src/Security/Voter/UserVoter.php line 13

Open in your IDE?
  1. <?php
  3. namespace App\Security\Voter;
  5. use App\Entity\Authorization;
  6. use App\Entity\RealEstate;
  7. use App\Entity\User;
  8. use App\Manager\UserManager;
  9. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. use Symfony\Component\Security\Core\Security;
  13. class UserVoter extends Voter
  14. {
  15.     public const CREATE = 'CAN_CREATE';
  16.     public const READ = 'CAN_READ';
  17.     public const EDIT = 'CAN_EDIT';
  18.     public const DELETE = 'CAN_DELETE';
  20.     public function __construct(
  21.         private Security $security,
  22.         private UserManager $userManager
  23.     ) {
  24.     }
  26.     protected function supports($attribute, $subject): bool
  27.     {
  28.         $supportsAttribute = in_array($attribute, [self::CREATE, self::DELETE, self::EDIT, self::READ]);
  29.         $supportsSubject = $subject instanceof User;
  31.         return $supportsAttribute && $supportsSubject;
  32.     }
  34.     /**
  35.      * @param mixed $subject
  36.      */
  37.     protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  38.     {
  39.         $user = $this->security->getUser();
  40.         if (!$user) {
  41.             return false;
  42.         }
  44.         switch ($attribute) {
  45.             case self::CREATE:
  46.                 return $this->canCreate($subject, $user);
  47.             case self::READ:
  48.                 return $this->canRead($subject, $user);
  49.             case self::EDIT:
  50.                 return $this->canEdit($subject, $user);
  51.             case self::DELETE:
  52.                 return $this->canDelete($subject, $user);
  53.         }
  55.         return false;
  56.     }
  58.     private function canCreate(User $subject, User $user): bool
  59.     {
  60.         if ($this->security->isGranted(Authorization::ROLE_ADMIN)
  61.             || $this->security->isGranted(Authorization::ROLE_OWNER_ADMIN)
  62.         ) {
  63.             return true;
  64.         }
  66.         return false;
  67.     }
  69.     private function canRead(User $subject, User $user): bool
  70.     {
  71.         if ($this->security->isGranted(Authorization::ROLE_ADMIN)) {
  72.             return true;
  73.         }
  75.         return $this->userManager->hasAccess($subject, $user);
  76.     }
  78.     /**
  79.      * Only owner can edit,
  80.      *  as owner admin, we need the same company
  81.      *  as simple owner, the real estate must be in the list of our realestate.
  82.      *
  83.      * @param RealEstate $realEstate
  84.      */
  85.     private function canEdit(User $subject, User $user): bool
  86.     {
  87.         if ($this->security->isGranted(Authorization::ROLE_ADMIN)) {
  88.             return true;
  89.         }
  91.         // as a owner,we must at least have the same company of the realEstate
  92.         if ($user->getCompany()->getId() !== $subject->getCompany()->getId()) {
  93.             return false;
  94.         }
  96.         if (
  97.             $this->security->isGranted(Authorization::ROLE_OWNER_ADMIN)
  98.             || $this->security->isGranted(Authorization::ROLE_SERVICE_PROVIDER_ADMIN)
  99.         ) {
  100.             return true;
  101.         }
  103.         return false;
  104.     }
  106.     private function canDelete(User $subject, User $user): bool
  107.     {
  108.         return $this->canEdit($subject, $user);
  109.     }
  110. }