Add security voter to check tenant scope. Fixed doctrine tenant filter

Author: turegjorup

config/packages/security.yaml

@@ -38,6 +38,9 @@ security:
     access_control:
         - { path: ^/admin, roles: ROLE_EDITOR }
 
+    access_decision_manager:
+        strategy: unanimous
+
 when@test:
     security:
         password_hashers:

src/Security/TenantScope/Doctrine/TenantFilter.php

@@ -8,6 +8,9 @@
 use App\Security\TenantScope\TenantScopeException;
 use Doctrine\ORM\Mapping\ClassMetadata;
 use Doctrine\ORM\Query\Filter\SQLFilter;
+use EasyCorp\Bundle\EasyAdminBundle\Factory\FilterFactory;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Contracts\Service\Attribute\Required;
 
 /**
  * Class TenantFilter.
@@ -27,6 +30,10 @@ public function addFilterConstraint(ClassMetadata $targetEntity, string $targetT
             return '';
         }
 
+        if (!$this->hasParameter('tenant_id')){
+            return '';
+        }
+
         try {
             return sprintf('%s.tenant_id = %s', $targetTableAlias, $this->getParameter('tenant_id'));
         } catch (\Exception $e) {

src/Security/TenantScope/TenantVoter.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Security\TenantScope;
+
+use App\Entity\Interfaces\TenantScopedEntityInterface;
+use App\Entity\Interfaces\TenantScopedUserInterface;
+use EasyCorp\Bundle\EasyAdminBundle\Security\Permission;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+
+class TenantVoter extends Voter
+{
+    protected function supports(string $attribute, mixed $subject): bool
+    {
+        return Permission::EA_EXECUTE_ACTION == $attribute
+            && null !== $subject['entity']
+            && $subject['entity']->getInstance() instanceof TenantScopedEntityInterface;
+    }
+
+    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
+    {
+        $user = $token->getUser();
+        assert($user instanceof TenantScopedUserInterface);
+        $tenant = $user->getTenant();
+
+        $entity = $subject['entity']->getInstance();
+
+        return $entity->getTenant() === $tenant;
+    }
+}