<?php
namespace App\Security\Voter;
use Menke\UserBundle\Entity\Client;
use Menke\UserBundle\Entity\User;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
/**
* Security voter to grant backend access by client.
*
* @package Menke\UserBundle\Security\Voter
*/
class FrontendClientVoter extends Voter
{
/** @var AccessDecisionManagerInterface */
protected $decisionManager;
/**
* ClientVoter constructor.
* @param AccessDecisionManagerInterface $decisionManager
*/
public function __construct(AccessDecisionManagerInterface $decisionManager)
{
$this->decisionManager = $decisionManager;
}
/**
* @return bool
*/
protected function supports($attribute, $subject)
{
return $attribute === 'frontend_client_allowed';
}
/**
* @return bool
*/
protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
{
$user = $token->getUser();
if (!$subject instanceof Client) {
return false;
}
$client = null;
if ($user instanceof User) {
$client = $user->getClient();
} else {
$client = $user->getApplicationClient();
}
if (!$client) {
return false;
}
if ($this->decisionManager->decide($token, array('ROLE_SUPER_USER'))) {
return true;
}
if (!$subject->getClient() instanceof Client) {
return false;
}
if ($client->getId() === $subject->getClient()->getId()) {
return true;
}
return false;
}
}