src/Security/Voters/Ledger/TransactionVoter.php line 11

  1. <?php
  3. namespace App\Security\Voters\Ledger;
  5. use App\Entity\Ledger\Transaction;
  6. use App\Enums\Operation;
  7. use App\Enums\Roles;
  8. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  9. use Symfony\Component\Security\Core\Authorization\Voter\CacheableVoterInterface;
  11. class TransactionVoter implements CacheableVoterInterface
  12. {
  13.     public function __construct(
  14.         private readonly \Symfony\Bundle\SecurityBundle\Security $security,
  15.     ) {
  16.     }
  18.     public function supportsAttribute(string $attribute): bool
  19.     {
  20.         return Operation::match($attribute);
  21.     }
  23.     public function supportsType(string $subjectType): bool
  24.     {
  25.         return Transaction::class === $subjectType;
  26.     }
  28.     public function vote(TokenInterface $token, mixed $subject, array $attributes): int
  29.     {
  30.         return match ($attributes) {
  31.             [Operation::READ->value] => $this->checkRead($token, $subject),
  32.             [Operation::CREATE->value] => $this->checkCreate($token, $subject, $attributes),
  33.             default => self::ACCESS_DENIED,
  34.         };
  35.     }
  37.     private function checkCreate(TokenInterface $token, Transaction $subject, array $attributes): int
  38.     {
  39.         $currentUser = $token->getUser();
  41.         if ($subject->getAccountFrom()->getOwner()->getUserIdentifier() === $currentUser->getUserIdentifier()) {
  42.             return self::ACCESS_GRANTED;
  43.         }
  45.         return self::ACCESS_DENIED;
  46.     }
  48.     private function checkRead(TokenInterface $token, Transaction $subject): int
  49.     {
  50.         if ($this->security->isGranted(Roles::ROLE_ADMIN)) {
  51.             return self::ACCESS_GRANTED;
  52.         }
  53.         if ($token->getUserIdentifier() === $subject->getAccountFrom()->getOwner()->getUserIdentifier()) {
  54.             return self::ACCESS_GRANTED;
  55.         }
  56.         if ($token->getUserIdentifier() === $subject->getAccountTo()->getOwner()->getUserIdentifier()) {
  57.             return self::ACCESS_GRANTED;
  58.         }
  60.         return self::ACCESS_DENIED;
  61.     }
  62. }