chill-bundles/src/Bundle/ChillPersonBundle/Security/Authorization/HouseholdVoter.php

<?php

declare(strict_types=1);

/*
 * Chill is a software for social workers
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace Chill\PersonBundle\Security\Authorization;

use Chill\MainBundle\Entity\Center;
use Chill\MainBundle\Security\Authorization\ChillVoterInterface;
use Chill\MainBundle\Security\Authorization\VoterHelperFactoryInterface;
use Chill\MainBundle\Security\Authorization\VoterHelperInterface;
use Chill\MainBundle\Security\ProvideRoleHierarchyInterface;
use Chill\PersonBundle\Entity\Household\Household;
use Chill\PersonBundle\Entity\Household\HouseholdMember;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\Security;
use UnexpectedValueException;
use function in_array;

class HouseholdVoter extends Voter implements ProvideRoleHierarchyInterface, ChillVoterInterface
{
    public const EDIT = 'CHILL_PERSON_HOUSEHOLD_EDIT';

    public const SEE = 'CHILL_PERSON_HOUSEHOLD_SEE';

    /**
     * @deprecated use @see{self::SEE} instead
     */
    public const SHOW = self::SEE;

    public const STATS = 'CHILL_PERSON_HOUSEHOLD_STATS';

    private const ALL = [
        self::SEE,
        self::EDIT,
        self::STATS,
    ];

    private VoterHelperInterface $helper;

    private Security $security;

    public function __construct(Security $security, VoterHelperFactoryInterface $voterHelperFactory)
    {
        $this->security = $security;
        $this->helper = $voterHelperFactory
            ->generate(self::class)
            ->addCheckFor(Center::class, [self::STATS])
            ->build();
    }

    public function getRoles(): array
    {
        return [self::STATS];
    }

    public function getRolesWithHierarchy(): array
    {
        return ['Household' => $this->getRoles()];
    }

    public function getRolesWithoutScope(): array
    {
        return $this->getRoles();
    }

    protected function supports($attribute, $subject)
    {
        return ($subject instanceof Household
            && in_array($attribute, self::ALL, true))
            || $this->helper->supports($attribute, $subject);
    }

    protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
    {
        switch ($attribute) {
            case self::SEE:
                return $this->checkAssociatedMembersRole($subject, PersonVoter::SEE);

            case self::EDIT:
                return $this->checkAssociatedMembersRole($subject, PersonVoter::UPDATE);

            case self::STATS:
                return $this->voteOnAttribute($attribute, $subject, $token);

            default:
                throw new UnexpectedValueException('attribute not supported');
        }
    }

    private function checkAssociatedMembersRole(Household $household, string $attribute): bool
    {
        foreach ($household->getCurrentMembers()->map(static fn (HouseholdMember $member) => $member->getPerson()) as $person) {
            if ($this->security->isGranted($attribute, $person)) {
                return true;
            }
        }

        return false;
    }
}