src/Bidcoz/Bundle/CoreBundle/Security/Authorization/Voter/OrganizationVoter.php line 18

Open in your IDE?
  1. <?php
  3. namespace Bidcoz\Bundle\CoreBundle\Security\Authorization\Voter;
  5. use Bidcoz\Bundle\CoreBundle\Entity\Organization;
  6. use Bidcoz\Bundle\CoreBundle\Services\OrganizationManager;
  7. use Bidcoz\Bundle\CoreBundle\Services\PermissionManager;
  8. use RS\DiExtraBundle\Annotation as DI;
  9. use Symfony\Component\HttpFoundation\RequestStack;
  10. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  11. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. use Symfony\Component\Security\Core\User\UserInterface;
  14. /**
  15.  * @DI\Service
  16.  * @DI\Tag("security.voter")
  17.  */
  18. class OrganizationVoter extends Voter
  19. {
  20.     const VIEW = 'VIEW';
  21.     const MANAGE = 'MANAGE';
  22.     const EMAIL = 'EMAIL';
  23.     const CONTACTS = 'CONTACTS';
  24.     const ADMIN = 'ADMIN';
  26.     protected OrganizationManager $organizationManager;
  27.     protected PermissionManager $permissionManager;
  28.     private RequestStack $requestStack;
  30.     /**
  31.      * @DI\InjectParams({
  32.      *     "organizationManager" = @DI\Inject("organization_manager"),
  33.      *     "permissionManager" = @DI\Inject("permission_manager"),
  34.      *     "requestStack" = @DI\Inject("request_stack")
  35.      * })
  36.      */
  37.     public function __construct(
  38.         OrganizationManager $organizationManager,
  39.         PermissionManager $permissionManager,
  40.         RequestStack $requestStack
  41.     )
  42.     {
  43.         $this->organizationManager = $organizationManager;
  44.         $this->permissionManager = $permissionManager;
  45.         $this->requestStack = $requestStack;
  46.     }
  48.     protected function supports($attribute, $subject)
  49.     {
  50.         return $subject instanceof Organization && in_array($attribute, [self::VIEW, self::MANAGE, self::EMAIL, self::CONTACTS, self::ADMIN]);
  51.     }
  53.     protected function voteOnAttribute($attribute, $organization, TokenInterface $token)
  54.     {
  55.         if (self::VIEW === $attribute && $organization->isActive() && ($organization->isApproved() || $organization->isDirectoryOnly())) {
  56.             return true;
  57.         }
  59.         $route = $this->requestStack->getMainRequest() ? $this->requestStack->getMainRequest()->get('_route') : null;
  60.         if ('organization_register_user' === $route) {
  61.             return true;
  62.         }
  64.         // make sure there is a user object (i.e. that the user is logged in)
  65.         $user = $token->getUser();
  66.         if (!$user instanceof UserInterface) {
  67.             return false;
  68.         }
  70.         if ($this->organizationManager->isOrganizationAdmin($organization, $user)) {
  71.             return true;
  72.         }
  74.         // If not an org admin, no access to any manage resources
  75.         if (self::MANAGE === $attribute) {
  76.             return false;
  77.         }
  79.         // User is logged in, not an admin, see if they have the ability to view any of the orgs campaigns
  80.         if (count($this->permissionManager->getUserGroupMembershipForOrganization($organization, $user))) {
  81.             return true;
  82.         }
  84.         return false;
  85.     }
  86. }