src/Core/Framework/Api/Acl/AclAnnotationValidator.php line 41

  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\Acl;
  5. use Doctrine\DBAL\Connection;
  6. use Shopware\Core\Framework\Api\Exception\MissingPrivilegeException;
  7. use Shopware\Core\Framework\Log\Package;
  8. use Shopware\Core\Framework\Routing\KernelListenerPriorities;
  9. use Shopware\Core\Framework\Uuid\Uuid;
  10. use Shopware\Core\PlatformRequest;
  11. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  12. use Symfony\Component\HttpFoundation\Request;
  13. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  14. use Symfony\Component\HttpKernel\KernelEvents;
  16. /**
  17.  * @internal
  18.  */
  19. #[Package('core')]
  20. class AclAnnotationValidator implements EventSubscriberInterface
  21. {
  22.     /**
  23.      * @internal
  24.      */
  25.     public function __construct(private readonly Connection $connection)
  26.     {
  27.     }
  29.     /**
  30.      * @return array<string, string|array{0: string, 1: int}|list<array{0: string, 1?: int}>>
  31.      */
  32.     public static function getSubscribedEvents(): array
  33.     {
  34.         return [
  35.             KernelEvents::CONTROLLER => [
  36.                 ['validate', KernelListenerPriorities::KERNEL_CONTROLLER_EVENT_SCOPE_VALIDATE],
  37.             ],
  38.         ];
  39.     }
  41.     public function validate(ControllerEvent $event): void
  42.     {
  43.         $request = $event->getRequest();
  45.         $privileges = $request->attributes->get(PlatformRequest::ATTRIBUTE_ACL);
  47.         if (!$privileges) {
  48.             return;
  49.         }
  51.         $context = $request->attributes->get(PlatformRequest::ATTRIBUTE_CONTEXT_OBJECT);
  52.         if ($context === null) {
  53.             throw new MissingPrivilegeException([]);
  54.         }
  56.         foreach ($privileges as $privilege) {
  57.             if ($privilege === 'app') {
  58.                 if ($context->isAllowed('app.all')) {
  59.                     return;
  60.                 }
  62.                 $privilege = $this->getAppPrivilege($request);
  63.             }
  65.             if (!$context->isAllowed($privilege)) {
  66.                 throw new MissingPrivilegeException([$privilege]);
  67.             }
  68.         }
  69.     }
  71.     private function getAppPrivilege(Request $request): string
  72.     {
  73.         $actionId = $request->get('id');
  75.         if (empty($actionId)) {
  76.             throw new MissingPrivilegeException();
  77.         }
  79.         $appName = $this->connection->fetchOne(
  80.             '
  81.                 SELECT `app`.`name` AS `name`
  82.                 FROM `app`
  83.                 INNER JOIN `app_action_button` ON `app`.`id` = `app_action_button`.`app_id`
  84.                 WHERE `app_action_button`.`id` = :id
  85.             ',
  86.             ['id' => Uuid::fromHexToBytes($actionId)],
  87.         );
  89.         return 'app.' . $appName;
  90.     }
  91. }