Update security voter (#278)

* make published voter compatible with new voter abstract

* change the security voter to the published voter

because you  should only be allowed access when the
workflow checker determines you should be allowed access
and not only when the document isPublishable returns true.
because then documents that are only publised after a period
would slip through

Author: esserj

src/Resources/config/publish-workflow.xml

@@ -35,7 +35,8 @@
 
         <!-- integration with core security service -->
 
-        <service id="cmf_core.security.published_voter" class="Symfony\Cmf\Bundle\CoreBundle\PublishWorkflow\Voter\PublishableVoter" public="false">
+        <service id="cmf_core.security.published_voter" class="Symfony\Cmf\Bundle\CoreBundle\Security\Authorization\Voter\PublishedVoter" public="false">
+            <argument type="service" id="cmf_core.publish_workflow.checker"/>
             <tag name="security.voter"/>
         </service>
 

src/Security/Authorization/Voter/PublishedVoter.php

@@ -11,17 +11,20 @@
 
 namespace Symfony\Cmf\Bundle\CoreBundle\Security\Authorization\Voter;
 
+use function is_subclass_of;
+use Symfony\Cmf\Bundle\CoreBundle\PublishWorkflow\PublishableReadInterface;
+use Symfony\Cmf\Bundle\CoreBundle\PublishWorkflow\PublishTimePeriodReadInterface;
 use Symfony\Cmf\Bundle\CoreBundle\PublishWorkflow\PublishWorkflowChecker;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
-use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
 
 /**
  * This is a security voter registered with the Symfony security system that
  * brings the publish workflow into standard Symfony security.
  *
  * @author David Buchmann <[email protected]>
  */
-class PublishedVoter implements VoterInterface
+class PublishedVoter extends Voter
 {
     /**
      * @var PublishWorkflowChecker
@@ -36,41 +39,27 @@ public function __construct(PublishWorkflowChecker $publishWorkflowChecker)
     /**
      * {@inheritdoc}
      */
-    public function supportsAttribute($attribute)
+    public function supportsAttribute($attribute): bool
     {
         return PublishWorkflowChecker::VIEW_ATTRIBUTE === $attribute
             || PublishWorkflowChecker::VIEW_ANONYMOUS_ATTRIBUTE === $attribute
         ;
     }
 
-    /**
-     * {@inheritdoc}
-     */
-    public function supportsClass($class)
+    public function supportsType(string $subjectType): bool
     {
-        return $this->publishWorkflowChecker->supportsClass($class);
+        return is_subclass_of($subjectType, PublishableReadInterface::class)
+            || is_subclass_of($subjectType, PublishTimePeriodReadInterface::class);
     }
 
-    /**
-     * {@inheritdoc}
-     *
-     * @param object $subject
-     */
-    public function vote(TokenInterface $token, $subject, array $attributes)
+    protected function supports($attribute, $subject)
     {
-        if (!\is_object($subject) || !$this->supportsClass(\get_class($subject))) {
-            return self::ACCESS_ABSTAIN;
-        }
-        foreach ($attributes as $attribute) {
-            if (!$this->supportsAttribute($attribute)) {
-                return self::ACCESS_ABSTAIN;
-            }
-        }
-
-        if ($this->publishWorkflowChecker->isGranted($attributes, $subject)) {
-            return self::ACCESS_GRANTED;
-        }
+        return \is_object($subject) && $this->supportsType(\get_class($subject))
+            && $this->supportsAttribute($attribute);
+    }
 
-        return self::ACCESS_DENIED;
+    protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
+    {
+        return $this->publishWorkflowChecker->isGranted($attribute, $subject);
     }
 }