Only SuperAdmin (Dev & Platform admin) can manage Keywords & Api clients

@param string         $attribute
@param mixed          $subject
@param TokenInterface $token

@return bool
174109
protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
    {
        if ($this->isSuperAdmin($token)) {
            return true;
        }

        return false;
    }
146444
public function voteOnAttribute($attribute, $subject, TokenInterface $token)
    {
        return $this->isOrganizationManager($token, $subject) ? VoterInterface::ACCESS_GRANTED : VoterInterface::ACCESS_DENIED;
    }
754059
protected function voteForReadAction($subject, TokenInterface $token)
    {
        $contentType = $subject;
        if (is_object($subject)) {
            $contentType = $subject->getContentType();
        }

        return $this->isSubjectInPerimeter($contentType, $token->getUser(), ContentTypeInterface::ENTITY_TYPE);
    }
370870
public function vote(TokenInterface $token, $object, array $attributes)
    {
        $result = VoterInterface::ACCESS_ABSTAIN;
        if (!$object instanceof FamilyInterface) {
            return $result;
        }
        if (VoterInterface::ACCESS_DENIED === $this->roleHierarchyVoter->vote($token, null, ['ROLE_DATA_MANAGER'])) {
            return VoterInterface::ACCESS_DENIED;
        }
        if (VoterInterface::ACCESS_GRANTED === $this->roleHierarchyVoter->vote($token, null, ['ROLE_DATA_ADMIN'])) {
            return VoterInterface::ACCESS_GRANTED;
        }
        $permissions = $this->extractPermissions($token);

        $result = VoterInterface::ACCESS_DENIED;
        foreach ($attributes as $attribute) {
            if (!$this->supportsAttribute($attribute)) {
                continue;
            }

            foreach ($permissions as $permission) {
                if ($permission->hasPermission($attribute) &&
                    $permission->getFamilyCode() === $object->getCode()
                ) {
                    return VoterInterface::ACCESS_GRANTED;
                }
            }
        }

        return $result;
    }
154432
public function authenticate(TokenInterface $token)
    {
        if (!$this->supports($token)) {
            return null;
        }

        $user = $token->getUser();

        if (!($user instanceof UserInterface)) {
            return null;
        }

        $user = $this->userProvider->refreshUser($user);
        $this->userChecker->checkPostAuth($user);

        $authenticatedToken = new JoomlaToken(
            $user,
            $user->getPassword(),
            $this->providerKey,
            $user->getRoles()
        );
        $authenticatedToken->setAttributes($token->getAttributes());

        return $authenticatedToken;
    }
283461
public function sendEmailToSuperAdmins($subject, $event, $emailBladeFile) {

        // Grab the super administrators who need to be notified from the config settting
        $superAdminEmails = config('auth_frontend_registration_successful_admins_who_receive_notification_email');

        // If there are no super administrators who are specified in the config setting, use the first-among-equals admin
        if (count($superAdminEmails) == 0) {
            $superAdminEmails[] = config('lasallecmsusermanagement.administrator_first_among_equals_email');
        }

        // create data array from the event DTO
        $data = $event->data;

        // Set the data needed to send the email
        $data['subject']   = $subject;
        $data['site_name'] = config('lasallecmsfrontend.site_name');

        // data used in the body of the email, in the blade file
        $data['data']['site_name'] = config('lasallecmsfrontend.site_name');
        $data['data']['id']        = $event->data['id'];

        // Send the notification email to each specified super administrator
        foreach ($superAdminEmails as $superAdminEmail) {

            // ensure that this email is a super admins
            if (!$this->isSuperAdministrator($superAdminEmail)) {
                continue;
            }

            // set the "to" email field
            $data['to'] = $superAdminEmail;

            Mail::queue($emailBladeFile, $data, function ($message) use ($data) {
                $message->subject($data['subject'])
                        ->to($data['to'])
            ;
            });
        }
    }
637124
protected function supports($attribute, $subject)
    {
        if (null !== $subject) {
            return $subject instanceof Payment && in_array($attribute, self::ATTRIBUTES);
        }

        return in_array($attribute, self::ATTRIBUTES);
    }
1234979
public function roleAddSubjectId(Role $role, $subject_id)
    {
        if (!$subject_id) {
            throw new ValidationError("Invalid subject ID");
        }
        $query = "
            INSERT INTO
                auth_subject_role (subject_id, role_id)
            VALUES
                (:subject_id, :role_id)
        ";
        $cur = $this->db->prepare($query);
        $cur->bindValue(":subject_id", $subject_id, PDO::PARAM_INT);
        $cur->bindParam(":role_id", $role->role_id, PDO::PARAM_INT);
        $this->db->beginTransaction();
        try {
            $cur->execute();
            $this->db->commit();
        } catch (PDOException $db_err) {
            $this->db->rollBack();
            if ($this->logger) {
                $this->logger->error("Failed to add subject to role", ['exception' => $db_err]);
            }
            return false;
        }
        return true;
    }
113785
protected function refreshUser(TokenInterface $token)
    {
        $user = $token->getUser();

        if (!$user instanceof UserInterface) {
            return;
        }

        $refreshedUser = $this->userProvider->refreshUser($user);
        $token->setUser($refreshedUser);

        return $token;
    }
211663
public function authenticateToken(TokenInterface $token, UserProviderInterface $userProvider, $providerKey)
    {
        return $this->authenticateApiKeyToken($token, $userProvider, $providerKey);
    }
352408
protected function supports($attribute, $subject): bool
    {
        // if the attribute isn't one we support, return false
        if (!in_array($attribute, [self::RESPOND])) {
            return false;
        }

        // only vote on Groupable objects inside this voter
        if (!$subject instanceof Invitation) {
            return false;
        }

        return true;
    }
561378
private function resolveAuthenticator(TokenInterface $token)
    {
        foreach ($this->authenticators as $authenticator) {
            if ($authenticator->supports($token)) {
                return $authenticator;
            }
        }

        return false;
    }
1304303
public function createToken(TokenInterface $token): TokenInterface
    {
        try {
            $now        = $this->ignoreException(function (): DateTimeImmutable {
                return new DateTimeImmutable();
            });
            $schema     = $this->getDatabaseSchema();
            $hasRefresh = $token->getRefreshValue() !== null;
            $values     = $hasRefresh === false ? [
                $schema->getTokensClientIdentityColumn() => $token->getClientIdentifier(),
                $schema->getTokensUserIdentityColumn()   => $token->getUserIdentifier(),
                $schema->getTokensValueColumn()          => $token->getValue(),
                $schema->getTokensTypeColumn()           => $token->getType(),
                $schema->getTokensIsScopeModified()      => $token->isScopeModified(),
                $schema->getTokensIsEnabledColumn()      => $token->isEnabled(),
                $schema->getTokensValueCreatedAtColumn() => $now,
            ] : [
                $schema->getTokensClientIdentityColumn()   => $token->getClientIdentifier(),
                $schema->getTokensUserIdentityColumn()     => $token->getUserIdentifier(),
                $schema->getTokensValueColumn()            => $token->getValue(),
                $schema->getTokensTypeColumn()             => $token->getType(),
                $schema->getTokensIsScopeModified()        => $token->isScopeModified(),
                $schema->getTokensIsEnabledColumn()        => $token->isEnabled(),
                $schema->getTokensValueCreatedAtColumn()   => $now,
                $schema->getTokensRefreshColumn()          => $token->getRefreshValue(),
                $schema->getTokensRefreshCreatedAtColumn() => $now,
            ];

            $tokenIdentifier = null;
            if (empty($scopeIdentifiers = $token->getScopeIdentifiers()) === false) {
                $this->inTransaction(function () use ($values, $scopeIdentifiers, &$tokenIdentifier) {
                    $this->createResource($values);
                    $tokenIdentifier = $this->getLastInsertId();
                    $this->bindScopeIdentifiers($tokenIdentifier, $scopeIdentifiers);
                });
            } else {
                $this->createResource($values);
                $tokenIdentifier = $this->getLastInsertId();
            }

            $token->setIdentifier($tokenIdentifier)->setValueCreatedAt($now);
            if ($hasRefresh === true) {
                $token->setRefreshCreatedAt($now);
            }

            return $token;
        } catch (RepositoryException $exception) {
            $message = 'Token creation failed';
            throw new RepositoryException($message, 0, $exception);
        }
    }
1099223
private function buildMasterFieldPermissions(SubjectIdentityInterface $subject, array $permissions)
    {
        if ($this->hasConfig($subject->getType())) {
            $map = $this->getConfig($subject->getType())->getMasterFieldMappingPermissions();

            foreach ($permissions as &$permission) {
                if (false !== $key = array_search($permission, $map, true)) {
                    $permission = $key;
                }
            }
        }

        return $permissions;
    }
117610
protected function supports($attribute, $subject)
    {
        $isSupportedAttribute = false;

        foreach ($this->getSupportedAttributes() as $supportedAttributeClass) {
            if ($attribute instanceof $supportedAttributeClass) {
                $isSupportedAttribute = true;
                break;
            }
        }

        return $isSupportedAttribute && $this->supportSubject($subject);
    }
1085385
public function updateValues(TokenInterface $token): void
    {
        try {
            $query = $this->getConnection()->createQueryBuilder();

            $schema = $this->getDatabaseSchema();
            $now    = $this->ignoreException(function (): DateTimeImmutable {
                return new DateTimeImmutable();
            });
            $dbNow  = $this->createTypedParameter($query, $now);
            $query
                ->update($this->getTableNameForWriting())
                ->where($this->getPrimaryKeyName() . '=' . $this->createTypedParameter($query, $token->getIdentifier()))
                ->set($schema->getTokensValueColumn(), $this->createTypedParameter($query, $token->getValue()))
                ->set($schema->getTokensValueCreatedAtColumn(), $dbNow);
            if ($token->getRefreshValue() !== null) {
                $query
                    ->set(
                        $schema->getTokensRefreshColumn(),
                        $this->createTypedParameter($query, $token->getRefreshValue())
                    )->set($schema->getTokensRefreshCreatedAtColumn(), $dbNow);
            }

            $numberOfUpdated = $query->execute();
            assert(is_int($numberOfUpdated) === true);
            if ($numberOfUpdated > 0) {
                $token->setValueCreatedAt($now);
                if ($token->getRefreshValue() !== null) {
                    $token->setRefreshCreatedAt($now);
                }
            }
        } /** @noinspection PhpRedundantCatchClauseInspection */ catch (DBALException $exception) {
            $message = 'Token update failed.';
            throw new RepositoryException($message, 0, $exception);
        }
    }
207017
public function vote(TokenInterface $token, $object, array $attributes)
    {
        if ($object instanceof FieldFacetCollection) {
            //fields right management is done at the Panel level
            return $this->fieldFacetVote($object, $token, strtolower($attributes[0]));
        }

        if ($object instanceof PanelFacet) {
            return $this->panelFacetVote($object, $token, strtolower($attributes[0]));
        } elseif ($object instanceof Facet) {
            //no implementation yet
        }

        return VoterInterface::ACCESS_ABSTAIN;
    }