How to get dynamic security privileges with Symfony Security

Question

I'm need to do add custom access law to my access control on Symfony, I try to explain me. I have a web application with some customer, and I want to able the access of some part of the code when that customer have the right plugin. So this is my customer:

namespace AppBundle\Entity;

class CustomerProfile{

private $id;

private $user;

private $plugins;
}

The Entity for the Plugin

namespace AppBundle\Entity;

class Plugin{

private $id;

private $name;

private $customerProfiles;
}

I use doctrine for the relations so from customer i can get his plugins. For example, we have 2 customer and 2 plugin:

AppBundle\Entity\CustomerProfile:
customer_1:
    user: '@user_1'
    plugins: ['@plugin_1','@plugin_2']
customer_2:
    user: '@user_2'
    plugins: ['@plugin_1']

AppBundle\Entity\Plugin:
plugin_1:
    name: 'plugin 1' 
plugin_2:
    name: 'plugin 2'

In my project all the code about customer is under the /customer namespace, Symfony like, and all work.

access_control:
    - { path: ^/customer, roles: ROLE_CUSTOMER }

But, for this customer with different plugin i would set an dinamic access control, but i don't know how. I need to control something like this:

access_control:
    - { path: ^/code_for_plugin_1, roles: ROLE_CUSTOMER_WHIT_PLUGIN_1}
    - { path: ^/code_for_plugin_2, roles: ROLE_CUSTOMER_WHIT_PLUGIN_2}

but I think the good way is set a "sub role" (if exist) to set for each customer that have a plugin a role to access in that namespace.

I hope I was clear enough, thanks for help.

Answer 1

I would suggest to use custom voter rather than the access_control and role approach as this is in my opinion more flexible for your use case. Your suggested solution requires a generated role (ROLE_CUSTOMER_WHIT_PLUGIN_{X}) for every plugin, which in case of adding pluggins dynamically would just not work.

Check the How to Use Voters to Check User Permissions article in Symfony documentation for more detail.

You basically need to implement a user voter which will check if the logged user has an access to requested resource. In your case it would look similar to this:

/src/YourBundle/Controller/YourController.php

<?php

...

class YourController extends Controller
{

    public function getFooAction($id)
    {
        $this->denyAccessUnlessGranted(YourVoter::VIEW_FOO);

        // ...method logic
    }

    public function getBarAction($id)
    {
        $this->denyAccessUnlessGranted(YourVoter::VIEW_BAR);

        // ...method logic
    }
}

/src/YourBundle/Security/YourVoter.php

<?php

...

class YourVoter extends AbstractVoter
{
    const VIEW_FOO = 'YOUR_VIEW_FOO';
    const VIEW_BAR = 'YOUR_VIEW_BAR';

    public function getVoterAttributes()
    {
        return [self::VIEW_FOO, self::VIEW_BAR,];
    }

    protected function supports($attribute, $subject)
    {
        ...
    }

    protected function voteOnAttribute($attribute, $item, TokenInterface $token)
    {
        $user = $token->getUser();
        if (!$user instanceof User) {
            return false;
        }

        switch ($attribute) {
            case self::VIEW_FOO:
                return $this->canViewFoo($user);
            case self::VIEW_BAR:
                return $this->canViewBar($user);
        }

        throw new \Exception(sprintf(
            'Invalid vote attribute "%s".',
            $attribute
        ));
    }

    private function canViewFoo(User $user)
    {
        return $user->getProfile()->hasRoleFooXYZ()
    }


    private function canViewBar(User $user)
    {
        return $user->getProfile()->hasRoleBarXYZ()
    }
}