<commit_before><?php

namespace Ilios\AuthenticationBundle\Voter;

use Ilios\CoreBundle\Entity\LearnerGroupInterface;
use Ilios\CoreBundle\Entity\Manager\PermissionManagerInterface;
use Ilios\CoreBundle\Entity\UserInterface;

/**
 * Class LearnerGroupVoter
 * @package Ilios\AuthenticationBundle\Voter
 */
class LearnerGroupVoter extends AbstractVoter
{
    /**
     * @var PermissionManagerInterface
     */
    protected $permissionManager;

    public function __construct(PermissionManagerInterface $permissionManager)
    {
        $this->permissionManager = $permissionManager;
    }

    /**
     * {@inheritdoc}
     */
    protected function getSupportedClasses()
    {
        return array('Ilios\CoreBundle\Entity\LearnerGroupInterface');
    }

    /**
     * @param string $attribute
     * @param LearnerGroupInterface $group
     * @param UserInterface|null $user
     * @return bool
     */
    protected function isGranted($attribute, $group, $user = null)
    {
        // make sure there is a user object (i.e. that the user is logged in)
        if (!$user instanceof UserInterface) {
            return false;
        }

        switch ($attribute) {
            case self::VIEW:
                // grant VIEW privileges if at least one of the following
                // statements is true:
                // 1. the user's primary school is the group's owning school
                //    and has at least one of 'Course Director', 'Faculty' and 'Developer' roles.
                // 2. the user has READ rights on the group's owning school via the permissions system
                //    and has at least one of 'LearnerGroup Director', 'Faculty' and 'Developer' roles.
                return ($this->userHasRole($user, ['Course Director', 'Faculty', 'Developer'])
                    && (
                        $user->getPrimarySchool() === $group->getSchool()
                        || $this->permissionManager->userHasReadPermissionToSchool($user, $group->getSchool())
                    )
                );
                break;
            case self::CREATE:
            case self::EDIT:
            case self::DELETE:
                // grant CREATE, EDIT and DELETE privileges if at least one of the following
                // statements is true:
                // 1. the user's primary school is the group's owning school
                //    and the user has at least one of the 'Course Director' and 'Developer' roles.
                // 2. the user has WRITE rights on the group's owning school via the permissions system
                //    and the user has at least one of the 'Course Director' and 'Developer' roles.
                return ($this->userHasRole($user, ['Course Director', 'Developer'])
                    && (
                        $user->getPrimarySchool() === $group->getSchool()
                        || $this->permissionManager->userHasWritePermissionToSchool($user, $group->getSchool())
                    )
                );
                break;<commit_msg>fixed/improved grants check in learner group voter.<commit_after><?php

namespace Ilios\AuthenticationBundle\Voter;

use Ilios\CoreBundle\Entity\LearnerGroupInterface;
use Ilios\CoreBundle\Entity\Manager\PermissionManagerInterface;
use Ilios\CoreBundle\Entity\UserInterface;

/**
 * Class LearnerGroupVoter
 * @package Ilios\AuthenticationBundle\Voter
 */
class LearnerGroupVoter extends AbstractVoter
{
    /**
     * @var PermissionManagerInterface
     */
    protected $permissionManager;

    public function __construct(PermissionManagerInterface $permissionManager)
    {
        $this->permissionManager = $permissionManager;
    }

    /**
     * {@inheritdoc}
     */
    protected function getSupportedClasses()
    {
        return array('Ilios\CoreBundle\Entity\LearnerGroupInterface');
    }

    /**
     * @param string $attribute
     * @param LearnerGroupInterface $group
     * @param UserInterface|null $user
     * @return bool
     */
    protected function isGranted($attribute, $group, $user = null)
    {
        // make sure there is a user object (i.e. that the user is logged in)
        if (!$user instanceof UserInterface) {
            return false;
        }

        switch ($attribute) {
            case self::VIEW:
                // grant VIEW privileges if at least one of the following
                // statements is true:
                // 1. the user's primary school is the group's owning school
                //    and has at least one of 'Course Director', 'Faculty' and 'Developer' roles.
                // 2. the user has READ rights on the group's owning school via the permissions system
                //    and has at least one of 'Course Director', 'Faculty' and 'Developer' roles.
                // 3. the user has READ rights to the group's owning program.
                return ($this->userHasRole($user, ['Course Director', 'Faculty', 'Developer'])
                    && (
                        $user->getPrimarySchool()->getId()
                        === $group->getCohort()->getProgramYear()->getProgram()->getOwningSchool()
                        || $this->permissionManager->userHasReadPermissionToSchool(
                            $user,
                            $group->getCohort()->getProgramYear()->getProgram()->getOwningSchool()
                        )
                    )
                    || $this->permissionManager->userHasReadPermissionToProgram(
                        $user,
                        $group->getCohort()->getProgramYear()->getProgram()
                    )
                );
                break;
            case self::CREATE:
            case self::EDIT:
            case self::DELETE:
                // grant CREATE, EDIT and DELETE privileges if at least one of the following
                // statements is true:
                // 1. the user's primary school is the group's owning school
                //    and the user has at least one of the 'Course Director' and 'Developer' roles.
                // 2. the user has WRITE rights on the group's owning school via the permissions system
                //    and the user has at least one of the 'Course Director' and 'Developer' roles.
                // 3. the user has WRITE rights to the group's owning program.
                return ($this->userHasRole($user, ['Course Director', 'Developer'])
                    && (
                        $user->getPrimarySchool()->getId()
                        === $group->getCohort()->getProgramYear()->getProgram()->getOwningSchool()
                        || $this->permissionManager->userHasWritePermissionToSchool(
                            $user,
                            $group->getCohort()->getProgramYear()->getProgram()->getOwningSchool()
                        )
                    )
                    || $this->permissionManager->userHasWritePermissionToProgram(
                        $user,
                        $group->getCohort()->getProgramYear()->getProgram()
                    )

                );
                break;
{'fraction_non_alphanumeric': 0.0993963217745332, 'fraction_numerical': 0.0014039028499227854, 'mean_word_length': 1.756965944272446, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 53, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 12, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7485036', 'n_tokens_mistral': 1805, 'n_tokens_neox': 1638, 'n_words': 499}