src/Security/Content/BlogVoter.php line 11

Open in your IDE?
  1. <?php
  3. namespace App\Security\Content;
  5. use App\Entity\Content\Blog;
  6. use \Symfony\Component\Security\Core\User\UserInterface;
  7. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  8. use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
  9. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. class BlogVoter extends Voter
  12. {
  13. const VIEW = 'BLOG_VIEW';
  14. const VIEW_ANY = 'BLOG_VIEW_ANY';
  15. const CREATE = 'BLOG_CREATE';
  16. const EDIT = 'BLOG_EDIT';
  17. const EDIT_ANY = 'BLOG_EDIT_ANY';
  18. const PRINT = 'BLOG_PRINT';
  19. const DELETE = 'BLOG_DELETE';
  21. /**
  22. * @var AccessDecisionManagerInterface
  23. */
  24. private $decisionManager;
  26. /**
  27. * UserVoter constructor.
  28. *
  29. * @param AccessDecisionManagerInterface $decisionManager
  30. */
  31. public function __construct(AccessDecisionManagerInterface $decisionManager)
  32. {
  33. $this->decisionManager = $decisionManager;
  34. }
  36. /**
  37. * @param string $attribute
  38. * @param mixed $subject
  39. *
  40. * @return bool
  41. */
  42. protected function supports($attribute, $subject): bool
  43. {
  44. // if the attribute isn't one we support, return false
  45. if (!in_array($attribute, array(
  46. self::VIEW,
  47. self::VIEW_ANY,
  48. self::CREATE,
  49. self::EDIT,
  50. self::EDIT_ANY,
  51. self::PRINT,
  52. self::DELETE,
  53. ), true)) {
  54. return false;
  55. }
  57. // only vote on Property objects inside this voter
  58. if ($subject && !$subject instanceof Blog) {
  59. return false;
  60. }
  62. return true;
  63. }
  65. /**
  66. * @param string $attribute
  67. * @param mixed $subject
  68. * @param TokenInterface $token
  69. *
  70. * @return bool
  71. */
  72. protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
  73. {
  74. if ($this->decisionManager->decide($token, array('ROLE_SUPER_ADMIN'))) {
  75. return true;
  76. }
  78. $user = $token->getUser();
  80. if (!$user instanceof UserInterface) {
  81. // the user must be logged in; if not, deny access
  82. return false;
  83. }
  85. switch ($attribute) {
  86. case self::VIEW_ANY:
  87. return $this->canViewAny($user);
  88. case self::VIEW:
  89. return $this->canView($subject, $user);
  90. case self::CREATE:
  91. return $this->canCreate($user);
  92. case self::EDIT:
  93. return $this->canEdit($subject, $user);
  94. case self::EDIT_ANY:
  95. return $this->canEditAny($subject, $user);
  96. case self::DELETE:
  97. return $this->canDelete($subject, $user);
  98. }
  100. throw new \LogicException('This code should not be reached!');
  101. }
  103. /**
  104. * Check if logged in User can view Property
  105. *
  106. * @param UserInterface $subject
  107. * @param UserInterface $user
  108. *
  109. * @return bool
  110. */
  111. private function canView(UserInterface $subject, UserInterface $user): bool
  112. {
  113. if ($this->canEdit($subject, $user)) {
  114. return true;
  115. }
  117. if ($this->isOwner($subject, $user)) {
  118. return true;
  119. }
  121. return false;
  122. }
  124. /**
  125. * Check if logged in User can view Property
  126. *
  127. * @param UserInterface $user
  128. *
  129. * @return bool
  130. */
  131. private function canViewAny(UserInterface $user): bool
  132. {
  133. if ($user->hasRight(self::VIEW_ANY)) {
  134. return true;
  135. }
  137. return false;
  138. }
  140. /**
  141. * Check if logged in User can create Property
  142. *
  143. * @param UserInterface $user
  144. *
  145. * @return bool
  146. */
  147. private function canCreate(UserInterface $user): bool
  148. {
  149. if ($user->hasRight(self::CREATE)) {
  150. return true;
  151. }
  153. return $user->hasRole('ROLE_ADMIN');
  154. }
  156. /**
  157. * Check if logged in User can edit Property
  158. *
  159. * @param UserInterface $subject
  160. * @param UserInterface $user
  161. *
  162. * @return bool
  163. */
  164. private function canEdit(UserInterface $subject, UserInterface $user): bool
  165. {
  166. if ($user->hasRight(self::EDIT)) {
  167. return true;
  168. }
  170. return false;
  171. }
  173. /**
  174. * Check if logged in User can print Property
  175. *
  176. * @param UserInterface $subject
  177. * @param UserInterface $user
  178. *
  179. * @return bool
  180. */
  181. private function canEditAny(UserInterface $subject, UserInterface $user): bool
  182. {
  183. if ($user->hasRight(self::EDIT_ANY)) {
  184. return true;
  185. }
  187. if ($this->isOwner($subject, $user)) {
  188. return true;
  189. }
  191. return false;
  192. }
  194. /**
  195. * Check if logged in User can delete Property
  196. *
  197. * @param UserInterface $subject
  198. * @param UserInterface $user
  199. *
  200. * @return bool
  201. */
  202. private function canDelete(UserInterface $subject, UserInterface $user): bool
  203. {
  204. if ($user->hasRight(self::DELETE)) {
  205. return true;
  206. }
  208. if ($this->isOwner($subject, $user)) {
  209. return true;
  210. }
  212. return false;
  213. }
  215. /**
  216. * Check if User if Owner of Subject/Property
  217. * @param UserInterface $subject
  218. * @param UserInterface $user
  219. *
  220. * @return bool
  221. */
  222. private function isOwner(UserInterface $subject, UserInterface $user): bool
  223. {
  224. return $user->getId() === $subject->getId();
  225. }
  227. }