Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[Security] Allow to override access decision strategy in isGranted #15130

Copy link
Copy link
Closed
@wouterj

Description

@wouterj
Issue body actions

While rewriting the access decision strategy documentation, I discovered that it probably is quite strange to have this configured at a global level. To me, it makes more sense to specify the strategy on a usage basis.

For instance, imagine a PersonalPost object. 2 voters are related to this object: UserIsAuthorOfPostVoter and UserIsAdminVoter. If one of these grants access, the user is allowed to see this post. Strategy: affirmative

Now imagine the same application to have a ViewRestrictedPost object. This one has a UserIsMemberVoter and a UserIsOlderThan18Voter. In order to see this post, both voters should grant access. Strategy: unanimous

At the moment, unless I'm missing something, this is not possible to do without extending AccessDecisionManager to add a feature like this.

I imagine something like this would be much nicer:

if ($authorizationChecker->isGranted('VIEW', $personalPost, 'affirmative')) {
    // ...
}

if ($authorizationChecker->isGranted('VIEW', $viewRestrictedPost, 'unanimous')) {
    // ...
}

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      Morty Proxy This is a proxified and sanitized view of the page, visit original site.