Description
While rewriting the access decision strategy documentation, I discovered that it probably is quite strange to have this configured at a global level. To me, it makes more sense to specify the strategy on a usage basis.
For instance, imagine a PersonalPost
object. 2 voters are related to this object: UserIsAuthorOfPostVoter
and UserIsAdminVoter
. If one of these grants access, the user is allowed to see this post. Strategy: affirmative
Now imagine the same application to have a ViewRestrictedPost
object. This one has a UserIsMemberVoter
and a UserIsOlderThan18Voter
. In order to see this post, both voters should grant access. Strategy: unanimous
At the moment, unless I'm missing something, this is not possible to do without extending AccessDecisionManager
to add a feature like this.
I imagine something like this would be much nicer:
if ($authorizationChecker->isGranted('VIEW', $personalPost, 'affirmative')) {
// ...
}
if ($authorizationChecker->isGranted('VIEW', $viewRestrictedPost, 'unanimous')) {
// ...
}