From 7564c2fde1734577e74cb01665b418c33994a7e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julien=20Fastr=C3=A9?= Date: Mon, 10 Jan 2022 23:12:52 +0100 Subject: [PATCH] AccompanyingPeriodResource: add ACL --- .../DependencyInjection/ChillPersonExtension.php | 8 ++++---- .../Authorization/AccompanyingPeriodResourceVoter.php | 7 ++++++- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/Bundle/ChillPersonBundle/DependencyInjection/ChillPersonExtension.php b/src/Bundle/ChillPersonBundle/DependencyInjection/ChillPersonExtension.php index fb73753f0..5982fcebe 100644 --- a/src/Bundle/ChillPersonBundle/DependencyInjection/ChillPersonExtension.php +++ b/src/Bundle/ChillPersonBundle/DependencyInjection/ChillPersonExtension.php @@ -14,6 +14,7 @@ namespace Chill\PersonBundle\DependencyInjection; use Chill\MainBundle\DependencyInjection\MissingBundleException; use Chill\MainBundle\Security\Authorization\ChillExportVoter; use Chill\PersonBundle\Doctrine\DQL\AddressPart; +use Chill\PersonBundle\Security\Authorization\AccompanyingPeriodResourceVoter; use Chill\PersonBundle\Security\Authorization\AccompanyingPeriodVoter; use Chill\PersonBundle\Security\Authorization\PersonVoter; use Exception; @@ -425,11 +426,10 @@ class ChillPersonExtension extends Extension implements PrependExtensionInterfac Request::METHOD_PATCH => true, Request::METHOD_HEAD => false, Request::METHOD_DELETE => false, - ], /* - 'roles' => [ - //Request::METHOD_PATCH => \Chill\PersonBundle\Security\Authorization\AccompanyingPeriodVoter::SEE ], - */ + 'roles' => [ + Request::METHOD_PATCH => AccompanyingPeriodResourceVoter::EDIT, + ], ], ], ], diff --git a/src/Bundle/ChillPersonBundle/Security/Authorization/AccompanyingPeriodResourceVoter.php b/src/Bundle/ChillPersonBundle/Security/Authorization/AccompanyingPeriodResourceVoter.php index e27a6a8bb..d17a44dd3 100644 --- a/src/Bundle/ChillPersonBundle/Security/Authorization/AccompanyingPeriodResourceVoter.php +++ b/src/Bundle/ChillPersonBundle/Security/Authorization/AccompanyingPeriodResourceVoter.php @@ -23,6 +23,11 @@ class AccompanyingPeriodResourceVoter extends Voter private AccessDecisionManagerInterface $accessDecisionManager; + public function __construct(AccessDecisionManagerInterface $accessDecisionManager) + { + $this->accessDecisionManager = $accessDecisionManager; + } + protected function supports($attribute, $subject) { return $subject instanceof Resource && self::EDIT === $attribute; @@ -35,7 +40,7 @@ class AccompanyingPeriodResourceVoter extends Voter case self::EDIT: return $this->accessDecisionManager->decide( $token, - AccompanyingPeriodVoter::EDIT, + [AccompanyingPeriodVoter::EDIT], $subject->getAccompanyingPeriod() );