[Workflow] add guard is_valid() method support #23499

halundraN · 2017-07-13T13:30:56Z

Q	A
Branch?	3.4
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	Yes
License	MIT

Workflow guard configuration support expression language like is_fully_authenticated(), has_role() or is_granted(), etc...
I would like to add the support for a new is_valid() expression.
Configuration allow to validate subject against specific validation groups to check if a transition can be applied.

In the next configuration exemple, my issue must validate "affectable" validation group to apply "affect" transistion:

framework:
    workflows:
        issue:
            marking_store:
                type: single_state
                arguments:
                    - state
            supports: AppBundle\Entity\Issue
            initial_place: created
            places:
                - created
                - affected
                - closed
            transitions:
                affect:
                    guard: "is_valid(subject, ['affectable'])"
                    from: created
                    to:   affected
                close:
                    from: completed
                    to: closed

fabpot · 2017-07-14T07:49:02Z

/cc @lyrixx

lyrixx

I like the idea, but some code need to be updated.

lyrixx · 2017-07-17T08:21:07Z

src/Symfony/Component/Workflow/EventListener/ExpressionLanguage.php

@@ -29,5 +29,13 @@ protected function registerFunctions()
        }, function (array $variables, $attributes, $object = null) {
            return $variables['auth_checker']->isGranted($attributes, $object);
        });
+
+        $this->register('is_valid', function ($object = 'null', $groups = 'null') {
+            return sprintf('$validator->validate(%s, null, %s)', $object, $groups);


you should add count() === 0 here too

lyrixx · 2017-07-17T08:22:49Z

src/Symfony/Component/Workflow/EventListener/GuardListener.php

+        AuthorizationCheckerInterface $authenticationChecker,
+        AuthenticationTrustResolverInterface $trustResolver,
+        ValidatorInterface $validator,
+        RoleHierarchyInterface $roleHierarchy = null


should be on one line

could you put the validator at the last position?

could you make the validator optional to preserve the BC + a runtime exception is the validator is not defined but the user want to use it.

lyrixx · 2017-07-17T09:30:13Z

👍

halundraN · 2017-07-18T07:53:51Z

Hello @lyrixx is there something else i can do ?
The build fails but it seems that it does not come from my developments.

lyrixx · 2017-07-18T08:20:44Z

@alain-flaus Nothing ;) I'm just waiting for the "2 days" ;)

Actually, could you rebase and push -f ?

halundraN · 2017-07-18T08:43:56Z

@lyrixx ok rebase done. Thanks!

lyrixx · 2017-07-20T16:38:45Z

Sorry, I forgot to ask you to add a note in the CHANGELOG.
Could you do it? I'm gonna merge it just after ;)

halundraN · 2017-07-20T18:12:12Z

@lyrixx Hi, I updated the CHANGELOG but I'm not sure about my modification, is it ok?

lyrixx · 2017-07-21T08:21:20Z

CHANGELOG-3.3.md

@@ -7,6 +7,8 @@ in 3.3 minor versions.
 To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
 To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v3.3.0...v3.3.1

+ * feature #23499 [Workflow] add guard is_valid() method support


Your need to update this changelog only

The current one is updated automatically.

halundraN · 2017-07-21T11:25:32Z

@lyrixx ok done!

xabbuh · 2017-07-21T12:21:09Z

src/Symfony/Component/Workflow/CHANGELOG.md

+3.4.0
+-----
+
+ * Add guard is_valid() method support


is_valid() should be enclosed by backticks

xabbuh · 2017-07-21T12:21:52Z

src/Symfony/Component/Workflow/EventListener/ExpressionLanguage.php

+            return sprintf('count($validator->validate(%s, null, %s)) === 0', $object, $groups);
+        }, function (array $variables, $object = null, $groups = null) {
+            if (!$variables['validator'] instanceof ValidatorInterface) {
+                throw new RuntimeException('Validator not defined, did you install the component ?');


the space in front of the question mark should be removed

xabbuh · 2017-07-21T12:24:31Z

src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

@@ -633,6 +633,7 @@ private function registerWorkflowConfiguration(array $workflows, ContainerBuilde
                    new Reference('security.authorization_checker'),
                    new Reference('security.authentication.trust_resolver'),
                    new Reference('security.role_hierarchy'),
+                    new Reference('validator'),


this will fail when the Validator component is not installed or the validation section is not enabled

Ok, I will add :

new Reference('validator', ContainerInterface::NULL_ON_INVALID_REFERENCE),

Should I also add

new Reference('security.role_hierarchy', ContainerInterface::NULL_ON_INVALID_REFERENCE),

As $roleHierarchy parameter in Symfony\Component\Workflow\EventListener\GuardListener can be null too ?

that should be done on older branches as a bugfix

xabbuh · 2017-07-21T12:50:47Z

src/Symfony/Component/Workflow/EventListener/GuardListener.php


-    public function __construct($configuration, ExpressionLanguage $expressionLanguage, TokenStorageInterface $tokenStorage, AuthorizationCheckerInterface $authenticationChecker, AuthenticationTrustResolverInterface $trustResolver, RoleHierarchyInterface $roleHierarchy = null)
+    public function __construct($configuration, ExpressionLanguage $expressionLanguage, TokenStorageInterface $tokenStorage, AuthorizationCheckerInterface $authenticationChecker, AuthenticationTrustResolverInterface $trustResolver, RoleHierarchyInterface $roleHierarchy = null, ValidatorInterface $validator = null)


I wonder if we shouldn't register a new listener with the validator as this part is not a security related listener

I may be wrong, but I thought that the "guard" option was designed to protect the execution of the transition and not only from a security point of view.

In this case, this does seem to me problematic that the expresion is_valid is in the guard listener ?

My fear is that the GuardListener could potentially become very big in the future if add support for other things here. Maybe splitting it into a SecurityGuardListener (as a replacement for the existing one) and a ValidatorGuardListener could be an idea.

I don't know how many types of conditions can bloc a transistion but yes we can imagine a lot of thing.

Then I could split GuardListener into SecurityGuardListener (the same as GuardListener before my PR) and a ValidatorGuardListener with the new behavior.

In FrameworkExtension, I need to create a new definition for ValidatorGuardListener.
For the definition id are you ok with :

sprintf('%s.listener.guard.security', $workflowId) and sprintf('%s.listener.guard.validator', $workflowId)

And I plug it on the same event ?

sprintf('workflow.%s.guard.%s', $name, $transitionName)

looks okay to me, but let's wait for @lyrixx and the other @symfony/deciders to share their opinion before spending time on this

I think adding a new listener event is a bad idea, you should only use the guard event.

Then, the GuardListener name is not very well chosen indeed. I should have name it ExpressionGuardListener

Finally, splitting it in 2 parts will be hard because you will need to duplicate everything (config in the .yml, .xml etc etc). More over the end user will not be able to mix security stuff and validation stuff in the same expression.

So I'm 👍 with the current implement (except you need to fix issue spotted by @xabbuh)

Ok. I made a code review commit but I don't understand why github don't close "is_valid() should be enclosed by backticks" discussion because it's done (you can see it in the files changed).

Don't worry I see it in the diff.
I guess it's because you have an anchor in your URL, so github re-expand it

lyrixx · 2017-07-21T14:00:24Z

👍

lyrixx · 2017-07-21T14:11:01Z

@xabbuh Is that OK for you?

javiereguiluz · 2017-07-26T08:16:25Z

src/Symfony/Component/Workflow/EventListener/ExpressionLanguage.php

+
+            $errors = $variables['validator']->validate($object, null, $groups);
+
+            return count($errors) === 0;


Minor comment. Should this be changed to return 0 === count($errors); ?

Simperfit · 2017-07-26T09:55:24Z

src/Symfony/Component/Workflow/EventListener/ExpressionLanguage.php

@@ -29,5 +31,17 @@ protected function registerFunctions()
        }, function (array $variables, $attributes, $object = null) {
            return $variables['auth_checker']->isGranted($attributes, $object);
        });
+
+        $this->register('is_valid', function ($object = 'null', $groups = 'null') {
+            return sprintf('count($validator->validate(%s, null, %s)) === 0', $object, $groups);


same here, should be yoda style

lyrixx · 2017-08-21T09:54:43Z

Failures on AppVeyor are not related.

👍

fabpot · 2017-08-22T20:46:34Z

src/Symfony/Component/Workflow/EventListener/ExpressionLanguage.php

+            return sprintf('0 === count($validator->validate(%s, null, %s))', $object, $groups);
+        }, function (array $variables, $object = null, $groups = null) {
+            if (!$variables['validator'] instanceof ValidatorInterface) {
+                throw new RuntimeException('Validator not defined, did you install the component?');


is_valid cannot be used as the Validator component is not installed.

fabpot · 2017-08-22T20:47:33Z

src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Compiler/WorkflowGuardListenerPass.php

+            'security.authorization_checker',
+            'security.authentication.trust_resolver',
+            'security.role_hierarchy',
+            'validator',


That makes validator a new "hard" requirement? Why?

Are you suggesting to inject null instead of the validator service if this one is not available?
If yes, It's a good idea. I will update the PR.

lyrixx · 2017-10-05T16:52:25Z

I totally forgot this PR. I rebased it on top of master (I guess it's toot late for 3.4?)
And I addressed Fab's comments

fabpot · 2017-10-05T22:42:47Z

src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

@@ -589,6 +590,10 @@ private function registerWorkflowConfiguration(array $config, ContainerBuilder $
                    throw new LogicException('Cannot guard workflows as the Security component is not installed.');
                }

+                if (!interface_exists(ValidatorInterface::class)) {
+                    throw new LogicException('Cannot guard workflows as the Validator component is not installed.');
+                }


This should be removed now, right?

Good catch. Fixed.

fabpot · 2017-10-05T22:43:02Z

src/Symfony/Component/Workflow/CHANGELOG.md

@@ -9,6 +9,7 @@ CHANGELOG
 3.4.0
 -----

+ * Add guard `is_valid()` method support.


fabpot · 2017-10-06T14:35:52Z

@lyrixx Can you fix fabbot error and rebase before I merge? Thanks.

fabpot · 2017-10-06T15:47:25Z

Thank you @alain-flaus.

…flaus, lyrixx) This PR was merged into the 3.4 branch. Discussion ---------- [Workflow] add guard is_valid() method support | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | Yes | License | MIT Workflow guard configuration support expression language like **is_fully_authenticated()**, **has_role()** or **is_granted()**, etc... I would like to add the support for a new **is_valid()** expression. Configuration allow to validate subject against specific validation groups to check if a transition can be applied. In the next configuration exemple, my issue must validate "affectable" validation group to apply "affect" transistion: ```yaml framework: workflows: issue: marking_store: type: single_state arguments: - state supports: AppBundle\Entity\Issue initial_place: created places: - created - affected - closed transitions: affect: guard: "is_valid(subject, ['affectable'])" from: created to: affected close: from: completed to: closed ``` Commits ------- 06d8198 [Workflow] Added tests for the is_valid() guard expression 9499bc2 [Workflow] Added guard 'is_valid()' method support

halundraN · 2017-10-06T16:37:59Z

Hello! Glad to have contributed.
I am sorry some personal problems have limited my availability.
Thanks to you, @lyrixx and @fabpot for finalizing.

lyrixx · 2017-10-06T16:44:41Z

@fabpot Sorry, I did not see your message sooner :/

carsonbot added Status: Needs Review Workflow Feature labels Jul 13, 2017

halundraN force-pushed the workflow_guard_is_valid branch from b89df24 to 30c3f13 Compare July 13, 2017 14:01

nicolas-grekas added this to the 3.4 milestone Jul 17, 2017

lyrixx requested changes Jul 17, 2017

View reviewed changes

halundraN force-pushed the workflow_guard_is_valid branch 2 times, most recently from cf7d0d9 to 6293a4c Compare July 17, 2017 09:08

Simperfit approved these changes Jul 18, 2017

View reviewed changes

lyrixx approved these changes Jul 18, 2017

View reviewed changes

halundraN force-pushed the workflow_guard_is_valid branch from 6293a4c to adb227f Compare July 18, 2017 08:42

lyrixx reviewed Jul 21, 2017

View reviewed changes

halundraN force-pushed the workflow_guard_is_valid branch from 1e8e0f6 to c1fc500 Compare July 21, 2017 11:24

xabbuh reviewed Jul 21, 2017

View reviewed changes

xabbuh requested changes Jul 21, 2017

View reviewed changes

xabbuh reviewed Jul 21, 2017

View reviewed changes

xabbuh mentioned this pull request Jul 24, 2017

[FrameworkBundle][Workflow] better errors when security deps are missing #23638

Merged

javiereguiluz reviewed Jul 26, 2017

View reviewed changes

Simperfit reviewed Jul 26, 2017

View reviewed changes

lyrixx force-pushed the workflow_guard_is_valid branch 4 times, most recently from d56974a to c193d37 Compare August 21, 2017 09:45

fabpot requested changes Aug 22, 2017

View reviewed changes

lyrixx force-pushed the workflow_guard_is_valid branch from c193d37 to 5969d68 Compare October 5, 2017 16:51

lyrixx changed the base branch from 3.4 to master October 5, 2017 16:52

carsonbot added Status: Needs Work and removed Status: Needs Review labels Oct 5, 2017

fabpot requested changes Oct 5, 2017

View reviewed changes

halundraN and others added 2 commits October 6, 2017 10:13

[Workflow] Added guard 'is_valid()' method support

9499bc2

[Workflow] Added tests for the is_valid() guard expression

06d8198

lyrixx force-pushed the workflow_guard_is_valid branch from 5969d68 to 06d8198 Compare October 6, 2017 08:14

lyrixx changed the base branch from master to 3.4 October 6, 2017 08:14

lyrixx mentioned this pull request Oct 6, 2017

[Workfow] Management of expressions in guard Listerner (and all others components) #24454

Closed

carsonbot added Status: Reviewed and removed Status: Needs Work labels Oct 6, 2017

fabpot approved these changes Oct 6, 2017

View reviewed changes

fabpot merged commit 06d8198 into symfony:3.4 Oct 6, 2017

xabbuh mentioned this pull request Oct 9, 2017

[Workflow] documentation for the is_valid() function symfony/symfony-docs#8499

Closed

This was referenced Oct 18, 2017

Release v3.4.0-BETA1 #24609

Merged

Release v4.0.0-BETA1 #24612

Merged

Guite mentioned this pull request Dec 13, 2017

Symfony 3.4 Guite/MostGenerator#1171

Closed

17 tasks


		public function __construct($configuration, ExpressionLanguage $expressionLanguage, TokenStorageInterface $tokenStorage, AuthorizationCheckerInterface $authenticationChecker, AuthenticationTrustResolverInterface $trustResolver, RoleHierarchyInterface $roleHierarchy = null)
		public function __construct($configuration, ExpressionLanguage $expressionLanguage, TokenStorageInterface $tokenStorage, AuthorizationCheckerInterface $authenticationChecker, AuthenticationTrustResolverInterface $trustResolver, RoleHierarchyInterface $roleHierarchy = null, ValidatorInterface $validator = null)


		$errors = $variables['validator']->validate($object, null, $groups);

		return count($errors) === 0;

[Workflow] add guard is_valid() method support #23499

[Workflow] add guard is_valid() method support #23499

Conversation

halundraN commented Jul 13, 2017 • edited by lyrixx Loading

fabpot commented Jul 14, 2017

lyrixx left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lyrixx commented Jul 17, 2017

halundraN commented Jul 18, 2017

lyrixx commented Jul 18, 2017

halundraN commented Jul 18, 2017

lyrixx commented Jul 20, 2017

halundraN commented Jul 20, 2017

lyrixx Jul 21, 2017 • edited Loading

Choose a reason for hiding this comment

halundraN commented Jul 21, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

halundraN Jul 21, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

halundraN Jul 21, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lyrixx commented Jul 21, 2017

lyrixx commented Jul 21, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lyrixx commented Aug 21, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lyrixx commented Oct 5, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fabpot commented Oct 6, 2017

fabpot commented Oct 6, 2017

halundraN commented Oct 6, 2017

lyrixx commented Oct 6, 2017

halundraN commented Jul 13, 2017 •

edited by lyrixx

Loading

lyrixx Jul 21, 2017 •

edited

Loading

halundraN Jul 21, 2017 •

edited

Loading

halundraN Jul 21, 2017 •

edited

Loading