src/Security/Voter/Content/ContentVoter.php line 11

Open in your IDE?
  1. <?php
  3. namespace App\Security\Voter\Content;
  5. use App\Entity\Content;
  6. use App\Security\ApiUser;
  7. use App\Service\Content\MemberContentService;
  8. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  9. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. class ContentVoter extends Voter
  12. {
  13.     public const PERMISSION_EDIT = 'edit';
  14.     public const PERMISSION_DELETE = 'delete';
  15.     public const PERMISSION_COMMENT = 'comment';
  16.     public const PERMISSION_WATCH = 'watch';
  18.     protected MemberContentService $memberContentService;
  20.     public function __construct(MemberContentService $memberContentService)
  21.     {
  22.         $this->memberContentService = $memberContentService;
  23.     }
  25.     protected function supports(string $attribute, $subject): bool
  26.     {
  27.         if (!$subject instanceof Content) {
  28.             return false;
  29.         }
  31.         return in_array($attribute, [
  32.             self::PERMISSION_EDIT,
  33.             self::PERMISSION_DELETE,
  34.             self::PERMISSION_COMMENT,
  35.             self::PERMISSION_WATCH,
  36.         ], true);
  37.     }
  39.     protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
  40.     {
  41.         $user = $token->getUser();
  43.         if (!$user instanceof ApiUser || !$subject instanceof Content) {
  44.             return false;
  45.         }
  47.         // Allow watch only when video was bought - even for admins!
  48.         if (self::PERMISSION_WATCH === $attribute) {
  49.             return $this->memberContentService->hasMemberPurchasedContent($subject, $user->getMember());
  50.         }
  52.         if ($user->getIsAdmin()) {
  53.             return true;
  54.         }
  56.         switch ($attribute) {
  57.             case self::PERMISSION_COMMENT:
  58.                 return $this->memberContentService->hasMemberPurchasedContent($subject, $user->getMember());
  59.             default:
  60.                 return $this->canEdit($subject, $user);
  61.         }
  62.     }
  64.     protected function canEdit(Content $subject, ApiUser $user): bool
  65.     {
  66.         return $user->getMember()->getId() == $subject->getMember()->getId();
  67.     }
  68. }