vendor/crea/security-bundle/src/Voter/UserVoter.php line 15

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace Crea\SecurityBundle\Voter;
  7. use Crea\SecurityBundle\Entity\User;
  8. use Crea\SecurityBundle\Entity\UserInterface;
  9. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. /**
  13. * @extends Voter<string, User>
  14. */
  15. class UserVoter extends Voter
  16. {
  17. public const USER_LIST = 'SECURITY_USER_LIST';
  18. public const USER_CREATE = 'SECURITY_USER_CREATE';
  19. public const USER_UPDATE_PASSWORD = 'SECURITY_USER_UPDATE_PASSWORD';
  20. public const USER_UPDATE = 'SECURITY_USER_UPDATE';
  21. public const USER_REMOVE = 'SECURITY_USER_REMOVE';
  22. public const USER_IMPERSONATE = 'SECURITY_USER_IMPERSONATE';
  23. public const USER_CONNECT = 'SECURITY_USER_CONNECT';
  24. public const USER_DETAIL = 'SECURITY_USER_DETAIL';
  25. public const USER_ACTIVE = 'SECURITY_USER_ACTIVE';
  27. protected function supports($attribute, $subject): bool
  28. {
  29. return in_array($attribute, [
  30. self::USER_LIST,
  31. self::USER_CREATE,
  32. self::USER_UPDATE_PASSWORD,
  33. self::USER_UPDATE,
  34. self::USER_REMOVE,
  35. self::USER_IMPERSONATE,
  36. self::USER_CONNECT,
  37. self::USER_DETAIL,
  38. self::USER_ACTIVE,
  39. ]) && (null === $subject || $subject instanceof User);
  40. }
  42. protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
  43. {
  44. /** @var User $loggedUser */
  45. $loggedUser = $token->getUser();
  47. if (!$loggedUser instanceof UserInterface) {
  48. return false;
  49. }
  51. switch ($attribute) {
  52. case self::USER_DETAIL:
  53. return $this->voteOnDetail($subject, $loggedUser);
  54. case self::USER_LIST:
  55. return $this->voteOnList($loggedUser);
  56. case self::USER_ACTIVE:
  57. return $this->voteOnActive($loggedUser);
  58. case self::USER_CREATE:
  59. return $this->voteOnCreate($loggedUser);
  60. case self::USER_UPDATE_PASSWORD:
  61. return $this->voteOnpassword($loggedUser);
  62. case self::USER_UPDATE:
  63. return $this->voteOnUpdate($subject, $loggedUser);
  64. case self::USER_REMOVE:
  65. return $this->voteOnRemove($subject, $loggedUser);
  66. case self::USER_IMPERSONATE:
  67. return $this->voteOnImpersonate($subject, $loggedUser);
  68. case self::USER_CONNECT:
  69. return $this->voteOnConnect($subject);
  70. }
  72. return false;
  73. }
  75. private function voteOnImpersonate(?User $subject, UserInterface $loggedUser): bool
  76. {
  77. if (null === $subject) {
  78. if (in_array(self::USER_IMPERSONATE, $loggedUser->getRoles())) {
  79. return true;
  80. }
  81. } else {
  82. /** @var User $user */
  83. $user = $subject;
  84. if (
  85. in_array(self::USER_IMPERSONATE, $loggedUser->getRoles())
  86. && $user->getLogin() !== $loggedUser->getUsername()
  87. && $this->voteOnConnect($user)
  88. ) {
  89. return true;
  90. }
  91. }
  93. return false;
  94. }
  96. public function voteOnConnect(?UserInterface $subject): bool
  97. {
  98. return null !== $subject && null !== $subject->getProfile() && $subject->isEnabled();
  99. }
  101. private function voteOnList(UserInterface $loggedUser): bool
  102. {
  103. if (in_array(self::USER_LIST, $loggedUser->getRoles())) {
  104. return true;
  105. }
  107. return false;
  108. }
  110. private function voteOnCreate(UserInterface $loggedUser): bool
  111. {
  112. if (in_array(self::USER_CREATE, $loggedUser->getRoles())) {
  113. return true;
  114. }
  116. return false;
  117. }
  119. private function voteOnPassword(UserInterface $loggedUser): bool
  120. {
  121. if (in_array(self::USER_UPDATE_PASSWORD, $loggedUser->getRoles())) {
  122. return true;
  123. }
  125. return false;
  126. }
  128. private function voteOnUpdate(?UserInterface $subject, UserInterface $loggedUser): bool
  129. {
  130. if (!in_array(self::USER_UPDATE, $loggedUser->getRoles())) {
  131. return false;
  132. }
  134. if (null === $subject) {
  135. return true;
  136. }
  138. if ($loggedUser !== $subject) {
  139. return true;
  140. }
  142. if (in_array('ROLE_ADMIN', $loggedUser->getRoles())) {
  143. return true;
  144. }
  146. return false;
  147. }
  149. private function voteOnRemove(?UserInterface $subject, UserInterface $loggedUser): bool
  150. {
  151. if (!in_array(self::USER_REMOVE, $loggedUser->getRoles())) {
  152. return false;
  153. }
  155. if (null === $subject) {
  156. return true;
  157. }
  159. if ($loggedUser !== $subject) {
  160. return true;
  161. }
  163. return false;
  164. }
  166. /**
  167. * By default, a user can see its own detail, the right let him see the other details.
  168. */
  169. private function voteOnDetail(UserInterface $subject, UserInterface $loggedUser): bool
  170. {
  171. if ($subject->getUsername() === $loggedUser->getUsername()) {
  172. return true;
  173. }
  175. if (in_array(self::USER_DETAIL, $loggedUser->getRoles())) {
  176. return true;
  177. }
  179. return false;
  180. }
  182. private function voteOnActive(UserInterface $loggedUser): bool
  183. {
  184. if (in_array(self::USER_ACTIVE, $loggedUser->getRoles())) {
  185. return true;
  186. }
  188. return false;
  189. }
  190. }