ERP/SecurityBundle/EventListener/DenyAccessListener.php line 59

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace ERP\SecurityBundle\EventListener;
  7. use ApiPlatform\Core\Exception\ResourceClassNotFoundException;
  8. use ApiPlatform\Core\Metadata\Resource\Factory\ResourceMetadataFactoryInterface;
  9. use ApiPlatform\Core\Security\ExpressionLanguage;
  10. use ApiPlatform\Core\Security\ResourceAccessChecker;
  11. use ApiPlatform\Core\Security\ResourceAccessCheckerInterface;
  12. use ApiPlatform\Core\Util\RequestAttributesExtractor;
  13. use ERP\SecurityBundle\Services\RoleHierarchyService;
  14. use Symfony\Component\HttpKernel\Event\RequestEvent;
  15. use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolverInterface;
  16. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  17. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  18. use Symfony\Component\Security\Core\Exception\AccessDeniedException;
  19. use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
  21. /**
  22.  * Denies access to the current resource if the logged user doesn't have sufficient permissions.
  23.  */
  24. final class DenyAccessListener
  25. {
  26.     private $resourceMetadataFactory;
  27.     private $resourceAccessChecker;
  28.     /**
  29.      * @var RoleHierarchyService
  30.      */
  31.     private $roleHierarchyService;
  33.     public function __construct(
  34.         ResourceMetadataFactoryInterface $resourceMetadataFactory,
  35.         RoleHierarchyService $roleHierarchyService,
  36.         /* ResourceAccessCheckerInterface */ $resourceAccessCheckerOrExpressionLanguage = null,
  37.         AuthenticationTrustResolverInterface $authenticationTrustResolver = null,
  38.         RoleHierarchyInterface $roleHierarchy = null,
  39.         TokenStorageInterface $tokenStorage = null,
  40.         AuthorizationCheckerInterface $authorizationChecker = null)
  41.     {
  42.         $this->resourceMetadataFactory = $resourceMetadataFactory;
  43.         $this->roleHierarchyService = $roleHierarchyService;
  45.         if ($resourceAccessCheckerOrExpressionLanguage instanceof ResourceAccessCheckerInterface) {
  46.             $this->resourceAccessChecker = $resourceAccessCheckerOrExpressionLanguage;
  48.             return;
  49.         }
  50.         $this->resourceAccessChecker = new ResourceAccessChecker($resourceAccessCheckerOrExpressionLanguage, $authenticationTrustResolver, $roleHierarchy, $tokenStorage, $authorizationChecker);
  51.         @trigger_error(sprintf('Passing an instance of "%s" or null as second argument of "%s" is deprecated since API Platform 2.2 and will not be possible anymore in API Platform 3. Pass an instance of "%s" and no extra argument instead.', ExpressionLanguage::class, self::class, ResourceAccessCheckerInterface::class), E_USER_DEPRECATED);
  52.     }
  54.     /**
  55.      * Sets the applicable format to the HttpFoundation Request.
  56.      *
  57.      * @throws ResourceClassNotFoundException
  58.      */
  59.     public function onKernelRequest(RequestEvent $event): void
  60.     {
  61.         $request = $event->getRequest();
  63.         if (!$attributes = RequestAttributesExtractor::extractAttributes($request)) {
  64.             return;
  65.         }
  67.         $resourceMetadata = $this->resourceMetadataFactory->create($attributes['resource_class']);
  69.         $metaAccess = $resourceMetadata->getOperationAttribute($attributes, 'access_control', null, true);
  71.         if ('/api/' !== substr($request->getPathInfo(), 0, 5)) {
  72.             // return;
  73.         }
  75.         if (null === $metaAccess) {
  76.             try {
  77.                 $attribute = $this->roleHierarchyService->getOperationAccessAttribute($attributes['resource_class']);
  78.                 $isGranted = "is_granted('{$attribute}')";
  79.             } catch (\InvalidArgumentException $exception) {
  80.                 $isGranted = null;
  81.             }
  83.             if (null === $isGranted) {
  84.                 return;
  85.             }
  87.             $extraVariables = $request->attributes->all();
  88.             $extraVariables['object'] = $request->attributes->get('data');
  89.             $extraVariables['request'] = $request;
  91.             if (isset($extraVariables['_route_params']) && isset($extraVariables['_route_params']['_api_extra_access_control'])) {
  92.                 switch ($extraVariables['_route_params']['_api_extra_access_control']) {
  93.                     case 'IS_AUTHENTICATED_ANONYMOUSLY':
  94.                         return;
  95.                 }
  96.             }
  98.             $access = $this->resourceAccessChecker->isGranted($attributes['resource_class'], $isGranted, $extraVariables);
  100.             if (!$access) {
  101.                 throw new AccessDeniedException((string) $resourceMetadata->getOperationAttribute($attributes, 'access_control_message', 'Access Denied.', true));
  102.             }
  103.         }
  104.     }
  105. }