jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

added domain logic for permission checks (#1803)

Browse Source
This commit is contained in:
Kevin Papst
2020-07-04 13:29:03 +02:00
committed by GitHub
parent 091740f407
commit 682681afa5
16 changed files with 39 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/Entity/Activity.php
View File

@@ -150,7 +150,6 @@ class Activity implements EntityWithMetaFields
}
/**
* @internal only here for symfony forms
* @return Collection|MetaTableTypeInterface[]
*/
public function getMetaFields(): Collection

1
src/Entity/Customer.php
View File

@@ -393,7 +393,6 @@ class Customer implements EntityWithMetaFields
}
/**
* @internal only here for symfony forms
* @return Collection|MetaTableTypeInterface[]
*/
public function getMetaFields(): Collection

1
src/Entity/EntityWithMetaFields.php
View File

@@ -14,7 +14,6 @@ use Doctrine\Common\Collections\Collection;
interface EntityWithMetaFields
{
/**
* @internal only here for symfony forms
* @return Collection|MetaTableTypeInterface[]
*/
public function getMetaFields(): Collection;

1
src/Entity/Project.php
View File

@@ -298,7 +298,6 @@ class Project implements EntityWithMetaFields
}
/**
* @internal only here for symfony forms
* @return Collection|MetaTableTypeInterface[]
*/
public function getMetaFields(): Collection

1
src/Entity/Timesheet.php
View File

@@ -509,7 +509,6 @@ class Timesheet implements EntityWithMetaFields, ExportItemInterface
}
/**
* @internal only here for symfony forms
* @return Collection|MetaTableTypeInterface[]
*/
public function getMetaFields(): Collection

10
src/Entity/User.php
View File

@@ -354,6 +354,11 @@ class User extends BaseUser implements UserInterface
$team->removeUser($this);
}
public function hasTeamAssignment(): bool
{
return !$this->getTeams()->isEmpty();
}
/**
* @return Collection<Team>
*/
@@ -372,6 +377,11 @@ class User extends BaseUser implements UserInterface
return $team->getTeamLead() === $this;
}
public function canSeeAllData(): bool
{
return $this->isSuperAdmin() || $this->isAdmin();
}
public function isTeamlead(): bool
{
return $this->hasRole(static::ROLE_TEAMLEAD);

2
src/EventSubscriber/AjaxAuthenticationSubscriber.php
View File

@@ -31,7 +31,7 @@ class AjaxAuthenticationSubscriber implements EventSubscriberInterface
$request = $event->getRequest();
if ($request->isXmlHttpRequest()) {
$exception = $event->getException();
$exception = $event->getThrowable();
if ($exception instanceof AuthenticationExpiredException) {
$event->setResponse(new Response('Session expired', 403, ['Login-Required' => true]));
} elseif ($exception instanceof AuthenticationException) {

2
src/Form/Type/TeamMemberType.php
View File

@@ -45,7 +45,7 @@ class TeamMemberType extends AbstractType
/** @var User $user */
$user = $options['user'];
if (null !== $user && !$user->getTeams()->isEmpty() && !$user->isSuperAdmin() && !$user->isAdmin()) {
if (null !== $user && $user->hasTeamAssignment() && !$user->canSeeAllData()) {
$qb
->leftJoin('u.teams', 'teams')
->leftJoin('teams.users', 'users')

2
src/Repository/ActivityRepository.php
View File

@@ -122,7 +122,7 @@ class ActivityRepository extends EntityRepository
}
// make sure that admins see all activities
if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
if (null !== $user && $user->canSeeAllData()) {
return;
}

2
src/Repository/CustomerRepository.php
View File

@@ -139,7 +139,7 @@ class CustomerRepository extends EntityRepository
}
// make sure that admins see all customers
if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
if (null !== $user && $user->canSeeAllData()) {
return;
}

2
src/Repository/InvoiceRepository.php
View File

@@ -92,7 +92,7 @@ class InvoiceRepository extends EntityRepository
}
// make sure that admins see all projects
if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
if (null !== $user && $user->canSeeAllData()) {
return;
}

2
src/Repository/ProjectRepository.php
View File

@@ -131,7 +131,7 @@ class ProjectRepository extends EntityRepository
}
// make sure that admins see all projects
if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
if (null !== $user && $user->canSeeAllData()) {
return;
}

2
src/Repository/TeamRepository.php
View File

@@ -174,7 +174,7 @@ class TeamRepository extends EntityRepository
}
// make sure that admins see all user
if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
if (null !== $user && $user->canSeeAllData()) {
return;
}

2
src/Repository/TimesheetRepository.php
View File

@@ -549,7 +549,7 @@ class TimesheetRepository extends EntityRepository
}
// make sure that admins see all timesheet records
if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
if (null !== $user && $user->canSeeAllData()) {
return;
}

2
src/Repository/UserRepository.php
View File

@@ -159,7 +159,7 @@ class UserRepository extends EntityRepository implements UserLoaderInterface
}
// make sure that admins see all user
if (null !== $user && ($user->isSuperAdmin() || $user->isAdmin())) {
if (null !== $user && $user->canSeeAllData()) {
return;
}

20
tests/Entity/UserTest.php
View File

@@ -32,6 +32,8 @@ class UserTest extends TestCase
self::assertNull($user->getApiToken());
self::assertNull($user->getPlainApiToken());
self::assertEquals(User::DEFAULT_LANGUAGE, $user->getLocale());
self::assertFalse($user->hasTeamAssignment());
self::assertFalse($user->canSeeAllData());
$user->setAvatar('https://www.gravatar.com/avatar/00000000000000000000000000000000?d=retro&f=y');
self::assertEquals('https://www.gravatar.com/avatar/00000000000000000000000000000000?d=retro&f=y', $user->getAvatar());
@@ -145,6 +147,7 @@ class UserTest extends TestCase
self::assertCount(1, $sut->getTeams());
self::assertSame($team, $sut->getTeams()[0]);
self::assertSame($sut, $team->getUsers()[0]);
self::assertTrue($sut->hasTeamAssignment());
self::assertFalse($sut->isTeamleadOf($team));
self::assertTrue($sut->isInTeam($team));
@@ -160,18 +163,35 @@ class UserTest extends TestCase
self::assertCount(2, $sut->getTeams());
$sut->removeTeam($team);
self::assertCount(1, $sut->getTeams());
self::assertTrue($sut->hasTeamAssignment());
$sut->removeTeam($team2);
self::assertCount(0, $sut->getTeams());
self::assertFalse($sut->hasTeamAssignment());
}
public function testRoles()
{
$sut = new User();
self::assertFalse($sut->canSeeAllData());
self::assertFalse($sut->isAdmin());
self::assertFalse($sut->isTeamlead());
$sut->addRole(User::ROLE_ADMIN);
self::assertTrue($sut->canSeeAllData());
self::assertTrue($sut->isAdmin());
self::assertFalse($sut->isTeamlead());
$sut->addRole(User::ROLE_TEAMLEAD);
self::assertTrue($sut->isTeamlead());
$sut->removeRole(User::ROLE_ADMIN);
self::assertFalse($sut->canSeeAllData());
self::assertFalse($sut->isAdmin());
$sut->addRole(User::ROLE_SUPER_ADMIN);
self::assertTrue($sut->canSeeAllData());
self::assertFalse($sut->isAdmin());
self::assertTrue($sut->isSuperAdmin());
}
/**