Backend Record Validators

<?php

namespace App\Data\Service\Record\RecordValidators;

use App\Data\Entity\Record;
use SugarBean;

interface RecordValidatorInterface
{
    public function getKey(): string;
    public function getModule(): string;
    public function getOrder(): int;
    public function getModes(): array;
    public function validate(Record $record, SugarBean $bean): void;
}

<?php

namespace App\Extension\defaultExt\modules\Contacts\Service\Record\Validators;

use App\Data\Entity\Record;
use App\Data\Service\Record\RecordValidators\RecordValidatorInterface;
use SugarBean;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;

class ContactsEmailRequiredValidator implements RecordValidatorInterface
{
    public function getKey(): string
    {
        return 'contacts-email-required';
    }

    public function getModule(): string
    {
        return 'Contacts';
    }

    public function getOrder(): int
    {
        return 0;
    }

    public function getModes(): array
    {
        return ['save'];
    }

    public function validate(Record $record, SugarBean $bean): void
    {
        $attributes = $record->getAttributes() ?? [];
        $email = $attributes['email1'] ?? '';

        if (empty($email)) {
            throw new AccessDeniedHttpException('An email address is required');
        }
    }
}

<?php

namespace App\Module\Users\Service\Record\Validators;

use App\Data\Entity\Record;
use App\Data\Service\Record\RecordValidators\RecordValidatorInterface;
use App\Engine\LegacyHandler\LegacyHandler;
use App\Engine\LegacyHandler\LegacyScopeState;
use SugarBean;
use Symfony\Component\HttpFoundation\RequestStack;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;

class UsersSaveValidator extends LegacyHandler implements RecordValidatorInterface
{
    public const HANDLER_KEY = 'users-admin-only-save-handler';

    public function __construct(
        string $projectDir,
        string $legacyDir,
        string $legacySessionName,
        string $defaultSessionName,
        LegacyScopeState $legacyScopeState,
        RequestStack $session
    ) {
        parent::__construct($projectDir, $legacyDir, $legacySessionName, $defaultSessionName, $legacyScopeState, $session);
    }

    public function getHandlerKey(): string
    {
        return self::HANDLER_KEY;
    }

    public function getKey(): string
    {
        return 'users-admin-only-save';
    }

    public function getModule(): string
    {
        return 'Users';
    }

    public function getOrder(): int
    {
        return 0;
    }

    public function getModes(): array
    {
        return ['save'];
    }

    public function validate(Record $record, SugarBean $bean): void
    {
        $this->init();

        global $current_user;

        // Admins can always save
        if (is_admin($current_user)) {
            $this->close();
            return;
        }

        // Non-admins can only edit their own profile
        $isUpdate = !empty($bean->id) && empty($bean->new_with_id);
        if ($isUpdate && $bean->id === $current_user->id) {
            $this->close();
            return;
        }

        $this->close();
        throw new AccessDeniedHttpException('Not authorized to save user records');
    }
}