Skip to content

Commit eb42580

Browse files
jbtronicsjbtronics
committed
Added voter reason explaination to the other voters
1 parent 117ff44 commit eb42580

14 files changed

+65
-35
lines changed

‎src/Security/Voter/AttachmentVoter.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
use RuntimeException;
4242

4343
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
44+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
4445
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
4546

4647
use function in_array;
@@ -56,7 +57,7 @@ public function __construct(private readonly Security $security, private readonl
5657
{
5758
}
5859

59-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
60+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
6061
{
6162

6263
//This voter only works for attachments
@@ -65,7 +66,8 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
6566
}
6667

6768
if ($attribute === 'show_private') {
68-
return $this->helper->isGranted($token, 'attachments', 'show_private');
69+
$vote?->addReason('User is not allowed to view private attachments.');
70+
return $this->helper->isGranted($token, 'attachments', 'show_private', $vote);
6971
}
7072

7173

@@ -111,7 +113,8 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
111113
throw new RuntimeException('Encountered unknown Parameter type: ' . $subject);
112114
}
113115

114-
return $this->helper->isGranted($token, $param, $this->mapOperation($attribute));
116+
$vote?->addReason('User is not allowed to '.$this->mapOperation($attribute).' attachments of type '.$param.'.');
117+
return $this->helper->isGranted($token, $param, $this->mapOperation($attribute), $vote);
115118
}
116119

117120
return false;

‎src/Security/Voter/GroupVoter.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
use App\Entity\UserSystem\Group;
2626
use App\Services\UserSystem\VoterHelper;
2727
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
28+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
2829
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
2930

3031
/**
@@ -43,9 +44,9 @@ public function __construct(private readonly VoterHelper $helper)
4344
*
4445
* @param string $attribute
4546
*/
46-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
47+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
4748
{
48-
return $this->helper->isGranted($token, 'groups', $attribute);
49+
return $this->helper->isGranted($token, 'groups', $attribute, $vote);
4950
}
5051

5152
/**

‎src/Security/Voter/ImpersonateUserVoter.php‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
use App\Entity\UserSystem\User;
2727
use App\Services\UserSystem\VoterHelper;
2828
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
29+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
2930
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
3031
use Symfony\Component\Security\Core\User\UserInterface;
3132

@@ -47,9 +48,16 @@ protected function supports(string $attribute, mixed $subject): bool
4748
&& $subject instanceof UserInterface;
4849
}
4950

50-
protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
51+
protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token, ?Vote $vote = null): bool
5152
{
52-
return $this->helper->isGranted($token, 'users', 'impersonate');
53+
$result = $this->helper->isGranted($token, 'users', 'impersonate');
54+
55+
if ($result === false) {
56+
$vote?->addReason('User is not allowed to impersonate other users.');
57+
$this->helper->addReason($vote, 'users', 'impersonate');
58+
}
59+
60+
return $result;
5361
}
5462

5563
public function supportsAttribute(string $attribute): bool
@@ -61,4 +69,4 @@ public function supportsType(string $subjectType): bool
6169
{
6270
return is_a($subjectType, User::class, true);
6371
}
64-
}
72+
}

‎src/Security/Voter/LabelProfileVoter.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
use App\Entity\LabelSystem\LabelProfile;
4545
use App\Services\UserSystem\VoterHelper;
4646
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
47+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
4748
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
4849

4950
/**
@@ -63,9 +64,9 @@ final class LabelProfileVoter extends Voter
6364
public function __construct(private readonly VoterHelper $helper)
6465
{}
6566

66-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
67+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
6768
{
68-
return $this->helper->isGranted($token, 'labels', self::MAPPING[$attribute]);
69+
return $this->helper->isGranted($token, 'labels', self::MAPPING[$attribute], $vote);
6970
}
7071

7172
protected function supports($attribute, $subject): bool

‎src/Security/Voter/LogEntryVoter.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
use Symfony\Bundle\SecurityBundle\Security;
2727
use App\Entity\LogSystem\AbstractLogEntry;
2828
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
29+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
2930
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
3031

3132
/**
@@ -39,7 +40,7 @@ public function __construct(private readonly Security $security, private readonl
3940
{
4041
}
4142

42-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
43+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
4344
{
4445
$user = $this->helper->resolveUser($token);
4546

@@ -48,19 +49,19 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
4849
}
4950

5051
if ('delete' === $attribute) {
51-
return $this->helper->isGranted($token, 'system', 'delete_logs');
52+
return $this->helper->isGranted($token, 'system', 'delete_logs', $vote);
5253
}
5354

5455
if ('read' === $attribute) {
5556
//Allow read of the users own log entries
5657
if (
5758
$subject->getUser() === $user
58-
&& $this->helper->isGranted($token, 'self', 'show_logs')
59+
&& $this->helper->isGranted($token, 'self', 'show_logs', $vote)
5960
) {
6061
return true;
6162
}
6263

63-
return $this->helper->isGranted($token, 'system', 'show_logs');
64+
return $this->helper->isGranted($token, 'system', 'show_logs', $vote);
6465
}
6566

6667
if ('show_details' === $attribute) {

‎src/Security/Voter/OrderdetailVoter.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
use App\Entity\Parts\Part;
4747
use App\Entity\PriceInformations\Orderdetail;
4848
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
49+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
4950
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
5051

5152
/**
@@ -59,7 +60,7 @@ public function __construct(private readonly Security $security, private readonl
5960

6061
protected const ALLOWED_PERMS = ['read', 'edit', 'create', 'delete', 'show_history', 'revert_element'];
6162

62-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
63+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
6364
{
6465
if (! is_a($subject, Orderdetail::class, true)) {
6566
throw new \RuntimeException('This voter can only handle Orderdetail objects!');
@@ -75,7 +76,7 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
7576

7677
//If we have no part associated use the generic part permission
7778
if (is_string($subject) || !$subject->getPart() instanceof Part) {
78-
return $this->helper->isGranted($token, 'parts', $operation);
79+
return $this->helper->isGranted($token, 'parts', $operation, $vote);
7980
}
8081

8182
//Otherwise vote on the part

‎src/Security/Voter/ParameterVoter.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
use App\Entity\Parameters\SupplierParameter;
4040
use RuntimeException;
4141
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
42+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
4243
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
4344

4445
/**
@@ -53,7 +54,7 @@ public function __construct(private readonly Security $security, private readonl
5354
{
5455
}
5556

56-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
57+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
5758
{
5859
//return $this->resolver->inherit($user, 'attachments', $attribute) ?? false;
5960

@@ -108,7 +109,7 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
108109
throw new RuntimeException('Encountered unknown Parameter type: ' . (is_object($subject) ? $subject::class : $subject));
109110
}
110111

111-
return $this->helper->isGranted($token, $param, $attribute);
112+
return $this->helper->isGranted($token, $param, $attribute, $vote);
112113
}
113114

114115
protected function supports(string $attribute, $subject): bool

‎src/Security/Voter/PartAssociationVoter.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
use Symfony\Bundle\SecurityBundle\Security;
4747
use App\Entity\Parts\Part;
4848
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
49+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
4950
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
5051

5152
/**
@@ -61,7 +62,7 @@ public function __construct(private readonly Security $security, private readonl
6162

6263
protected const ALLOWED_PERMS = ['read', 'edit', 'create', 'delete', 'show_history', 'revert_element'];
6364

64-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
65+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
6566
{
6667
if (!is_string($subject) && !$subject instanceof PartAssociation) {
6768
throw new \RuntimeException('Invalid subject type!');
@@ -77,7 +78,7 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
7778

7879
//If we have no part associated use the generic part permission
7980
if (is_string($subject) || !$subject->getOwner() instanceof Part) {
80-
return $this->helper->isGranted($token, 'parts', $operation);
81+
return $this->helper->isGranted($token, 'parts', $operation, $vote);
8182
}
8283

8384
//Otherwise vote on the part

‎src/Security/Voter/PartLotVoter.php‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
use App\Entity\Parts\Part;
4747
use App\Entity\Parts\PartLot;
4848
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
49+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
4950
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
5051

5152
/**
@@ -59,20 +60,24 @@ public function __construct(private readonly Security $security, private readonl
5960

6061
protected const ALLOWED_PERMS = ['read', 'edit', 'create', 'delete', 'show_history', 'revert_element', 'withdraw', 'add', 'move'];
6162

62-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
63+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
6364
{
6465
$user = $this->helper->resolveUser($token);
6566

6667
if (in_array($attribute, ['withdraw', 'add', 'move'], true))
6768
{
68-
$base_permission = $this->helper->isGranted($token, 'parts_stock', $attribute);
69+
$base_permission = $this->helper->isGranted($token, 'parts_stock', $attribute, $vote);
6970

7071
$lot_permission = true;
7172
//If the lot has an owner, we need to check if the user is the owner of the lot to be allowed to withdraw it.
7273
if ($subject instanceof PartLot && $subject->getOwner()) {
7374
$lot_permission = $subject->getOwner() === $user || $subject->getOwner()->getID() === $user->getID();
7475
}
7576

77+
if (!$lot_permission) {
78+
$vote->addReason('User is not the owner of the lot.');
79+
}
80+
7681
return $base_permission && $lot_permission;
7782
}
7883

@@ -86,7 +91,7 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
8691

8792
//If we have no part associated use the generic part permission
8893
if (is_string($subject) || !$subject->getPart() instanceof Part) {
89-
return $this->helper->isGranted($token, 'parts', $operation);
94+
return $this->helper->isGranted($token, 'parts', $operation, $vote);
9095
}
9196

9297
//Otherwise vote on the part

‎src/Security/Voter/PartVoter.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
use App\Entity\Parts\Part;
2626
use App\Services\UserSystem\VoterHelper;
2727
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
28+
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
2829
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
2930

3031
/**
@@ -52,10 +53,9 @@ protected function supports($attribute, $subject): bool
5253
return false;
5354
}
5455

55-
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
56+
protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token, ?Vote $vote = null): bool
5657
{
57-
//Null concealing operator means, that no
58-
return $this->helper->isGranted($token, 'parts', $attribute);
58+
return $this->helper->isGranted($token, 'parts', $attribute, $vote);
5959
}
6060

6161
public function supportsAttribute(string $attribute): bool

0 commit comments

Comments
 (0)