src/Security/Voter/Users/UserVoter.php line 15

Open in your IDE?
  1. <?php
  3. namespace App\Security\Voter\Users;
  5. use App\Entity\Garages\Garage;
  6. use App\Entity\User;
  7. use App\Enum\MenuRolesManagerEnum;
  8. use App\Enum\UserRolesEnum;
  9. use App\Enum\VotersEnum;
  10. use App\Repository\Garages\GarageRepository;
  11. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  12. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  13. use Symfony\Component\Security\Core\Security;
  15. final class UserVoter extends Voter
  16. {
  17.     private Security $security;
  18.     private array $voters;
  19.     private GarageRepository $gr;
  21.     public function __construct(Security $security, GarageRepository $gr)
  22.     {
  23.         $this->security = $security;
  24.         $this->voters = [
  25.             VotersEnum::LIST_USER,
  26.             VotersEnum::CREATE_USER,
  27.             VotersEnum::READ,
  28.             VotersEnum::UPDATE,
  29.             VotersEnum::DELETE,
  30.             VotersEnum::STATISTICS_LIST,
  31.             VotersEnum::STATISTICS_VIEW,
  32.             VotersEnum::STATISTICS_ENABLE,
  33.             VotersEnum::STATISTICS_DISABLE,
  34.             VotersEnum::STATISTICS_DOWNLOAD,
  35.         ];
  36.         $this->gr = $gr;
  37.     }
  39.     protected function supports(string $attribute, $subject): bool
  40.     {
  41.         // first check the $subject and last if the $attribute is supported,
  42.         // because there are attributes (with subject) used as well by other voters (like UPDATE, ...)
  43.         if ($subject && !$subject instanceof User) {
  44.             // only vote on these objects
  45.             return false;
  46.         }
  47.         if (in_array($attribute, $this->voters)) {
  48.             // if the attribute is one we support
  49.             return true;
  50.         }
  52.         return false;
  53.     }
  55.     protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  56.     {
  57.         $user = $token->getUser();
  58.         if (!$user instanceof User) {
  59.             // the user must be logged in; if not, deny access
  60.             return false;
  61.         }
  62.         switch ($attribute) {
  63.             case VotersEnum::LIST_USER:
  64.                 return $this->canList();
  65.             case VotersEnum::CREATE_USER:
  66.                 return $this->canCreate();
  67.             case VotersEnum::READ:
  68.                 return $this->canRead();
  69.             case VotersEnum::UPDATE:
  70.                 return $this->canUpdate($subject);
  71.             case VotersEnum::DELETE:
  72.                 return $this->canDelete($subject);
  73.             case VotersEnum::STATISTICS_LIST:
  74.                 return $this->canListStatistics($subject, $user);
  75.             case VotersEnum::STATISTICS_VIEW:
  76.                 return $this->canViewStatistics($subject, $user);
  77.             case VotersEnum::STATISTICS_ENABLE:
  78.                 return $this->canEnableStatistics($subject);
  79.             case VotersEnum::STATISTICS_DISABLE:
  80.                 return $this->canDisableStatistics($subject);
  81.             case VotersEnum::STATISTICS_DOWNLOAD:
  82.                 return $this->canDownloadStatistics($subject, $user);
  83.         }
  85.         throw new \LogicException('This code should not be reached!');
  86.     }
  88.     private function canList(): bool
  89.     {
  90.         return $this->isAdminUser();
  91.     }
  93.     private function canCreate(): bool
  94.     {
  95.         return $this->isAdminUser();
  96.     }
  98.     private function canRead(): bool
  99.     {
  100.         return $this->isAdminUser();
  101.     }
  103.     private function canUpdate(User $subject): bool
  104.     {
  105.         if ((UserRolesEnum::ROLE_ADMIN === $subject->getUserRole()) || (UserRolesEnum::ROLE_SUPER_ADMIN === $subject->getUserRole())) {
  106.             // only users with ROLE_ADMIN can update ADMINS users
  107.             return $this->security->isGranted(UserRolesEnum::ROLE_ADMIN_LONG);
  108.         } else {
  109.             return $this->isAdminUser();
  110.         }
  111.     }
  113.     private function canDelete(User $user): bool
  114.     {
  115.         return $this->canUpdate($user);
  116.     }
  118.     private function canListStatistics(User $user, User $loggedUser): bool
  119.     {
  120.         if ($this->security->isGranted(UserRolesEnum::ROLE_COORDINATOR_LONG)) {
  121.             $found = false;
  122.             $garages = $this->gr->getEnabledGaragesByProvincesSortedByName($loggedUser->getWorkProvinces());
  123.             /** @var Garage $garage */
  124.             foreach ($garages as $garage) {
  125.                 if ($garage->isOwner($user)) {
  126.                     $found = true;
  128.                     break;
  129.                 }
  130.             }
  132.             return $found && $user->isEnableStatisticsManagement();
  133.         }
  135.         return $this->isStatisticsAdminUser() && $user->isEnableStatisticsManagement();
  136.     }
  138.     private function canViewStatistics(User $user, User $loggedUser): bool
  139.     {
  140.         return $this->canListStatistics($user, $loggedUser);
  141.     }
  143.     private function canEnableStatistics(User $user): bool
  144.     {
  145.         return $this->isStatisticsAdminUser() && !$user->isEnableStatisticsManagement();
  146.     }
  148.     private function canDisableStatistics(User $user): bool
  149.     {
  150.         return $this->isStatisticsAdminUser() && $user->isEnableStatisticsManagement();
  151.     }
  153.     private function canDownloadStatistics(User $user, User $loggedUser): bool
  154.     {
  155.         return $this->canListStatistics($user, $loggedUser);
  156.     }
  158.     private function isStatisticsAdminUser(): bool
  159.     {
  160.         return ($this->isAdminUser() || $this->security->isGranted(MenuRolesManagerEnum::ROLE_MENU_BAROMETER_DATA)) && !$this->security->isGranted(UserRolesEnum::ROLE_COORDINATOR_LONG);
  161.     }
  163.     private function isAdminUser(): bool
  164.     {
  165.         return $this->security->isGranted(UserRolesEnum::ROLE_ADMIN_LONG);
  166.     }
  167. }