added voter for customer, project and activity #34 (#39)

src/AppBundle/Voter/UserVoter.php

@@ -23,9 +23,11 @@ class UserVoter extends AbstractVoter
 {
     const VIEW = 'view';
     const EDIT = 'edit';
+    const CREATE = 'create';
     const DELETE = 'delete';
     const PASSWORD = 'password';
     const ROLES = 'roles';
+    const VIEW_ALL = 'view_all';
 
     /**
      * @param string $attribute
@@ -34,7 +36,7 @@ class UserVoter extends AbstractVoter
      */
     protected function supports($attribute, $subject)
     {
-        if (!in_array($attribute, array(self::VIEW, self::EDIT, self::ROLES, self::PASSWORD, self::DELETE))) {
+        if (!in_array($attribute, [self::VIEW, self::VIEW_ALL, self::EDIT, self::CREATE, self::ROLES, self::PASSWORD, self::DELETE])) {
             return false;
         }
 
@@ -65,9 +67,13 @@ class UserVoter extends AbstractVoter
             case self::EDIT:
             case self::PASSWORD:
                 return $this->canEdit($subject, $user, $token);
+            case self::VIEW_ALL:
+            case self::CREATE:
+                // create actually passes in the current user as $subject, not the new one
             case self::DELETE:
+                // if we ever allow to delete user for ADMIN we have to check if the user to be deleted is not in a higher level
             case self::ROLES:
-                return $this->canEditRoles($token);
+                return $this->canAdminUsers($token);
         }
 
         return false;
@@ -78,7 +84,7 @@ class UserVoter extends AbstractVoter
      * @param User $user
      * @return bool
      */
-    private function canView(User $profile, User $user, TokenInterface $token)
+    protected function canView(User $profile, User $user, TokenInterface $token)
     {
         if ($this->canEdit($profile, $user, $token)) {
             return true;
@@ -92,9 +98,9 @@ class UserVoter extends AbstractVoter
      * @param User $user
      * @return bool
      */
-    private function canEdit(User $profile, User $user, TokenInterface $token)
+    protected function canEdit(User $profile, User $user, TokenInterface $token)
     {
-        if ($this->canEditRoles($token)) {
+        if ($this->canAdminUsers($token)) {
             return true;
         }
 
@@ -105,7 +111,7 @@ class UserVoter extends AbstractVoter
      * @param TokenInterface $token
      * @return bool
      */
-    private function canEditRoles(TokenInterface $token)
+    protected function canAdminUsers(TokenInterface $token)
     {
         return $this->hasRole('ROLE_SUPER_ADMIN', $token);
     }