vendor/sulu/sulu/src/Sulu/Component/Security/Authorization/SecurityContextVoter.php line 22

  1. <?php
  3. /*
  4.  * This file is part of Sulu.
  5.  *
  6.  * (c) Sulu GmbH
  7.  *
  8.  * This source file is subject to the MIT license that is bundled
  9.  * with this source code in the file LICENSE.
  10.  */
  12. namespace Sulu\Component\Security\Authorization;
  14. use Sulu\Bundle\SecurityBundle\Entity\User;
  15. use Sulu\Component\Security\Authorization\AccessControl\AccessControlManagerInterface;
  16. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  17. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  19. /**
  20.  * Checks the Sulu security.
  21.  */
  22. class SecurityContextVoter implements VoterInterface
  23. {
  24.     /**
  25.      * @param mixed[] $permissions
  26.      */
  27.     public function __construct(
  28.         private AccessControlManagerInterface $accessControlManager,
  29.         /**
  30.          * The permissions available, defined by config.
  31.          */
  32.         private $permissions
  33.     ) {
  34.     }
  36.     public function supportsAttribute($attribute)
  37.     {
  38.         return \in_array($attribute, \array_keys($this->permissions));
  39.     }
  41.     public function supportsClass($class)
  42.     {
  43.         return SecurityCondition::class === $class || \is_subclass_of($class, SecurityCondition::class);
  44.     }
  46.     public function vote(TokenInterface $token, $object, array $attributes)
  47.     {
  48.         /** @var User $user */
  49.         $user = $token->getUser();
  51.         if (!\is_object($object)
  52.             || !$this->supportsClass(\get_class($object))
  53.         ) {
  54.             return VoterInterface::ACCESS_ABSTAIN;
  55.         }
  57.         $userPermissions = $this->accessControlManager->getUserPermissions($object, $user);
  58.         if (0 === \count($userPermissions)) {
  59.             return VoterInterface::ACCESS_DENIED;
  60.         }
  62.         // only if all attributes are granted the access is granted
  63.         foreach ($attributes as $attribute) {
  64.             if (isset($userPermissions[$attribute]) && !$userPermissions[$attribute]) {
  65.                 return VoterInterface::ACCESS_DENIED;
  66.             }
  67.         }
  69.         return VoterInterface::ACCESS_GRANTED;
  70.     }
  71. }