src/Security/Core/SessionAccessVoter.php line 22

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace App\Security\Core;
  7. use App\Entity\Core\ActivitySessionInterface;
  8. use App\Entity\User\User;
  9. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  10. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  12. /**
  13. * Controls read and edit access to activity sessions (QuizSession, DictateSession, ReadingTestSession).
  14. *
  15. * A teacher may view or edit a session if:
  16. * - they created the session (createdBy), OR
  17. * - they are listed as a teacher in the session's classroom (classroom_teacher).
  18. *
  19. * This allows supervisors to create folders/sessions and assign them to classrooms
  20. * without blocking the classroom's teachers from viewing results or updating sessions.
  21. */
  22. class SessionAccessVoter extends Voter
  23. {
  24. public const string SESSION_VIEW = 'SESSION_VIEW';
  25. public const string SESSION_EDIT = 'SESSION_EDIT';
  27. private const array SUPPORTED_ATTRIBUTES = [self::SESSION_VIEW, self::SESSION_EDIT];
  29. /**
  30. *
  31. * @param string $attribute
  32. * @param mixed $subject
  33. *
  34. * @return bool
  35. */
  36. protected function supports(string $attribute, mixed $subject): bool
  37. {
  38. return in_array($attribute, self::SUPPORTED_ATTRIBUTES, true)
  39. && $subject instanceof ActivitySessionInterface;
  40. }
  42. /**
  43. * Perform a single access check operation on a given attribute, subject and token.
  44. * It is safe to assume that $attribute and $subject already passed the "supports()" method check.
  45. *
  46. * @param string $attribute
  47. * @param mixed $subject
  48. * @param TokenInterface $token
  49. * @return bool
  50. */
  51. protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
  52. {
  53. $user = $token->getUser();
  55. if (!$user instanceof User) {
  56. return false;
  57. }
  59. /** @var ActivitySessionInterface $subject */
  61. // The session creator always has access.
  62. if ($subject->getCreatedBy()?->getId() === $user->getId()) {
  63. return true;
  64. }
  66. // Any teacher associated with the session's classroom also has access.
  67. // Classroom::hasTeacher() checks the classroom_teacher join table by user ID.
  68. $classroom = $subject->getClassroom();
  70. return $classroom !== null && $classroom->hasTeacher($user);
  71. }
  72. }