فهرست منبع

fix post merge errors with entities security

Olivier Massot 2 سال پیش
والد
کامیت
7428ac1b14

+ 15 - 1
src/ApiResources/Access/AdminAccess.php

@@ -17,7 +17,21 @@ use Symfony\Component\Validator\Constraints as Assert;
 /**
  * Classe resource qui contient les champs d'un compte admin
  */
-#[ApiResource(operations: [])]
+#[ApiResource(
+    operations: [
+        new Get(
+            uriTemplate: '/admin-access/{id}',
+            defaults: ['id' => 0]
+        ),
+        new Put(
+            uriTemplate: '/admin-access/{id}',
+            defaults: ['id' => 0],
+            security: '(is_granted("ROLE_ADMIN_CORE") and object.getOrganizationId() == user.getOrganization().getId() )'
+        )
+    ],
+    provider: AdminAccessProvider::class,
+    processor : AdminAccessProcessor::class
+)]
 class AdminAccess implements ApiResourcesInterface
 {
     #[ApiProperty(identifier: true)]

+ 19 - 1
src/Entity/Billing/ResidenceArea.php

@@ -24,7 +24,25 @@ use Doctrine\Common\Collections\Collection;
  *
  *     @see \App\Doctrine\Billing\CurrentResidenceAreaExtension
  */
-#[ApiResource(operations: [])] // @see App\Doctrine\Billing\CurrentResidenceAreaExtension
+#[ApiResource(
+    operations: [
+        new Get(
+            security: 'is_granted(\'ROLE_ORGANIZATION_VIEW\') and object.getBillingSetting().getOrganization().getId() == user.getOrganization().getId()'
+
+        ),
+        new Put(
+            security: 'object.getBillingSetting().getOrganization().getId() == user.getOrganization().getId()'
+        ),
+        new Delete(
+            security: 'object.getBillingSetting().getOrganization().getId() == user.getOrganization().getId()'
+        ),
+        new GetCollection(
+            security: 'is_granted(\'ROLE_ORGANIZATION_VIEW\')'
+        ),
+        new Post()
+    ],
+    security: 'is_granted(\'ROLE_ORGANIZATION\')'
+)]
 //#[Auditable]
 #[BillingSettingDefaultValue(fieldName: "billingSetting")]
 #[ORM\Entity(repositoryClass: ResidenceAreaRepository::class)]

+ 14 - 1
src/Entity/Education/Cycle.php

@@ -23,7 +23,20 @@ use Doctrine\Common\Collections\Collection;
  * Security :
  *   * @see App\Doctrine\Education\CurrentCycleExtension
  */
-#[ApiResource(operations: [])]
+#[ApiResource(
+    operations: [
+        new Get(
+            security: 'is_granted(\'ROLE_ORGANIZATION_VIEW\') and object.getOrganization().getId() == user.getOrganization().getId()'
+        ),
+        new Put(
+            security: 'object.getOrganization().getId() == user.getOrganization().getId()'
+        ),
+        new GetCollection(
+            security: 'is_granted(\'ROLE_ORGANIZATION_VIEW\')'
+        )
+    ],
+    security: 'is_granted(\'ROLE_ORGANIZATION\')'
+)]
 //#[Auditable]
 #[ORM\Entity(repositoryClass: CycleRepository::class)]
 class Cycle

+ 18 - 1
src/Entity/Education/EducationTiming.php

@@ -25,7 +25,24 @@ use Doctrine\Common\Collections\Collection;
  *
  *    @see \App\Doctrine\Education\CurrentEducationTimingExtension
  */
-#[ApiResource(operations: [])]
+#[ApiResource(
+    operations: [
+        new Get(
+            security: 'is_granted(\'ROLE_ORGANIZATION_VIEW\') and object.getOrganization().getId() == user.getOrganization().getId()'
+        ),
+        new Put(
+            security: 'object.getOrganization().getId() == user.getOrganization().getId()'
+        ),
+        new Delete(
+            security: 'object.getOrganization().getId() == user.getOrganization().getId()'
+        ),
+        new GetCollection(
+            security: 'is_granted(\'ROLE_ORGANIZATION_VIEW\')'
+        ),
+        new Post()
+    ],
+    security: 'is_granted(\'ROLE_ORGANIZATION\')'
+)]
 //#[Auditable]
 #[OrganizationDefaultValue(fieldName: "organization")]
 #[ORM\Entity(repositoryClass: EducationTimingRepository::class)]