src/Security/InvoiceVoter.php line 11

Open in your IDE?
  1. <?php
  3. namespace App\Security;
  5. use App\Entity\Booking;
  6. use App\Entity\Invoice;
  7. use Doctrine\ORM\EntityManagerInterface;
  8. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  9. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  11. class InvoiceVoter extends Voter
  12. {
  13.     public const DOWNLOAD = 'download';
  15.     /**
  16.      * @var EntityManagerInterface
  17.      */
  18.     protected $entityManager;
  20.     public function __construct(EntityManagerInterface $entityManager)
  21.     {
  22.         $this->entityManager = $entityManager;
  23.     }
  25.     protected function supports($attribute, $subject): bool
  26.     {
  27.         return self::DOWNLOAD === $attribute && $subject instanceof Invoice;
  28.     }
  30.     protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
  31.     {
  32.         if (!$subject instanceof Invoice) {
  33.             return false;
  34.         }
  35.         /** @var Booking|null $booking */
  36.         $booking = $this->entityManager->getRepository(Booking::class)
  37.             ->findByInvoiceId($subject->getId());
  39.         if (!$booking) {
  40.             return false; // Invoice not related to a booking, shouldn't be accessible
  41.         }
  43.         return $booking->getUser() === $token->getUser();
  44.     }
  45. }