mirror of
https://gitlab.com/Chill-Projet/chill-bundles.git
synced 2025-09-04 22:04:59 +00:00
cs: Fix code style (safe rules only).
This commit is contained in:
Pol Dellaiera
@@ -1,19 +1,29 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Chill is a software for social workers
|
||||
*
|
||||
* For the full copyright and license information, please view
|
||||
* the LICENSE file that was distributed with this source code.
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Chill\MainBundle\Security\Authorization;
|
||||
|
||||
use Chill\MainBundle\Entity\User;
|
||||
use Chill\MainBundle\Entity\Center;
|
||||
use Chill\MainBundle\Entity\Scope;
|
||||
use Chill\MainBundle\Entity\User;
|
||||
use Chill\MainBundle\Repository\UserACLAwareRepositoryInterface;
|
||||
use Chill\MainBundle\Security\ParentRoleHelper;
|
||||
use Chill\MainBundle\Security\Resolver\CenterResolverDispatcherInterface;
|
||||
use Chill\MainBundle\Security\Resolver\ScopeResolverDispatcher;
|
||||
use Psr\Log\LoggerInterface;
|
||||
use Symfony\Component\Security\Core\Role\Role;
|
||||
use Chill\MainBundle\Entity\Scope;
|
||||
use Symfony\Component\Security\Core\User\UserInterface;
|
||||
use Traversable;
|
||||
use UnexpectedValueException;
|
||||
use function array_merge;
|
||||
|
||||
/**
|
||||
* Helper for authorizations.
|
||||
@@ -24,14 +34,14 @@ class AuthorizationHelper implements AuthorizationHelperInterface
|
||||
{
|
||||
private CenterResolverDispatcherInterface $centerResolverDispatcher;
|
||||
|
||||
private ScopeResolverDispatcher $scopeResolverDispatcher;
|
||||
|
||||
private LoggerInterface $logger;
|
||||
|
||||
private UserACLAwareRepositoryInterface $userACLAwareRepository;
|
||||
|
||||
private ParentRoleHelper $parentRoleHelper;
|
||||
|
||||
private ScopeResolverDispatcher $scopeResolverDispatcher;
|
||||
|
||||
private UserACLAwareRepositoryInterface $userACLAwareRepository;
|
||||
|
||||
public function __construct(
|
||||
CenterResolverDispatcherInterface $centerResolverDispatcher,
|
||||
LoggerInterface $logger,
|
||||
@@ -47,168 +57,11 @@ class AuthorizationHelper implements AuthorizationHelperInterface
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines if a user is active on this center
|
||||
*
|
||||
* @param Center|Center[] $center May be an array of center
|
||||
*/
|
||||
public function userCanReachCenter(User $user, $center): bool
|
||||
{
|
||||
if ($center instanceof \Traversable) {
|
||||
foreach ($center as $c) {
|
||||
if ($c->userCanReachCenter($user, $c)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
if ($center instanceof Center) {
|
||||
foreach ($user->getGroupCenters() as $groupCenter) {
|
||||
if ($center->getId() === $groupCenter->getCenter()->getId()) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
throw new \UnexpectedValueException(
|
||||
sprintf(
|
||||
'The entity given is not an instance of %s, %s given',
|
||||
Center::class,
|
||||
get_class($center)
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines if the user has access to the given entity.
|
||||
*
|
||||
* if the entity implements Chill\MainBundle\Entity\HasScopeInterface,
|
||||
* the scope is taken into account.
|
||||
*
|
||||
* @param User $user
|
||||
* @param mixed $entity the entity may also implement HasScopeInterface
|
||||
* @param string|Role $attribute
|
||||
* @return boolean true if the user has access
|
||||
*/
|
||||
public function userHasAccess(User $user, $entity, $attribute)
|
||||
{
|
||||
$center = $this->centerResolverDispatcher->resolveCenter($entity);
|
||||
|
||||
if (is_iterable($center)) {
|
||||
foreach ($center as $c) {
|
||||
if ($this->userHasAccessForCenter($user, $c, $entity, $attribute)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
} elseif ($center instanceof Center) {
|
||||
return $this->userHasAccessForCenter($user, $center, $entity, $attribute);
|
||||
} elseif (NULL === $center) {
|
||||
return false;
|
||||
} else {
|
||||
throw new \UnexpectedValueException("could not resolver a center");
|
||||
}
|
||||
}
|
||||
|
||||
private function userHasAccessForCenter(User $user, Center $center, $entity, $attribute): bool
|
||||
{
|
||||
if (!$this->userCanReachCenter($user, $center)) {
|
||||
$this->logger->debug("user cannot reach center of entity", [
|
||||
'center_name' => $center->getName(),
|
||||
'user' => $user->getUsername()
|
||||
]);
|
||||
return false;
|
||||
}
|
||||
|
||||
foreach ($user->getGroupCenters() as $groupCenter){
|
||||
//filter on center
|
||||
if ($groupCenter->getCenter() === $center) {
|
||||
$permissionGroup = $groupCenter->getPermissionsGroup();
|
||||
//iterate on roleScopes
|
||||
foreach($permissionGroup->getRoleScopes() as $roleScope) {
|
||||
//check that the role allow to reach the required role
|
||||
if ($this->isRoleReached($attribute, $roleScope->getRole())) {
|
||||
//if yes, we have a right on something...
|
||||
// perform check on scope if necessary
|
||||
if ($this->scopeResolverDispatcher->isConcerned($entity)) {
|
||||
$scope = $this->scopeResolverDispatcher->resolveScope($entity);
|
||||
|
||||
if (NULL === $scope) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (is_iterable($scope)) {
|
||||
foreach ($scope as $s) {
|
||||
if ($s === $roleScope->getScope()) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if ($scope === $roleScope->getScope()) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$this->logger->debug("user can reach center entity, but not role", [
|
||||
'username' => $user->getUsername(),
|
||||
'center' => $center->getName()
|
||||
]);
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get reachable Centers for the given user, role,
|
||||
* and optionally Scope
|
||||
*
|
||||
* @return Center[]|array
|
||||
*/
|
||||
public function getReachableCenters(UserInterface $user, string $role, ?Scope $scope = null): array
|
||||
{
|
||||
if ($role instanceof Role) {
|
||||
$role = $role->getRole();
|
||||
}
|
||||
$centers = array();
|
||||
|
||||
foreach ($user->getGroupCenters() as $groupCenter){
|
||||
$permissionGroup = $groupCenter->getPermissionsGroup();
|
||||
//iterate on roleScopes
|
||||
foreach($permissionGroup->getRoleScopes() as $roleScope) {
|
||||
//check that the role is in the reachable roles
|
||||
if ($this->isRoleReached($role, $roleScope->getRole())) {
|
||||
if ($scope === null) {
|
||||
$centers[] = $groupCenter->getCenter();
|
||||
break 1;
|
||||
}
|
||||
|
||||
if ($scope->getId() == $roleScope->getScope()->getId()){
|
||||
$centers[] = $groupCenter->getCenter();
|
||||
break 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return $centers;
|
||||
}
|
||||
|
||||
/**
|
||||
* Filter an array of centers, return only center which are reachable
|
||||
* Filter an array of centers, return only center which are reachable.
|
||||
*
|
||||
* @param User $user The user
|
||||
* @param array $centers a list of centers which are going to be filtered
|
||||
* @param string|Center $role
|
||||
* @param Center|string $role
|
||||
*/
|
||||
public function filterReachableCenters(User $user, array $centers, $role): array
|
||||
{
|
||||
@@ -228,27 +81,75 @@ class AuthorizationHelper implements AuthorizationHelperInterface
|
||||
}
|
||||
|
||||
/**
|
||||
* Return all reachable scope for a given user, center and role
|
||||
* @deprecated use UserACLAwareRepositoryInterface::findUsersByReachedACL instead
|
||||
*
|
||||
* @deprecated Use getReachableCircles
|
||||
* @param array|Center|Center[] $center
|
||||
* @param array|Scope|Scope[]|null $scope
|
||||
*
|
||||
* @param Center|Center[] $center
|
||||
* @return Scope[]|array
|
||||
* @return User[]
|
||||
*/
|
||||
public function getReachableScopes(UserInterface $user, string $role, $center): array
|
||||
public function findUsersReaching(string $role, $center, $scope = null, bool $onlyEnabled = true): array
|
||||
{
|
||||
return $this->userACLAwareRepository
|
||||
->findUsersByReachedACL($role, $center, $scope, $onlyEnabled);
|
||||
}
|
||||
|
||||
/**
|
||||
* Return all the role which give access to the given role. Only the role
|
||||
* which are registered into Chill are taken into account.
|
||||
*
|
||||
* @return string[] the role which give access to the given $role
|
||||
*/
|
||||
public function getParentRoles(string $role): array
|
||||
{
|
||||
trigger_deprecation('Chill\MainBundle', '2.0', 'use ParentRoleHelper::getParentRoles instead');
|
||||
|
||||
return $this->parentRoleHelper->getParentRoles($role);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get reachable Centers for the given user, role,
|
||||
* and optionally Scope.
|
||||
*
|
||||
* @return array|Center[]
|
||||
*/
|
||||
public function getReachableCenters(UserInterface $user, string $role, ?Scope $scope = null): array
|
||||
{
|
||||
if ($role instanceof Role) {
|
||||
$role = $role->getRole();
|
||||
}
|
||||
$centers = [];
|
||||
|
||||
return $this->getReachableCircles($user, $role, $center);
|
||||
foreach ($user->getGroupCenters() as $groupCenter) {
|
||||
$permissionGroup = $groupCenter->getPermissionsGroup();
|
||||
//iterate on roleScopes
|
||||
foreach ($permissionGroup->getRoleScopes() as $roleScope) {
|
||||
//check that the role is in the reachable roles
|
||||
if ($this->isRoleReached($role, $roleScope->getRole())) {
|
||||
if (null === $scope) {
|
||||
$centers[] = $groupCenter->getCenter();
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
if ($scope->getId() == $roleScope->getScope()->getId()) {
|
||||
$centers[] = $groupCenter->getCenter();
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return $centers;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return all reachable circle for a given user, center and role
|
||||
* Return all reachable circle for a given user, center and role.
|
||||
*
|
||||
* @param string|Role $role
|
||||
* @param Role|string $role
|
||||
* @param Center|Center[] $center
|
||||
*
|
||||
* @return Scope[]
|
||||
*/
|
||||
public function getReachableCircles(UserInterface $user, $role, $center)
|
||||
@@ -257,7 +158,7 @@ class AuthorizationHelper implements AuthorizationHelperInterface
|
||||
|
||||
if (is_iterable($center)) {
|
||||
foreach ($center as $c) {
|
||||
$scopes = \array_merge($scopes, $this->getReachableCircles($user, $role, $c));
|
||||
$scopes = array_merge($scopes, $this->getReachableCircles($user, $role, $c));
|
||||
}
|
||||
|
||||
return $scopes;
|
||||
@@ -267,12 +168,12 @@ class AuthorizationHelper implements AuthorizationHelperInterface
|
||||
$role = $role->getRole();
|
||||
}
|
||||
|
||||
foreach ($user->getGroupCenters() as $groupCenter){
|
||||
foreach ($user->getGroupCenters() as $groupCenter) {
|
||||
if ($center->getId() === $groupCenter->getCenter()->getId()) {
|
||||
//iterate on permissionGroup
|
||||
$permissionGroup = $groupCenter->getPermissionsGroup();
|
||||
//iterate on roleScopes
|
||||
foreach($permissionGroup->getRoleScopes() as $roleScope) {
|
||||
foreach ($permissionGroup->getRoleScopes() as $roleScope) {
|
||||
//check that the role is in the reachable roles
|
||||
if ($this->isRoleReached($role, $roleScope->getRole())) {
|
||||
$scopes[] = $roleScope->getScope();
|
||||
@@ -285,41 +186,160 @@ class AuthorizationHelper implements AuthorizationHelperInterface
|
||||
}
|
||||
|
||||
/**
|
||||
* Return all reachable scope for a given user, center and role.
|
||||
*
|
||||
* @deprecated use UserACLAwareRepositoryInterface::findUsersByReachedACL instead
|
||||
* @param Center|Center[]|array $center
|
||||
* @param Scope|Scope[]|array|null $scope
|
||||
* @param bool $onlyActive true if get only active users
|
||||
* @return User[]
|
||||
* @deprecated Use getReachableCircles
|
||||
*
|
||||
* @param Center|Center[] $center
|
||||
*
|
||||
* @return array|Scope[]
|
||||
*/
|
||||
public function findUsersReaching(string $role, $center, $scope = null, bool $onlyEnabled = true): array
|
||||
public function getReachableScopes(UserInterface $user, string $role, $center): array
|
||||
{
|
||||
return $this->userACLAwareRepository
|
||||
->findUsersByReachedACL($role, $center, $scope, $onlyEnabled);
|
||||
if ($role instanceof Role) {
|
||||
$role = $role->getRole();
|
||||
}
|
||||
|
||||
return $this->getReachableCircles($user, $role, $center);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test if a parent role may give access to a given child role
|
||||
* Determines if a user is active on this center.
|
||||
*
|
||||
* @param Center|Center[] $center May be an array of center
|
||||
*/
|
||||
public function userCanReachCenter(User $user, $center): bool
|
||||
{
|
||||
if ($center instanceof Traversable) {
|
||||
foreach ($center as $c) {
|
||||
if ($c->userCanReachCenter($user, $c)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
if ($center instanceof Center) {
|
||||
foreach ($user->getGroupCenters() as $groupCenter) {
|
||||
if ($center->getId() === $groupCenter->getCenter()->getId()) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
throw new UnexpectedValueException(
|
||||
sprintf(
|
||||
'The entity given is not an instance of %s, %s given',
|
||||
Center::class,
|
||||
get_class($center)
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Determines if the user has access to the given entity.
|
||||
*
|
||||
* if the entity implements Chill\MainBundle\Entity\HasScopeInterface,
|
||||
* the scope is taken into account.
|
||||
*
|
||||
* @param mixed $entity the entity may also implement HasScopeInterface
|
||||
* @param Role|string $attribute
|
||||
*
|
||||
* @return bool true if the user has access
|
||||
*/
|
||||
public function userHasAccess(User $user, $entity, $attribute)
|
||||
{
|
||||
$center = $this->centerResolverDispatcher->resolveCenter($entity);
|
||||
|
||||
if (is_iterable($center)) {
|
||||
foreach ($center as $c) {
|
||||
if ($this->userHasAccessForCenter($user, $c, $entity, $attribute)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
if ($center instanceof Center) {
|
||||
return $this->userHasAccessForCenter($user, $center, $entity, $attribute);
|
||||
}
|
||||
|
||||
if (null === $center) {
|
||||
return false;
|
||||
}
|
||||
|
||||
throw new UnexpectedValueException('could not resolver a center');
|
||||
}
|
||||
|
||||
/**
|
||||
* Test if a parent role may give access to a given child role.
|
||||
*
|
||||
* @param string $childRole The role we want to test if he is reachable
|
||||
* @param string $parentRole The role which should give access to $childRole
|
||||
* @return boolean true if the child role is granted by parent role
|
||||
*
|
||||
* @return bool true if the child role is granted by parent role
|
||||
*/
|
||||
private function isRoleReached(string $childRole, string $parentRole)
|
||||
{
|
||||
return $this->parentRoleHelper->isRoleReached($childRole, $parentRole);
|
||||
}
|
||||
|
||||
/**
|
||||
* Return all the role which give access to the given role. Only the role
|
||||
* which are registered into Chill are taken into account.
|
||||
*
|
||||
* @param string $role
|
||||
* @return string[] the role which give access to the given $role
|
||||
*/
|
||||
public function getParentRoles(string $role): array
|
||||
private function userHasAccessForCenter(User $user, Center $center, $entity, $attribute): bool
|
||||
{
|
||||
trigger_deprecation('Chill\MainBundle', '2.0', 'use ParentRoleHelper::getParentRoles instead');
|
||||
return $this->parentRoleHelper->getParentRoles($role);
|
||||
if (!$this->userCanReachCenter($user, $center)) {
|
||||
$this->logger->debug('user cannot reach center of entity', [
|
||||
'center_name' => $center->getName(),
|
||||
'user' => $user->getUsername(),
|
||||
]);
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
foreach ($user->getGroupCenters() as $groupCenter) {
|
||||
//filter on center
|
||||
if ($groupCenter->getCenter() === $center) {
|
||||
$permissionGroup = $groupCenter->getPermissionsGroup();
|
||||
//iterate on roleScopes
|
||||
foreach ($permissionGroup->getRoleScopes() as $roleScope) {
|
||||
//check that the role allow to reach the required role
|
||||
if ($this->isRoleReached($attribute, $roleScope->getRole())) {
|
||||
//if yes, we have a right on something...
|
||||
// perform check on scope if necessary
|
||||
if ($this->scopeResolverDispatcher->isConcerned($entity)) {
|
||||
$scope = $this->scopeResolverDispatcher->resolveScope($entity);
|
||||
|
||||
if (null === $scope) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (is_iterable($scope)) {
|
||||
foreach ($scope as $s) {
|
||||
if ($roleScope->getScope() === $s) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if ($roleScope->getScope() === $scope) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$this->logger->debug('user can reach center entity, but not role', [
|
||||
'username' => $user->getUsername(),
|
||||
'center' => $center->getName(),
|
||||
]);
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user