src/Security/SwitchUserSubscriber.php line 39

Open in your IDE?
  1. <?php
  3. namespace App\Security;
  5. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  6. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  7. use Symfony\Component\Security\Core\Exception\AccessDeniedException;
  8. use Symfony\Component\Security\Http\Event\SwitchUserEvent;
  9. use Symfony\Component\Security\Http\SecurityEvents;
  11. class SwitchUserSubscriber implements EventSubscriberInterface
  12. {
  13. private const ROLE_PRIORITY = [
  14. 'ROLE_SUPERADMIN' => 60,
  15. 'ROLE_ADMIN' => 50,
  16. 'ROLE_MANAGER' => 40,
  17. 'ROLE_SUPPORT_MASTER' => 35,
  18. 'ROLE_SUPPORT' => 30,
  19. 'ROLE_SECRETARIAT' => 20,
  20. 'ROLE_TEACHER' => 10,
  21. 'ROLE_USER' => 10,
  22. 'ROLE_EMAIL' => 10,
  23. ];
  25. private TokenStorageInterface $tokenStorage;
  27. public function __construct(TokenStorageInterface $tokenStorage)
  28. {
  29. $this->tokenStorage = $tokenStorage;
  30. }
  32. public static function getSubscribedEvents(): array
  33. {
  34. return [
  35. SecurityEvents::SWITCH_USER => 'onSwitchUser',
  36. ];
  37. }
  39. public function onSwitchUser(SwitchUserEvent $event): void
  40. {
  41. // Ne pas bloquer le retour à son propre compte
  42. if ($event->getRequest()->get('_switch_user') === '_exit') {
  43. return;
  44. }
  46. $token = $this->tokenStorage->getToken();
  47. if ($token === null) {
  48. throw new AccessDeniedException();
  49. }
  51. $switcherLevel = $this->getMaxRoleLevel($token->getUser()->getRoles());
  52. $targetLevel = $this->getMaxRoleLevel($event->getTargetUser()->getRoles());
  54. if ($targetLevel >= $switcherLevel) {
  55. throw new AccessDeniedException('Vous ne pouvez pas prendre le contrôle d\'un compte avec un niveau de permissions égal ou supérieur au vôtre.');
  56. }
  57. }
  59. private function getMaxRoleLevel(array $roles): int
  60. {
  61. $max = 0;
  62. foreach ($roles as $role) {
  63. $max = max($max, self::ROLE_PRIORITY[$role] ?? 0);
  64. }
  66. return $max;
  67. }
  68. }