add voter for documents

src/Bundle/ChillDocStoreBundle/Security/Authorization/AccompanyingCourseDocumentVoter.php

@@ -3,13 +3,20 @@
 namespace Chill\DocStoreBundle\Security\Authorization;
 
 use Chill\DocStoreBundle\Entity\AccompanyingCourseDocument;
+use Chill\DocStoreBundle\Entity\PersonDocument;
 use Chill\MainBundle\Security\Authorization\AbstractChillVoter;
 use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
+use Chill\MainBundle\Security\Authorization\VoterHelperFactoryInterface;
+use Chill\MainBundle\Security\Authorization\VoterHelperInterface;
 use Chill\MainBundle\Security\ProvideRoleHierarchyInterface;
 use Chill\MainBundle\Entity\User;
+use Chill\PersonBundle\Entity\AccompanyingPeriod;
+use Chill\PersonBundle\Entity\Person;
+use Chill\PersonBundle\Security\Authorization\AccompanyingPeriodVoter;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
 use Psr\Log\LoggerInterface;
+use Symfony\Component\Security\Core\Security;
 
 /**
  *
@@ -22,30 +29,22 @@ class AccompanyingCourseDocumentVoter extends AbstractChillVoter implements Prov
     const UPDATE = 'CHILL_ACCOMPANYING_COURSE_DOCUMENT_UPDATE';
     const DELETE = 'CHILL_ACCOMPANYING_COURSE_DOCUMENT_DELETE';
 
-    /**
-     * @var AuthorizationHelper
-     */
-    protected $authorizationHelper;
-
-    /**
-     * @var AccessDecisionManagerInterface
-     */
-    protected $accessDecisionManager;
-
-    /**
-     * @var LoggerInterface
-     */
-    protected $logger;
+    protected LoggerInterface $logger;
+    protected VoterHelperInterface $voterHelper;
+    protected Security $security;
 
     public function __construct(
-        AccessDecisionManagerInterface $accessDecisionManager,
-        AuthorizationHelper $authorizationHelper,
-        LoggerInterface $logger
-    )
-    {
-        $this->accessDecisionManager = $accessDecisionManager;
-        $this->authorizationHelper = $authorizationHelper;
+        LoggerInterface $logger,
+        Security $security,
+        VoterHelperFactoryInterface $voterHelperFactory
+    ) {
         $this->logger = $logger;
+        $this->security = $security;
+        $this->voterHelper = $voterHelperFactory
+            ->generate(self::class)
+            ->addCheckFor(AccompanyingCourseDocument::class, $this->getRoles())
+            ->addCheckFor(AccompanyingPeriod::class, [self::SEE, self::CREATE])
+            ->build();
     }
 
     public function getRoles()
@@ -61,26 +60,30 @@ class AccompanyingCourseDocumentVoter extends AbstractChillVoter implements Prov
 
     protected function supports($attribute, $subject)
     {
-
-        if (\in_array($attribute, $this->getRoles())) {
-            return true;
-        }
-
-        return false;
+        return $this->voterHelper->supports($attribute, $subject);
     }
 
     protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
     {
-        return true;
-    }
+        $this->logger->debug(sprintf("Voting from %s class", self::class));
 
+        if (!$token->getUser() instanceof User) {
+            return false;
+        }
+
+        if ($subject instanceof AccompanyingCourseDocument
+            && !$this->security->isGranted(AccompanyingPeriodVoter::SEE, $subject->getCourse())) {
+            return false;
+        }
+
+        return $this->voterHelper->voteOnAttribute($attribute, $subject, $token);
+    }
 
     public function getRolesWithoutScope()
     {
         return array();
     }
 
-
     public function getRolesWithHierarchy()
     {
         return ['accompanyingCourseDocument' => $this->getRoles() ];

src/Bundle/ChillDocStoreBundle/Security/Authorization/PersonDocumentVoter.php

@@ -19,8 +19,11 @@
 
 namespace Chill\DocStoreBundle\Security\Authorization;
 
+use App\Security\Authorization\VoterHelperFactory;
 use Chill\MainBundle\Security\Authorization\AbstractChillVoter;
 use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
+use Chill\MainBundle\Security\Authorization\VoterHelperFactoryInterface;
+use Chill\MainBundle\Security\Authorization\VoterHelperInterface;
 use Chill\MainBundle\Security\ProvideRoleHierarchyInterface;
 use Chill\DocStoreBundle\Entity\PersonDocument;
 use Chill\MainBundle\Security\Resolver\CenterResolverDispatcher;
@@ -31,6 +34,7 @@ use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Role\Role;
 use Psr\Log\LoggerInterface;
+use Symfony\Component\Security\Core\Security;
 
 /**
  *
@@ -43,25 +47,22 @@ class PersonDocumentVoter extends AbstractChillVoter implements ProvideRoleHiera
     const UPDATE = 'CHILL_PERSON_DOCUMENT_UPDATE';
     const DELETE = 'CHILL_PERSON_DOCUMENT_DELETE';
 
-    protected AuthorizationHelper $authorizationHelper;
-
-    protected AccessDecisionManagerInterface $accessDecisionManager;
-
     protected LoggerInterface $logger;
-
-    protected CenterResolverDispatcher $centerResolverDispatcher;
+    protected Security $security;
+    protected VoterHelperInterface $voterHelper;
 
     public function __construct(
-        AccessDecisionManagerInterface $accessDecisionManager,
-        AuthorizationHelper $authorizationHelper,
-        LoggerInterface $logger//,
-        //CenterResolverDispatcher $centerResolverDispatcher
-    )
-    {
-        $this->accessDecisionManager = $accessDecisionManager;
-        $this->authorizationHelper = $authorizationHelper;
+        LoggerInterface $logger,
+        Security $security,
+        VoterHelperFactoryInterface $voterHelperFactory
+    ) {
         $this->logger = $logger;
-        //$this->centerResolverDispatcher = $centerResolverDispatcher;
+        $this->security = $security;
+        $this->voterHelper = $voterHelperFactory
+            ->generate(self::class)
+            ->addCheckFor(PersonDocument::class, $this->getRoles())
+            ->addCheckFor(Person::class, [self::SEE, self::CREATE])
+            ->build();
     }
 
     public function getRoles()
@@ -77,16 +78,7 @@ class PersonDocumentVoter extends AbstractChillVoter implements ProvideRoleHiera
 
     protected function supports($attribute, $subject)
     {
-        if (\in_array($attribute, $this->getRoles()) && $subject instanceof PersonDocument) {
-            return true;
-        }
-
-        if ($subject instanceof Person
-            && \in_array($attribute, [self::CREATE, self::SEE])) {
-            return true;
-        }
-
-        return false;
+        return $this->voterHelper->supports($attribute, $subject);
     }
 
     /**
@@ -104,42 +96,12 @@ class PersonDocumentVoter extends AbstractChillVoter implements ProvideRoleHiera
             return false;
         }
 
-        $center = $this->centerResolverDispatcher->resolveCenter($subject);
-
-        if ($subject instanceof PersonDocument) {
-            return $this->authorizationHelper->userHasAccess($token->getUser(), $subject, $attribute);
-
-        } elseif ($subject instanceof Person) {
-            return $this->authorizationHelper->userHasAccess($token->getUser(), $subject, $attribute);
-
-        } else {
-
-            // subject is null. We check that at least one center is reachable
-            $centers = $this->authorizationHelper
-                ->getReachableCenters($token->getUser(), new Role($attribute));
-
-            return count($centers) > 0;
-        }
-
-        if (!$this->accessDecisionManager->decide($token, [PersonVoter::SEE], $person)) {
+        if ($subject instanceof PersonDocument
+            && !$this->security->isGranted(PersonVoter::SEE, $subject->getPerson())) {
             return false;
         }
 
-        return $this->authorizationHelper->userHasAccess(
-            $token->getUser(),
-            $subject,
-            $attribute
-        );
-
-    }
-
-    protected function isGranted($attribute, $report, $user = null)
-    {
-        if (! $user instanceof User){
-            return false;
-        }
-
-        return $this->helper->userHasAccess($user, $report, $attribute);
+        return $this->voterHelper->voteOnAttribute($attribute, $subject, $token);
     }
 
     public function getRolesWithoutScope()