diff --git a/src/Entity/Parts/PartAssociation.php b/src/Entity/Parts/PartAssociation.php index 2fe6975e..241b9542 100644 --- a/src/Entity/Parts/PartAssociation.php +++ b/src/Entity/Parts/PartAssociation.php @@ -23,12 +23,27 @@ declare(strict_types=1); namespace App\Entity\Parts; +use ApiPlatform\Doctrine\Orm\Filter\BooleanFilter; +use ApiPlatform\Doctrine\Orm\Filter\DateFilter; +use ApiPlatform\Doctrine\Orm\Filter\OrderFilter; +use ApiPlatform\Doctrine\Orm\Filter\RangeFilter; +use ApiPlatform\Metadata\ApiFilter; +use ApiPlatform\Metadata\ApiProperty; +use ApiPlatform\Metadata\ApiResource; +use ApiPlatform\Metadata\Delete; +use ApiPlatform\Metadata\Get; +use ApiPlatform\Metadata\GetCollection; +use ApiPlatform\Metadata\Patch; +use ApiPlatform\Metadata\Post; +use ApiPlatform\Serializer\Filter\PropertyFilter; +use App\ApiPlatform\Filter\LikeFilter; use App\Repository\DBElementRepository; use Doctrine\DBAL\Types\Types; use Doctrine\ORM\Mapping as ORM; use App\Entity\Base\AbstractDBElement; use App\Entity\Base\TimestampTrait; use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity; +use Symfony\Component\Serializer\Annotation\Groups; use Symfony\Component\Validator\Constraints as Assert; /** @@ -38,6 +53,21 @@ use Symfony\Component\Validator\Constraints as Assert; #[ORM\Entity(repositoryClass: DBElementRepository::class)] #[ORM\HasLifecycleCallbacks] #[UniqueEntity(fields: ['other', 'owner', 'type'], message: 'validator.part_association.already_exists')] +#[ApiResource( + operations: [ + new Get(security: 'is_granted("read", object)'), + new GetCollection(security: 'is_granted("@parts.read")'), + new Post(securityPostDenormalize: 'is_granted("create", object)'), + new Patch(security: 'is_granted("edit", object)'), + new Delete(security: 'is_granted("delete", object)'), + ], + normalizationContext: ['groups' => ['part_assoc:read', 'part_assoc:read:standalone', 'api:basic:read'], 'openapi_definition_name' => 'Read'], + denormalizationContext: ['groups' => ['part_assoc:write', 'api:basic:write'], 'openapi_definition_name' => 'Write'], +)] +#[ApiFilter(PropertyFilter::class)] +#[ApiFilter(LikeFilter::class, properties: ["other_type", "comment"])] +#[ApiFilter(DateFilter::class, strategy: DateFilter::EXCLUDE_NULL)] +#[ApiFilter(OrderFilter::class, properties: ['comment', 'addedDate', 'lastModified'])] class PartAssociation extends AbstractDBElement { use TimestampTrait; @@ -46,6 +76,7 @@ class PartAssociation extends AbstractDBElement * @var AssociationType The type of this association (how the two parts are related) */ #[ORM\Column(type: Types::SMALLINT, enumType: AssociationType::class)] + #[Groups('part_assoc:read', 'part_assoc:write')] protected AssociationType $type = AssociationType::OTHER; /** @@ -55,12 +86,14 @@ class PartAssociation extends AbstractDBElement #[ORM\Column(type: Types::STRING, length: 255, nullable: true)] #[Assert\Expression("this.getType().value !== 0 or this.getOtherType() !== null", message: 'validator.part_association.must_set_an_value_if_type_is_other')] + #[Groups('part_assoc:read', 'part_assoc:write')] protected ?string $other_type = null; /** * @var string|null A comment describing this association further. */ #[ORM\Column(type: Types::TEXT, nullable: true)] + #[Groups('part_assoc:read', 'part_assoc:write')] protected ?string $comment = null; /** @@ -69,6 +102,7 @@ class PartAssociation extends AbstractDBElement #[ORM\ManyToOne(targetEntity: Part::class, inversedBy: 'associated_parts_as_owner')] #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')] #[Assert\NotNull] + #[Groups('part_assoc:read', 'part_assoc:write', 'part_assoc:read:standalone')] protected ?Part $owner = null; /** @@ -79,6 +113,7 @@ class PartAssociation extends AbstractDBElement #[Assert\NotNull] #[Assert\Expression("this.getOwner() !== this.getOther()", message: 'validator.part_association.part_cannot_be_associated_with_itself')] + #[Groups('part_assoc:read', 'part_assoc:write')] protected ?Part $other = null; /** diff --git a/src/Entity/Parts/PartTraits/AssociationTrait.php b/src/Entity/Parts/PartTraits/AssociationTrait.php index 6cc1b973..48ffe761 100644 --- a/src/Entity/Parts/PartTraits/AssociationTrait.php +++ b/src/Entity/Parts/PartTraits/AssociationTrait.php @@ -27,6 +27,7 @@ use App\Entity\Parts\Part; use App\Entity\Parts\PartAssociation; use Doctrine\Common\Collections\ArrayCollection; use Doctrine\Common\Collections\Collection; +use Symfony\Component\Serializer\Annotation\Groups; use Symfony\Component\Validator\Constraints\Valid; use Doctrine\ORM\Mapping as ORM; @@ -38,6 +39,7 @@ trait AssociationTrait #[Valid] #[ORM\OneToMany(mappedBy: 'owner', targetEntity: PartAssociation::class, cascade: ['persist', 'remove'], orphanRemoval: true)] + #[Groups(['part:read', 'part:write'])] protected Collection $associated_parts_as_owner; /** @@ -46,6 +48,7 @@ trait AssociationTrait #[Valid] #[ORM\OneToMany(mappedBy: 'other', targetEntity: PartAssociation::class, cascade: ['persist', 'remove'], orphanRemoval: true)] + #[Groups(['part:read'])] protected Collection $associated_parts_as_other; /** diff --git a/src/Security/Voter/PartAssociationVoter.php b/src/Security/Voter/PartAssociationVoter.php new file mode 100644 index 00000000..e6e6abdb --- /dev/null +++ b/src/Security/Voter/PartAssociationVoter.php @@ -0,0 +1,104 @@ +. + */ + +declare(strict_types=1); + +/** + * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony). + * + * Copyright (C) 2019 - 2022 Jan Böhmer (https://github.com/jbtronics) + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published + * by the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + */ + +namespace App\Security\Voter; + +use App\Entity\Parts\PartAssociation; +use App\Services\UserSystem\VoterHelper; +use Symfony\Bundle\SecurityBundle\Security; +use App\Entity\Parts\Part; +use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; +use Symfony\Component\Security\Core\Authorization\Voter\Voter; + +/** + * This voter handles permissions for part associations. + * The permissions are inherited from the part. + */ +final class PartAssociationVoter extends Voter +{ + public function __construct(private readonly Security $security, private readonly VoterHelper $helper) + { + } + + protected const ALLOWED_PERMS = ['read', 'edit', 'create', 'delete', 'show_history', 'revert_element']; + + protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool + { + if (!is_string($subject) && !$subject instanceof PartAssociation) { + throw new \RuntimeException('Invalid subject type!'); + } + + $operation = match ($attribute) { + 'read' => 'read', + 'edit', 'create', 'delete' => 'edit', + 'show_history' => 'show_history', + 'revert_element' => 'revert_element', + default => throw new \RuntimeException('Encountered unknown operation "'.$attribute.'"!'), + }; + + //If we have no part associated use the generic part permission + if (is_string($subject) || !$subject->getOwner() instanceof Part) { + return $this->helper->isGranted($token, 'parts', $operation); + } + + //Otherwise vote on the part + return $this->security->isGranted($attribute, $subject->getOwner()); + } + + protected function supports($attribute, $subject): bool + { + if (is_a($subject, PartAssociation::class, true)) { + return in_array($attribute, self::ALLOWED_PERMS, true); + } + + return false; + } + + public function supportsType(string $subjectType): bool + { + return $subjectType === 'string' || is_a($subjectType, PartAssociation::class, true); + } + + public function supportsAttribute(string $attribute): bool + { + return in_array($attribute, self::ALLOWED_PERMS, true); + } +}