src/Core/Framework/DataAbstractionLayer/EntityProtection/EntityProtectionValidator.php line 79

  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\DataAbstractionLayer\EntityProtection;
  5. use Shopware\Core\Framework\Context;
  6. use Shopware\Core\Framework\DataAbstractionLayer\EntityDefinition;
  7. use Shopware\Core\Framework\DataAbstractionLayer\Event\EntitySearchedEvent;
  8. use Shopware\Core\Framework\DataAbstractionLayer\Field\AssociationField;
  9. use Shopware\Core\Framework\DataAbstractionLayer\Field\Field;
  10. use Shopware\Core\Framework\DataAbstractionLayer\Search\Criteria;
  11. use Shopware\Core\Framework\DataAbstractionLayer\Write\Validation\PreWriteValidationEvent;
  12. use Shopware\Core\Framework\Log\Package;
  13. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  14. use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
  16. /**
  17.  * @internal
  18.  */
  19. #[Package('core')]
  20. class EntityProtectionValidator implements EventSubscriberInterface
  21. {
  22.     /**
  23.      * @return array<string, string|array{0: string, 1: int}|list<array{0: string, 1?: int}>>
  24.      */
  25.     public static function getSubscribedEvents(): array
  26.     {
  27.         return [
  28.             PreWriteValidationEvent::class => 'validateWriteCommands',
  29.             EntitySearchedEvent::class => 'validateEntitySearch',
  30.         ];
  31.     }
  33.     /**
  34.      * @param list<array{entity: string, value: string|null, definition: EntityDefinition, field: Field|null}> $pathSegments
  35.      * @param array<string> $protections FQCN of the protections that need to be validated
  36.      */
  37.     public function validateEntityPath(array $pathSegments, array $protections, Context $context): void
  38.     {
  39.         foreach ($pathSegments as $pathSegment) {
  40.             /** @var EntityDefinition $definition */
  41.             $definition = $pathSegment['definition'];
  43.             foreach ($protections as $protection) {
  44.                 $protectionInstance = $definition->getProtections()->get($protection);
  45.                 if (!$protectionInstance || $protectionInstance->isAllowed($context->getScope())) {
  46.                     continue;
  47.                 }
  49.                 throw new AccessDeniedHttpException(
  50.                     sprintf('API access for entity "%s" not allowed.', $pathSegment['entity'])
  51.                 );
  52.             }
  53.         }
  54.     }
  56.     public function validateEntitySearch(EntitySearchedEvent $event): void
  57.     {
  58.         $definition = $event->getDefinition();
  59.         $readProtection = $definition->getProtections()->get(ReadProtection::class);
  60.         $context = $event->getContext();
  62.         if ($readProtection && !$readProtection->isAllowed($context->getScope())) {
  63.             throw new AccessDeniedHttpException(
  64.                 sprintf(
  65.                     'Read access to entity "%s" not allowed for scope "%s".',
  66.                     $definition->getEntityName(),
  67.                     $context->getScope()
  68.                 )
  69.             );
  70.         }
  72.         $this->validateCriteriaAssociation(
  73.             $definition,
  74.             $event->getCriteria()->getAssociations(),
  75.             $context
  76.         );
  77.     }
  79.     public function validateWriteCommands(PreWriteValidationEvent $event): void
  80.     {
  81.         foreach ($event->getCommands() as $command) {
  82.             // Don't validate commands that fake operations on DB level, e.g. cascade deletes
  83.             if (!$command->isValid()) {
  84.                 continue;
  85.             }
  87.             $writeProtection = $command->getDefinition()->getProtections()->get(WriteProtection::class);
  88.             if ($writeProtection && !$writeProtection->isAllowed($event->getContext()->getScope())) {
  89.                 throw new AccessDeniedHttpException(
  90.                     sprintf(
  91.                         'Write access to entity "%s" are not allowed in scope "%s".',
  92.                         $command->getDefinition()->getEntityName(),
  93.                         $event->getContext()->getScope()
  94.                     )
  95.                 );
  96.             }
  97.         }
  98.     }
  100.     /**
  101.      * @param array<string, Criteria> $associations
  102.      */
  103.     private function validateCriteriaAssociation(EntityDefinition $definition, array $associations, Context $context): void
  104.     {
  105.         /** @var Criteria $criteria */
  106.         foreach ($associations as $associationName => $criteria) {
  107.             $field = $definition->getField($associationName);
  108.             if (!$field instanceof AssociationField) {
  109.                 continue;
  110.             }
  112.             $associationDefinition = $field->getReferenceDefinition();
  113.             $readProtection = $associationDefinition->getProtections()->get(ReadProtection::class);
  114.             if ($readProtection && !$readProtection->isAllowed($context->getScope())) {
  115.                 throw new AccessDeniedHttpException(
  116.                     sprintf(
  117.                         'Read access to nested association "%s" on entity "%s" not allowed for scope "%s".',
  118.                         $associationName,
  119.                         $definition->getEntityName(),
  120.                         $context->getScope()
  121.                     )
  122.                 );
  123.             }
  125.             $this->validateCriteriaAssociation($associationDefinition, $criteria->getAssociations(), $context);
  126.         }
  127.     }
  128. }