adaptations for acl with tasks

src/Bundle/ChillMainBundle/Form/Type/ScopePickerType.php

@@ -23,7 +23,9 @@ use Chill\MainBundle\Entity\Scope;
 use Chill\MainBundle\Entity\User;
 use Chill\MainBundle\Form\DataMapper\ScopePickerDataMapper;
 use Chill\MainBundle\Repository\ScopeRepository;
+use Chill\MainBundle\Repository\UserACLAwareRepositoryInterface;
 use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
+use Chill\MainBundle\Security\Authorization\AuthorizationHelperInterface;
 use Chill\MainBundle\Templating\TranslatableStringHelper;
 use Doctrine\ORM\EntityRepository;
 use Symfony\Bridge\Doctrine\Form\Type\EntityType;
@@ -36,6 +38,7 @@ use Symfony\Component\OptionsResolver\Options;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 use Symfony\Component\Security\Core\Role\Role;
+use Symfony\Component\Security\Core\Security;
 
 /**
  * Allow to pick amongst available scope for the current
@@ -46,14 +49,10 @@ use Symfony\Component\Security\Core\Role\Role;
  * - `center`: the center of the entity
  * - `role`  : the role of the user
  *
- * @author Julien Fastré <julien.fastre@champs-libres.coop>
  */
 class ScopePickerType extends AbstractType
 {
-    /**
-     * @var AuthorizationHelper
-     */
-    protected $authorizationHelper;
+    protected AuthorizationHelperInterface $authorizationHelper;
 
     /**
      * @var TokenStorageInterface
@@ -70,22 +69,26 @@ class ScopePickerType extends AbstractType
      */
     protected $translatableStringHelper;
 
+    protected Security $security;
+
     public function __construct(
-        AuthorizationHelper $authorizationHelper,
+        AuthorizationHelperInterface $authorizationHelper,
         TokenStorageInterface $tokenStorage,
         ScopeRepository $scopeRepository,
+        Security $security,
         TranslatableStringHelper $translatableStringHelper
     ) {
         $this->authorizationHelper = $authorizationHelper;
         $this->tokenStorage = $tokenStorage;
         $this->scopeRepository = $scopeRepository;
+        $this->security = $security;
         $this->translatableStringHelper = $translatableStringHelper;
     }
 
     public function buildForm(FormBuilderInterface $builder, array $options)
     {
-        $query = $this->buildAccessibleScopeQuery($options['center'], $options['role']);
-        $items = $query->getQuery()->execute();
+        $items = $this->authorizationHelper->getReachableScopes($this->security->getUser(),
+            $options['role'], $options['center']);
 
         if (1 !== count($items)) {
             $builder->add('scope', EntityType::class, [
@@ -94,9 +97,7 @@ class ScopePickerType extends AbstractType
                 'choice_label' => function (Scope $c) {
                     return $this->translatableStringHelper->localize($c->getName());
                 },
-                'query_builder' => function () use ($options) {
-                    return $this->buildAccessibleScopeQuery($options['center'], $options['role']);
-                },
+                'choices' => $items,
             ]);
             $builder->setDataMapper(new ScopePickerDataMapper());
         } else {
@@ -121,19 +122,22 @@ class ScopePickerType extends AbstractType
         $resolver
           // create `center` option
             ->setRequired('center')
-            ->setAllowedTypes('center', [Center::class])
+            ->setAllowedTypes('center', [Center::class, 'array', 'null'])
           // create ``role` option
             ->setRequired('role')
             ->setAllowedTypes('role', ['string', Role::class]);
     }
 
     /**
+     * @param Center|array|Center[] $center
+     * @param string $role
      * @return \Doctrine\ORM\QueryBuilder
      */
-    protected function buildAccessibleScopeQuery(Center $center, Role $role)
+    protected function buildAccessibleScopeQuery($center, $role)
     {
         $roles = $this->authorizationHelper->getParentRoles($role);
         $roles[] = $role;
+        $centers = $center instanceof Center ? [$center]: $center;
 
         $qb = $this->scopeRepository->createQueryBuilder('s');
         $qb
@@ -142,8 +146,8 @@ class ScopePickerType extends AbstractType
             ->join('rs.permissionsGroups', 'pg')
             ->join('pg.groupCenters', 'gc')
           // add center constraint
-            ->where($qb->expr()->eq('IDENTITY(gc.center)', ':center'))
-            ->setParameter('center', $center->getId())
+            ->where($qb->expr()->in('IDENTITY(gc.center)', ':centers'))
+            ->setParameter('centers', \array_map(fn(Center $c) => $c->getId(), $centers))
           // role constraints
             ->andWhere($qb->expr()->in('rs.role', ':roles'))
             ->setParameter('roles', $roles)

src/Bundle/ChillMainBundle/Form/Type/UserPickerType.php

@@ -17,6 +17,8 @@
  */
 namespace Chill\MainBundle\Form\Type;
 
+use Chill\MainBundle\Entity\Scope;
+use Chill\MainBundle\Repository\UserACLAwareRepositoryInterface;
 use Symfony\Component\Form\AbstractType;
 use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
 use Doctrine\ORM\EntityRepository;
@@ -56,14 +58,18 @@ class UserPickerType extends AbstractType
 
     protected UserRepository $userRepository;
 
+    protected UserACLAwareRepositoryInterface $userACLAwareRepository;
+
     public function __construct(
         AuthorizationHelper $authorizationHelper,
         TokenStorageInterface $tokenStorage,
-        UserRepository $userRepository
+        UserRepository $userRepository,
+        UserACLAwareRepositoryInterface $userACLAwareRepository
     ) {
         $this->authorizationHelper = $authorizationHelper;
         $this->tokenStorage = $tokenStorage;
         $this->userRepository = $userRepository;
+        $this->userACLAwareRepository = $userACLAwareRepository;
     }
 
 
@@ -72,7 +78,7 @@ class UserPickerType extends AbstractType
         $resolver
             // create `center` option
             ->setRequired('center')
-            ->setAllowedTypes('center', [\Chill\MainBundle\Entity\Center::class ])
+            ->setAllowedTypes('center', [\Chill\MainBundle\Entity\Center::class, 'null', 'array' ])
             // create ``role` option
             ->setRequired('role')
             ->setAllowedTypes('role', ['string', \Symfony\Component\Security\Core\Role\Role::class ])
@@ -86,17 +92,19 @@ class UserPickerType extends AbstractType
             ->setDefault('choice_label', function(User $u) {
                 return $u->getUsername();
             })
+            ->setDefault('scope', null)
+            ->setAllowedTypes('scope', [Scope::class, 'array', 'null'])
             ->setNormalizer('choices', function(Options $options) {
-                
-                $users = $this->authorizationHelper
-                    ->findUsersReaching($options['role'], $options['center']);
-                
+
+                $users = $this->userACLAwareRepository
+                    ->findUsersByReachedACL($options['role'], $options['center'], $options['scope'], true);
+
                 if (NULL !== $options['having_permissions_group_flag']) {
                     return $this->userRepository
                         ->findUsersHavingFlags($options['having_permissions_group_flag'], $users)
                         ;
                 }
-                
+
                 return $users;
             })
             ;