The Toolbox:

The Symfony security layer

Authentication and authorization

Access COntrol for urls

# app/config/security.yml
security:
    # ...
    access_control:
        - { path: ^/admin, roles: ROLE_USER_IP, ip: 127.0.0.1 }
        - { path: ^/admin, roles: ROLE_USER_HOST, host: symfony\.com$ }
        - { path: ^/admin, roles: ROLE_USER_METHOD, methods: [POST, PUT] }
        - { path: ^/admin, roles: ROLE_USER }

access control for Objects

ACL (Access control LIST)

In complex applications, you will often face the problem that access decisions cannot only be based on the person (Token) who is requesting access, but also involve a domain object that access is being requested for. This is where the ACL system comes in.

                                                              -- symfony.com

Using ACL's isn't trivial, and for simpler use cases, it may be overkill.

                       -- symfony.com

Ok great, but:

• Is a considerable effort
• I have to clarify the ownership
• Access control is a domain logic

Wait...

Voters

The voters are simple services that respond to certain questions and abstain when the question asked is not their responsibility.

interface VoterInterface
{
    const ACCESS_GRANTED = 1;
    const ACCESS_ABSTAIN = 0;
    const ACCESS_DENIED  = -1;

    /**
     * [...]
     */
    public function supportsAttribute($attribute);

    /**
     * [...]
     */
    public function supportsClass($class);

    /**
     * [...]
     */
    public function vote(TokenInterface $token, $object, array $attributes);
}

Attributes

Questions posed to the security system

class RoleVoter implements VoterInterface
{
    private $prefix;

    public function __construct($prefix = 'ROLE_')
    {
        $this->prefix = $prefix;
    }

    public function supportsAttribute($attribute)
    {
        return 0 === strpos($attribute, $this->prefix);
    }

    // ...
}

Decision Strategies

• affermative (default)

• unanimous

• consensus

Ok, let's use a custom voter to implement this feature!

The controller without any kind of security limitation

class ExampleController extends Controller
{
    public function getOrderAction($orderIdentifier)
    {
        if ($orderView = $this->getOrderView($orderIdentifier)) {

            return new JsonResponse($orderView);
        }

        throw $this->createNotFoundException();
    }
    
    private function getOrderView($orderIdentifier)
    {
        return $this
            ->get('example.order.use_case.fetch_order_view_from_order_identifier')
            ->fetch($orderIdentifier);
    }
}

the ownership check service

<?php

namespace Example\Order\Service;

use Example\Order\DTO\OrderView;
use Example\Order\Rule\OrderViewOwnerCheck;
use Example\User\Entity\User;

class OrderViewOwnerChecker implements OrderViewOwnerCheckerInterface
{
    public function checkUserOwnershipOnOrder(User $user, OrderView $orderView)
    {
        return OrderViewOwnerCheck::isThisUserOwnerOfThisOrderView($user, $orderView);
    }
}

Define attributes

<?php

namespace Example\Order\Security\Attributes;

final class OrderViewAttributes
{
    const CAN_READ_THIS_ORDER_VIEW   = 'can_read_this_order_view';
    const CAN_EDIT_THIS_ORDER_VIEW   = 'can_edit_this_order_view';
    const CAN_INSERT_THIS_ORDER_VIEW = 'can_insert_this_order_view';
    const CAN_DELETE_THIS_ORDER_VIEW = 'can_delete_this_order_view';
}

custom voter

class OrderViewReadVoter implements VoterInterface
{
    const ORDER_VIEW_CLASS = 'Example\Order\DTO\OrderView';

    private $orderViewOwnerChecker;

    public function __construct(OrderViewOwnerCheckerInterface $orderViewOwnerChecker)
    {
        $this->orderViewOwnerChecker = $orderViewOwnerChecker;
    }

    public function supportsAttribute($attribute)
    {
        return in_array($attribute, [
            OrderViewAttributes::CAN_READ_THE_ORDER_VIEW
        ], true);
    }

    public function supportsClass($class)
    {
        $reflectionClass = new \ReflectionClass($class);

        return $class === self::ORDER_VIEW_CLASS
            || $reflectionClass->isSubclassOf(self::ORDER_VIEW_CLASS);
    }

    // [...]
}

Configuring the voter

<!-- [...] -->
<service class="Example\Infrastructure\ExampleBundle\Voter\OrderViewReadVoter" 
         id="example_infrastructure.example_bundle.voter.order_view_read_voter">
    <argument id="example_order.domain_service.order_view_owner_checker" type="service"/>
    <tag name="security.voter" />
</service>
<!-- [...] -->

Ask the question to the security context

class ExampleController extends Controller
{
    public function getOrderAction($orderIdentifier)
    {
        if ($orderView = $this->getOrderView($orderIdentifier)) {
            if (!$this->isAuthorized())
            {
                throw $this->createAccessDeniedException();
            }
            return new JsonResponse($orderView);
        }

        throw $this->createNotFoundException();
    }

    private function isAuthorized()
    {
        return $this->get('security.context')
                    ->isGranted(
                        OrderViewAttributes::CAN_READ_THIS_ORDER_VIEW,
                        $orderView
                    );
    }

    private function getOrderView($orderIdentifier)
    {
        return $this->get('example.order.use_case.fetch_order_view_from_order_identifier')
                    ->fetch($orderIdentifier);
    }
}