jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

API methods to handle teams and users (#1384)

Browse Source
This commit is contained in:
Kevin Papst
2020-01-28 22:28:31 +01:00
committed by GitHub
parent a31e027c54
commit 836a530b86
24 changed files with 1525 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

492
src/API/TeamController.php
View File

@@ -11,8 +11,15 @@ declare(strict_types=1);
namespace App\API;
use App\Entity\Customer;
use App\Entity\Project;
use App\Entity\Team;
use App\Entity\User;
use App\Form\API\TeamApiEditForm;
use App\Repository\CustomerRepository;
use App\Repository\ProjectRepository;
use App\Repository\TeamRepository;
use App\Repository\UserRepository;
use FOS\RestBundle\Controller\Annotations\RouteResource;
use FOS\RestBundle\Request\ParamFetcherInterface;
use FOS\RestBundle\View\View;
@@ -20,23 +27,25 @@ use FOS\RestBundle\View\ViewHandlerInterface;
use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
use Swagger\Annotations as SWG;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
/**
* @RouteResource("Team")
*
* @Security("is_granted('IS_AUTHENTICATED_REMEMBERED')")
*/
class TeamController extends BaseApiController
final class TeamController extends BaseApiController
{
/**
* @var TeamRepository
*/
protected $repository;
private $repository;
/**
* @var ViewHandlerInterface
*/
protected $viewHandler;
private $viewHandler;
public function __construct(ViewHandlerInterface $viewHandler, TeamRepository $repository)
{
@@ -135,4 +144,481 @@ class TeamController extends BaseApiController
return $this->viewHandler->handle($view);
}
/**
* Creates a new team
*
* @SWG\Post(
* description="Creates a new team and returns it afterwards",
* @SWG\Response(
* response=200,
* description="Returns the new created team",
* @SWG\Schema(ref="#/definitions/TeamEntity",),
* )
* )
* @SWG\Parameter(
* name="body",
* in="body",
* required=true,
* @SWG\Schema(ref="#/definitions/TeamEditForm")
* )
*
* @Security("is_granted('create_team')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function postAction(Request $request): Response
{
$team = new Team();
$team->setTeamLead($this->getUser());
$form = $this->createForm(TeamApiEditForm::class, $team);
$form->submit($request->request->all());
$team->addUser($team->getTeamLead());
if ($form->isValid()) {
$this->repository->saveTeam($team);
$view = new View($team, 200);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
$view = new View($form);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
/**
* Update an existing team
*
* @SWG\Patch(
* description="Update an existing team, you can pass all or just a subset of all attributes (passing users will replace all existing ones)",
* @SWG\Response(
* response=200,
* description="Returns the updated team",
* @SWG\Schema(ref="#/definitions/TeamEntity")
* )
* )
* @SWG\Parameter(
* name="body",
* in="body",
* required=true,
* @SWG\Schema(ref="#/definitions/TeamEditForm")
* )
* @SWG\Parameter(
* name="id",
* in="path",
* type="integer",
* description="Team ID to update",
* required=true,
* )
*
* @Security("is_granted('edit_team')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function patchAction(Request $request, int $id): Response
{
$team = $this->repository->find($id);
if (null === $team) {
throw new NotFoundException();
}
$form = $this->createForm(TeamApiEditForm::class, $team);
$form->setData($team);
$form->submit($request->request->all(), false);
$team->addUser($team->getTeamLead());
if (false === $form->isValid()) {
$view = new View($form, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
$this->repository->saveTeam($team);
$view = new View($team, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
/**
* Add a new member to a team
*
* @SWG\Post(
* @SWG\Response(
* response=200,
* description="Adds a new user to a team. The user must not be deactivated.",
* @SWG\Schema(ref="#/definitions/TeamEntity")
* )
* )
* @SWG\Parameter(
* name="id",
* in="path",
* type="integer",
* description="The team which will receive the new member",
* required=true,
* )
* @SWG\Parameter(
* name="userId",
* in="path",
* type="integer",
* description="The team member to add (User ID)",
* required=true,
* )
*
* @Security("is_granted('edit_team')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function postMemberAction(int $id, int $userId, UserRepository $repository): Response
{
$team = $this->repository->find($id);
if (null === $team) {
throw new NotFoundException('Team not found');
}
/** @var User $user */
$user = $repository->find($userId);
if (null === $user) {
throw new NotFoundException('User not found');
}
if (!$user->isEnabled()) {
throw new BadRequestHttpException('Cannot add disabled user to team');
}
if ($user->isInTeam($team)) {
throw new BadRequestHttpException('User is already member of the team');
}
$team->addUser($user);
$this->repository->saveTeam($team);
$view = new View($team, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
/**
* Removes a member from the team
*
* @SWG\Delete(
* @SWG\Response(
* response=200,
* description="Removes a user from the team. The teamlead cannot be removed.",
* @SWG\Schema(ref="#/definitions/TeamEntity")
* )
* )
* @SWG\Parameter(
* name="id",
* in="path",
* type="integer",
* description="The team from which the member will be removed",
* required=true,
* )
* @SWG\Parameter(
* name="userId",
* in="path",
* type="integer",
* description="The team member to remove (User ID)",
* required=true,
* )
*
* @Security("is_granted('edit_team')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function deleteMemberAction(int $id, int $userId, UserRepository $repository): Response
{
$team = $this->repository->find($id);
if (null === $team) {
throw new NotFoundException('Team not found');
}
/** @var User $user */
$user = $repository->find($userId);
if (null === $user) {
throw new NotFoundException('User not found');
}
if (!$user->isInTeam($team)) {
throw new BadRequestHttpException('User is not a member of the team');
}
if ($team->isTeamlead($user)) {
throw new BadRequestHttpException('Cannot remove teamlead');
}
$team->removeUser($user);
$this->repository->saveTeam($team);
$view = new View($team, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
/**
* Grant the team access to a customer
*
* @SWG\Post(
* @SWG\Response(
* response=200,
* description="Adds a new customer to a team. The customer must not be invisible.",
* @SWG\Schema(ref="#/definitions/TeamEntity")
* )
* )
* @SWG\Parameter(
* name="id",
* in="path",
* type="integer",
* description="The team that is granted access",
* required=true,
* )
* @SWG\Parameter(
* name="customerId",
* in="path",
* type="integer",
* description="The customer to grant acecess to (Customer ID)",
* required=true,
* )
*
* @Security("is_granted('edit_team')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function postCustomerAction(int $id, int $customerId, CustomerRepository $repository): Response
{
$team = $this->repository->find($id);
if (null === $team) {
throw new NotFoundException('Team not found');
}
/** @var Customer $customer */
$customer = $repository->find($customerId);
if (null === $customer) {
throw new NotFoundException('Customer not found');
}
if (!$customer->isVisible()) {
throw new BadRequestHttpException('Cannot grant access to an invisible customer');
}
if ($team->hasCustomer($customer)) {
throw new BadRequestHttpException('Team has already access to customer');
}
$team->addCustomer($customer);
$this->repository->saveTeam($team);
$view = new View($team, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
/**
* Revokes access for a customer from a team
*
* @SWG\Delete(
* @SWG\Response(
* response=200,
* description="Removes a customer from the team.",
* @SWG\Schema(ref="#/definitions/TeamEntity")
* )
* )
* @SWG\Parameter(
* name="id",
* in="path",
* type="integer",
* description="The team whose permission will be revoked",
* required=true,
* )
* @SWG\Parameter(
* name="customerId",
* in="path",
* type="integer",
* description="The customer to remove (Customer ID)",
* required=true,
* )
*
* @Security("is_granted('edit_team')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function deleteCustomerAction(int $id, int $customerId, CustomerRepository $repository): Response
{
$team = $this->repository->find($id);
if (null === $team) {
throw new NotFoundException('Team not found');
}
/** @var Customer $customer */
$customer = $repository->find($customerId);
if (null === $customer) {
throw new NotFoundException('Customer not found');
}
if (!$team->hasCustomer($customer)) {
throw new BadRequestHttpException('Customer is not assigned to the team');
}
$team->removeCustomer($customer);
$this->repository->saveTeam($team);
$view = new View($team, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
/**
* Grant the team access to a project
*
* @SWG\Post(
* @SWG\Response(
* response=200,
* description="Adds a new project to a team. The project must not be invisible.",
* @SWG\Schema(ref="#/definitions/TeamEntity")
* )
* )
* @SWG\Parameter(
* name="id",
* in="path",
* type="integer",
* description="The team that is granted access",
* required=true,
* )
* @SWG\Parameter(
* name="projectId",
* in="path",
* type="integer",
* description="The project to grant acecess to (Project ID)",
* required=true,
* )
*
* @Security("is_granted('edit_team')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function postProjectAction(int $id, int $projectId, ProjectRepository $repository): Response
{
$team = $this->repository->find($id);
if (null === $team) {
throw new NotFoundException('Team not found');
}
/** @var Project $project */
$project = $repository->find($projectId);
if (null === $project) {
throw new NotFoundException('Project not found');
}
if (!$project->isVisible()) {
throw new BadRequestHttpException('Cannot grant access to an invisible project');
}
if ($team->hasProject($project)) {
throw new BadRequestHttpException('Team has already access to project');
}
$team->addProject($project);
$this->repository->saveTeam($team);
$view = new View($team, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
/**
* Revokes access for a project from a team
*
* @SWG\Delete(
* @SWG\Response(
* response=200,
* description="Removes a project from the team.",
* @SWG\Schema(ref="#/definitions/TeamEntity")
* )
* )
* @SWG\Parameter(
* name="id",
* in="path",
* type="integer",
* description="The team whose permission will be revoked",
* required=true,
* )
* @SWG\Parameter(
* name="projectId",
* in="path",
* type="integer",
* description="The project to remove (Project ID)",
* required=true,
* )
*
* @Security("is_granted('edit_team')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function deleteProjectAction(int $id, int $projectId, ProjectRepository $repository): Response
{
$team = $this->repository->find($id);
if (null === $team) {
throw new NotFoundException('Team not found');
}
/** @var Project $project */
$project = $repository->find($projectId);
if (null === $project) {
throw new NotFoundException('Project not found');
}
if (!$team->hasProject($project)) {
throw new BadRequestHttpException('Project is not assigned to the team');
}
$team->removeProject($project);
$this->repository->saveTeam($team);
$view = new View($team, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'Team_Entity']);
return $this->viewHandler->handle($view);
}
}

146
src/API/UserController.php
View File

@@ -11,6 +11,10 @@ declare(strict_types=1);
namespace App\API;
use App\Configuration\FormConfiguration;
use App\Entity\User;
use App\Form\API\UserApiCreateForm;
use App\Form\API\UserApiEditForm;
use App\Repository\Query\UserQuery;
use App\Repository\UserRepository;
use App\Utils\SearchTerm;
@@ -22,34 +26,45 @@ use FOS\RestBundle\View\ViewHandlerInterface;
use Nelmio\ApiDocBundle\Annotation\Security as ApiSecurity;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
use Swagger\Annotations as SWG;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
/**
* @RouteResource("User")
*
* @Security("is_granted('IS_AUTHENTICATED_REMEMBERED')")
*/
class UserController extends BaseApiController
final class UserController extends BaseApiController
{
/**
* @var UserRepository
*/
protected $repository;
private $repository;
/**
* @var ViewHandlerInterface
*/
protected $viewHandler;
private $viewHandler;
/**
* @var UserPasswordEncoderInterface
*/
private $encoder;
/**
* @var FormConfiguration
*/
private $configuration;
/**
* @param ViewHandlerInterface $viewHandler
* @param UserRepository $repository
*/
public function __construct(ViewHandlerInterface $viewHandler, UserRepository $repository)
public function __construct(ViewHandlerInterface $viewHandler, UserRepository $repository, UserPasswordEncoderInterface $encoder, FormConfiguration $config)
{
$this->viewHandler = $viewHandler;
$this->repository = $repository;
$this->encoder = $encoder;
$this->configuration = $config;
}
/**
@@ -159,4 +174,125 @@ class UserController extends BaseApiController
return $this->viewHandler->handle($view);
}
/**
* Creates a new user
*
* @SWG\Post(
* description="Creates a new user and returns it afterwards",
* @SWG\Response(
* response=200,
* description="Returns the new created user",
* @SWG\Schema(ref="#/definitions/UserEntity",),
* )
* )
* @SWG\Parameter(
* name="body",
* in="body",
* required=true,
* @SWG\Schema(ref="#/definitions/UserCreateForm")
* )
*
* @Security("is_granted('create_user')")
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function postAction(Request $request): Response
{
$user = new User();
$user->setEnabled(true);
$user->setRoles([User::DEFAULT_ROLE]);
$user->setTimezone($this->configuration->getUserDefaultTimezone());
$user->setLanguage($this->configuration->getUserDefaultLanguage());
$form = $this->createForm(UserApiCreateForm::class, $user, [
'include_roles' => $this->isGranted('roles', $user),
'include_active_flag' => true,
'include_preferences' => $this->isGranted('preferences', $user),
]);
$form->submit($request->request->all());
if ($form->isValid()) {
$password = $this->encoder->encodePassword($user, $user->getPlainPassword());
$user->setPassword($password);
$this->repository->saveUser($user);
$view = new View($user, 200);
$view->getContext()->setGroups(['Default', 'Entity', 'User', 'User_Entity']);
return $this->viewHandler->handle($view);
}
$view = new View($form);
$view->getContext()->setGroups(['Default', 'Entity', 'User', 'User_Entity']);
return $this->viewHandler->handle($view);
}
/**
* Update an existing user
*
* @SWG\Patch(
* description="Update an existing user, you can pass all or just a subset of all attributes (passing roles will replace all existing ones)",
* @SWG\Response(
* response=200,
* description="Returns the updated user",
* @SWG\Schema(ref="#/definitions/UserEntity")
* )
* )
* @SWG\Parameter(
* name="body",
* in="body",
* required=true,
* @SWG\Schema(ref="#/definitions/UserEditForm")
* )
* @SWG\Parameter(
* name="id",
* in="path",
* type="integer",
* description="User ID to update",
* required=true,
* )
*
* @ApiSecurity(name="apiUser")
* @ApiSecurity(name="apiToken")
*/
public function patchAction(Request $request, int $id): Response
{
$user = $this->repository->getUserById($id);
if (null === $user) {
throw new NotFoundException();
}
if (!$this->isGranted('edit', $user)) {
throw new AccessDeniedHttpException('Not allowed to edit user');
}
$form = $this->createForm(UserApiEditForm::class, $user, [
'include_roles' => $this->isGranted('roles', $user),
'include_active_flag' => ($user->getId() !== $this->getUser()->getId()),
'include_preferences' => $this->isGranted('preferences', $user),
]);
$form->setData($user);
$form->submit($request->request->all(), false);
if (false === $form->isValid()) {
$view = new View($form, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'User', 'User_Entity']);
return $this->viewHandler->handle($view);
}
$this->repository->saveUser($user);
$view = new View($user, Response::HTTP_OK);
$view->getContext()->setGroups(['Default', 'Entity', 'User', 'User_Entity']);
return $this->viewHandler->handle($view);
}
}