Symfony Profiler

<?php
namespace App\Security\Voter\Users;
use App\Entity\Garages\Garage;
use App\Entity\User;
use App\Enum\MenuRolesManagerEnum;
use App\Enum\UserRolesEnum;
use App\Enum\VotersEnum;
use App\Repository\Garages\GarageRepository;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\Security;
final class UserVoter extends Voter
{
private Security $security;
private array $voters;
private GarageRepository $gr;
public function __construct(Security $security, GarageRepository $gr)
{
$this->security = $security;
$this->voters = [
VotersEnum::LIST_USER,
VotersEnum::LIST_ASSOCIATED_EMPLOYEE,
VotersEnum::CREATE_USER,
VotersEnum::CREATE_ASSOCIATED_EMPLOYEE,
VotersEnum::READ,
VotersEnum::UPDATE,
VotersEnum::DELETE,
VotersEnum::STATISTICS_LIST,
VotersEnum::STATISTICS_VIEW,
VotersEnum::STATISTICS_ENABLE,
VotersEnum::STATISTICS_DISABLE,
VotersEnum::STATISTICS_DOWNLOAD,
];
$this->gr = $gr;
}
protected function supports(string $attribute, $subject): bool
{
// first check the $subject and last if the $attribute is supported,
// because there are attributes (with subject) used as well by other voters (like UPDATE, ...)
if ($subject && !$subject instanceof User) {
// only vote on these objects
return false;
}
if (in_array($attribute, $this->voters)) {
// if the attribute is one we support
return true;
}
return false;
}
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
if (!$user instanceof User) {
// the user must be logged in; if not, deny access
return false;
}
switch ($attribute) {
case VotersEnum::LIST_USER:
return $this->canList();
case VotersEnum::LIST_ASSOCIATED_EMPLOYEE:
return $this->canListAssociatedEmployee();
case VotersEnum::CREATE_USER:
return $this->canCreate();
case VotersEnum::CREATE_ASSOCIATED_EMPLOYEE:
return $this->canCreateAssociatedEmployee();
case VotersEnum::READ:
return $this->canRead($subject, $user);
case VotersEnum::UPDATE:
return $this->canUpdate($subject, $user);
case VotersEnum::DELETE:
return $this->canDelete($subject, $user);
case VotersEnum::STATISTICS_LIST:
return $this->canListStatistics($subject, $user);
case VotersEnum::STATISTICS_VIEW:
return $this->canViewStatistics($subject, $user);
case VotersEnum::STATISTICS_ENABLE:
return $this->canEnableStatistics($subject);
case VotersEnum::STATISTICS_DISABLE:
return $this->canDisableStatistics($subject);
case VotersEnum::STATISTICS_DOWNLOAD:
return $this->canDownloadStatistics($subject, $user);
}
throw new \LogicException('This code should not be reached!');
}
private function canList(): bool
{
return $this->isAdminUser();
}
private function canListAssociatedEmployee(): bool
{
return $this->isAdminUser() || $this->isAssociatedUser();
}
private function canCreate(): bool
{
return $this->isAdminUser();
}
private function canCreateAssociatedEmployee(): bool
{
return $this->isAdminUser() || $this->isAssociatedUser();
}
private function canRead(User $subject, User $loggedUser): bool
{
return $this->isAdminUser() || $this->isMyEmployee($subject, $loggedUser);
}
private function canUpdate(User $subject, User $loggedUser): bool
{
if ((UserRolesEnum::ROLE_ADMIN === $subject->getUserRole()) || (UserRolesEnum::ROLE_SUPER_ADMIN === $subject->getUserRole())) {
// only users with ROLE_ADMIN can update ADMINS users
return $this->security->isGranted(UserRolesEnum::ROLE_ADMIN_LONG);
} else {
return $this->isAdminUser() || $this->isMyEmployee($subject, $loggedUser);
}
}
private function canDelete(User $subject, User $loggedUser): bool
{
return $this->canUpdate($subject, $loggedUser);
}
private function canListStatistics(User $user, User $loggedUser): bool
{
if ($this->security->isGranted(UserRolesEnum::ROLE_COORDINATOR_LONG)) {
$found = false;
$garages = $this->gr->getEnabledGaragesByProvincesSortedByName($loggedUser->getWorkProvinces());
/** @var Garage $garage */
foreach ($garages as $garage) {
if ($garage->isOwner($user)) {
$found = true;
break;
}
}
return $found && $user->isEnableStatisticsManagement();
}
return $this->isStatisticsAdminUser() && $user->isEnableStatisticsManagement();
}
private function canViewStatistics(User $user, User $loggedUser): bool
{
return $this->canListStatistics($user, $loggedUser);
}
private function canEnableStatistics(User $user): bool
{
return $this->isStatisticsAdminUser() && !$user->isEnableStatisticsManagement();
}
private function canDisableStatistics(User $user): bool
{
return $this->isStatisticsAdminUser() && $user->isEnableStatisticsManagement();
}
private function canDownloadStatistics(User $user, User $loggedUser): bool
{
return $this->canListStatistics($user, $loggedUser);
}
private function isStatisticsAdminUser(): bool
{
return ($this->isAdminUser() || $this->security->isGranted(MenuRolesManagerEnum::ROLE_MENU_BAROMETER_DATA)) && !$this->security->isGranted(UserRolesEnum::ROLE_COORDINATOR_LONG);
}
private function isAdminUser(): bool
{
return $this->security->isGranted(UserRolesEnum::ROLE_ADMIN_LONG);
}
private function isAssociatedUser(): bool
{
return $this->security->isGranted(UserRolesEnum::ROLE_ASSOCIATED_LONG);
}
private function isMyEmployee(User $employee, User $loggedUser): bool
{
$employeeGarage = $employee->getEmployeeGarage();
if ($employeeGarage) {
/** @var Garage $garage */
foreach ($loggedUser->getGarages() as $garage) {
if ($employeeGarage->getId() === $garage->getId()) {
return true;
}
}
}
return false;
}
}

src/Security/Voter/Users/UserVoter.php line 15