src/LocalLife/UserBundle/Security/Voter/OwnerVoter.php line 11

Open in your IDE?
  1. <?php
  3. namespace LocalLife\UserBundle\Security\Voter;
  5. use LocalLife\UserBundle\Entity\User;
  6. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  7. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  8. use Symfony\Component\Security\Core\User\UserInterface;
  9. use Symfony\Component\DependencyInjection\Container;
  11. class OwnerVoter implements VoterInterface
  12. {
  13.     const ACTION_CREATE = 'CREATE';
  14.     const ACTION_READ = 'READ';
  15.     const ACTION_UPDATE = 'UPDATE';
  16.     const ACTION_DELETE = 'DELETE';
  18.     const ABILITY_NAME_OWNER = 'OWNER';
  20.     private $roles;
  22.     public function __construct(Container $container)
  23.     {
  24.         $this->roles = $container->getParameter('security.role_hierarchy.roles');
  25.     }
  27.     public function supportsAttribute($attribute)
  28.     {
  29.         return in_array($attribute, array(
  30.             self::ACTION_READ,
  31.             self::ACTION_UPDATE,
  32.             self::ACTION_DELETE,
  33.             self::ACTION_CREATE,
  34.         ));
  35.     }
  37.     public function supportsClass($class)
  38.     {
  39.         $reflectionClass = new \ReflectionClass($class);
  41.         return $reflectionClass->implementsInterface('LocalLife\UserBundle\Entity\HasOwnerInterface');
  42.     }
  44.     public function vote(TokenInterface $token, $object, array $attributes)
  45.     {
  46.         /** @var User $user */
  47.         $user = $token->getUser();
  48.         if (!$user instanceof UserInterface) {
  49.             return VoterInterface::ACCESS_ABSTAIN;
  50.         }
  52.         $role = $user->getRoles();
  53.         if (array_key_exists((string) $role[0], $this->roles)) {
  54.             $roles = $this->roles[(string) $role[0]];
  55.             $roles[] = (string) $role[0];
  56.         } else {
  57.             $roles[] = (string) $role[0];
  58.         }
  60.         if (!$this->supportsClass(get_class($object))) {
  61.             if (get_class($object) == get_class($this)) {
  62.                 if (in_array($attributes[0], $roles)) {
  63.                     return VoterInterface::ACCESS_GRANTED;
  64.                 }
  65.             }
  67.             return VoterInterface::ACCESS_ABSTAIN;
  68.         }
  70.         if (1 !== count($attributes)) {
  71.             throw new \InvalidArgumentException(
  72.                 'Only one attribute is allowed for CREATE, READ, UPDATE or DELETE'
  73.             );
  74.         }
  76.         $reflection = new \ReflectionClass($object);
  77.         $shortClassName = strtoupper(Container::underscore($reflection->getShortName()));
  78.         $baseRoleName = 'ABILITY_'.$shortClassName;
  80.         $attribute = $attributes[0];
  82.         $actionRole = '';
  83.         if (0 === strpos($attribute, $baseRoleName)) {
  84.             $actionRole = substr($attribute, strlen($baseRoleName) + 1);
  85.         }
  87.         if (!$this->supportsAttribute($actionRole)) {
  88.             return VoterInterface::ACCESS_ABSTAIN;
  89.         }
  91.         $roleOwn = $baseRoleName.'_'.self::ABILITY_NAME_OWNER;
  93.         if (in_array($roleOwn, $roles) && in_array($attribute, $roles)) {
  94.             $owners = $object->getOwners();
  95.             foreach ($owners as $owner) {
  96.                 if ($owner && $owner->getId() == $user->getId()) {
  97.                     return VoterInterface::ACCESS_GRANTED;
  98.                 }
  99.             }
  101.             return VoterInterface::ACCESS_DENIED;
  102.         } elseif (in_array($attribute, $roles)) {
  103.             return VoterInterface::ACCESS_GRANTED;
  104.         }
  106.         return VoterInterface::ACCESS_ABSTAIN;
  107.     }
  108. }