56 lines
2.4 KiB
PHP
56 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Controller\Admin\System\User;
|
|
|
|
use App\BusProNet\UserDataHandler;
|
|
use App\Entity\User;
|
|
use App\Htmx\HxRedirectResponse;
|
|
use App\Security\Voter\UserVoter;
|
|
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\Routing\Attribute\Route;
|
|
use Symfony\Component\Security\Http\Attribute\IsGranted;
|
|
|
|
/**
|
|
* Granting a privilege is its own act, deliberately not a checkbox on the user edit form:
|
|
* it is confirmed on its own, logged on its own, and cannot happen as a side effect of
|
|
* saving an unrelated setting. It is also the only way a role is ever granted at all -
|
|
* everything else about roles is synced from BusPro (see docs/user-roles.md).
|
|
*/
|
|
class ApproveRoleController extends AbstractController
|
|
{
|
|
public function __construct(private readonly UserDataHandler $userDataHandler)
|
|
{
|
|
}
|
|
|
|
#[Route('/admin/system/user/approve-role/{id}/{role}', name: 'app_admin_system_user_approve_role')]
|
|
#[IsGranted(UserVoter::EDIT, subject: 'user')]
|
|
public function index(User $user, string $role, Request $request): Response
|
|
{
|
|
// nothing but a role this user is actually nominated for, so a hand-crafted URL
|
|
// cannot grant one BusPro never claimed
|
|
$pendingRole = User::PENDING_ROLES[$role] ?? null;
|
|
if (null === $pendingRole || false === in_array($pendingRole, $user->getPendingRoles(), true)) {
|
|
throw $this->createNotFoundException('Für diese Rolle liegt keine Freischaltung vor');
|
|
}
|
|
|
|
if (true === $request->isMethod(Request::METHOD_POST)) {
|
|
// checked again by the handler, which is what catches a sync revoking the claim
|
|
// between opening the dialog and confirming it
|
|
if (false === $this->userDataHandler->approveRole($user, $role)) {
|
|
throw $this->createNotFoundException('Für diese Rolle liegt keine Freischaltung vor');
|
|
}
|
|
|
|
$this->addFlash('success', sprintf('Die Rolle %s wurde freigeschaltet', User::ROLES[$role]));
|
|
|
|
return new HxRedirectResponse($this->generateUrl('app_admin_system_user_edit', ['id' => $user->getId()]));
|
|
}
|
|
|
|
return $this->render('admin/system/user/modal_approve_role.html.twig', [
|
|
'user' => $user,
|
|
'roleLabel' => User::ROLES[$role],
|
|
]);
|
|
}
|
|
}
|