Applications\Acl\ApplicationAccessAssertion

Complexity

Total Complexity

7

Size/Duplication

Total Lines	37
Duplicated Lines	0 %

Coupling/Cohesion

Components	0
Dependencies	0

Importance

Changes

0

1 Method

Rating	Name	Duplication	Size	Complexity
C	assert()	0	27	7

<?php
/**
 * YAWIK
 *
 * @filesource
 * @copyright (c) 2013 - 2016 Cross Solution (http://cross-solution.de)
 * @license   MIT
 */

/** */
namespace Applications\Acl;

use Core\Entity\DraftableEntityInterface;
use Zend\Permissions\Acl\Assertion\AssertionInterface;
use Zend\Permissions\Acl\Acl;
use Zend\Permissions\Acl\Resource\ResourceInterface;
use Zend\Permissions\Acl\Role\RoleInterface;
use Applications\Entity\ApplicationInterface;
use Auth\Entity\UserInterface;
use Core\Entity\PermissionsInterface;

/**
 * Checks permission on attachments
 *
 * @author Mathias Gelhausen <gelhausen@cross-solution.de>
 * @author Carsten Bleek <bleek@cross-solution.de>
 * @author Miroslav Fedeleš <miroslav.fedeles@gmail.com>
 * @since 0.27 Checks, if application is a draft and only allow the associated user if so.
 * @since 0.4
 */
class ApplicationAccessAssertion implements AssertionInterface
{
    /**
     * Checks permissions based on resources' permissions.
     *
     * {@inheritDoc}
     *
     * @see \Zend\Permissions\Acl\Assertion\AssertionInterface::assert()
     */
    public function assert(
        Acl $acl,
        RoleInterface $role = null,
        ResourceInterface $resource = null,
        $privilege = null
    ) {
        if (!$role instanceof UserInterface || !$resource instanceof ApplicationInterface) {
            return false;
        }

        /* @var $resource ApplicationInterface|DraftableEntityInterface */

        /* If application is a draft, only the associated user may view and edit. */
        if ($resource->isDraft()) {
            return $role === $resource->getUser();
        }

        $permissions = $resource->getPermissions();
        
        if (ApplicationInterface::PERMISSION_SUBSEQUENT_ATTACHMENT_UPLOAD == $privilege) {
            // only applicant is allowed to upload subsequent attachments
            return $permissions->isAssigned($role) && $permissions->isGranted($role, PermissionsInterface::PERMISSION_VIEW);
        }
        
        $permission = 'read' == $privilege ? PermissionsInterface::PERMISSION_VIEW : PermissionsInterface::PERMISSION_CHANGE;
        return $permissions->isGranted($role, $permission);
    }
}