranted(Authorization::ROLE_ADMIN)) {
  73.             return true;
  74.         }
  76.         return $this->groupRepository->hasAccess($group, $user);
  77.     }
  79.     /**
  80.      * Only owner can edit,
  81.      *  as owner admin, we need the same company
  82.      *  as simple owner, the real estate must be in the list of our realestate.
  83.      *
  84.      * @param RealEstate $realEstate
  85.      */
  86.     private function canEdit(Group $group, User $user): bool
  87.     {
  88.         if ($this->security->isGranted(Authorization::ROLE_ADMIN)) {
  89.             return true;
  90.         }
  92.         // as a owner,we must at least have the same company of the realEstate
  93.         if ($user->getCompany()->getId() !== $group->getCompany()->getId()) {
  94.             return false;
  95.         }
  97.         if (
  98.             $this->security->isGranted(Authorization::ROLE_OWNER_ADMIN)
  99.             || $this->security->isGranted(Authorization::ROLE_SERVICE_PROVIDER_ADMIN)
  100.         ) {
  101.             return true;
  102.         }
  104.         return false;
  105.     }
  107.     private function canDelete(Group $group, User $user): bool
  108.     {
  109.         return $this->canEdit($group, $user);
  110.     }
  111. }