src/Security/Voter/UserPermissionVoter.php line 14

Open in your IDE?
  1. <?php
  2. namespace App\Security\Voter;
  3. use App\Entity\User;
  4. use App\ValueObject\UserRoles;
  5. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  6. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  7. use Symfony\Component\Security\Core\Security;
  8. use Symfony\Component\Security\Core\User\UserInterface;
  9. use App\ValueObject\UserPermission;
  10. use Symfony\Component\Security\Core\Validator\Constraints\UserPassword;
  11. class UserPermissionVoter extends Voter
  12. {
  13.     private $security;
  14.     public function __construct(
  15.         Security $security
  16.     ) {
  17.         $this->security $security;
  18.     }
  19.     protected function supports(string $attribute$subject): bool
  20.     {
  21.         $userPermissions UserPermission::getConstants();
  22.         if (in_array($attribute$userPermissions)) {
  23.             return true;
  24.         }
  25.         return false;
  26.     }
  27.     protected function voteOnAttribute(string $attribute$subjectTokenInterface $token): bool
  28.     {
  29.         /** @var User $user */
  30.         $user $token->getUser();
  31.         if (!$user instanceof UserInterface) {
  32.             return false;
  33.         }
  34. //        ROLE_MUNIREG
  35.         if ($this->security->isGranted(UserRoles::ROLE_MUNIREG)) {
  36.             if (in_array($attribute, [
  37.                 UserPermission::ROLE_EMPLOYEE_UPGRADE_TO_ADMIN_SUPER_ADMIN,
  38.                 UserPermission::ROLE_EMPLOYEE_SUPER_ADMIN
  39.             ])) {
  40.                 return false;
  41.             }
  42.             return true;
  43.         }
  44. //        ROLE_SUPER_ADMIN
  45.         if ($this->security->isGranted(UserRoles::ROLE_SUPER_ADMIN)) {
  46.             return true;
  47.         }
  48. //        ROLE_ADMIN_MUNIREG
  49.         if ($this->security->isGranted(UserRoles::ROLE_ADMIN_MUNIREG)) {
  50.             if (
  51.                 in_array($attribute, [
  52.                     UserPermission::ROLE_SUPER_ADMIN,
  53.                     UserPermission::ROLE_EMPLOYEE_SUPER_ADMIN,
  54.                     UserPermission::ROLE_EXPORT_XLS_AND_PDF_USERS,
  55.                     UserPermission::ROLE_USER_VIEW,
  56.                     UserPermission::ROLE_USER_EDIT
  57.                 ])
  58.             ){
  59.                 return false;
  60.             }
  61.             return true;
  62.         }
  63. //      ROLE_ADMIN_REGISTER >> ROLE_ADMIN_REGISTER_PARTY
  64.         if ($this->security->isGranted(UserRoles::ROLE_ADMIN_REGISTER)) {
  65.             if (
  66.                 in_array($attribute, [
  67.                     UserPermission::ROLE_MUNIREG,
  68.                     UserPermission::ROLE_ADMIN_MUNICIPAL,
  69.                     UserPermission::ROLE_SUPER_ADMIN,
  70.                     UserPermission::ROLE_USER_EDIT,
  71.                     UserPermission::ROLE_ORGANIZATION_MANAGEMENT,
  72.                     UserPermission::ROLE_ORGANIZATION_NEW,
  73.                     UserPermission::ROLE_ORGANIZATION_EDIT,
  74.                     UserPermission::ROLE_ORGANIZATION_VIEW,
  75.                     UserPermission::ROLE_MUNICIPALITY,
  76.                     UserPermission::ROLE_MUNICIPALITY_MANAGEMENT,
  77.                     UserPermission::ROLE_MUNICIPALITY_EDIT,
  78.                     UserPermission::ROLE_MUNICIPALITY_NEW,
  79.                     UserPermission::ROLE_VERSION_NEW,
  80.                     UserPermission::ROLE_VERSION_EDIT,
  81.                     UserPermission::ROLE_VERSION_VIEW,
  82.                     UserPermission::ROLE_TUTORIAL_NEW,
  83.                     UserPermission::ROLE_TUTORIAL_EDIT,
  84.                     UserPermission::ROLE_TUTORIAL_MANAGEMENT,
  85.                     UserPermission::ROLE_VERSION_MANAGEMENT,
  86.                     UserPermission::ROLE_ADMIN_MUNIREG,
  87.                     UserPermission::ROLE_EXPORT_XLS_AND_PDF_USERS,
  88.                     UserPermission::ROLE_PROPERTY_OCCUPANCY_DETAILS,
  89.                 ])
  90.             ) {
  91.                 return false;
  92.             } elseif ($user->isViewOnly()) {
  93.                 // dd($attribute);
  94.                 if (in_array($attribute, [
  95.                     UserPermission::ROLE_REGISTRATION_ACTIVITY,
  96.                     UserPermission::ROLE_IMPORT_PROPERTY,
  97.                     UserPermission::ROLE_FORM_REGISTRATION_EDIT,
  98.                     UserPermission::ROLE_FORM_RENEWAL_EDIT,
  99.                     UserPermission::ROLE_DOWNLOAD_RENEWAL,
  100.                     UserPermission::ROLE_FORM_DEREGISTRATION_EDIT,
  101.                     UserPermission::ROLE_DOWNLOAD_DEREGISTRATION,
  102.                     UserPermission::ROLE_MANAGE_INVOICE,
  103.                     UserPermission::MANAGE_SUPPORT_TICKET_INVOICE,
  104.                     UserPermission::ROLE_MANAGE_PROPERTY_FILLINGS,
  105.                     UserPermission::MANAGE_INSPECTION,
  106.                     UserPermission::ROLE_MANAGE_REPORTS,
  107.                     UserPermission::ROLE_ORGANIZATION_MANAGEMENT,
  108.                     UserPermission::ROLE_MANAGE_SUPPORT_FORM,
  109.                     UserPermission::MANAGE_CONTACT,
  110.                     UserPermission::ROLE_USER_NEW,
  111.                     UserPermission::ROLE_MANAGE_PROPERTY_NOTES,
  112.                 ])) {
  113.                   return false;
  114.                 }
  115.             }
  116.             return true;
  117.         }
  118. //      ROLE_REGISTER >>  ROLE_REGISTER_PARTY
  119.         if ($this->security->isGranted(UserRoles::ROLE_REGISTER)) {
  120.             if (
  121.                 in_array($attribute, [
  122.                     UserPermission::ROLE_MUNIREG,
  123.                     UserPermission::ROLE_ADMIN_MUNICIPAL,
  124.                     UserPermission::ROLE_SUPER_ADMIN,
  125.                     UserPermission::ROLE_USER_MANAGEMENT,
  126.                     UserPermission::ROLE_USER_EDIT_PRIVILEGES,
  127.                     UserPermission::ROLE_USER_EDIT,
  128.                     UserPermission::ROLE_ORGANIZATION_MANAGEMENT,
  129.                     UserPermission::ROLE_ORGANIZATION_NEW,
  130.                     UserPermission::ROLE_ORGANIZATION_EDIT,
  131.                     UserPermission::ROLE_ORGANIZATION_VIEW,
  132.                     UserPermission::ROLE_MUNICIPALITY,
  133.                     UserPermission::ROLE_MUNICIPALITY_MANAGEMENT,
  134.                     UserPermission::ROLE_MUNICIPALITY_EDIT,
  135.                     UserPermission::ROLE_MUNICIPALITY_NEW,
  136.                     UserPermission::ROLE_VERSION_NEW,
  137.                     UserPermission::ROLE_VERSION_EDIT,
  138.                     UserPermission::ROLE_VERSION_VIEW,
  139.                     UserPermission::ROLE_TUTORIAL_NEW,
  140.                     UserPermission::ROLE_TUTORIAL_EDIT,
  141.                     UserPermission::ROLE_TUTORIAL_MANAGEMENT,
  142.                     UserPermission::ROLE_VERSION_MANAGEMENT,
  143.                     UserPermission::ROLE_ADMIN_REGISTER_PARTY,
  144.                     UserPermission::ROLE_ADMIN_MUNIREG,
  145.                     UserPermission::ROLE_EXPORT_XLS_AND_PDF_USERS,
  146.                     UserPermission::ROLE_PROPERTY_OCCUPANCY_DETAILS,
  147.                 ])
  148.             ) {
  149.                 return false;
  150.             } elseif ($user->isViewOnly()) {
  151.                 // dd($attribute);
  152.                 if (in_array($attribute, [
  153.                     UserPermission::ROLE_REGISTRATION_ACTIVITY,
  154.                     UserPermission::ROLE_IMPORT_PROPERTY,
  155.                     UserPermission::ROLE_FORM_REGISTRATION_EDIT,
  156.                     UserPermission::ROLE_FORM_RENEWAL_EDIT,
  157.                     UserPermission::ROLE_DOWNLOAD_RENEWAL,
  158.                     UserPermission::ROLE_FORM_DEREGISTRATION_EDIT,
  159.                     UserPermission::ROLE_DOWNLOAD_DEREGISTRATION,
  160.                     UserPermission::ROLE_MANAGE_INVOICE,
  161.                     UserPermission::MANAGE_SUPPORT_TICKET_INVOICE,
  162.                     UserPermission::ROLE_MANAGE_PROPERTY_FILLINGS,
  163.                     UserPermission::MANAGE_INSPECTION,
  164.                     UserPermission::ROLE_MANAGE_REPORTS,
  165.                     UserPermission::ROLE_ORGANIZATION_MANAGEMENT,
  166.                     UserPermission::ROLE_MANAGE_SUPPORT_FORM,
  167.                     UserPermission::MANAGE_CONTACT,
  168.                     UserPermission::ROLE_USER_NEW,
  169.                     UserPermission::ROLE_MANAGE_PROPERTY_NOTES,
  170.                 ])) {
  171.                   return false;
  172.                 }
  173.             }
  174.             return true;
  175.         }
  176. //      ROLE_ADMIN_MUNICIPAL >> ROLE_ADMIN_MUNICIPAL
  177.         if ($this->security->isGranted(UserRoles::ROLE_ADMIN_MUNICIPAL)) {
  178.             if (
  179.                 in_array($attribute, [
  180.                     UserPermission::ROLE_MUNIREG,
  181.                     UserPermission::ROLE_ADMIN_MUNICIPAL,
  182.                     UserPermission::ROLE_SUPER_ADMIN,
  183.                     UserPermission::ROLE_FORM_DEREGISTRATION,
  184.                     UserPermission::ROLE_ORGANIZATION_MANAGEMENT,
  185.                     UserPermission::ROLE_ORGANIZATION_NEW,
  186.                     UserPermission::ROLE_ORGANIZATION_EDIT,
  187.                     UserPermission::ROLE_ORGANIZATION_VIEW,
  188.                     UserPermission::ROLE_REGISTER_PARTY,
  189.                     UserPermission::ROLE_REGISTRATION_ACTIVITY,
  190.                     UserPermission::ROLE_FORM_REGISTRATION,
  191.                     UserPermission::ROLE_FORM_RENEWAL,
  192.                     UserPermission::ROLE_FORM_REGISTRATION_NEW,
  193.                     UserPermission::ROLE_FORM_REGISTRATION_EDIT,
  194.                     UserPermission::ROLE_FORM_RENEWAL_NEW,
  195.                     UserPermission::ROLE_FORM_RENEWAL_EDIT,
  196.                     UserPermission::ROLE_FORM_DEREGISTRATION_NEW,
  197.                     UserPermission::ROLE_FORM_DEREGISTRATION_EDIT,
  198.                     UserPermission::ROLE_VERSION_NEW,
  199.                     UserPermission::ROLE_VERSION_EDIT,
  200.                     UserPermission::ROLE_VERSION_VIEW,
  201.                     UserPermission::ROLE_TUTORIAL_NEW,
  202.                     UserPermission::ROLE_TUTORIAL_EDIT,
  203.                     UserPermission::ROLE_TUTORIAL_MANAGEMENT,
  204.                     UserPermission::ROLE_VERSION_MANAGEMENT,
  205.                     UserPermission::ROLE_ADMIN_REGISTER_PARTY,
  206.                     UserPermission::ROLE_ADMIN_MUNIREG,
  207.                     UserPermission::ROLE_MANAGE_INVOICES_FOR_ALL_USERS,
  208.                 ])
  209.             ) {
  210.                 return false;
  211.             } elseif ($user->isViewOnly()) {
  212.                 if (in_array($attribute, [
  213.                     UserPermission::ROLE_REGISTRATION_ACTIVITY,
  214.                     UserPermission::ROLE_IMPORT_PROPERTY,
  215.                     UserPermission::ROLE_DOWNLOAD_RENEWAL,
  216.                     UserPermission::ROLE_DOWNLOAD_DEREGISTRATION,
  217.                     UserPermission::ROLE_MANAGE_INVOICE,
  218.                     UserPermission::MANAGE_SUPPORT_TICKET_INVOICE,
  219.                     UserPermission::ROLE_MANAGE_PROPERTY_FILLINGS,
  220.                     UserPermission::MANAGE_INSPECTION,
  221.                     UserPermission::ROLE_MANAGE_REPORTS,
  222.                     UserPermission::ROLE_ORGANIZATION_MANAGEMENT,
  223.                     UserPermission::ROLE_MANAGE_SUPPORT_FORM,
  224.                     UserPermission::MANAGE_CONTACT,
  225.                     UserPermission::ROLE_EXPORT_XLS_AND_PDF_USERS,
  226.                     UserPermission::ROLE_USER_NEW,
  227.                     UserPermission::ROLE_USER_EDIT,
  228.                     UserPermission::ROLE_MUNICIPALITY_EDIT,
  229.                     UserPermission::ROLE_REGISTRATION_ACTIVITY,
  230.                     UserPermission::ROLE_MANAGE_PROPERTY_NOTES,
  231.                     UserPermission::ROLE_MANAGE_INVOICES_FOR_ALL_USERS,
  232.                 ])) {
  233.                   return false;
  234.                 }
  235.             }
  236.             return true;
  237.         }
  238. //      ROLE_MUNICIPAL >>  ROLE_MUNICIPALITY
  239.         if ($this->security->isGranted(UserRoles::ROLE_MUNICIPAL)) {
  240.             if (
  241.                 in_array($attribute, [
  242.                     UserPermission::ROLE_MUNIREG,
  243.                     UserPermission::ROLE_ADMIN_MUNICIPAL,
  244.                     UserPermission::ROLE_SUPER_ADMIN,
  245.                     UserPermission::ROLE_FORM_DEREGISTRATION,
  246.                     UserPermission::ROLE_USER_MANAGEMENT,
  247.                     UserPermission::ROLE_USER_EDIT_PRIVILEGES,
  248.                     UserPermission::ROLE_ORGANIZATION_MANAGEMENT,
  249.                     UserPermission::ROLE_ORGANIZATION_NEW,
  250.                     UserPermission::ROLE_ORGANIZATION_EDIT,
  251.                     UserPermission::ROLE_ORGANIZATION_VIEW,
  252.                     UserPermission::ROLE_REGISTER_PARTY,
  253.                     UserPermission::ROLE_MUNICIPALITY_MANAGEMENT,
  254.                     UserPermission::ROLE_MUNICIPALITY_EDIT,
  255.                     UserPermission::ROLE_MUNICIPALITY_NEW,
  256.                     UserPermission::ROLE_REGISTRATION_ACTIVITY,
  257.                     UserPermission::ROLE_FORM_REGISTRATION,
  258.                     UserPermission::ROLE_FORM_RENEWAL,
  259.                     UserPermission::ROLE_FORM_REGISTRATION_NEW,
  260.                     UserPermission::ROLE_FORM_REGISTRATION_EDIT,
  261.                     UserPermission::ROLE_FORM_RENEWAL_NEW,
  262.                     UserPermission::ROLE_FORM_RENEWAL_EDIT,
  263.                     UserPermission::ROLE_FORM_DEREGISTRATION_NEW,
  264.                     UserPermission::ROLE_FORM_DEREGISTRATION_EDIT,
  265.                     UserPermission::ROLE_VERSION_NEW,
  266.                     UserPermission::ROLE_VERSION_EDIT,
  267.                     UserPermission::ROLE_VERSION_VIEW,
  268.                     UserPermission::ROLE_TUTORIAL_NEW,
  269.                     UserPermission::ROLE_TUTORIAL_EDIT,
  270.                     UserPermission::ROLE_TUTORIAL_MANAGEMENT,
  271.                     UserPermission::ROLE_VERSION_MANAGEMENT,
  272.                     UserPermission::ROLE_ADMIN_REGISTER_PARTY,
  273.                     UserPermission::ROLE_ADMIN_MUNICIPAL,
  274.                     UserPermission::ROLE_PROPERTY_DETAILS_CREATE,
  275.                     UserPermission::ROLE_ADMIN_MUNIREG,
  276.                     UserPermission::ROLE_MANAGE_INVOICES_FOR_ALL_USERS,
  277.                 ])
  278.             ) {
  279.                 return false;
  280.             } elseif ($user->isViewOnly()) {
  281.                 if (in_array($attribute, [
  282.                     UserPermission::ROLE_REGISTRATION_ACTIVITY,
  283.                     UserPermission::ROLE_IMPORT_PROPERTY,
  284.                     UserPermission::ROLE_DOWNLOAD_RENEWAL,
  285.                     UserPermission::ROLE_DOWNLOAD_DEREGISTRATION,
  286.                     UserPermission::ROLE_MANAGE_INVOICE,
  287.                     UserPermission::MANAGE_SUPPORT_TICKET_INVOICE,
  288.                     UserPermission::ROLE_MANAGE_PROPERTY_FILLINGS,
  289.                     UserPermission::MANAGE_INSPECTION,
  290.                     UserPermission::ROLE_MANAGE_REPORTS,
  291.                     UserPermission::ROLE_ORGANIZATION_MANAGEMENT,
  292.                     UserPermission::ROLE_MANAGE_SUPPORT_FORM,
  293.                     UserPermission::MANAGE_CONTACT,
  294.                     UserPermission::ROLE_EXPORT_XLS_AND_PDF_USERS,
  295.                     UserPermission::ROLE_USER_NEW,
  296.                     UserPermission::ROLE_USER_EDIT,
  297.                     UserPermission::ROLE_MUNICIPALITY_EDIT,
  298.                     UserPermission::ROLE_REGISTRATION_ACTIVITY,
  299.                     UserPermission::ROLE_MANAGE_PROPERTY_NOTES,
  300.                     UserPermission::ROLE_MANAGE_INVOICES_FOR_ALL_USERS,
  301.                 ])) {
  302.                   return false;
  303.                 }
  304.             }
  305.             return true;
  306.         }
  307.         if ($this->security->isGranted(UserRoles::ROLE_MUNICIPAL) || $this->security->isGranted(UserRoles::ROLE_REGISTER) || $this->security->isGranted(UserRoles::ROLE_MUNIREG)) {
  308.         }
  309.         return false;
  310.     }
  311. }