Show more information in the security profiler #17887

javiereguiluz · 2016-02-22T15:05:31Z

Q	A
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	#17856
License	MIT
Doc PR	-

This is an early prototype to explore the feature of displaying more information in the security panel. Example:

HeahDude · 2016-02-22T15:23:44Z

Really awesome ! Many thanks for that feature !

xabbuh · 2016-02-23T19:59:00Z

src/Symfony/Component/Security/Core/Authorization/DebugAccessDecisionManager.php

+
+/**
+ * AccessDecisionManager is the base class for all access decision managers
+ * that use decision voters.


This docblock looks wrong.

Fixed. Thanks.

fabpot · 2016-02-29T16:12:06Z

@javiereguiluz Can you rebase as tests have been fixed since your submitted the PR.

fabpot · 2016-02-29T16:16:40Z

src/Symfony/Component/Security/Core/Authorization/DebugAccessDecisionManager.php

+ *
+ * @author Javier Eguiluz <[email protected]>
+ */
+class DebugAccessDecisionManager implements AccessDecisionManagerInterface //extends AccessDecisionManager


The comment should probably be removed here, right?

fabpot · 2016-02-29T16:19:51Z

Apart from my minor comments, 👍

javiereguiluz · 2016-02-29T16:28:58Z

I've made all the requested changes (thanks for the review!) ... but before merging this, it should be tested by someone which works on Symfony apps with complex security needs (maybe @iltar could help us?)

linaori · 2016-02-29T17:02:19Z

@javiereguiluz sadly still running on 2.8 in the application I can test it on properly. The 3.0 upgrade will be done somewhere starting in 2 weeks as we are still gathering deprecations in our production env. Maybe I'll be able to upgrade just the security bundle as most (if not all) of those are already fixed.

linaori · 2016-03-01T08:46:46Z

@javiereguiluz I've downloaded your branch as zip, extracted it and symlinked vendor/symfony/symfony to your branch. However, I cannot get it to work. The error I'm getting is Warning: Invalid argument supplied for foreach():

issue 1

Most important part of the stacktrace:

in SecurityDataCollector.php line 117
at ErrorHandler->handleError('2', 'Invalid argument supplied for foreach()', '/home/ivanderberg/projects/forks/symfony-fix_17856/src/Symfony/Bundle/SecurityBundle/DataCollector/SecurityDataCollector.php', '117', ...)

I've checked the service and it has the DebugAccessDecisionManager which is correct. However, getVoters() returns null. I've checked and setVoters() is never called. I've traced that back to AddSecurityVotersPass:48:

$container->getDefinition('security.access.decision_manager')->addMethodCall('setVoters', array(array_values($voters)));

There's 2 possible solutions:

DebugAccessDecisionManager setVoters()should be removed andgetVoters()should forward the call to$this->manager. Sadly this class doesn't havegetVoters()` yet so it will have to be added.
The setVoters() should also be called on the decorating service. It seems like this is not added because the decoration pass is later (correct me if I'm wrong)

issue 2

After patching either one of the above issues, I have a serialization issue "You cannot serialize or unserialize PDO instances". The @template is being cached now and causes the bug I fixed in this pending PR: sensiolabs/SensioFrameworkExtraBundle#404. However, fixing this issue didn't solve my serialization issue. After digging a bit deeper it made sense... The request also contains your session. This means that if you use a database session storage like I do, it will try to serialize this. This will also fail if you use the @ParamConverter and put objects in your attribute bag.

I've changed DebugAccessDecisionManager:50 to 'object' => is_object($object) ? get_class($object) : gettype($object), and now it works. In the actual PR you might want to use the ClassUtils from doctrine to fetch the actual class though, otherwise you'll see useless proxy names.

After fixing

The following screens are on my login page. The first thing I notice is that the Token column might be redundant.

When I'm logged in, it shows more information on my dashboard. The things I notice:

The attributes are not shown in the most readable format for the most common case (1 attribute).
Column numbers get put on multiple lines
The Token column is redundant
I'm unable to trace back where it came from (but this could be a future PR)

When viewing a page which as a lot of isGranted() checks, it becomes hard to trace back the data. Maybe it could be grouped but that would be annoying to trace back either way. A nice feature that I'm missing is the ability to show the "identifier" of an entity in this case. In this list it looks like I have inconsistent results while in fact it's 80 different entities being checked in a list. Finding the identifier might be nice as it will help debugging a lot but you will run into the same issue I have: linaori/http-bundle#12.

and the list goes on

Looking at a page with less different objects, it becomes a bit of a mess as well.

Conclusion

It's a nice start but with lots of information it becomes a mess really quick. A possible solution would be to group the checks per object (via object hash?) and to add the ID of an object if managed by doctrine (plug & play system so people can hook in?). Additionally the last column could be removed and the attributes shown with the just attribute as comma imploded string.

javiereguiluz · 2016-03-01T12:14:09Z

@iltar thank you very much for your incredible review!!

I've made some changes as requested:

Removed the token column in the decision log
Improved the way we display attributes when there is only 1 attribute
Tried to improve the way objects are represented (this needs to be tested)
Related to previous one: don't store objects to avoid serializing errors
Other minor design tweaks

I still need to fix the setVoters() problem.

linaori · 2016-03-01T13:13:39Z

Once the setVoters() is fixed I'll run it through the application again if I have some time today, otherwise it will be tomorrow. Can you ping me when it's ready to be tested?

javiereguiluz · 2016-03-01T13:51:18Z

@iltar it should be ready for review. Thanks!

linaori · 2016-03-01T15:17:15Z

Not sure if the Request gives the desired effect now, but works for me:

The list is a lot easier to read now but differences between objects is still hard to find. I suppose getting the actual ID field + the value of the object in question (if entity) would be too hard to implement in this patch for now. It's already an improvement but it takes a lot of time to see the different objects.

2 different objects

Many different objects

Found one with a basic type, someone found it necessary to use an ID instead of an object...

Besides of the minor comments (which are hard to fix), I think this shows a lot of usable information already. What I would still like to see is a way to identify an Entity in a generic fashion; I need it mysel and it could be re-used here to show useful info.

I hope this helps 👍

javiereguiluz · 2016-03-01T15:37:43Z

@iltar great! We're making progress here. I've just added a special case to check if getId() method exists to use it instead of the object hash. I think it's worth it because getId() is used very commonly.

linaori · 2016-03-01T17:09:48Z

I agree that this covers most use-cases. In a later stage I would like to ask the entity metadata what the identifier is, but I want this done in a generic fashion as not everything is a doctrine entity for example which probably blows up the scope of this PR.

fabpot · 2016-03-01T17:38:40Z

Good to merge? ping @symfony/deciders

xabbuh · 2016-03-01T20:00:13Z

src/Symfony/Bundle/SecurityBundle/DataCollector/SecurityDataCollector.php

+        // collect voters and access decision manager information
+        if (null !== $this->accessDecisionManager) {
+            $this->data['access_decision_log'] = $this->accessDecisionManager->getDecisionLog();
+            $this->data['voter_strategy'] = $this->accessDecisionManager->getStrategy();


Both the getDecisionLog() and getStrategy() methods may not exist.

Could typehint against the DebugAccessDecisionManager, good to let it crash if you run this incorrectly imo

I've made this change. Is this what you suggested?

-if (null !== $this->accessDecisionManager) { +if ($this->accessDecisionManager instance of DebugAccessDecisionManager) {

javiereguiluz · 2016-03-03T14:54:53Z

I've tested all kinds of attributes and objects and it seems to work as expected:

The Travis errors are unrelated.

linaori · 2016-03-03T15:02:22Z

That looks really nice and useful! 👍

fabpot · 2016-03-04T07:25:33Z

Thank you @javiereguiluz.

…eguiluz) This PR was squashed before being merged into the 3.1-dev branch (closes #17887). Discussion ---------- Show more information in the security profiler | Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #17856 | License | MIT | Doc PR | - This is an early prototype to explore the feature of displaying more information in the security panel. Example: ![profiler_security](https://cloud.githubusercontent.com/assets/73419/13221929/0235fc46-d97e-11e5-981a-249b7148f3a6.png) Commits ------- b12152d Show more information in the security profiler

felipsmartins · 2016-03-07T00:00:47Z

Great great great!!! Congrats @javiereguiluz @iltar

…on (xabbuh) This PR was merged into the 3.1-dev branch. Discussion ---------- [SecurityBundle] fix lowest required Security Core version | Q | A | ------------- | --- | Branch | master | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #17887 | License | MIT | Doc PR | Commits ------- 4283cd7 fix lowest required Security Core version

…(javiereguiluz) This PR was squashed before being merged into the 3.1-dev branch (closes symfony#17887). Discussion ---------- Show more information in the security profiler | Q | A | ------------- | --- | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | symfony#17856 | License | MIT | Doc PR | - This is an early prototype to explore the feature of displaying more information in the security panel. Example: ![profiler_security](https://cloud.githubusercontent.com/assets/73419/13221929/0235fc46-d97e-11e5-981a-249b7148f3a6.png) Commits ------- b12152d Show more information in the security profiler

javiereguiluz added Feature WebProfilerBundle labels Feb 22, 2016

carsonbot added the Status: Needs Review label Feb 22, 2016

javiereguiluz mentioned this pull request Feb 22, 2016

[RFC] Show voter information in the security profiler panel #17856

Closed

xabbuh reviewed Feb 23, 2016
View reviewed changes

javiereguiluz added 5 commits February 29, 2016 17:15

Show more information in the security profiler

4f37d7a

Try to fix the test issues

c9bfc30

Minor refactoring

5e46d23

Another refactor to fix tests

879d671

Fixed the PHPdoc od the new class

378db40

javiereguiluz force-pushed the fix_17856 branch from 87f474b to 378db40 Compare February 29, 2016 16:15

fabpot reviewed Feb 29, 2016
View reviewed changes

Made the changes asked for by reviewers

9349fdf

Improvements after Iltar's review

597bc48

Fixed fabbot issues

ca6da19

Fixes and tweaks

e20948e

Improved the string representation of the objects

367f8ea

Display the contents when the object is not a true object

89bc8c0

xabbuh reviewed Mar 1, 2016
View reviewed changes

javiereguiluz added 3 commits March 2, 2016 08:48

Made code more robust

97111f3

Take care of the null objects

8b36d15

Fixed a syntax error

4864976

Minor Twig change

f3db034

fabpot closed this Mar 4, 2016

xabbuh mentioned this pull request Mar 10, 2016

[SecurityBundle] fix lowest required Security Core version #18086

Merged

linaori mentioned this pull request Apr 15, 2016

AccessDecisionManager can not be injected into Voter anymore #18554

Closed

fabpot mentioned this pull request May 13, 2016

Release v3.1.0-BETA1 #18776

Merged

linaori mentioned this pull request Oct 6, 2016

[security] Proposal: a way to know what voter refused the access #20168

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Show more information in the security profiler #17887

Show more information in the security profiler #17887

javiereguiluz commented Feb 22, 2016

HeahDude commented Feb 22, 2016

xabbuh Feb 23, 2016

javiereguiluz Feb 25, 2016

fabpot commented Feb 29, 2016

fabpot Feb 29, 2016

fabpot commented Feb 29, 2016

javiereguiluz commented Feb 29, 2016

linaori commented Feb 29, 2016

linaori commented Mar 1, 2016

javiereguiluz commented Mar 1, 2016

linaori commented Mar 1, 2016

javiereguiluz commented Mar 1, 2016

linaori commented Mar 1, 2016

javiereguiluz commented Mar 1, 2016

linaori commented Mar 1, 2016

fabpot commented Mar 1, 2016

xabbuh Mar 1, 2016

linaori Mar 1, 2016

javiereguiluz Mar 2, 2016

javiereguiluz commented Mar 3, 2016

linaori commented Mar 3, 2016

fabpot commented Mar 4, 2016

felipsmartins commented Mar 7, 2016

Show more information in the security profiler #17887

Show more information in the security profiler #17887

Conversation

javiereguiluz commented Feb 22, 2016

HeahDude commented Feb 22, 2016

xabbuh Feb 23, 2016

Choose a reason for hiding this comment

javiereguiluz Feb 25, 2016

Choose a reason for hiding this comment

fabpot commented Feb 29, 2016

fabpot Feb 29, 2016

Choose a reason for hiding this comment

fabpot commented Feb 29, 2016

javiereguiluz commented Feb 29, 2016

linaori commented Feb 29, 2016

linaori commented Mar 1, 2016

issue 1

issue 2

After fixing

Conclusion

javiereguiluz commented Mar 1, 2016

linaori commented Mar 1, 2016

javiereguiluz commented Mar 1, 2016

linaori commented Mar 1, 2016

javiereguiluz commented Mar 1, 2016

linaori commented Mar 1, 2016

fabpot commented Mar 1, 2016

xabbuh Mar 1, 2016

Choose a reason for hiding this comment

linaori Mar 1, 2016

Choose a reason for hiding this comment

javiereguiluz Mar 2, 2016

Choose a reason for hiding this comment

javiereguiluz commented Mar 3, 2016

linaori commented Mar 3, 2016

fabpot commented Mar 4, 2016

felipsmartins commented Mar 7, 2016