diff --git a/src/Dto/Output/MenuOutput.php b/src/Dto/Output/MenuOutput.php index 0c55133..309fb45 100644 --- a/src/Dto/Output/MenuOutput.php +++ b/src/Dto/Output/MenuOutput.php @@ -10,7 +10,7 @@ use Symfony\Component\Serializer\Annotation\Groups; #[Get(shortName: 'Menu')] final class MenuOutput extends AbstractOutput { - #[Groups(['menu:read'])] + #[Groups(['menu:read', 'organizational-unit:read'])] public string $name; #[Groups(['menu:read'])] diff --git a/src/Security/Voter/OrganizationalUnitVoter.php b/src/Security/Voter/OrganizationalUnitVoter.php index 1445a7f..2fd3112 100644 --- a/src/Security/Voter/OrganizationalUnitVoter.php +++ b/src/Security/Voter/OrganizationalUnitVoter.php @@ -5,6 +5,7 @@ namespace App\Security\Voter; use App\Dto\Output\OrganizationalUnitOutput; use App\Entity\OrganizationalUnit; use App\Entity\User; +use App\Model\UserGroupPermissions; use Symfony\Component\Security\Core\Authentication\Token\TokenInterface; use Symfony\Component\Security\Core\Authorization\Voter\Voter; use Symfony\Component\Security\Core\User\UserInterface; @@ -24,11 +25,15 @@ class OrganizationalUnitVoter extends Voter /** @var User $user */ $user = $token->getUser(); - // if the user is anonymous, do not grant access + if (!$user instanceof UserInterface) { return false; } + if (in_array(UserGroupPermissions::ROLE_SUPER_ADMIN, $user->getRoles())) { + return true; + } + if ($attribute === 'ORGANIZATIONAL_UNIT_VIEW' ) { foreach ($user->getAllowedOrganizationalUnits() as $allowedOrganizationalUnit) { if ($allowedOrganizationalUnit->getId() === $subject->getEntity()->getId()) {