Merge branch '111_exports_acl' into '111_exports_suite'

Adapt ACL to allow the usage of global ACL

See merge request Chill-Projet/chill-bundles!452

src/Bundle/ChillActivityBundle/Security/Authorization/ActivityStatsVoter.php

@@ -13,10 +13,10 @@ namespace Chill\ActivityBundle\Security\Authorization;
 
 use Chill\MainBundle\Entity\Center;
 use Chill\MainBundle\Security\Authorization\AbstractChillVoter;
-use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
+use Chill\MainBundle\Security\Authorization\VoterHelperFactoryInterface;
+use Chill\MainBundle\Security\Authorization\VoterHelperInterface;
 use Chill\MainBundle\Security\ProvideRoleHierarchyInterface;
-
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
-use function in_array;
 
 class ActivityStatsVoter extends AbstractChillVoter implements ProvideRoleHierarchyInterface
 {
@@ -24,14 +24,14 @@ class ActivityStatsVoter extends AbstractChillVoter implements ProvideRoleHierar
 
     public const STATS = 'CHILL_ACTIVITY_STATS';
 
-    /**
+    protected VoterHelperInterface $helper;
-     * @var AuthorizationHelper
-     */
-    protected $helper;
 
-    public function __construct(AuthorizationHelper $helper)
+    public function __construct(VoterHelperFactoryInterface $voterHelperFactory)
     {
-        $this->helper = $helper;
+        $this->helper = $voterHelperFactory
+            ->generate(self::class)
+            ->addCheckFor(Center::class, [self::STATS, self::LISTS])
+            ->build();
     }
 
     public function getRoles(): array
@@ -49,30 +49,14 @@ class ActivityStatsVoter extends AbstractChillVoter implements ProvideRoleHierar
         return $this->getAttributes();
     }
 
-    protected function getSupportedClasses()
+    protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
     {
-        return [Center::class];
+        return $this->helper->voteOnAttribute($attribute, $subject, $token);
-    }
-
-    protected function isGranted($attribute, $object, $user = null)
-    {
-        if (!$user instanceof \Symfony\Component\Security\Core\User\UserInterface) {
-            return false;
-        }
-
-        return $this->helper->userHasAccess($user, $object, $attribute);
     }
 
     protected function supports($attribute, $subject)
     {
-        if (
+        return $this->helper->supports($attribute, $subject);
-            $subject instanceof Center
-            && in_array($attribute, $this->getAttributes(), true)
-        ) {
-            return true;
-        }
-
-        return false;
     }
 
     private function getAttributes()

src/Bundle/ChillMainBundle/Controller/ExportController.php

@@ -23,6 +23,7 @@ use Symfony\Component\Form\Extension\Core\Type\FormType;
 use Symfony\Component\Form\Extension\Core\Type\SubmitType;
 use Symfony\Component\Form\FormFactoryInterface;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\Session\SessionInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
@@ -142,10 +143,8 @@ class ExportController extends AbstractController
 
     /**
      * Render the list of available exports.
-     *
-     * @return \Symfony\Component\HttpFoundation\Response
      */
-    public function indexAction(Request $request)
+    public function indexAction(): Response
     {
         $exportManager = $this->exportManager;
 

src/Bundle/ChillMainBundle/Export/ExportManager.php

@@ -14,6 +14,7 @@ namespace Chill\MainBundle\Export;
 use Chill\MainBundle\Form\Type\Export\ExportType;
 use Chill\MainBundle\Form\Type\Export\PickCenterType;
 use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
+use Chill\MainBundle\Security\Authorization\AuthorizationHelperInterface;
 use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\ORM\QueryBuilder;
 use Generator;
@@ -42,52 +43,38 @@ class ExportManager
     /**
      * The collected aggregators, injected by DI.
      *
-     * @var AggregatorInterface[]
+     * @var array|AggregatorInterface[]
      */
-    private $aggregators = [];
+    private array $aggregators = [];
 
-    /**
+    private AuthorizationCheckerInterface $authorizationChecker;
-     * @var AuthorizationChecker
-     */
-    private $authorizationChecker;
 
-    /**
+    private AuthorizationHelperInterface $authorizationHelper;
-     * @var AuthorizationHelper
-     */
-    private $authorizationHelper;
 
-    /**
+    private EntityManagerInterface $em;
-     * @var EntityManagerInterface
-     */
-    private $em;
 
     /**
      * Collected Exports, injected by DI.
      *
-     * @var ExportInterface[]
+     * @var array|ExportInterface[]
      */
-    private $exports = [];
+    private array $exports = [];
 
     /**
      * The collected filters, injected by DI.
      *
-     * @var FilterInterface[]
+     * @var array|FilterInterface[]
      */
-    private $filters = [];
+    private array $filters = [];
 
     /**
      * Collected Formatters, injected by DI.
      *
-     * @var FormatterInterface[]
+     * @var array|FormatterInterface[]
      */
-    private $formatters = [];
+    private array $formatters = [];
 
-    /**
+    private LoggerInterface $logger;
-     * a logger.
-     *
-     * @var LoggerInterface
-     */
-    private $logger;
 
     /**
      * @var \Symfony\Component\Security\Core\User\UserInterface
@@ -98,7 +85,7 @@ class ExportManager
         LoggerInterface $logger,
         EntityManagerInterface $em,
         AuthorizationCheckerInterface $authorizationChecker,
-        AuthorizationHelper $authorizationHelper,
+        AuthorizationHelperInterface $authorizationHelper,
         TokenStorageInterface $tokenStorage
     ) {
         $this->logger = $logger;
@@ -547,19 +534,16 @@ class ExportManager
                     . 'an ExportInterface.');
         }
 
-        if (null === $centers) {
+        if (null === $centers || [] === $centers) {
-            $centers = $this->authorizationHelper->getReachableCenters(
+            // we want to try if at least one center is reachable
+            return [] !== $this->authorizationHelper->getReachableCenters(
                 $this->user,
                 $role
             );
         }
 
-        if (count($centers) === 0) {
-            return false;
-        }
-
         foreach ($centers as $center) {
-            if ($this->authorizationChecker->isGranted($role, $center) === false) {
+            if (false === $this->authorizationChecker->isGranted($role, $center)) {
                 //debugging
                 $this->logger->debug('user has no access to element', [
                     'method' => __METHOD__,
@@ -568,10 +552,6 @@ class ExportManager
                     'role' => $role,
                 ]);
 
-                ///// Bypasse les autorisations qui empêche d'afficher les nouveaux exports
-                return true;
-                ///// TODO supprimer le return true
-
                 return false;
             }
         }

src/Bundle/ChillMainBundle/Form/Type/Export/PickCenterType.php

@@ -15,6 +15,7 @@ use Chill\MainBundle\Center\GroupingCenterInterface;
 use Chill\MainBundle\Entity\Center;
 use Chill\MainBundle\Export\ExportManager;
 use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
+use Chill\MainBundle\Security\Authorization\AuthorizationHelperInterface;
 use Doctrine\ORM\EntityRepository;
 use Symfony\Bridge\Doctrine\Form\Type\EntityType;
 use Symfony\Component\Form\AbstractType;
@@ -24,6 +25,7 @@ use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 
+use Symfony\Component\Security\Core\User\UserInterface;
 use function array_intersect;
 use function array_key_exists;
 use function array_merge;
@@ -38,30 +40,24 @@ class PickCenterType extends AbstractType
 {
     public const CENTERS_IDENTIFIERS = 'c';
 
-    /**
+    protected AuthorizationHelperInterface $authorizationHelper;
-     * @var AuthorizationHelper
+
-     */
+    protected ExportManager $exportManager;
-    protected $authorizationHelper;
 
     /**
-     * @var ExportManager
+     * @var array|GroupingCenterInterface[]
      */
-    protected $exportManager;
+    protected array $groupingCenters = [];
-
-    /**
-     * @var GroupingCenterInterface[]
-     */
-    protected $groupingCenters = [];
 
     /**
      * @var \Symfony\Component\Security\Core\User\UserInterface
      */
-    protected $user;
+    protected UserInterface $user;
 
     public function __construct(
         TokenStorageInterface $tokenStorage,
         ExportManager $exportManager,
-        AuthorizationHelper $authorizationHelper
+        AuthorizationHelperInterface $authorizationHelper
     ) {
         $this->exportManager = $exportManager;
         $this->user = $tokenStorage->getToken()->getUser();
@@ -78,22 +74,12 @@ class PickCenterType extends AbstractType
         $export = $this->exportManager->getExport($options['export_alias']);
         $centers = $this->authorizationHelper->getReachableCenters(
             $this->user,
-            (string) $export->requiredRole()
+            $export->requiredRole()
         );
 
         $builder->add(self::CENTERS_IDENTIFIERS, EntityType::class, [
             'class' => Center::class,
-            'query_builder' => static function (EntityRepository $er) use ($centers) {
+            'choices' => $centers,
-                $qb = $er->createQueryBuilder('c');
-                $ids = array_map(
-                    static function (Center $el) {
-                        return $el->getId();
-                    },
-                    $centers
-                );
-
-                return $qb->where($qb->expr()->in('c.id', $ids));
-            },
             'multiple' => true,
             'expanded' => true,
             'choice_label' => static function (Center $c) {

src/Bundle/ChillMainBundle/Repository/CenterRepository.php

@@ -16,7 +16,7 @@ use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\ORM\EntityRepository;
 use Doctrine\Persistence\ObjectRepository;
 
-final class CenterRepository implements ObjectRepository
+final class CenterRepository implements CenterRepositoryInterface
 {
     private EntityRepository $repository;
 
@@ -30,6 +30,11 @@ final class CenterRepository implements ObjectRepository
         return $this->repository->find($id, $lockMode, $lockVersion);
     }
 
+    public function findActive(): array
+    {
+        return $this->findAll();
+    }
+
     /**
      * @return Center[]
      */

src/Bundle/ChillMainBundle/Repository/CenterRepositoryInterface.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Chill\MainBundle\Repository;
+
+use Chill\MainBundle\Entity\Center;
+use Doctrine\Persistence\ObjectRepository;
+
+interface CenterRepositoryInterface extends ObjectRepository
+{
+    /**
+     * Return all active centers
+     *
+     * Note: this is a teaser: active will comes later on center entity
+     *
+     * @return Center[]
+     */
+    public function findActive(): array;
+}

src/Bundle/ChillMainBundle/Security/Authorization/ChillExportVoter.php

@@ -19,24 +19,23 @@ class ChillExportVoter extends Voter
 {
     public const EXPORT = 'chill_export';
 
-    protected AuthorizationHelperInterface $authorizationHelper;
+    private VoterHelperInterface $helper;
 
-    public function __construct(AuthorizationHelperInterface $authorizationHelper)
+    public function __construct(VoterHelperFactoryInterface $voterHelperFactory)
     {
-        $this->authorizationHelper = $authorizationHelper;
+        $this->helper = $voterHelperFactory
+            ->generate(self::class)
+            ->addCheckFor(null, [self::EXPORT])
+            ->build();
     }
 
     protected function supports($attribute, $subject): bool
     {
-        return self::EXPORT === $attribute;
+        return $this->helper->supports($attribute, $subject);
     }
 
     protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
     {
-        if (!$token->getUser() instanceof User) {
+        return $this->helper->voteOnAttribute($attribute, $subject, $token);
-            return false;
-        }
-
-        return [] !== $this->authorizationHelper->getReachableCenters($token->getUser(), $attribute);
     }
 }

src/Bundle/ChillMainBundle/Test/ProphecyTrait.php

@@ -18,6 +18,7 @@ namespace Chill\MainBundle\Test;
  * and use tearDownTrait after usage.
  *
  * @codeCoverageIgnore
+ * @deprecated use @class{Prophecy\PhpUnit\ProphecyTrait} instead
  */
 trait ProphecyTrait
 {

src/Bundle/ChillMainBundle/config/services.yaml

@@ -88,12 +88,8 @@ services:
             - { name: validator.constraint_validator, alias: 'role_scope_scope_presence' }
 
     Chill\MainBundle\Export\ExportManager:
-        arguments:
+        autoconfigure: true
-            - "@logger"
+        autowire: true
-            - "@doctrine.orm.entity_manager"
-            - "@security.authorization_checker"
-            - "@chill.main.security.authorization.helper"
-            - "@security.token_storage"
 
     Chill\MainBundle\Security\Resolver\CenterResolverDispatcherInterface: '@Chill\MainBundle\Security\Resolver\CenterResolverDispatcher'
 

src/Bundle/ChillMainBundle/config/services/form.yaml

@@ -81,12 +81,8 @@ services:
 
     chill.main.form.pick_centers_type:
         class: Chill\MainBundle\Form\Type\Export\PickCenterType
-        arguments:
+        autowire: true
-            - "@security.token_storage"
+        autoconfigure: true
-            - '@Chill\MainBundle\Export\ExportManager'
-            - "@chill.main.security.authorization.helper"
-        tags:
-            - { name: form.type }
 
     chill.main.form.formatter_type:
         class: Chill\MainBundle\Form\Type\Export\FormatterType

src/Bundle/ChillPersonBundle/Security/Authorization/AccompanyingPeriodVoter.php

@@ -11,6 +11,7 @@ declare(strict_types=1);
 
 namespace Chill\PersonBundle\Security\Authorization;
 
+use Chill\MainBundle\Entity\Center;
 use Chill\MainBundle\Entity\User;
 use Chill\MainBundle\Security\Authorization\AbstractChillVoter;
 use Chill\MainBundle\Security\Authorization\VoterHelperFactoryInterface;
@@ -119,6 +120,7 @@ class AccompanyingPeriodVoter extends AbstractChillVoter implements ProvideRoleH
             ->addCheckFor(null, [self::CREATE, self::REASSIGN_BULK])
             ->addCheckFor(AccompanyingPeriod::class, [self::TOGGLE_CONFIDENTIAL, ...self::ALL])
             ->addCheckFor(Person::class, [self::SEE, self::CREATE])
+            ->addCheckFor(Center::class, [self::STATS])
             ->build();
     }
 

src/Bundle/ChillPersonBundle/Security/Authorization/HouseholdVoter.php

@@ -11,6 +11,10 @@ declare(strict_types=1);
 
 namespace Chill\PersonBundle\Security\Authorization;
 
+use Chill\MainBundle\Entity\Center;
+use Chill\MainBundle\Security\Authorization\VoterHelperFactoryInterface;
+use Chill\MainBundle\Security\Authorization\VoterHelperInterface;
+use Chill\MainBundle\Security\ProvideRoleHierarchyInterface;
 use Chill\PersonBundle\Entity\Household\Household;
 use Chill\PersonBundle\Entity\Household\HouseholdMember;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
@@ -19,7 +23,7 @@ use Symfony\Component\Security\Core\Security;
 use UnexpectedValueException;
 use function in_array;
 
-class HouseholdVoter extends Voter
+class HouseholdVoter extends Voter implements ProvideRoleHierarchyInterface
 {
     public const EDIT = 'CHILL_PERSON_HOUSEHOLD_EDIT';
 
@@ -36,17 +40,40 @@ class HouseholdVoter extends Voter
         self::EDIT, self::SEE,
     ];
 
+    private VoterHelperInterface $helper;
+
     private Security $security;
 
-    public function __construct(Security $security)
+    public function __construct(Security $security, VoterHelperFactoryInterface $voterHelperFactory)
     {
         $this->security = $security;
+        $this->helper = $voterHelperFactory
+            ->generate(self::class)
+            ->addCheckFor(Center::class, [self::STATS])
+            ->build();
+    }
+
+    public function getRolesWithHierarchy(): array
+    {
+        return [ 'Person' => $this->getRoles() ];
+    }
+
+    public function getRoles(): array
+    {
+        return [self::STATS];
+    }
+
+    public function getRolesWithoutScope(): array
+    {
+        return $this->getRoles();
     }
 
     protected function supports($attribute, $subject)
     {
-        return $subject instanceof Household
+        return ($subject instanceof Household
-            && in_array($attribute, self::ALL, true);
+            && in_array($attribute, self::ALL, true))
+            || $this->helper->supports($attribute, $subject)
+            ;
     }
 
     protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
@@ -58,6 +85,9 @@ class HouseholdVoter extends Voter
             case self::EDIT:
                 return $this->checkAssociatedMembersRole($subject, PersonVoter::UPDATE);
 
+            case self::STATS:
+                return $this->voteOnAttribute($attribute, $subject, $token);
+
             default:
                 throw new UnexpectedValueException('attribute not supported');
         }

src/Bundle/ChillPersonBundle/translations/messages.fr.yml

@@ -318,6 +318,7 @@ CHILL_PERSON_ACCOMPANYING_PERIOD_FULL: Voir les détails, créer, supprimer et m
 CHILL_PERSON_ACCOMPANYING_COURSE_REASSIGN_BULK: Réassigner les parcours en lot
 CHILL_PERSON_ACCOMPANYING_PERIOD_SEE_DETAILS: Voir les détails  d'une période d'accompagnement
 CHILL_PERSON_ACCOMPANYING_PERIOD_STATS: Statistiques sur les parcours d'accompagnement
+CHILL_PERSON_HOUSEHOLD_STATS: Statistiques sur les ménages
 
 #period
 Period closed!: Période clôturée!