apply new role on accompanying period

src/Bundle/ChillPersonBundle/Security/Authorization/AccompanyingPeriodVoter.php

@@ -4,73 +4,101 @@ namespace Chill\PersonBundle\Security\Authorization;
 
 use Chill\MainBundle\Security\Authorization\AbstractChillVoter;
 use Chill\MainBundle\Entity\User;
-use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
+use Chill\MainBundle\Security\Authorization\VoterHelperFactoryInterface;
+use Chill\MainBundle\Security\Authorization\VoterHelperInterface;
 use Chill\MainBundle\Security\ProvideRoleHierarchyInterface;
 use Chill\PersonBundle\Entity\Person;
 use Chill\PersonBundle\Entity\AccompanyingPeriod;
-use Chill\MainBundle\Entity\Center;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
-use Symfony\Component\Security\Core\Role\Role;
+use Symfony\Component\Security\Core\Security;
 
 class AccompanyingPeriodVoter extends AbstractChillVoter  implements ProvideRoleHierarchyInterface
 {
-    protected AuthorizationHelper $helper;
-
     public const SEE = 'CHILL_PERSON_ACCOMPANYING_PERIOD_SEE';
+    /**
+     * details are for seeing:
+     *
+     * * SocialIssues
+     */
+    public const SEE_DETAILS = 'CHILL_PERSON_ACCOMPANYING_PERIOD_SEE_DETAILS';
+    public const CREATE = 'CHILL_PERSON_ACCOMPANYING_PERIOD_CREATE';
+    public const EDIT = 'CHILL_PERSON_ACCOMPANYING_PERIOD_UPDATE';
+    public const DELETE = 'CHILL_PERSON_ACCOMPANYING_PERIOD_DELETE';
 
     /**
-     * @param AuthorizationHelper $helper
+     * Give all the right above
      */
-    public function __construct(AuthorizationHelper $helper)
-    {
-            $this->helper = $helper;
+    public const FULL = 'CHILL_PERSON_ACCOMPANYING_PERIOD_FULL';
+
+    public const ALL = [
+        self::SEE,
+        self::SEE_DETAILS,
+        self::CREATE,
+        self::EDIT,
+        self::DELETE,
+        self::FULL,
+    ];
+
+    private VoterHelperInterface $voterHelper;
+
+    private Security $security;
+
+    public function __construct(
+        Security $security,
+        VoterHelperFactoryInterface $voterHelperFactory
+    ) {
+        $this->security = $security;
+        $this->voterHelper = $voterHelperFactory
+            ->generate(self::class)
+            ->addCheckFor(null, [self::CREATE])
+            ->addCheckFor(AccompanyingPeriod::class, self::ALL)
+            ->addCheckFor(Person::class, [self::SEE])
+            ->build();
     }
 
     protected function supports($attribute, $subject)
     {
-        return $subject instanceof AccompanyingPeriod;
+        return $this->voterHelper->supports($attribute, $subject);
     }
 
-    protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
+    protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
     {
         if (!$token->getUser() instanceof User) {
             return false;
         }
 
-        // TODO take scopes into account
-        if (count($subject->getPersons()) === 0) {
-            return true;
-        }
-        foreach ($subject->getPersons() as $person) {
-            // give access as soon as on center is reachable
-            if ($this->helper->userHasAccess($token->getUser(), $person->getCenter(), $attribute)) {
-                return true;
+        if ($subject instanceof AccompanyingPeriod) {
+            if (AccompanyingPeriod::STEP_DRAFT === $subject->getStep()) {
+                // only creator can see, edit, delete, etc.
+                if ($subject->getCreatedBy() === $token->getUser()
+                    || NULL === $subject->getCreatedBy()) {
+                    return true;
+                }
+
+                return false;
             }
 
-            return false;
+            // if confidential, only the referent can see it
+            if ($subject->isConfidential()) {
+                return $token->getUser() === $subject->getUser();
+            }
         }
-    }
 
-    private function getAttributes()
-    {
-        return [
-            self::SEE
-        ];
+        return $this->voterHelper->voteOnAttribute($attribute, $subject, $token);
     }
 
     public function getRoles()
     {
-        return $this->getAttributes();
+        return self::ALL;
     }
 
     public function getRolesWithoutScope()
     {
         return [];
     }
-    
+
     public function getRolesWithHierarchy()
     {
-        return [ 'Person' => $this->getRoles() ];
+        return [ 'Accompanying period' => $this->getRoles() ];
     }
-
 }