vendor/sulu/sulu/src/Sulu/Component/Security/Authorization/SecurityContextVoter.php line 22

  1. <?php
  3. /*
  4.  * This file is part of Sulu.
  5.  *
  6.  * (c) Sulu GmbH
  7.  *
  8.  * This source file is subject to the MIT license that is bundled
  9.  * with this source code in the file LICENSE.
  10.  */
  12. namespace Sulu\Component\Security\Authorization;
  14. use Sulu\Bundle\SecurityBundle\Entity\User;
  15. use Sulu\Component\Security\Authorization\AccessControl\AccessControlManagerInterface;
  16. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  17. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  19. /**
  20.  * Checks the Sulu security.
  21.  */
  22. class SecurityContextVoter implements VoterInterface
  23. {
  24.     /**
  25.      * The permissions available, defined by config.
  26.      *
  27.      * @var array
  28.      */
  29.     private $permissions;
  31.     /**
  32.      * @var AccessControlManagerInterface
  33.      */
  34.     private $accessControlManager;
  36.     public function __construct(AccessControlManagerInterface $accessControlManager, $permissions)
  37.     {
  38.         $this->accessControlManager = $accessControlManager;
  39.         $this->permissions = $permissions;
  40.     }
  42.     public function supportsAttribute($attribute)
  43.     {
  44.         return \in_array($attribute, \array_keys($this->permissions));
  45.     }
  47.     public function supportsClass($class)
  48.     {
  49.         return SecurityCondition::class === $class || \is_subclass_of($class, SecurityCondition::class);
  50.     }
  52.     public function vote(TokenInterface $token, $object, array $attributes)
  53.     {
  54.         /** @var User $user */
  55.         $user = $token->getUser();
  57.         if (!\is_object($object) ||
  58.             !$this->supportsClass(\get_class($object))
  59.         ) {
  60.             return VoterInterface::ACCESS_ABSTAIN;
  61.         }
  63.         $userPermissions = $this->accessControlManager->getUserPermissions($object, $user);
  64.         if (0 === \count($userPermissions)) {
  65.             return VoterInterface::ACCESS_DENIED;
  66.         }
  68.         // only if all attributes are granted the access is granted
  69.         foreach ($attributes as $attribute) {
  70.             if (isset($userPermissions[$attribute]) && !$userPermissions[$attribute]) {
  71.                 return VoterInterface::ACCESS_DENIED;
  72.             }
  73.         }
  75.         return VoterInterface::ACCESS_GRANTED;
  76.     }
  77. }