Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Security] Allow to override access decision strategy in isGranted #15130

Closed
@wouterj

Description

@wouterj

While rewriting the access decision strategy documentation, I discovered that it probably is quite strange to have this configured at a global level. To me, it makes more sense to specify the strategy on a usage basis.

For instance, imagine a PersonalPost object. 2 voters are related to this object: UserIsAuthorOfPostVoter and UserIsAdminVoter. If one of these grants access, the user is allowed to see this post. Strategy: affirmative

Now imagine the same application to have a ViewRestrictedPost object. This one has a UserIsMemberVoter and a UserIsOlderThan18Voter. In order to see this post, both voters should grant access. Strategy: unanimous

At the moment, unless I'm missing something, this is not possible to do without extending AccessDecisionManager to add a feature like this.

I imagine something like this would be much nicer:

if ($authorizationChecker->isGranted('VIEW', $personalPost, 'affirmative')) {
    // ...
}

if ($authorizationChecker->isGranted('VIEW', $viewRestrictedPost, 'unanimous')) {
    // ...
}

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions