Merge remote-tracking branch 'origin/master' into issue120_filter_social_actions

src/Bundle/ChillPersonBundle/Repository/AccompanyingPeriodACLAwareRepository.php

@@ -12,107 +12,93 @@ declare(strict_types=1);
 namespace Chill\PersonBundle\Repository;
 
 use Chill\MainBundle\Entity\Address;
+use Chill\MainBundle\Entity\Center;
 use Chill\MainBundle\Entity\Location;
 use Chill\MainBundle\Entity\PostalCode;
 use Chill\MainBundle\Entity\Scope;
 use Chill\MainBundle\Entity\User;
 use Chill\MainBundle\Entity\UserJob;
-use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
-use Chill\MainBundle\Security\Resolver\CenterResolverDispatcherInterface;
+use Chill\MainBundle\Security\Authorization\AuthorizationHelperForCurrentUserInterface;
+use Chill\MainBundle\Security\Resolver\CenterResolverManagerInterface;
 use Chill\PersonBundle\Entity\AccompanyingPeriod;
 use Chill\PersonBundle\Entity\AccompanyingPeriodParticipation;
-use Chill\PersonBundle\Entity\Household\PersonHouseholdAddress;
 use Chill\PersonBundle\Entity\Person;
 use Chill\PersonBundle\Security\Authorization\AccompanyingPeriodVoter;
-use DateTime;
-
-use DateTimeImmutable;
-use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\NonUniqueResultException;
+use Doctrine\ORM\NoResultException;
 use Doctrine\ORM\Query\Expr\Join;
 use Doctrine\ORM\QueryBuilder;
+use Repository\AccompanyingPeriodACLAwareRepositoryTest;
 use Symfony\Component\Security\Core\Security;
 use function count;
 
-final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodACLAwareRepositoryInterface
+/**
+ * @see AccompanyingPeriodACLAwareRepositoryTest
+ */
+final readonly class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodACLAwareRepositoryInterface
 {
     private AccompanyingPeriodRepository $accompanyingPeriodRepository;
 
-    private AuthorizationHelper $authorizationHelper;
+    private AuthorizationHelperForCurrentUserInterface $authorizationHelper;
 
-    private CenterResolverDispatcherInterface $centerResolverDispatcher;
+    private CenterResolverManagerInterface $centerResolver;
 
     private Security $security;
 
     public function __construct(
         AccompanyingPeriodRepository $accompanyingPeriodRepository,
         Security $security,
-        AuthorizationHelper $authorizationHelper,
-        CenterResolverDispatcherInterface $centerResolverDispatcher
+        AuthorizationHelperForCurrentUserInterface $authorizationHelper,
+        CenterResolverManagerInterface $centerResolverDispatcher
     ) {
         $this->accompanyingPeriodRepository = $accompanyingPeriodRepository;
         $this->security = $security;
         $this->authorizationHelper = $authorizationHelper;
-        $this->centerResolverDispatcher = $centerResolverDispatcher;
+        $this->centerResolver = $centerResolverDispatcher;
     }
 
-    /**
-     * @param array|PostalCode[]
-     *
-     * @return QueryBuilder
-     */
-    public function buildQueryOpenedAccompanyingCourseByUser(?User $user, array $postalCodes = [])
+    public function buildQueryOpenedAccompanyingCourseByUserAndPostalCodes(?User $user, array $postalCodes = []): QueryBuilder
     {
         $qb = $this->accompanyingPeriodRepository->createQueryBuilder('ap');
 
         $qb->where($qb->expr()->eq('ap.user', ':user'))
             ->andWhere(
                 $qb->expr()->neq('ap.step', ':draft'),
-                $qb->expr()->orX(
-                    $qb->expr()->isNull('ap.closingDate'),
-                    $qb->expr()->gt('ap.closingDate', ':now')
-                )
+                $qb->expr()->neq('ap.step', ':closed'),
             )
             ->setParameter('user', $user)
-            ->setParameter('now', new DateTime('now'))
-            ->setParameter('draft', AccompanyingPeriod::STEP_DRAFT);
+            ->setParameter('draft', AccompanyingPeriod::STEP_DRAFT)
+            ->setParameter('closed', AccompanyingPeriod::STEP_CLOSED);
 
         if ([] !== $postalCodes) {
-            $qb->join('ap.locationHistories', 'location_history')
-                ->leftJoin(PersonHouseholdAddress::class, 'person_address', Join::WITH, 'IDENTITY(location_history.personLocation) = IDENTITY(person_address.person)')
+            $qb->join('ap.locationHistories', 'location_history', Join::WITH, 'location_history.endDate IS NULL')
+                ->leftJoin(Person\PersonCurrentAddress::class, 'person_address', Join::WITH, 'IDENTITY(location_history.personLocation) = IDENTITY(person_address.person)')
                 ->join(
                     Address::class,
                     'address',
                     Join::WITH,
-                    'COALESCE(IDENTITY(location_history.addressLocation), IDENTITY(person_address.address)) = address.id'
+                    'COALESCE(IDENTITY(person_address.address), IDENTITY(location_history.addressLocation)) = address.id'
                 )
+                ->join('address.postcode', 'postcode')
                 ->andWhere(
-                    $qb->expr()->orX(
-                        $qb->expr()->isNull('person_address'),
-                        $qb->expr()->andX(
-                            $qb->expr()->lte('person_address.validFrom', ':now'),
-                            $qb->expr()->orX(
-                                $qb->expr()->isNull('person_address.validTo'),
-                                $qb->expr()->lt('person_address.validTo', ':now')
-                            )
-                        )
-                    )
+                    $qb->expr()->in('postcode.code', ':postal_codes')
                 )
-                ->andWhere(
-                    $qb->expr()->isNull('location_history.endDate')
-                )
-                ->andWhere(
-                    $qb->expr()->in('address.postcode', ':postal_codes')
-                )
-                ->setParameter('now', new DateTimeImmutable('now'), Types::DATE_IMMUTABLE)
-                ->setParameter('postal_codes', $postalCodes);
+                ->setParameter('postal_codes', array_map(fn (PostalCode $postalCode) => $postalCode->getCode(), $postalCodes));
         }
 
         return $qb;
     }
 
+    /**
+     * @throws NonUniqueResultException
+     * @throws NoResultException
+     */
     public function countByUnDispatched(array $jobs, array $services, array $administrativeLocations): int
     {
-        $qb = $this->addACLByUnDispatched($this->buildQueryUnDispatched($jobs, $services, $administrativeLocations));
+        $qb = $this->addACLMultiCenterOnQuery(
+            $this->buildQueryUnDispatched($jobs, $services, $administrativeLocations),
+            $this->buildCenterOnScope()
+        );
 
         $qb->select('COUNT(ap)');
 
@@ -125,22 +111,12 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
             return 0;
         }
 
-        return $this->buildQueryOpenedAccompanyingCourseByUser($user, $postalCodes)
-            ->select('COUNT(ap)')
-            ->getQuery()
-            ->getSingleScalarResult();
-    }
+        $qb = $this->buildQueryOpenedAccompanyingCourseByUserAndPostalCodes($user, $postalCodes);
+        $qb = $this->addACLMultiCenterOnQuery($qb, $this->buildCenterOnScope(), false);
 
-    public function countByUserOpenedAccompanyingPeriod(?User $user): int
-    {
-        if (null === $user) {
-            return 0;
-        }
+        $qb->select('COUNT(DISTINCT ap)');
 
-        return $this->buildQueryOpenedAccompanyingCourseByUser($user)
-            ->select('COUNT(ap)')
-            ->getQuery()
-            ->getSingleScalarResult();
+        return $qb->getQuery()->getSingleScalarResult();
     }
 
     public function findByPerson(
@@ -152,10 +128,14 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
     ): array {
         $qb = $this->accompanyingPeriodRepository->createQueryBuilder('ap');
         $scopes = $this->authorizationHelper
-            ->getReachableCircles(
-                $this->security->getUser(),
+            ->getReachableScopes(
                 $role,
-                $this->centerResolverDispatcher->resolveCenter($person)
+                $this->centerResolver->resolveCenters($person)
+            );
+        $scopesCanSeeConfidential = $this->authorizationHelper
+            ->getReachableScopes(
+                AccompanyingPeriodVoter::SEE_CONFIDENTIAL_ALL,
+                $this->centerResolver->resolveCenters($person)
             );
 
         if (0 === count($scopes)) {
@@ -165,12 +145,44 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
         $qb
             ->join('ap.participations', 'participation')
             ->where($qb->expr()->eq('participation.person', ':person'))
-            ->andWhere(
-                $qb->expr()->orX(
-                    'ap.confidential = FALSE',
-                    $qb->expr()->eq('ap.user', ':user')
-                )
-            )
+            ->setParameter('person', $person);
+
+        $qb = $this->addACLClauses($qb, $scopes, $scopesCanSeeConfidential);
+        $qb = $this->addOrderLimitClauses($qb, $orderBy, $limit, $offset);
+
+        return $qb->getQuery()->getResult();
+    }
+
+    public function addOrderLimitClauses(QueryBuilder $qb, ?array $orderBy = null, ?int $limit = null, ?int $offset = null): QueryBuilder
+    {
+        if (null !== $orderBy) {
+            foreach ($orderBy as $field => $order) {
+                $qb->addOrderBy('ap.' . $field, $order);
+            }
+        }
+
+        if (null !== $limit) {
+            $qb->setMaxResults($limit);
+        }
+
+        if (null !== $offset) {
+            $qb->setFirstResult($offset);
+        }
+
+        return $qb;
+    }
+
+    /**
+     * Add clause for scope on a query, based on no
+     *
+     * @param QueryBuilder $qb where the accompanying period have the `ap` alias
+     * @param array<Scope> $scopesCanSee
+     * @param array<Scope> $scopesCanSeeConfidential
+     * @return QueryBuilder
+     */
+    public function addACLClauses(QueryBuilder $qb, array $scopesCanSee, array $scopesCanSeeConfidential): QueryBuilder
+    {
+        $qb
             ->andWhere(
                 $qb->expr()->orX(
                     $qb->expr()->neq('ap.step', ':draft'),
@@ -181,40 +193,67 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
                 )
             )
             ->setParameter('draft', AccompanyingPeriod::STEP_DRAFT)
-            ->setParameter('person', $person)
             ->setParameter('user', $this->security->getUser())
             ->setParameter('creator', $this->security->getUser());
+
         // add join condition for scopes
         $orx = $qb->expr()->orX(
+            // even if the scope is not in one authorized, the user can see the course if it is in DRAFT state
             $qb->expr()->eq('ap.step', ':draft')
         );
 
-        foreach ($scopes as $key => $scope) {
-            $orx->add($qb->expr()->orX(
+        foreach ($scopesCanSee as $key => $scope) {
+            // for each scope:
+            // - either the user is the referrer of the course
+            // - or the accompanying course is one of the reachable scopes
+            // - and the parcours is not confidential OR the user is the referrer OR the user can see the confidential course
+
+            $orOnScope = $qb->expr()->orX(
                 $qb->expr()->isMemberOf(':scope_' . $key, 'ap.scopes'),
                 $qb->expr()->eq('ap.user', ':user')
-            ));
+            );
+
+            if (in_array($scope, $scopesCanSeeConfidential, true)) {
+                $orx->add($orOnScope);
+            } else {
+                // we must add a condition: the course is not confidential or the user is the referrer
+                $andXOnScope = $qb->expr()->andX(
+                    $orOnScope,
+                    $qb->expr()->orX(
+                        'ap.confidential = FALSE',
+                        $qb->expr()->eq('ap.user', ':user')
+                    )
+                );
+                $orx->add($andXOnScope);
+            }
             $qb->setParameter('scope_' . $key, $scope);
-            $qb->setParameter('user', $this->security->getUser());
         }
         $qb->andWhere($orx);
 
-        return $qb->getQuery()->getResult();
+        return $qb;
     }
 
-    public function findByUnDispatched(array $jobs, array $services, array $administrativeLocations, ?int $limit = null, ?int $offset = null): array
+    public function buildCenterOnScope(): array
     {
-        $qb = $this->addACLByUnDispatched($this->buildQueryUnDispatched($jobs, $services, $administrativeLocations));
+        $centerOnScopes = [];
+        foreach ($this->authorizationHelper->getReachableCenters(AccompanyingPeriodVoter::SEE) as $center) {
+            $centerOnScopes[] = [
+                'center' => $center,
+                'scopeOnRole' => $this->authorizationHelper->getReachableScopes(AccompanyingPeriodVoter::SEE, $center),
+                'scopeCanSeeConfidential' => $this->authorizationHelper->getReachableScopes(AccompanyingPeriodVoter::SEE_CONFIDENTIAL_ALL, $center),
+            ];
+        }
 
+        return $centerOnScopes;
+    }
+
+    public function findByUnDispatched(array $jobs, array $services, array $administrativeAdministrativeLocations, ?array $orderBy = null, ?int $limit = null, ?int $offset = null): array
+    {
+        $qb = $this->buildQueryUnDispatched($jobs, $services, $administrativeAdministrativeLocations);
         $qb->select('ap');
 
-        if (null !== $limit) {
-            $qb->setMaxResults($limit);
-        }
-
-        if (null !== $offset) {
-            $qb->setFirstResult($offset);
-        }
+        $qb = $this->addACLMultiCenterOnQuery($qb, $this->buildCenterOnScope(), false);
+        $qb = $this->addOrderLimitClauses($qb, $orderBy, $limit, $offset);
 
         return $qb->getQuery()->getResult();
     }
@@ -225,76 +264,80 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
             return [];
         }
 
-        $qb = $this->buildQueryOpenedAccompanyingCourseByUser($user);
-
-        $qb->setFirstResult($offset)
-            ->setMaxResults($limit);
-
-        foreach ($orderBy as $field => $direction) {
-            $qb->addOrderBy('ap.' . $field, $direction);
-        }
+        $qb = $this->buildQueryOpenedAccompanyingCourseByUserAndPostalCodes($user, $postalCodes);
+        $qb = $this->addACLMultiCenterOnQuery($qb, $this->buildCenterOnScope(), false);
+        $qb = $this->addOrderLimitClauses($qb, $orderBy, $limit, $offset);
 
         return $qb->getQuery()->getResult();
     }
 
     /**
-     * @return array|AccompanyingPeriod[]
+     * @param QueryBuilder $qb
+     * @param list<array{center: Center, scopeOnRole: list<Scope>, scopeCanSeeConfidential: list<Scope>}> $centerScopes
+     * @param bool $allowNoCenter if true, will allow to see the periods linked to person which does not have any center. Very few edge case when some Person are not associated to a center.
+     * @return QueryBuilder
      */
-    public function findByUserOpenedAccompanyingPeriod(?User $user, array $orderBy = [], int $limit = 0, int $offset = 50): array
+    public function addACLMultiCenterOnQuery(QueryBuilder $qb, array $centerScopes, bool $allowNoCenter = false): QueryBuilder
     {
-        if (null === $user) {
-            return [];
-        }
+        $user = $this->security->getUser();
 
-        $qb = $this->buildQueryOpenedAccompanyingCourseByUser($user);
-
-        $qb->setFirstResult($offset)
-            ->setMaxResults($limit);
-
-        foreach ($orderBy as $field => $direction) {
-            $qb->addOrderBy('ap.' . $field, $direction);
-        }
-
-        return $qb->getQuery()->getResult();
-    }
-
-    private function addACLByUnDispatched(QueryBuilder $qb): QueryBuilder
-    {
-        $centers = $this->authorizationHelper->getReachableCenters(
-            $this->security->getUser(),
-            AccompanyingPeriodVoter::SEE
-        );
-
-        $orX = $qb->expr()->orX();
-
-        if (0 === count($centers)) {
+        if (0 === count($centerScopes) || !$user instanceof User) {
             return $qb->andWhere("'FALSE' = 'TRUE'");
         }
 
-        foreach ($centers as $key => $center) {
-            $scopes = $this->authorizationHelper
-                ->getReachableCircles(
-                    $this->security->getUser(),
-                    AccompanyingPeriodVoter::SEE,
-                    $center
-                );
+        $orX = $qb->expr()->orX();
 
+        $idx = 0;
+        foreach ($centerScopes as ['center' => $center, 'scopeOnRole' => $scopes, 'scopeCanSeeConfidential' => $scopesCanSeeConfidential]) {
             $and = $qb->expr()->andX(
-                $qb->expr()->exists('SELECT part FROM ' . AccompanyingPeriodParticipation::class . ' part ' .
-                    "JOIN part.person p WHERE part.accompanyingPeriod = ap.id AND p.center = :center_{$key}")
+                $qb->expr()->exists(
+                    'SELECT 1 FROM ' . AccompanyingPeriodParticipation::class . " part_{$idx} " .
+                    "JOIN part_{$idx}.person p{$idx} LEFT JOIN p{$idx}.centerCurrent centerCurrent_{$idx} " .
+                    "WHERE part_{$idx}.accompanyingPeriod = ap.id AND (centerCurrent_{$idx}.center = :center_{$idx}"
+                    . ($allowNoCenter ? " OR centerCurrent_{$idx}.id IS NULL)" : ")")
+                )
             );
-            $qb->setParameter('center_' . $key, $center);
-            $orScope = $qb->expr()->orX();
+            $qb->setParameter('center_' . $idx, $center);
 
-            foreach ($scopes as $skey => $scope) {
-                $orScope->add(
-                    $qb->expr()->isMemberOf(':scope_' . $key . '_' . $skey, 'ap.scopes')
+            $orScopeInsideCenter = $qb->expr()->orX(
+                // even if the scope is not in one authorized, the user can see the course if it is in DRAFT state
+                $qb->expr()->eq('ap.step', ':draft')
+            );
+
+            $idx++;
+            foreach ($scopes as $scope) {
+                // for each scope:
+                // - either the user is the referrer of the course
+                // - or the accompanying course is one of the reachable scopes
+                // - and the parcours is not confidential OR the user is the referrer OR the user can see the confidential course
+                $orOnScope = $qb->expr()->orX(
+                    $qb->expr()->isMemberOf(':scope_' . $idx, 'ap.scopes'),
+                    $qb->expr()->eq('ap.user', ':user_executing')
                 );
-                $qb->setParameter('scope_' . $key . '_' . $skey, $scope);
+                $qb->setParameter('user_executing', $user);
+
+                if (in_array($scope, $scopesCanSeeConfidential, true)) {
+                    $orScopeInsideCenter->add($orOnScope);
+                } else {
+                    // we must add a condition: the course is not confidential or the user is the referrer
+                    $andXOnScope = $qb->expr()->andX(
+                        $orOnScope,
+                        $qb->expr()->orX(
+                            'ap.confidential = FALSE',
+                            $qb->expr()->eq('ap.user', ':user_executing')
+                        )
+                    );
+                    $orScopeInsideCenter->add($andXOnScope);
+                }
+                $qb->setParameter('scope_' . $idx, $scope);
+
+                $idx++;
             }
 
-            $and->add($orScope);
+            $and->add($orScopeInsideCenter);
             $orX->add($and);
+
+            $idx++;
         }
 
         return $qb->andWhere($orX);
@@ -305,7 +348,7 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
      * @param array|Scope[] $services
      * @param array|Location[] $locations
      */
-    private function buildQueryUnDispatched(array $jobs, array $services, array $locations): QueryBuilder
+    public function buildQueryUnDispatched(array $jobs, array $services, array $locations): QueryBuilder
     {
         $qb = $this->accompanyingPeriodRepository->createQueryBuilder('ap');
 
@@ -333,8 +376,8 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
             $or = $qb->expr()->orX();
 
             foreach ($services as $key => $service) {
-                $or->add($qb->expr()->isMemberOf(':scope_' . $key, 'ap.scopes'));
-                $qb->setParameter('scope_' . $key, $service);
+                $or->add($qb->expr()->isMemberOf(':scopef_' . $key, 'ap.scopes'));
+                $qb->setParameter('scopef_' . $key, $service);
             }
             $qb->andWhere($or);
         }

src/Bundle/ChillPersonBundle/Repository/AccompanyingPeriodACLAwareRepositoryInterface.php

@@ -31,28 +31,28 @@ interface AccompanyingPeriodACLAwareRepositoryInterface
      */
     public function countByUserAndPostalCodesOpenedAccompanyingPeriod(?User $user, array $postalCodes): int;
 
-    public function countByUserOpenedAccompanyingPeriod(?User $user): int;
-
+    /**
+     * @return array<AccompanyingPeriod>
+     */
     public function findByPerson(
         Person $person,
         string $role,
         ?array $orderBy = [],
-        ?int $limit = null,
-        ?int $offset = null
+        ?int   $limit = null,
+        ?int   $offset = null
     ): array;
 
     /**
      * @param array|UserJob[] $jobs if empty, does not take this argument into account
      * @param array|Scope[] $services if empty, does not take this argument into account
      *
-     * @return array|AccompanyingPeriod[]
+     * @return list<AccompanyingPeriod>
      */
-    public function findByUnDispatched(array $jobs, array $services, array $administrativeLocations, ?int $limit = null, ?int $offset = null): array;
+    public function findByUnDispatched(array $jobs, array $services, array $administrativeAdministrativeLocations, ?array $orderBy = null, ?int $limit = null, ?int $offset = null): array;
 
     /**
      * @param array|PostalCode[] $postalCodes
+     * @return list<AccompanyingPeriod>
      */
     public function findByUserAndPostalCodesOpenedAccompanyingPeriod(?User $user, array $postalCodes, array $orderBy = [], int $limit = 0, int $offset = 50): array;
-
-    public function findByUserOpenedAccompanyingPeriod(?User $user, array $orderBy = [], int $limit = 0, int $offset = 50): array;
 }