vendor/sulu/sulu/src/Sulu/Component/Security/Authorization/SecurityContextVoter.php line 22

Open in your IDE?
  1. <?php
  3. /*
  4. * This file is part of Sulu.
  5. *
  6. * (c) Sulu GmbH
  7. *
  8. * This source file is subject to the MIT license that is bundled
  9. * with this source code in the file LICENSE.
  10. */
  12. namespace Sulu\Component\Security\Authorization;
  14. use Sulu\Bundle\SecurityBundle\Entity\User;
  15. use Sulu\Component\Security\Authorization\AccessControl\AccessControlManagerInterface;
  16. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  17. use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
  19. /**
  20. * Checks the Sulu security.
  21. */
  22. class SecurityContextVoter implements VoterInterface
  23. {
  24. /**
  25. * The permissions available, defined by config.
  26. *
  27. * @var array
  28. */
  29. private $permissions;
  31. /**
  32. * @var AccessControlManagerInterface
  33. */
  34. private $accessControlManager;
  36. public function __construct(AccessControlManagerInterface $accessControlManager, $permissions)
  37. {
  38. $this->accessControlManager = $accessControlManager;
  39. $this->permissions = $permissions;
  40. }
  42. public function supportsAttribute($attribute)
  43. {
  44. return \in_array($attribute, \array_keys($this->permissions));
  45. }
  47. public function supportsClass($class)
  48. {
  49. return SecurityCondition::class === $class || \is_subclass_of($class, SecurityCondition::class);
  50. }
  52. public function vote(TokenInterface $token, $object, array $attributes)
  53. {
  54. /** @var User $user */
  55. $user = $token->getUser();
  57. if (!\is_object($object)
  58. || !$this->supportsClass(\get_class($object))
  59. ) {
  60. return VoterInterface::ACCESS_ABSTAIN;
  61. }
  63. $userPermissions = $this->accessControlManager->getUserPermissions($object, $user);
  64. if (0 === \count($userPermissions)) {
  65. return VoterInterface::ACCESS_DENIED;
  66. }
  68. // only if all attributes are granted the access is granted
  69. foreach ($attributes as $attribute) {
  70. if (isset($userPermissions[$attribute]) && !$userPermissions[$attribute]) {
  71. return VoterInterface::ACCESS_DENIED;
  72. }
  73. }
  75. return VoterInterface::ACCESS_GRANTED;
  76. }
  77. }