2ac815d074
- Block SVG MIME type in TaskDocumentProcessor upload validation - Serve existing SVG files as attachment (defense-in-depth) in download controller - Block ROLE_CLIENT from uploading documents to tasks (only allowed via portal tickets) - Add Doctrine extension to filter projects by allowedProjects for ROLE_CLIENT Tickets: T-003, T-005, T-006 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
67 lines
2.1 KiB
PHP
67 lines
2.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Doctrine;
|
|
|
|
use ApiPlatform\Doctrine\Orm\Extension\QueryCollectionExtensionInterface;
|
|
use ApiPlatform\Doctrine\Orm\Extension\QueryItemExtensionInterface;
|
|
use ApiPlatform\Doctrine\Orm\Util\QueryNameGeneratorInterface;
|
|
use ApiPlatform\Metadata\Operation;
|
|
use App\Entity\Project;
|
|
use App\Entity\User;
|
|
use Doctrine\ORM\QueryBuilder;
|
|
use Symfony\Bundle\SecurityBundle\Security;
|
|
|
|
final readonly class ProjectAllowedExtension implements QueryCollectionExtensionInterface, QueryItemExtensionInterface
|
|
{
|
|
public function __construct(
|
|
private Security $security,
|
|
) {}
|
|
|
|
public function applyToCollection(QueryBuilder $queryBuilder, QueryNameGeneratorInterface $queryNameGenerator, string $resourceClass, ?Operation $operation = null, array $context = []): void
|
|
{
|
|
$this->addWhere($queryBuilder, $resourceClass);
|
|
}
|
|
|
|
public function applyToItem(QueryBuilder $queryBuilder, QueryNameGeneratorInterface $queryNameGenerator, string $resourceClass, array $identifiers, ?Operation $operation = null, array $context = []): void
|
|
{
|
|
$this->addWhere($queryBuilder, $resourceClass);
|
|
}
|
|
|
|
private function addWhere(QueryBuilder $queryBuilder, string $resourceClass): void
|
|
{
|
|
if (Project::class !== $resourceClass) {
|
|
return;
|
|
}
|
|
|
|
$user = $this->security->getUser();
|
|
|
|
if (!$user instanceof User) {
|
|
return;
|
|
}
|
|
|
|
// Only restrict for ROLE_CLIENT users who are NOT admins
|
|
if (!in_array('ROLE_CLIENT', $user->getRoles(), true) || in_array('ROLE_ADMIN', $user->getRoles(), true)) {
|
|
return;
|
|
}
|
|
|
|
$rootAlias = $queryBuilder->getRootAliases()[0];
|
|
|
|
$allowedProjectIds = $user->getAllowedProjects()->map(
|
|
fn (Project $project) => $project->getId(),
|
|
)->toArray();
|
|
|
|
if ([] === $allowedProjectIds) {
|
|
$queryBuilder->andWhere('1 = 0');
|
|
|
|
return;
|
|
}
|
|
|
|
$queryBuilder
|
|
->andWhere($rootAlias.'.id IN (:allowed_project_ids)')
|
|
->setParameter('allowed_project_ids', $allowedProjectIds)
|
|
;
|
|
}
|
|
}
|