Action voter

src/Definition/AbstractDefinition.php

@@ -16,6 +16,7 @@
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\PropertyAccess\PropertyAccess;
 use Symfony\Component\Routing\RouterInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
 use Symfony\Contracts\Service\ServiceSubscriberInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
 use whatwedo\CrudBundle\Action\Action;
@@ -133,7 +134,15 @@ public function removeBatchAction(string $acronym): static
 
     public function getBatchActions(): array
     {
-        return $this->batchActions;
+        return array_filter(
+            $this->batchActions,
+            function (Action $action) {
+                return $this->container->get(AuthorizationCheckerInterface::class)->isGranted(
+                    $action->getOption('voter_attribute'),
+                    $action
+                );
+            }
+        );
     }
 
     public function configureView(DefinitionBuilder $builder, $data): void
@@ -495,6 +504,7 @@ public static function getSubscribedServices(): array
             IndexRepository::class,
             RequestStack::class,
             LoggerInterface::class,
+            AuthorizationCheckerInterface::class,
         ];
     }
 

src/Security/Voter/DefaultActionVoter.php

@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+/*
+ * Copyright (c) 2017, whatwedo GmbH
+ * All rights reserved
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace whatwedo\CrudBundle\Security\Voter;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+use whatwedo\CoreBundle\Action\Action;
+
+class DefaultActionVoter implements VoterInterface
+{
+    public function vote(TokenInterface $token, $subject, array $attributes)
+    {
+        // Check if subject is set
+        if ($subject === null) {
+            return static::ACCESS_ABSTAIN;
+        }
+
+        if ($subject instanceof Action) {
+            return static::ACCESS_GRANTED;
+        }
+
+        return static::ACCESS_ABSTAIN;
+    }
+}