src/CoreBundle/Security/ProblemVoter.php line 14

Open in your IDE?
  1. <?php
  3. namespace CoreBundle\Security;
  5. use AdminBundle\Service\EasyAdminService;
  6. use CoreBundle\Entity\Mathproblem;
  7. use CoreBundle\Entity\Quiz;
  8. use Doctrine\ORM\EntityManagerInterface;
  9. use Symfony\Component\HttpFoundation\RequestStack;
  10. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. use Symfony\Component\Security\Core\Security;
  14. class ProblemVoter extends Voter
  15. {
  16. const PERMISSION = 'problemEntityPermission';
  17. const INDEX_ACTION = 'problemIndexAction';
  18. const NEW_ACTION = 'problemNewAction';
  19. const EDIT_ACTION = 'problemEditAction';
  20. const DELETE_ACTION = 'problemDeleteAction';
  22. private Security $security;
  23. private EntityManagerInterface $em;
  24. private EasyAdminService $easyAdminService;
  25. private RequestStack $requestStack;
  27. public function __construct(Security $security, EntityManagerInterface $em, EasyAdminService $easyAdminService, RequestStack $requestStack)
  28. {
  29. $this->security = $security;
  30. $this->em = $em;
  31. $this->easyAdminService = $easyAdminService;
  32. $this->requestStack = $requestStack;
  33. }
  35. protected function supports(string $attribute, $subject): bool
  36. {
  37. // For index and new, $subject will always be null. For permission, it will be null when trying to create a new entity.
  38. if (in_array($attribute, [self::INDEX_ACTION, self::NEW_ACTION, self::PERMISSION])) {
  39. return true;
  40. }
  42. if (in_array($attribute, [self::EDIT_ACTION, self::DELETE_ACTION])) {
  43. return $subject instanceof Mathproblem;
  44. }
  46. return false;
  47. }
  49. protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  50. {
  51. if ($attribute === self::INDEX_ACTION) {
  52. // Allow everyone to list - the entity permissions will still apply and hide entities you are not allowed
  53. // to access.
  54. return true;
  55. }
  57. if ($attribute === self::NEW_ACTION || $attribute === self::PERMISSION && $subject === null) {
  58. // Anyone with cms access should be able to create new problems
  59. return true;
  60. }
  62. if (!$subject instanceof Mathproblem) {
  63. throw new \LogicException("Invalid type for voter and attribute.");
  64. }
  66. return $this->checkEntityPermissions($subject, $attribute);
  67. }
  69. public function checkEntityPermissions(Mathproblem $subject): bool
  70. {
  71. // ROLE_SUPER_ADMIN inherits ROLE_ADMIN, and will also be included here.
  72. if ($this->security->isGranted('ROLE_ADMIN')) {
  73. return true;
  74. }
  76. if ($subject->getId() === null) {
  77. // Creating a new problem via MathproblemFromQuizCrudController
  78. try {
  79. $quiz = $this->easyAdminService->getQuiz($this->requestStack->getCurrentRequest());
  80. return $this->checkPermissionByQuiz($quiz);
  81. } catch (\Exception) {
  82. return false;
  83. }
  84. }
  86. return $this->checkPermissionByProblem($subject);
  87. }
  89. private function checkPermissionByProblem(Mathproblem $problem): bool
  90. {
  91. $dql = <<<DQL
  92. SELECT p.id
  93. FROM CoreBundle\Entity\RelationQuizMathproblem rel
  94. JOIN rel.quiz q
  95. JOIN q.publication pc
  96. JOIN pc.publisher ps
  97. JOIN CoreBundle\Entity\PublisherPermission p WITH p.publisher = ps
  98. WHERE p.user = ?1
  99. AND rel.mathproblem = ?2
  100. DQL;
  102. return $this->runQuery($dql, $problem);
  103. }
  105. private function checkPermissionByQuiz(Quiz $quiz): bool
  106. {
  107. $dql = <<<DQL
  108. SELECT p.id
  109. FROM CoreBundle\Entity\Quiz q
  110. JOIN q.publication pc
  111. JOIN pc.publisher ps
  112. JOIN CoreBundle\Entity\PublisherPermission p WITH p.publisher = ps
  113. WHERE p.user = ?1
  114. AND q = ?2
  115. DQL;
  117. return $this->runQuery($dql, $quiz);
  118. }
  120. private function runQuery(string $dql, Mathproblem|Quiz $parameter): bool
  121. {
  122. if ($this->security->isGranted('ROLE_EDITOR'))
  123. $dql .= PHP_EOL . 'AND (p.editorPermission = true OR p.publication = pc)';
  124. else if ($this->security->isGranted('ROLE_AUTHOR'))
  125. $dql .= PHP_EOL . 'AND p.publication = pc';
  126. else
  127. $dql .= PHP_EOL . 'AND 0 = 1';
  129. $query = $this->em->createQuery($dql);
  130. $query->setParameter(1, $this->security->getUser());
  131. $query->setParameter(2, $parameter);
  133. $result = $query->getResult();
  135. return !empty($result);
  136. }
  137. }