Signature fixes

src/Bundle/ChillDocStoreBundle/Resources/public/types/generic_doc.ts

@@ -25,7 +25,7 @@ export interface GenericDoc {
     type: "doc_store_generic_doc";
     uniqueKey: string;
     key: string;
-    identifiers: object;
+    identifiers: { id: number };
     context: "person" | "accompanying-period";
     doc_date: DateTime;
     metadata: GenericDocMetadata;

src/Bundle/ChillDocStoreBundle/Security/Authorization/StoredObjectVoter/AbstractStoredObjectVoter.php

@@ -46,6 +46,16 @@ abstract class AbstractStoredObjectVoter implements StoredObjectVoterInterface
 
     public function voteOnAttribute(StoredObjectRoleEnum $attribute, StoredObject $subject, TokenInterface $token): bool
     {
+        // we first try to get the permission from the workflow, as attachement (this is the less intensive query)
+        $workflowPermissionAsAttachment = match ($attribute) {
+            StoredObjectRoleEnum::SEE => $this->workflowDocumentService->isAllowedByWorkflowForReadOperation($subject),
+            StoredObjectRoleEnum::EDIT => $this->workflowDocumentService->isAllowedByWorkflowForWriteOperation($subject),
+        };
+
+        if (WorkflowRelatedEntityPermissionHelper::FORCE_DENIED === $workflowPermissionAsAttachment) {
+            return false;
+        }
+
         // Retrieve the related entity
         $entity = $this->getRepository()->findAssociatedEntityToStoredObject($subject);
 
@@ -66,7 +76,7 @@ abstract class AbstractStoredObjectVoter implements StoredObjectVoterInterface
         return match ($workflowPermission) {
             WorkflowRelatedEntityPermissionHelper::FORCE_GRANT => true,
             WorkflowRelatedEntityPermissionHelper::FORCE_DENIED => false,
-            WorkflowRelatedEntityPermissionHelper::ABSTAIN => $regularPermission,
+            WorkflowRelatedEntityPermissionHelper::ABSTAIN => WorkflowRelatedEntityPermissionHelper::FORCE_GRANT === $workflowPermissionAsAttachment || $regularPermission,
         };
     }
 }

src/Bundle/ChillDocStoreBundle/Security/Authorization/StoredObjectVoterInterface.php

@@ -14,6 +14,12 @@ namespace Chill\DocStoreBundle\Security\Authorization;
 use Chill\DocStoreBundle\Entity\StoredObject;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 
+/**
+ * Interface for voting on stored object permissions.
+ *
+ * Each time a stored object is attached to a document, the voter is responsible for determining
+ * whether the user has the necessary permissions to access or modify the stored object.
+ */
 interface StoredObjectVoterInterface
 {
     public function supports(StoredObjectRoleEnum $attribute, StoredObject $subject): bool;

src/Bundle/ChillDocStoreBundle/Tests/Security/Authorization/AbstractStoredObjectVoterTest.php

@@ -86,9 +86,165 @@ class AbstractStoredObjectVoterTest extends TestCase
     }
 
     /**
-     * @dataProvider dataProviderVoteOnAttribute
+     * @dataProvider dataProviderVoteOnAttributeWithStoredObjectPermission
      */
-    public function testVoteOnAttribute(
+    public function testVoteOnAttributeWithStoredObjectPermission(
+        StoredObjectRoleEnum $attribute,
+        bool $expected,
+        bool $isGrantedRegularPermission,
+        string $isGrantedWorkflowPermission,
+        string $isGrantedStoredObjectAttachment,
+    ): void {
+        $storedObject = new StoredObject();
+        $repository = new DummyRepository($related = new \stdClass());
+        $token = new UsernamePasswordToken(new User(), 'dummy');
+
+        $security = $this->prophesize(Security::class);
+        $security->isGranted('SOME_ROLE', $related)->willReturn($isGrantedRegularPermission);
+
+        $workflowRelatedEntityPermissionHelper = $this->prophesize(WorkflowRelatedEntityPermissionHelper::class);
+
+        $security = $this->prophesize(Security::class);
+        $security->isGranted('SOME_ROLE', $related)->willReturn($isGrantedRegularPermission);
+
+        if (StoredObjectRoleEnum::SEE === $attribute) {
+            $workflowRelatedEntityPermissionHelper->isAllowedByWorkflowForReadOperation($storedObject)
+                ->shouldBeCalled()
+                ->willReturn($isGrantedStoredObjectAttachment);
+            $workflowRelatedEntityPermissionHelper->isAllowedByWorkflowForReadOperation($related)
+                ->willReturn($isGrantedWorkflowPermission);
+        } elseif (StoredObjectRoleEnum::EDIT === $attribute) {
+            $workflowRelatedEntityPermissionHelper->isAllowedByWorkflowForWriteOperation($storedObject)
+                ->shouldBeCalled()
+                ->willReturn($isGrantedStoredObjectAttachment);
+            $workflowRelatedEntityPermissionHelper->isAllowedByWorkflowForWriteOperation($related)
+                ->willReturn($isGrantedWorkflowPermission);
+        } else {
+            throw new \LogicException('Invalid attribute for StoredObjectVoter');
+        }
+
+        $storedObjectVoter = new class ($repository, $workflowRelatedEntityPermissionHelper->reveal(), $security->reveal()) extends AbstractStoredObjectVoter {
+            public function __construct(private $repository, $helper, $security)
+            {
+                parent::__construct($security, $helper);
+            }
+
+            protected function getRepository(): AssociatedEntityToStoredObjectInterface
+            {
+                return $this->repository;
+            }
+
+            protected function getClass(): string
+            {
+                return \stdClass::class;
+            }
+
+            protected function attributeToRole(StoredObjectRoleEnum $attribute): string
+            {
+                return 'SOME_ROLE';
+            }
+
+            protected function canBeAssociatedWithWorkflow(): bool
+            {
+                return true;
+            }
+        };
+
+        $actual = $storedObjectVoter->voteOnAttribute($attribute, $storedObject, $token);
+
+        self::assertEquals($expected, $actual);
+    }
+
+    public static function dataProviderVoteOnAttributeWithStoredObjectPermission(): iterable
+    {
+        foreach (['read' => StoredObjectRoleEnum::SEE, 'write' => StoredObjectRoleEnum::EDIT] as $action => $attribute) {
+            yield 'Not related to any workflow nor attachment ('.$action.')' => [
+                $attribute,
+                true,
+                true,
+                WorkflowRelatedEntityPermissionHelper::ABSTAIN,
+                WorkflowRelatedEntityPermissionHelper::ABSTAIN,
+            ];
+
+            yield 'Not related to any workflow nor attachment (refuse) ('.$action.')' => [
+                $attribute,
+                false,
+                false,
+                WorkflowRelatedEntityPermissionHelper::ABSTAIN,
+                WorkflowRelatedEntityPermissionHelper::ABSTAIN,
+            ];
+
+            yield 'Is granted by a workflow takes precedence (workflow) ('.$action.')' => [
+                $attribute,
+                false,
+                true,
+                WorkflowRelatedEntityPermissionHelper::FORCE_DENIED,
+                WorkflowRelatedEntityPermissionHelper::ABSTAIN,
+            ];
+
+            yield 'Is granted by a workflow takes precedence (stored object) ('.$action.')' => [
+                $attribute,
+                false,
+                true,
+                WorkflowRelatedEntityPermissionHelper::ABSTAIN,
+                WorkflowRelatedEntityPermissionHelper::FORCE_DENIED,
+            ];
+
+            yield 'Is granted by a workflow takes precedence (workflow) although grant ('.$action.')' => [
+                $attribute,
+                false,
+                true,
+                WorkflowRelatedEntityPermissionHelper::FORCE_DENIED,
+                WorkflowRelatedEntityPermissionHelper::FORCE_GRANT,
+            ];
+
+            yield 'Is granted by a workflow takes precedence (stored object) although grant ('.$action.')' => [
+                $attribute,
+                false,
+                true,
+                WorkflowRelatedEntityPermissionHelper::FORCE_GRANT,
+                WorkflowRelatedEntityPermissionHelper::FORCE_DENIED,
+            ];
+
+            yield 'Is granted by a workflow takes precedence (initially refused) (workflow) although grant ('.$action.')' => [
+                $attribute,
+                false,
+                false,
+                WorkflowRelatedEntityPermissionHelper::FORCE_DENIED,
+                WorkflowRelatedEntityPermissionHelper::FORCE_GRANT,
+            ];
+
+            yield 'Is granted by a workflow takes precedence (initially refused) (stored object) although grant ('.$action.')' => [
+                $attribute,
+                false,
+                false,
+                WorkflowRelatedEntityPermissionHelper::FORCE_GRANT,
+                WorkflowRelatedEntityPermissionHelper::FORCE_DENIED,
+            ];
+
+            yield 'Force grant inverse the regular permission (workflow) ('.$action.')' => [
+                $attribute,
+                true,
+                false,
+                WorkflowRelatedEntityPermissionHelper::FORCE_GRANT,
+                WorkflowRelatedEntityPermissionHelper::ABSTAIN,
+            ];
+
+            yield 'Force grant inverse the regular permission (so) ('.$action.')' => [
+                $attribute,
+                true,
+                false,
+                WorkflowRelatedEntityPermissionHelper::ABSTAIN,
+                WorkflowRelatedEntityPermissionHelper::FORCE_GRANT,
+            ];
+
+        }
+    }
+
+    /**
+     * @dataProvider dataProviderVoteOnAttributeWithoutStoredObjectPermission
+     */
+    public function testVoteOnAttributeWithoutStoredObjectPermission(
         StoredObjectRoleEnum $attribute,
         bool $expected,
         bool $canBeAssociatedWithWorkflow,
@@ -105,6 +261,10 @@ class AbstractStoredObjectVoterTest extends TestCase
         $security->isGranted('SOME_ROLE', $related)->willReturn($isGrantedRegularPermission);
 
         $workflowRelatedEntityPermissionHelper = $this->prophesize(WorkflowRelatedEntityPermissionHelper::class);
+
+        $workflowRelatedEntityPermissionHelper->isAllowedByWorkflowForReadOperation($storedObject)->willReturn(WorkflowRelatedEntityPermissionHelper::ABSTAIN);
+        $workflowRelatedEntityPermissionHelper->isAllowedByWorkflowForWriteOperation($storedObject)->willReturn(WorkflowRelatedEntityPermissionHelper::ABSTAIN);
+
         if (null !== $isGrantedWorkflowPermissionRead) {
             $workflowRelatedEntityPermissionHelper->isAllowedByWorkflowForReadOperation($related)
                 ->willReturn($isGrantedWorkflowPermissionRead)->shouldBeCalled();
@@ -123,7 +283,7 @@ class AbstractStoredObjectVoterTest extends TestCase
         self::assertEquals($expected, $voter->voteOnAttribute($attribute, $storedObject, $token), $message);
     }
 
-    public static function dataProviderVoteOnAttribute(): iterable
+    public static function dataProviderVoteOnAttributeWithoutStoredObjectPermission(): iterable
     {
         // not associated on a workflow
         yield [StoredObjectRoleEnum::SEE, true, false, true, null, null, 'not associated on a workflow, granted by regular access, must not rely on helper'];