<?php

namespace App\Security\Voter;

use App\Entity\User;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Vote;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\User\UserInterface;

class ImpersonationVoter extends Voter
{
    public function __construct(private readonly Security $security)
    {
    }

    protected function supports(string $attribute, mixed $subject): bool
    {
        return 'CAN_IMPERSONATE' === $attribute && $subject instanceof UserInterface;
    }

    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token, ?Vote $vote = null): bool
    {
        $currentUser = $token->getUser();
        $targetUser = $subject;

        // if the user is anonymous or if the subject is not a user, do not grant access
        if (!$currentUser instanceof User || !$targetUser instanceof User) {
            return false;
        }

        // if the current user is trying to impersonate herself, do not grant access
        if ($currentUser === $targetUser) {
            return false;
        }

        // if the current user is already impersonating, do not grant access
        if ($this->security->isGranted('IS_IMPERSONATOR')) {
            return false;
        }

        // if the target user is superadmin, do not grant access
        if (true === $targetUser->isSuperAdmin()) {
            return false;
        }

        // a deleted account is excluded from every process, so impersonating it must not
        // become a way back into the teamer area
        if (true === $targetUser->isDeleted()) {
            return false;
        }

        // Admin is the only role allowed to impersonate
        if (false === $this->security->isGranted('ROLE_TEAM_ADMIN')) {
            return false;
        }

        return $currentUser->isSuperAdmin();
    }
}