Sonata admin bundle, how to use entity repository classes

Question

1. Using this code in PropertyAdmin extends Admin :

   public function createQuery($context = 'list')
   {   
   $user = $this->getConfigurationPool()->getContainer()->get('security.context')->getToken()->getUser();
   $query = $this->getModelManager()->createQuery($this->getClass(), 'o');
   $query->where('o.Creator=:creator')->setParameter("creator", $user);
   return $query;
   }
   

I was able to limit "list" results to those who "belong" to logged admin ie. only Properties (that is an entity) created by logged admin.

The problem: By manually changing the URL (id value like 1, 2...), I can edit Property that belongs to other user. For edit action, above query is not called at all. How to change that behavior?

2.Instead of putting query in controllers, can I fetch it from PropertyRepository class? That would keep logic in models for which I could write unit tests.

3.I am trying: ProductAdmin extends AdminHelper {....} AdminHelper extends Admin { .... }

But it fails saying "Cannot import resource "D:_development\rent2\app/config." from "D:_development\rent2\app/config\routing.yml".

AdminHelper is abstract class but Sonata still reads it. Any solution?

Answer 1

1.a) Use ACL for your objects, CRUD controller has permission checking.

1.b) Redefine edit action, make sure that user tries to edit property that belongs to him, something similar to Page Admin Controller, there create action is redefined

2) In controller $this->getConfigurationPool()->getContainer()->get('doctrine')->getRepository($this->getClass()); gives you access to repository registered for this model. Probably there are few other ways to get service container and entity manager from it.

3) To create your admin class you should extend Sonata Admin: docs for this, this problem does not seems to be related to sonata as for me. Can you please provide content for D:_development\rent2\app/config\routing.yml ?