added domain logic for permission checks (#1803)

src/Entity/Activity.php

@@ -150,7 +150,6 @@ class Activity implements EntityWithMetaFields
     }
 
     /**
-     * @internal only here for symfony forms
      * @return Collection|MetaTableTypeInterface[]
      */
     public function getMetaFields(): Collection

src/Entity/Customer.php

@@ -393,7 +393,6 @@ class Customer implements EntityWithMetaFields
     }
 
     /**
-     * @internal only here for symfony forms
      * @return Collection|MetaTableTypeInterface[]
      */
     public function getMetaFields(): Collection

src/Entity/EntityWithMetaFields.php

@@ -14,7 +14,6 @@ use Doctrine\Common\Collections\Collection;
 interface EntityWithMetaFields
 {
     /**
-     * @internal only here for symfony forms
      * @return Collection|MetaTableTypeInterface[]
      */
     public function getMetaFields(): Collection;

src/Entity/Project.php

@@ -298,7 +298,6 @@ class Project implements EntityWithMetaFields
     }
 
     /**
-     * @internal only here for symfony forms
      * @return Collection|MetaTableTypeInterface[]
      */
     public function getMetaFields(): Collection

src/Entity/Timesheet.php

@@ -509,7 +509,6 @@ class Timesheet implements EntityWithMetaFields, ExportItemInterface
     }
 
     /**
-     * @internal only here for symfony forms
      * @return Collection|MetaTableTypeInterface[]
      */
     public function getMetaFields(): Collection

src/Entity/User.php

@@ -354,6 +354,11 @@ class User extends BaseUser implements UserInterface
         $team->removeUser($this);
     }
 
+    public function hasTeamAssignment(): bool
+    {
+        return !$this->getTeams()->isEmpty();
+    }
+
     /**
      * @return Collection<Team>
      */
@@ -372,6 +377,11 @@ class User extends BaseUser implements UserInterface
         return $team->getTeamLead() === $this;
     }
 
+    public function canSeeAllData(): bool
+    {
+        return $this->isSuperAdmin() || $this->isAdmin();
+    }
+
     public function isTeamlead(): bool
     {
         return $this->hasRole(static::ROLE_TEAMLEAD);

src/EventSubscriber/AjaxAuthenticationSubscriber.php

@@ -31,7 +31,7 @@ class AjaxAuthenticationSubscriber implements EventSubscriberInterface
         $request = $event->getRequest();
 
         if ($request->isXmlHttpRequest()) {
-            $exception = $event->getException();
+            $exception = $event->getThrowable();
             if ($exception instanceof AuthenticationExpiredException) {
                 $event->setResponse(new Response('Session expired', 403, ['Login-Required' => true]));
             } elseif ($exception instanceof AuthenticationException) {

src/Form/Type/TeamMemberType.php

@@ -45,7 +45,7 @@ class TeamMemberType extends AbstractType
                 /** @var User $user */
                 $user = $options['user'];
 
-                if (null !== $user && !$user->getTeams()->isEmpty() && !$user->isSuperAdmin() && !$user->isAdmin()) {
+                if (null !== $user && $user->hasTeamAssignment() && !$user->canSeeAllData()) {
                     $qb
                         ->leftJoin('u.teams', 'teams')
                         ->leftJoin('teams.users', 'users')

src/Repository/ActivityRepository.php

@@ -122,7 +122,7 @@ class ActivityRepository extends EntityRepository
         }
 
         // make sure that admins see all activities
-        if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
+        if (null !== $user && $user->canSeeAllData()) {
             return;
         }
 

src/Repository/CustomerRepository.php

@@ -139,7 +139,7 @@ class CustomerRepository extends EntityRepository
         }
 
         // make sure that admins see all customers
-        if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
+        if (null !== $user && $user->canSeeAllData()) {
             return;
         }
 

src/Repository/InvoiceRepository.php

@@ -92,7 +92,7 @@ class InvoiceRepository extends EntityRepository
         }
 
         // make sure that admins see all projects
-        if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
+        if (null !== $user && $user->canSeeAllData()) {
             return;
         }
 

src/Repository/ProjectRepository.php

@@ -131,7 +131,7 @@ class ProjectRepository extends EntityRepository
         }
 
         // make sure that admins see all projects
-        if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
+        if (null !== $user && $user->canSeeAllData()) {
             return;
         }
 

src/Repository/TeamRepository.php

@@ -174,7 +174,7 @@ class TeamRepository extends EntityRepository
         }
 
         // make sure that admins see all user
-        if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
+        if (null !== $user && $user->canSeeAllData()) {
             return;
         }
 

src/Repository/TimesheetRepository.php

@@ -549,7 +549,7 @@ class TimesheetRepository extends EntityRepository
         }
 
         // make sure that admins see all timesheet records
-        if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
+        if (null !== $user && $user->canSeeAllData()) {
             return;
         }
 

src/Repository/UserRepository.php

@@ -159,7 +159,7 @@ class UserRepository extends EntityRepository implements UserLoaderInterface
         }
 
         // make sure that admins see all user
-        if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
+        if (null !== $user && $user->canSeeAllData()) {
             return;
         }
 

tests/Entity/UserTest.php

@@ -32,6 +32,8 @@ class UserTest extends TestCase
         self::assertNull($user->getApiToken());
         self::assertNull($user->getPlainApiToken());
         self::assertEquals(User::DEFAULT_LANGUAGE, $user->getLocale());
+        self::assertFalse($user->hasTeamAssignment());
+        self::assertFalse($user->canSeeAllData());
 
         $user->setAvatar('https://www.gravatar.com/avatar/00000000000000000000000000000000?d=retro&f=y');
         self::assertEquals('https://www.gravatar.com/avatar/00000000000000000000000000000000?d=retro&f=y', $user->getAvatar());
@@ -145,6 +147,7 @@ class UserTest extends TestCase
         self::assertCount(1, $sut->getTeams());
         self::assertSame($team, $sut->getTeams()[0]);
         self::assertSame($sut, $team->getUsers()[0]);
+        self::assertTrue($sut->hasTeamAssignment());
 
         self::assertFalse($sut->isTeamleadOf($team));
         self::assertTrue($sut->isInTeam($team));
@@ -160,18 +163,35 @@ class UserTest extends TestCase
         self::assertCount(2, $sut->getTeams());
         $sut->removeTeam($team);
         self::assertCount(1, $sut->getTeams());
+        self::assertTrue($sut->hasTeamAssignment());
         $sut->removeTeam($team2);
         self::assertCount(0, $sut->getTeams());
+        self::assertFalse($sut->hasTeamAssignment());
     }
 
     public function testRoles()
     {
         $sut = new User();
+        self::assertFalse($sut->canSeeAllData());
+        self::assertFalse($sut->isAdmin());
         self::assertFalse($sut->isTeamlead());
+
         $sut->addRole(User::ROLE_ADMIN);
+        self::assertTrue($sut->canSeeAllData());
+        self::assertTrue($sut->isAdmin());
         self::assertFalse($sut->isTeamlead());
+
         $sut->addRole(User::ROLE_TEAMLEAD);
         self::assertTrue($sut->isTeamlead());
+
+        $sut->removeRole(User::ROLE_ADMIN);
+        self::assertFalse($sut->canSeeAllData());
+        self::assertFalse($sut->isAdmin());
+
+        $sut->addRole(User::ROLE_SUPER_ADMIN);
+        self::assertTrue($sut->canSeeAllData());
+        self::assertFalse($sut->isAdmin());
+        self::assertTrue($sut->isSuperAdmin());
     }
 
     /**