add security to UserSearchItem

sql/schema-extensions/003-view_search_user.sql

@@ -1,6 +1,7 @@
 CREATE OR REPLACE VIEW view_search_user AS
     SELECT
         a.id,
+        a.organization_id as organizationId,
         p.id AS personId,
         p.username,
         p.name,

src/Doctrine/Custom/Search/RestrictToOrganizationIdExtension.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Doctrine\Custom\Search;
+
+use ApiPlatform\Metadata\Operation;
+use App\Doctrine\AbstractExtension;
+use App\Entity\Access\Access;
+use App\Entity\Custom\Search\UserSearchItem;
+use App\Service\ServiceIterator\CurrentAccessExtensionIterator;
+use Doctrine\ORM\QueryBuilder;
+use Symfony\Bundle\SecurityBundle\Security;
+
+/**
+ * Filtre de sécurité pour les recherches
+ * Restreint les résultats à ceux de l'organization actuelle.
+ */
+final class RestrictToOrganizationIdExtension extends AbstractExtension
+{
+    public function __construct(
+        private readonly Security $security,
+    ) {}
+
+    public function supports(string $resourceClass, ?Operation $operation): bool
+    {
+        return $resourceClass === UserSearchItem::class;
+    }
+
+    protected function addWhere(QueryBuilder $queryBuilder, string $resourceClass, ?Operation $operation): void
+    {
+        /** @var Access $currentUser */
+        $currentUser = $this->security->getUser();
+        if ($currentUser === null || $currentUser->getOrganization() === null) {
+            return;
+        }
+        $rootAlias = $queryBuilder->getRootAliases()[0];
+        $queryBuilder
+            ->andWhere(sprintf('%s.organizationId = :organizationId', $rootAlias))
+            ->setParameter('organizationId', $currentUser->getOrganization()->getId())
+        ;
+    }
+}

src/Entity/Custom/Search/UserSearchItem.php

@@ -40,6 +40,9 @@ class UserSearchItem
     #[ORM\Column]
     private int $id;
 
+    #[ORM\Column(type: 'integer')]
+    private ?int $organizationId = null;
+
     #[ORM\Column(type: 'integer')]
     private ?int $personId = null;
 
@@ -66,6 +69,17 @@ class UserSearchItem
         return $this;
     }
 
+    public function getOrganizationId(): ?int
+    {
+        return $this->organizationId;
+    }
+
+    public function setOrganizationId(?int $organizationId): self
+    {
+        $this->organizationId = $organizationId;
+        return $this;
+    }
+
     public function getPersonId(): ?int
     {
         return $this->personId;