support creating new roles (#1050)

config/services.yaml

@@ -130,7 +130,8 @@ services:
         arguments: ['%security.role_hierarchy.roles%']
 
     App\Security\RolePermissionManager:
-        arguments: ['%kimai.permissions%']
+        arguments:
+            $permissions: '%kimai.permissions%'
 
     # ================================================================================
     # LDAP

src/Security/RolePermissionManager.php

@@ -19,9 +19,14 @@ class RolePermissionManager
      * @var string[]
      */
     protected $knownPermissions = [];
+    /**
+     * @var RoleService
+     */
+    private $roles;
 
-    public function __construct(array $permissions)
+    public function __construct(RoleService $roles, array $permissions)
     {
+        $this->roles = $roles;
         $this->permissions = $permissions;
 
         foreach ($permissions as $role => $perms) {
@@ -46,7 +51,7 @@ class RolePermissionManager
 
     public function getRoles(): array
     {
-        return array_keys($this->permissions);
+        return $this->roles->getAvailableNames();
     }
 
     public function getPermissions(): array

src/Security/RoleService.php

@@ -9,12 +9,16 @@
 
 namespace App\Security;
 
-class RoleService
+final class RoleService
 {
     /**
      * @var array
      */
-    protected $roles;
+    private $roles;
+    /**
+     * @var string[]
+     */
+    private $roleNames = [];
 
     public function __construct(array $roles)
     {
@@ -23,16 +27,20 @@ class RoleService
 
     public function getAvailableNames(): array
     {
-        $roles = [];
+        if (empty($this->roleNames)) {
-        foreach ($this->roles as $key => $value) {
+            $roles = [];
-            $roles[] = $key;
+            foreach ($this->roles as $key => $value) {
-            if (is_array($value)) {
+                $roles[] = $key;
-                foreach ($value as $name) {
+                if (is_array($value)) {
-                    $roles[] = $name;
+                    foreach ($value as $name) {
+                        $roles[] = $name;
+                    }
                 }
             }
+
+            $this->roleNames = array_values(array_unique($roles));
         }
 
-        return array_values(array_unique($roles));
+        return $this->roleNames;
     }
 }

src/Validator/Constraints/RoleValidator.php

@@ -9,7 +9,7 @@
 
 namespace App\Validator\Constraints;
 
-use App\Entity\User;
+use App\Security\RoleService;
 use Symfony\Component\Validator\Constraint;
 use Symfony\Component\Validator\ConstraintValidator;
 use Symfony\Component\Validator\Exception\UnexpectedTypeException;
@@ -17,14 +17,14 @@ use Symfony\Component\Validator\Exception\UnexpectedTypeException;
 class RoleValidator extends ConstraintValidator
 {
     /**
-     * @var string[]
+     * @var RoleService
      */
-    protected $allowedRoles = [
+    private $service;
-        User::ROLE_USER,
+
-        User::ROLE_TEAMLEAD,
+    public function __construct(RoleService $service)
-        User::ROLE_ADMIN,
+    {
-        User::ROLE_SUPER_ADMIN
+        $this->service = $service;
-    ];
+    }
 
     /**
      * {@inheritdoc}
@@ -41,8 +41,10 @@ class RoleValidator extends ConstraintValidator
             $roles = [$roles];
         }
 
+        $allowedRoles = $this->service->getAvailableNames();
+
         foreach ($roles as $role) {
-            if (!is_string($role) || !in_array($role, $this->allowedRoles)) {
+            if (!is_string($role) || !in_array($role, $allowedRoles)) {
                 $this->context->buildViolation($constraint->message)
                     ->setParameter('{{ value }}', $this->formatValue($role))
                     ->setCode(Role::ROLE_ERROR)

tests/Mocks/Security/RoleServiceFactory.php

@@ -0,0 +1,31 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Mocks\Security;
+
+use App\Entity\User;
+use App\Security\RoleService;
+use App\Tests\Mocks\AbstractMockFactory;
+
+class RoleServiceFactory extends AbstractMockFactory
+{
+    public function create($roles = null): RoleService
+    {
+        if (null === $roles) {
+            $roles = [
+                User::ROLE_USER => [],
+                User::ROLE_TEAMLEAD => [User::ROLE_USER],
+                User::ROLE_ADMIN => [User::ROLE_TEAMLEAD],
+                User::ROLE_SUPER_ADMIN => [User::ROLE_ADMIN],
+            ];
+        }
+
+        return new RoleService($roles);
+    }
+}

tests/Validator/Constraints/RoleValidatorTest.php

@@ -10,6 +10,7 @@
 namespace App\Tests\Validator\Constraints;
 
 use App\Entity\User;
+use App\Tests\Mocks\Security\RoleServiceFactory;
 use App\Validator\Constraints\Role;
 use App\Validator\Constraints\RoleValidator;
 use Symfony\Component\Validator\Constraints\NotBlank;
@@ -22,7 +23,10 @@ class RoleValidatorTest extends ConstraintValidatorTestCase
 {
     protected function createValidator()
     {
-        return new RoleValidator();
+        $factory = new RoleServiceFactory($this);
+        $roleService = $factory->create();
+
+        return new RoleValidator($roleService);
     }
 
     public function getValidRoles()

tests/Voter/AbstractVoterTest.php

@@ -12,6 +12,7 @@ namespace App\Tests\Voter;
 use App\Entity\User;
 use App\Security\AclDecisionManager;
 use App\Security\RolePermissionManager;
+use App\Tests\Mocks\Security\RoleServiceFactory;
 use App\Voter\AbstractVoter;
 use PHPUnit\Framework\TestCase;
 
@@ -95,6 +96,9 @@ abstract class AbstractVoterTest extends TestCase
             ];
         }
 
-        return new RolePermissionManager($permissions);
+        $factory = new RoleServiceFactory($this);
+        $roleService = $factory->create();
+
+        return new RolePermissionManager($roleService, $permissions);
     }
 }