lib/Sds/DoctrineExtensions/AccessControl/AccessController.php
public function isAllowed($action, ClassMetadata $metadata = null, $document = null){

        $result = new IsAllowedResult(false);
        if (!isset($metadata)){
            $metadata = $this->documentManager->getClassMetadata(get_class($document));
        }

        if (!isset($metadata->permissions)){
            return $result;
        }

        if ( !isset($this->permissions[$metadata->name])){
            $this->permissions[$metadata->name] = [];
        }

        $roles = $this->getRoles();
        if (isset($document) && $identityName = $this->getIdentityName()){
            if (isset($metadata->owner) &&
                $metadata->reflFields[$metadata->owner]->getValue($document) == $identityName
            ){
                $roles[] = self::owner;
            }
            if (isset($metadata->stamp) && isset($metadata->stamp['createdBy']) &&
                $metadata->reflFields[$metadata->stamp['createdBy']]->getValue($document) == $identityName
            ){
                $roles[] = self::creator;
            }
            if (isset($metadata->stamp) && isset($metadata->stamp['updatedBy']) &&
                $metadata->reflFields[$metadata->stamp['updatedBy']]->getValue($document) == $identityName
            ){
                $roles[] = self::updater;
            }
        }

        foreach($metadata->permissions as $index => $permissionMetadata){

            if ( !isset($this->permissions[$metadata->name][$index])){
                $factory = $permissionMetadata['factory'];
                $this->permissions[$metadata->name][$index] = $factory::get($metadata, $permissionMetadata['options']);
            }

            $permission = $this->permissions[$metadata->name][$index];
            $newResult = $permission->isAllowed($roles, $action);
            $isAllowed = $newResult->getIsAllowed();
            if ( ! isset($isAllowed)){
                continue;
            }
            $result->setIsAllowed($isAllowed);

            $new = $newResult->getNew();
            if (isset($new)){
                $result->setNew(array_merge($new, $newResult->getNew()));
            }

            $old = $newResult->getOld();
            if (isset($old)){
                $result->setOld(array_merge($old, $newResult->getOld()));
            }
        }

        if (isset($document)){
            if (count($result->getNew()) > 0){
                foreach ($result->getNew() as $field => $value){
                    if ($metadata->reflFields[$field]->getValue($document) != $value){
                        $result->setIsAllowed(false);
                        return $result;
                    }
                }
            }

            if (count($result->getOld()) > 0){
                $changeSet = $this->documentManager->getUnitOfWork()->getDocumentChangeSet($document);
                foreach ($result->getOld() as $field => $value){
                    if ($changeSet[$field][0] != $value){
                        $result->setIsAllowed(false);
                        return $result;
                    }
                }
            }
        }

        return $result;
    }
public function isAllowed($action, ClassMetadata $metadata = null, $document = null){

        $result = new IsAllowedResult(false);
        if (!isset($metadata)){
            $metadata = $this->documentManager->getClassMetadata(get_class($document));
        }

        if (!isset($metadata->permissions)){
            return $result;
        }

        if ( !isset($this->permissions[$metadata->name])){
            $this->permissions[$metadata->name] = [];
        }

        $roles = $this->getRoles();
        if (isset($document) && $identityName = $this->getIdentityName()){
            if (isset($metadata->owner) &&
                $metadata->reflFields[$metadata->owner]->getValue($document) == $identityName
            ){
                $roles[] = self::owner;
            }
            if (isset($metadata->stamp) && isset($metadata->stamp['createdBy']) &&
                $metadata->reflFields[$metadata->stamp['createdBy']]->getValue($document) == $identityName
            ){
                $roles[] = self::creator;
            }
            if (isset($metadata->stamp) && isset($metadata->stamp['updatedBy']) &&
                $metadata->reflFields[$metadata->stamp['updatedBy']]->getValue($document) == $identityName
            ){
                $roles[] = self::updater;
            }
        }

        foreach($metadata->permissions as $index => $permissionMetadata){

            if ( !isset($this->permissions[$metadata->name][$index])){
                $factory = $permissionMetadata['factory'];
                $this->permissions[$metadata->name][$index] = $factory::get($metadata, $permissionMetadata['options']);
            }

            $permission = $this->permissions[$metadata->name][$index];
            $newResult = $permission->isAllowed($roles, $action);
            $isAllowed = $newResult->getIsAllowed();
            if ( ! isset($isAllowed)){
                continue;
            }
            $result->setIsAllowed($isAllowed);

            $new = $newResult->getNew();
            if (isset($new)){
                $result->setNew(array_merge($new, $newResult->getNew()));
            }

            $old = $newResult->getOld();
            if (isset($old)){
                $result->setOld(array_merge($old, $newResult->getOld()));
            }
        }

        if (isset($document)){
            if (count($result->getNew()) > 0){
                foreach ($result->getNew() as $field => $value){
                    if ($metadata->reflFields[$field]->getValue($document) != $value){
                        $result->setIsAllowed(false);
                        return $result;
                    }
                }
            }

            if (count($result->getOld()) > 0){
                $changeSet = $this->documentManager->getUnitOfWork()->getDocumentChangeSet($document);
                foreach ($result->getOld() as $field => $value){
                    if ($changeSet[$field][0] != $value){
                        $result->setIsAllowed(false);
                        return $result;
                    }
                }
            }
        }

        return $result;
    }
public function isAllowed ( $ action , ClassMetadata $ metadata = null , $ document = null ) { $ result = new IsAllowedResult ( false ) ; if ( ! isset ( $ metadata ) ) { $ metadata = $ this -> documentManager -> getClassMetadata ( get_class ( $ document ) ) ; } if ( ! isset ( $ metadata -> permissions ) ) { return $ result ; } if ( ! isset ( $ this -> permissions [ $ metadata -> name ] ) ) { $ this -> permissions [ $ metadata -> name ] = [ ] ; } $ roles = $ this -> getRoles ( ) ; if ( isset ( $ document ) && $ identityName = $ this -> getIdentityName ( ) ) { if ( isset ( $ metadata -> owner ) && $ metadata -> reflFields [ $ metadata -> owner ] -> getValue ( $ document ) == $ identityName ) { $ roles [ ] = self :: owner ; } if ( isset ( $ metadata -> stamp ) && isset ( $ metadata -> stamp [ 'createdBy' ] ) && $ metadata -> reflFields [ $ metadata -> stamp [ 'createdBy' ] ] -> getValue ( $ document ) == $ identityName ) { $ roles [ ] = self :: creator ; } if ( isset ( $ metadata -> stamp ) && isset ( $ metadata -> stamp [ 'updatedBy' ] ) && $ metadata -> reflFields [ $ metadata -> stamp [ 'updatedBy' ] ] -> getValue ( $ document ) == $ identityName ) { $ roles [ ] = self :: updater ; } } foreach ( $ metadata -> permissions as $ index => $ permissionMetadata ) { if ( ! isset ( $ this -> permissions [ $ metadata -> name ] [ $ index ] ) ) { $ factory = $ permissionMetadata [ 'factory' ] ; $ this -> permissions [ $ metadata -> name ] [ $ index ] = $ factory :: get ( $ metadata , $ permissionMetadata [ 'options' ] ) ; } $ permission = $ this -> permissions [ $ metadata -> name ] [ $ index ] ; $ newResult = $ permission -> isAllowed ( $ roles , $ action ) ; $ isAllowed = $ newResult -> getIsAllowed ( ) ; if ( ! isset ( $ isAllowed ) ) { continue ; } $ result -> setIsAllowed ( $ isAllowed ) ; $ new = $ newResult -> getNew ( ) ; if ( isset ( $ new ) ) { $ result -> setNew ( array_merge ( $ new , $ newResult -> getNew ( ) ) ) ; } $ old = $ newResult -> getOld ( ) ; if ( isset ( $ old ) ) { $ result -> setOld ( array_merge ( $ old , $ newResult -> getOld ( ) ) ) ; } } if ( isset ( $ document ) ) { if ( count ( $ result -> getNew ( ) ) > 0 ) { foreach ( $ result -> getNew ( ) as $ field => $ value ) { if ( $ metadata -> reflFields [ $ field ] -> getValue ( $ document ) != $ value ) { $ result -> setIsAllowed ( false ) ; return $ result ; } } } if ( count ( $ result -> getOld ( ) ) > 0 ) { $ changeSet = $ this -> documentManager -> getUnitOfWork ( ) -> getDocumentChangeSet ( $ document ) ; foreach ( $ result -> getOld ( ) as $ field => $ value ) { if ( $ changeSet [ $ field ] [ 0 ] != $ value ) { $ result -> setIsAllowed ( false ) ; return $ result ; } } } } return $ result ; }
Determines if an action can be done by the current Identity

@param type $document
@param string | ActionInterface $action
@return IsAllowedResult
Determines if an action can be done by the current Identity