Skip to content

Commit acad212

Browse files
AngelFQCAngelFQC
committed
Internal: Move code to ResourceAclHelper
1 parent b2de345 commit acad212

File tree

2 files changed

+105
-70
lines changed

2 files changed

+105
-70
lines changed

‎src/CoreBundle/Helpers/ResourceAclHelper.php‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
<?php
2+
3+
/* For licensing terms, see /license.txt */
4+
5+
declare(strict_types=1);
6+
7+
namespace Chamilo\CoreBundle\Helpers;
8+
9+
use Chamilo\CoreBundle\Entity\ResourceLink;
10+
use Chamilo\CoreBundle\Security\Authorization\Voter\ResourceNodeVoter;
11+
use Laminas\Permissions\Acl\Acl;
12+
use Laminas\Permissions\Acl\Resource\GenericResource;
13+
use Laminas\Permissions\Acl\Role\GenericRole;
14+
use Symfony\Bundle\SecurityBundle\Security;
15+
use Symfony\Component\Security\Acl\Permission\MaskBuilder;
16+
use Symfony\Component\Security\Core\Authentication\Token\NullToken;
17+
use Symfony\Component\Security\Core\User\UserInterface;
18+
19+
readonly class ResourceAclHelper
20+
{
21+
public function __construct(
22+
private Security $security,
23+
) { }
24+
25+
public function isAllowed(
26+
string $attribute,
27+
ResourceLink $resourceLink,
28+
iterable $rights,
29+
bool $allowAnonsToView,
30+
): bool {
31+
// Creating roles
32+
$anon = new GenericRole('IS_AUTHENTICATED_ANONYMOUSLY');
33+
$userRole = new GenericRole('ROLE_USER');
34+
$student = new GenericRole('ROLE_STUDENT');
35+
$teacher = new GenericRole('ROLE_TEACHER');
36+
$studentBoss = new GenericRole('ROLE_STUDENT_BOSS');
37+
38+
$currentStudent = new GenericRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_STUDENT);
39+
$currentTeacher = new GenericRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_TEACHER);
40+
41+
$currentStudentGroup = new GenericRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_STUDENT);
42+
$currentTeacherGroup = new GenericRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_TEACHER);
43+
44+
$currentStudentSession = new GenericRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_STUDENT);
45+
$currentTeacherSession = new GenericRole(ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_TEACHER);
46+
47+
// Setting Simple ACL.
48+
$acl = (new Acl())
49+
->addRole($anon)
50+
->addRole($userRole)
51+
->addRole($student)
52+
->addRole($teacher)
53+
->addRole($studentBoss)
54+
55+
->addRole($currentStudent)
56+
->addRole($currentTeacher, ResourceNodeVoter::ROLE_CURRENT_COURSE_STUDENT)
57+
58+
->addRole($currentStudentSession)
59+
->addRole($currentTeacherSession, ResourceNodeVoter::ROLE_CURRENT_COURSE_SESSION_STUDENT)
60+
61+
->addRole($currentStudentGroup)
62+
->addRole($currentTeacherGroup, ResourceNodeVoter::ROLE_CURRENT_COURSE_GROUP_STUDENT)
63+
;
64+
65+
// Add a security resource.
66+
$acl->addResource(new GenericResource((string) $resourceLink->getId()));
67+
68+
// Check all the right this link has.
69+
// Set rights from the ResourceRight.
70+
foreach ($rights as $right) {
71+
$acl->allow($right->getRole(), null, (string) $right->getMask());
72+
}
73+
74+
// Anons can see.
75+
if ($allowAnonsToView) {
76+
$acl->allow($anon, null, (string) ResourceNodeVoter::getReaderMask());
77+
}
78+
79+
// Asked mask
80+
$mask = new MaskBuilder();
81+
$mask->add($attribute);
82+
83+
$askedMask = (string) $mask->get();
84+
85+
if ($this->security->getToken() instanceof NullToken) {
86+
return (bool) $acl->isAllowed('IS_AUTHENTICATED_ANONYMOUSLY', $resourceLink->getId(), $askedMask);
87+
}
88+
89+
$user = $this->security->getUser();
90+
91+
$roles = $user instanceof UserInterface ? $user->getRoles() : [];
92+
93+
foreach ($roles as $role) {
94+
if ($acl->isAllowed($role, $resourceLink->getId(), $askedMask)) {
95+
return true;
96+
}
97+
}
98+
99+
return false;
100+
}
101+
}

‎src/CoreBundle/Security/Authorization/Voter/ResourceNodeVoter.php‎

Lines changed: 4 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
use Chamilo\CoreBundle\Entity\ResourceNode;
1212
use Chamilo\CoreBundle\Entity\ResourceRight;
1313
use Chamilo\CoreBundle\Entity\Session;
14+
use Chamilo\CoreBundle\Helpers\ResourceAclHelper;
1415
use Chamilo\CoreBundle\Settings\SettingsManager;
1516
use Chamilo\CourseBundle\Entity\CDocument;
1617
use Chamilo\CourseBundle\Entity\CGroup;
@@ -51,7 +52,8 @@ public function __construct(
5152
private Security $security,
5253
private RequestStack $requestStack,
5354
private SettingsManager $settingsManager,
54-
private EntityManagerInterface $entityManager
55+
private EntityManagerInterface $entityManager,
56+
private readonly ResourceAclHelper $resourceAclHelper,
5557
) {}
5658

5759
public static function getReaderMask(): int
@@ -445,75 +447,7 @@ protected function voteOnAttribute(string $attribute, $subject, TokenInterface $
445447
$rights[] = $resourceRight;
446448
}
447449

448-
// Asked mask
449-
$mask = new MaskBuilder();
450-
$mask->add($attribute);
451-
452-
$askedMask = (string) $mask->get();
453-
454-
// Creating roles
455-
// @todo move this in a service
456-
$anon = new GenericRole('IS_AUTHENTICATED_ANONYMOUSLY');
457-
$userRole = new GenericRole('ROLE_USER');
458-
$student = new GenericRole('ROLE_STUDENT');
459-
$teacher = new GenericRole('ROLE_TEACHER');
460-
$studentBoss = new GenericRole('ROLE_STUDENT_BOSS');
461-
462-
$currentStudent = new GenericRole(self::ROLE_CURRENT_COURSE_STUDENT);
463-
$currentTeacher = new GenericRole(self::ROLE_CURRENT_COURSE_TEACHER);
464-
465-
$currentStudentGroup = new GenericRole(self::ROLE_CURRENT_COURSE_GROUP_STUDENT);
466-
$currentTeacherGroup = new GenericRole(self::ROLE_CURRENT_COURSE_GROUP_TEACHER);
467-
468-
$currentStudentSession = new GenericRole(self::ROLE_CURRENT_COURSE_SESSION_STUDENT);
469-
$currentTeacherSession = new GenericRole(self::ROLE_CURRENT_COURSE_SESSION_TEACHER);
470-
471-
// Setting Simple ACL.
472-
$acl = (new Acl())
473-
->addRole($anon)
474-
->addRole($userRole)
475-
->addRole($student)
476-
->addRole($teacher)
477-
->addRole($studentBoss)
478-
479-
->addRole($currentStudent)
480-
->addRole($currentTeacher, self::ROLE_CURRENT_COURSE_STUDENT)
481-
482-
->addRole($currentStudentSession)
483-
->addRole($currentTeacherSession, self::ROLE_CURRENT_COURSE_SESSION_STUDENT)
484-
485-
->addRole($currentStudentGroup)
486-
->addRole($currentTeacherGroup, self::ROLE_CURRENT_COURSE_GROUP_STUDENT)
487-
;
488-
489-
// Add a security resource.
490-
$linkId = (string) $link->getId();
491-
$acl->addResource(new GenericResource($linkId));
492-
493-
// Check all the right this link has.
494-
// Set rights from the ResourceRight.
495-
foreach ($rights as $right) {
496-
$acl->allow($right->getRole(), null, (string) $right->getMask());
497-
}
498-
499-
// Anons can see.
500-
if ($allowAnonsToView) {
501-
$acl->allow($anon, null, (string) self::getReaderMask());
502-
}
503-
504-
if ($token instanceof NullToken) {
505-
return $acl->isAllowed('IS_AUTHENTICATED_ANONYMOUSLY', $linkId, $askedMask);
506-
}
507-
508-
$roles = $user instanceof UserInterface ? $user->getRoles() : [];
509-
510-
foreach ($roles as $role) {
511-
if ($acl->isAllowed($role, $linkId, $askedMask)) {
512-
return true;
513-
}
514-
}
515-
516-
return false;
450+
return $this->resourceAclHelper->isAllowed($attribute, $link, $rights, $allowAnonsToView);
517451
}
518452

519453
private function isBlogResource(ResourceNode $node): bool

0 commit comments

Comments
 (0)