lib/Sds/DoctrineExtensions/AccessControl/AccessController.php
public function isAllowed($action, ClassMetadata $metadata = null, $document = null){

        $result = new IsAllowedResult(false);
        if (!isset($metadata)){
            $metadata = $this->documentManager->getClassMetadata(get_class($document));
        }

        if (!isset($metadata->permissions)){
            return $result;
        }

        if ( !isset($this->permissions[$metadata->name])){
            $this->permissions[$metadata->name] = [];
        }

        $roles = $this->getRoles();
        if (isset($document) && $identityName = $this->getIdentityName()){
            if (isset($metadata->owner) &&
                $metadata->reflFields[$metadata->owner]->getValue($document) == $identityName
            ){
                $roles[] = self::owner;
            }
            if (isset($metadata->stamp) && isset($metadata->stamp['createdBy']) &&
                $metadata->reflFields[$metadata->stamp['createdBy']]->getValue($document) == $identityName
            ){
                $roles[] = self::creator;
            }
            if (isset($metadata->stamp) && isset($metadata->stamp['updatedBy']) &&
                $metadata->reflFields[$metadata->stamp['updatedBy']]->getValue($document) == $identityName
            ){
                $roles[] = self::updater;
            }
        }

        foreach($metadata->permissions as $index => $permissionMetadata){

            if ( !isset($this->permissions[$metadata->name][$index])){
                $factory = $permissionMetadata['factory'];
                $this->permissions[$metadata->name][$index] = $factory::get($metadata, $permissionMetadata['options']);
            }

            $permission = $this->permissions[$metadata->name][$index];
            $newResult = $permission->isAllowed($roles, $action);
            $isAllowed = $newResult->getIsAllowed();
            if ( ! isset($isAllowed)){
                continue;
            }
            $result->setIsAllowed($isAllowed);

            $new = $newResult->getNew();
            if (isset($new)){
                $result->setNew(array_merge($new, $newResult->getNew()));
            }

            $old = $newResult->getOld();
            if (isset($old)){
                $result->setOld(array_merge($old, $newResult->getOld()));
            }
        }

        if (isset($document)){
            if (count($result->getNew()) > 0){
                foreach ($result->getNew() as $field => $value){
                    if ($metadata->reflFields[$field]->getValue($document) != $value){
                        $result->setIsAllowed(false);
                        return $result;
                    }
                }
            }

            if (count($result->getOld()) > 0){
                $changeSet = $this->documentManager->getUnitOfWork()->getDocumentChangeSet($document);
                foreach ($result->getOld() as $field => $value){
                    if ($changeSet[$field][0] != $value){
                        $result->setIsAllowed(false);
                        return $result;
                    }
                }
            }
        }

        return $result;
    }
public function isAllowed($action, ClassMetadata $metadata = null, $document = null){

        $result = new IsAllowedResult(false);
        if (!isset($metadata)){
            $metadata = $this->documentManager->getClassMetadata(get_class($document));
        }

        if (!isset($metadata->permissions)){
            return $result;
        }

        if ( !isset($this->permissions[$metadata->name])){
            $this->permissions[$metadata->name] = [];
        }

        $roles = $this->getRoles();
        if (isset($document) && $identityName = $this->getIdentityName()){
            if (isset($metadata->owner) &&
                $metadata->reflFields[$metadata->owner]->getValue($document) == $identityName
            ){
                $roles[] = self::owner;
            }
            if (isset($metadata->stamp) && isset($metadata->stamp['createdBy']) &&
                $metadata->reflFields[$metadata->stamp['createdBy']]->getValue($document) == $identityName
            ){
                $roles[] = self::creator;
            }
            if (isset($metadata->stamp) && isset($metadata->stamp['updatedBy']) &&
                $metadata->reflFields[$metadata->stamp['updatedBy']]->getValue($document) == $identityName
            ){
                $roles[] = self::updater;
            }
        }

        foreach($metadata->permissions as $index => $permissionMetadata){

            if ( !isset($this->permissions[$metadata->name][$index])){
                $factory = $permissionMetadata['factory'];
                $this->permissions[$metadata->name][$index] = $factory::get($metadata, $permissionMetadata['options']);
            }

            $permission = $this->permissions[$metadata->name][$index];
            $newResult = $permission->isAllowed($roles, $action);
            $isAllowed = $newResult->getIsAllowed();
            if ( ! isset($isAllowed)){
                continue;
            }
            $result->setIsAllowed($isAllowed);

            $new = $newResult->getNew();
            if (isset($new)){
                $result->setNew(array_merge($new, $newResult->getNew()));
            }

            $old = $newResult->getOld();
            if (isset($old)){
                $result->setOld(array_merge($old, $newResult->getOld()));
            }
        }

        if (isset($document)){
            if (count($result->getNew()) > 0){
                foreach ($result->getNew() as $field => $value){
                    if ($metadata->reflFields[$field]->getValue($document) != $value){
                        $result->setIsAllowed(false);
                        return $result;
                    }
                }
            }

            if (count($result->getOld()) > 0){
                $changeSet = $this->documentManager->getUnitOfWork()->getDocumentChangeSet($document);
                foreach ($result->getOld() as $field => $value){
                    if ($changeSet[$field][0] != $value){
                        $result->setIsAllowed(false);
                        return $result;
                    }
                }
            }
        }

        return $result;
    }
Determines if an action can be done by the current Identity

@param type $document
@param string | ActionInterface $action
@return IsAllowedResult