src/Pumukit/SchemaBundle/Services/MultimediaObjectVoter.php line 16

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace Pumukit\SchemaBundle\Services;
  7. use Pumukit\SchemaBundle\Document\EmbeddedBroadcast;
  8. use Pumukit\SchemaBundle\Document\MultimediaObject;
  9. use Pumukit\SchemaBundle\Document\PermissionProfile;
  10. use Pumukit\SchemaBundle\Document\User;
  11. use Pumukit\WebTVBundle\PumukitWebTVBundle;
  12. use Symfony\Component\HttpFoundation\RequestStack;
  13. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  14. use Symfony\Component\Security\Core\Authorization\Voter\Voter;
  16. class MultimediaObjectVoter extends Voter
  17. {
  18.     public const EDIT = 'edit';
  19.     public const PLAY = 'play';
  20.     public const VIEW_METADATA = 'view_metadata';
  22.     private $mmobjService;
  23.     private $requestStack;
  25.     public function __construct(MultimediaObjectService $mmobjService, RequestStack $requestStack)
  26.     {
  27.         $this->mmobjService = $mmobjService;
  28.         $this->requestStack = $requestStack;
  29.     }
  31.     protected function supports($attribute, $subject)
  32.     {
  33.         // if the attribute isn't one we support, return false
  34.         if (!in_array($attribute, [self::EDIT, self::PLAY, self::VIEW_METADATA])) {
  35.             return false;
  36.         }
  38.         // only vote on Post objects inside this voter
  39.         if (!$subject instanceof MultimediaObject) {
  40.             return false;
  41.         }
  43.         return true;
  44.     }
  46.     protected function voteOnAttribute($attribute, $multimediaObject, TokenInterface $token)
  47.     {
  48.         $user = $token->getUser();
  50.         switch ($attribute) {
  51.             case self::EDIT:
  52.                 return $this->canEdit($multimediaObject, $user);
  54.             case self::PLAY:
  55.                 return $this->canPlay($multimediaObject, $user);
  57.             case self::VIEW_METADATA:
  58.                 return $this->canViewMetadata($multimediaObject, $user);
  59.         }
  61.         throw new \LogicException('This code should not be reached!');
  62.     }
  64.     protected function canEdit(MultimediaObject $multimediaObject, $user = null)
  65.     {
  66.         if ($user instanceof User && ($user->hasRole(PermissionProfile::SCOPE_GLOBAL) || $user->hasRole('ROLE_SUPER_ADMIN'))) {
  67.             return true;
  68.         }
  70.         if ($user instanceof User && $user->hasRole(PermissionProfile::SCOPE_PERSONAL) && $this->mmobjService->isUserOwner($user, $multimediaObject)) {
  71.             return true;
  72.         }
  74.         return false;
  75.     }
  77.     protected function canPlay(MultimediaObject $multimediaObject, $user = null)
  78.     {
  79.         // Private play
  80.         if ($this->canEdit($multimediaObject, $user)) {
  81.             return true;
  82.         }
  84.         // Test broadcast
  85.         $embeddedBroadcast = $multimediaObject->getEmbeddedBroadcastNotNull();
  86.         if (EmbeddedBroadcast::TYPE_LOGIN === $embeddedBroadcast->getType()) {
  87.             if (!$user instanceof User || !$this->isViewerOrWithScope($user)) {
  88.                 return false;
  89.             }
  90.         }
  91.         if (EmbeddedBroadcast::TYPE_GROUPS === $embeddedBroadcast->getType()) {
  92.             if (!$user instanceof User || !$this->isViewerOrWithScope($user) || !$this->isUserRelatedToBroadcast($multimediaObject->getEmbeddedBroadcastNotNull(), $user)) {
  93.                 return false;
  94.             }
  95.         }
  97.         /*
  98.          * NOTE: (OUT OF SCOPE) Share URL and password is as easy as share only the URL.
  99.          *      if (EmbeddedBroadcast::TYPE_PASSWORD === $embeddedBroadcast->getType()) {
  100.          *          $password = $this->requestStack->getMasterRequest()->get('broadcast_password');
  101.          *          if ($password != $embeddedBroadcast->getPassword()) {
  102.          *              return false;
  103.          *          }
  104.          *      }
  105.         */
  107.         // Public play
  108.         if ($this->mmobjService->isHidden($multimediaObject, PumukitWebTVBundle::WEB_TV_TAG) || $this->mmobjService->isHidden($multimediaObject, 'PUCHPODCAST')) {
  109.             return true;
  110.         }
  112.         // Legacy code
  113.         if ($this->mmobjService->isHidden($multimediaObject, 'PUCHOPENEDX')) {
  114.             return true;
  115.         }
  117.         // TTK-24312 WA to show public videos with Poddium channel
  118.         if ($this->mmobjService->isPublished($multimediaObject, 'PUCHPODDIUM')) {
  119.             return true;
  120.         }
  122.         return false;
  123.     }
  125.     protected function canViewMetadata(MultimediaObject $multimediaObject, $user = null)
  126.     {
  127.         // Private play
  128.         if ($this->canEdit($multimediaObject, $user)) {
  129.             return true;
  130.         }
  132.         // Public play
  133.         if ($this->mmobjService->isHidden($multimediaObject, PumukitWebTVBundle::WEB_TV_TAG) || $this->mmobjService->isHidden($multimediaObject, 'PUCHPODCAST')) {
  134.             return true;
  135.         }
  137.         // Legacy code
  138.         if ($this->mmobjService->isHidden($multimediaObject, 'PUCHOPENEDX')) {
  139.             return true;
  140.         }
  142.         return false;
  143.     }
  145.     protected function isViewerOrWithScope(User $user)
  146.     {
  147.         return $user->hasRole(PermissionProfile::SCOPE_GLOBAL) || $user->hasRole(PermissionProfile::SCOPE_PERSONAL)
  148.                 || $user->hasRole(PermissionProfile::SCOPE_NONE) || $user->hasRole('ROLE_SUPER_ADMIN');
  149.     }
  151.     // Related to EmbeddedBroadcastService::isUserRelatedToMultimediaObject
  152.     protected function isUserRelatedToBroadcast(EmbeddedBroadcast $broadcast, User $user)
  153.     {
  154.         $userGroups = $user->getGroups()->toArray();
  155.         $playGroups = $broadcast->getGroups()->toArray();
  157.         return array_intersect($playGroups, $userGroups);
  158.     }
  159. }