src/Security/ImpersonateUserVoter.php line 14

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace App\Security;
  7. use App\Entity\System\Customer;
  8. use App\Entity\System\Employee;
  9. use App\Entity\System\Role;
  10. use Symfony\Component\DependencyInjection\ParameterBag\ParameterBagInterface;
  11. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  12. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  14. class ImpersonateUserVoter extends Voter
  15. {
  16.     private ParameterBagInterface $parameterBag;
  18.     public function __construct(
  19.         ParameterBagInterface $parameterBag
  20.     ) {
  21.         $this->parameterBag = $parameterBag;
  22.     }
  24.     public const CAN_SWITCH_USER = 'CAN_SWITCH_USER';
  26.     protected function supports($attribute, $subject): bool
  27.     {
  28.         return $attribute === self::CAN_SWITCH_USER && $subject instanceof Customer;
  29.     }
  31.     protected function voteOnAttribute($attribute, $subject, TokenInterface $token): bool
  32.     {
  33.         $user = $token->getUser();
  35.         if (!$user instanceof Employee || !$subject instanceof Customer) {
  36.             return false;
  37.         }
  39.         if ($this->loggedUserIsAdmin($user)) {
  40.             return true;
  41.         }
  43.         if ($this->requestedUserIsEmployee($subject->getEmail())) {
  44.             return $user->getEmail() === $subject->getEmail();
  45.         }
  47.         $userRolesIndex = \array_flip($user->getRoles());
  49.         return $this->loggedUserHasAnyImpersonatorRole($userRolesIndex);
  50.     }
  52.     protected function requestedUserIsEmployee(string $email): bool
  53.     {
  54.         return str_contains($email, $this->parameterBag->get('microsoft_tenant_email_postfix'));
  55.     }
  57.     protected function loggedUserIsAdmin(Employee $user): bool
  58.     {
  59.         $userRolesIndex = \array_flip($user->getRoles());
  61.         return \array_key_exists(Role::ROLE_EMPLOYEE_DEVELOPER, $userRolesIndex);
  62.     }
  64.     /**
  65.      * @param array<string, array-key> $userRolesIndex
  66.      */
  67.     public function loggedUserHasAnyImpersonatorRole(array $userRolesIndex): bool
  68.     {
  69.         return \array_key_exists(Role::ROLE_EMPLOYEE_SUPER_ADMIN, $userRolesIndex)
  70.             || \array_key_exists(Role::ROLE_EMPLOYEE_TECH_SUPPORT, $userRolesIndex)
  71.             || \array_key_exists(Role::ROLE_EMPLOYEE_SALES_ADMIN, $userRolesIndex)
  72.             || \array_key_exists('ROLE_FINANCE', $userRolesIndex);
  73.     }
  74. }