vendor/symfony/security-core/Authorization/Voter/AuthenticatedVoter.php line 27

  1. <?php
  3. /*
  4. * This file is part of the Symfony package.
  5. *
  6. * (c) Fabien Potencier <fabien@symfony.com>
  7. *
  8. * For the full copyright and license information, please view the LICENSE
  9. * file that was distributed with this source code.
  10. */
  12. namespace Symfony\Component\Security\Core\Authorization\Voter;
  14. use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolverInterface;
  15. use Symfony\Component\Security\Core\Authentication\Token\OfflineTokenInterface;
  16. use Symfony\Component\Security\Core\Authentication\Token\SwitchUserToken;
  17. use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  18. use Symfony\Component\Security\Core\Exception\InvalidArgumentException;
  20. /**
  21. * AuthenticatedVoter votes if an attribute like IS_AUTHENTICATED_FULLY,
  22. * IS_AUTHENTICATED_REMEMBERED, IS_AUTHENTICATED is present.
  23. *
  24. * This list is most restrictive to least restrictive checking.
  25. *
  26. * @author Fabien Potencier <fabien@symfony.com>
  27. * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  28. */
  29. class AuthenticatedVoter implements CacheableVoterInterface
  30. {
  31. public const IS_AUTHENTICATED_FULLY = 'IS_AUTHENTICATED_FULLY';
  32. public const IS_AUTHENTICATED_REMEMBERED = 'IS_AUTHENTICATED_REMEMBERED';
  33. public const IS_AUTHENTICATED = 'IS_AUTHENTICATED';
  34. public const IS_IMPERSONATOR = 'IS_IMPERSONATOR';
  35. public const IS_REMEMBERED = 'IS_REMEMBERED';
  36. public const PUBLIC_ACCESS = 'PUBLIC_ACCESS';
  38. public function __construct(
  39. private AuthenticationTrustResolverInterface $authenticationTrustResolver,
  40. ) {
  41. }
  43. /**
  44. * @param Vote|null $vote Should be used to explain the vote
  45. */
  46. public function vote(TokenInterface $token, mixed $subject, array $attributes/* , ?Vote $vote = null */): int
  47. {
  48. $vote = 3 < \func_num_args() ? func_get_arg(3) : null;
  50. if ($attributes === [self::PUBLIC_ACCESS]) {
  51. $vote?->addReason('Access is public.');
  53. return VoterInterface::ACCESS_GRANTED;
  54. }
  56. $result = VoterInterface::ACCESS_ABSTAIN;
  57. foreach ($attributes as $attribute) {
  58. if (null === $attribute || (self::IS_AUTHENTICATED_FULLY !== $attribute
  59. && self::IS_AUTHENTICATED_REMEMBERED !== $attribute
  60. && self::IS_AUTHENTICATED !== $attribute
  61. && self::IS_IMPERSONATOR !== $attribute
  62. && self::IS_REMEMBERED !== $attribute)) {
  63. continue;
  64. }
  66. if ($token instanceof OfflineTokenInterface) {
  67. throw new InvalidArgumentException('Cannot decide on authentication attributes when an offline token is used.');
  68. }
  70. $result = VoterInterface::ACCESS_DENIED;
  72. if ((self::IS_AUTHENTICATED_FULLY === $attribute || self::IS_AUTHENTICATED_REMEMBERED === $attribute)
  73. && $this->authenticationTrustResolver->isFullFledged($token)
  74. ) {
  75. $vote?->addReason('The user is fully authenticated.');
  77. return VoterInterface::ACCESS_GRANTED;
  78. }
  80. if (self::IS_AUTHENTICATED_REMEMBERED === $attribute
  81. && $this->authenticationTrustResolver->isRememberMe($token)
  82. ) {
  83. $vote?->addReason('The user is remembered.');
  85. return VoterInterface::ACCESS_GRANTED;
  86. }
  88. if (self::IS_AUTHENTICATED === $attribute && $this->authenticationTrustResolver->isAuthenticated($token)) {
  89. $vote?->addReason('The user is authenticated.');
  91. return VoterInterface::ACCESS_GRANTED;
  92. }
  94. if (self::IS_REMEMBERED === $attribute && $this->authenticationTrustResolver->isRememberMe($token)) {
  95. $vote?->addReason('The user is remembered.');
  97. return VoterInterface::ACCESS_GRANTED;
  98. }
  100. if (self::IS_IMPERSONATOR === $attribute && $token instanceof SwitchUserToken) {
  101. $vote?->addReason('The user is impersonating another user.');
  103. return VoterInterface::ACCESS_GRANTED;
  104. }
  105. }
  107. if (VoterInterface::ACCESS_DENIED === $result) {
  108. $vote?->addReason('The user is not appropriately authenticated.');
  109. }
  111. return $result;
  112. }
  114. public function supportsAttribute(string $attribute): bool
  115. {
  116. return \in_array($attribute, [
  117. self::IS_AUTHENTICATED_FULLY,
  118. self::IS_AUTHENTICATED_REMEMBERED,
  119. self::IS_AUTHENTICATED,
  120. self::IS_IMPERSONATOR,
  121. self::IS_REMEMBERED,
  122. self::PUBLIC_ACCESS,
  123. ], true);
  124. }
  126. public function supportsType(string $subjectType): bool
  127. {
  128. return true;
  129. }
  130. }