CheckAdditionalCredentialsOwnedByUser.php

Go to the documentation of this file.

<?php

namespace BristolSU\Support\Authorization\Middleware;

use BristolSU\ControlDB\Contracts\Models\Group;
use BristolSU\ControlDB\Contracts\Models\Role;
use BristolSU\ControlDB\Contracts\Models\User;
use BristolSU\Support\Authentication\Contracts\Authentication;
use BristolSU\Support\Authorization\Exception\IncorrectLogin;
use Illuminate\Http\Request;

class CheckAdditionalCredentialsOwnedByUser
{

    private $authentication;

    public function __construct(Authentication $authentication)
    {
        $this->authentication = $authentication;
    }

    public function handle(Request $request, \Closure $next)
    {
        if($user = $this->authentication->getUser()) {
            if($role = $this->authentication->getRole()) {
                $this->checkUserIsInRole($user, $role);
                $group = $this->checkGroupIsLoggedIn();
                $this->checkGroupBelongsToRole($group, $role);
            } elseif($group = $this->authentication->getGroup()) {
                $this->checkUserHasMembershipToGroup($user, $group);
            }
        }
        
        return $next($request);
    }

    private function checkUserIsInRole(User $user, Role $role): void
    {
        if(!in_array($role->id(), $user->roles()->map(function(Role $role) {
            return $role->id();
        })->toArray())) {
            throw new IncorrectLogin('The user must own the current role');
        }
    }

    private function checkGroupBelongsToRole(Group $group, Role $role): void
    {
        if($group->id() !== $role->groupId()) {
            throw new IncorrectLogin('The group must belong to the current role');
        }
    }

    private function checkUserHasMembershipToGroup(User $user, Group $group): void
    {
        if(!in_array($group->id(), $user->groups()->map(function(Group $group) {
            return $group->id();
        })->toArray())) {
            throw new IncorrectLogin('The user must have a membership to the group');
        }
    }

    private function checkGroupIsLoggedIn(): Group
    {
        if($group = $this->authentication->getGroup()) {
            return $group;
        }
        throw new IncorrectLogin('The group must belong to the current role');
    }

}