brzez/access-policy-bundle

symfony-access-policy

Overview

Access checker, inspired by Laravel., _(*1)

It allows for checking access via simple can and cannot methods accessible via the brzez_access_policy.access_policy_provider service., _(*2)

It also extends twig with those two methods as global functions., _(*3)

can needs minimum 2 arguments: - intent - what are you checking access for ex. view, edit etc - object - what object are you checking the access for cannot is just an inverse of can (so !can()), _(*4)

It is also possible to pass additional variables to the can/cannot methods., _(*5)

The 2nd arg is always used for finding the matching policy., _(*6)

The rest are just passed to the policy can*() method., _(*7)

Policy needs to implement AccessPolicyInterface which requires the getPoliciedClass method. Policied objects are checked via, _(*8)

``` php is_a($object, $policy->getPoliciedClass());, <sub>(*9)</sub>

Which means that it will work for mocked entities.
It's also possible to implement 'global' policies for interfaces / parent classes.


Policies are registered as services.

The policy service needs to be tagged as *access_policy* so it will be recognized by the access policy provider.

## Installation

``` bash
composer require brzez/access-policy-bundle

Enable the bundle in the kernel, <sub>(*10)</sub>

``` php // app/AppKernel.php, <sub>(*11)</sub>

public function registerBundles() { $bundles = array( //... new Brzez\AccessPolicyBundle\BrzezAccessPolicyBundle(), //... ); return $bundles; }, <sub>(*12)</sub>

## Registering policies
In **services.yml**

```yml
services:
  test_policy:
    class: AppBundle\TestPolicy
    tags:
      - {name: access_policy}

Naming intent methods

When using can/cannot methods the intent is written in kebab-case, without the can/cannot word., <sub>(*13)</sub>

Example:, <sub>(*14)</sub>

// Will run canChangeStatus($something) on the policy
$this->can('change-status', $something);

// Will return negated canChangeStatus($something)
$this->cannot('change-status', $something);

Usage

PolicyProvider can be accessed via container, <sub>(*15)</sub>

$container->get('brzez_access_policy.access_policy_provider')

Controllers can use Brzez\AccessPolicyBundle\Traits\AccessCheckerTrait which will extend the controller by adding: - can(intent, object) - cannot(intent, object) - getPolicyProvider() methods, <sub>(*16)</sub>

It also adds twig global functions - can(...) and cannot(...) which can be used like this:, <sub>(*17)</sub>

    {% if can('view', someObject) %}
        i can view someObject
    {% endif %}
    {% if cannot('view', someObject) %}
        i cannot view someObject
    {% endif %}

Example

Let's say we have SomeEntity and we need to check view access via our policy., <sub>(*18)</sub>

We need to create SomeEntityPolicy with canView method., <sub>(*19)</sub>

use Brzez\AccessPolicyBundle\Service\AccessPolicyInterface;

class SomeEntityPolicy implements AccessPolicyInterface
{
    public function canView(SomeEntity $entity)
    {
        // access logic here
        return false;
    }
}

Link the policy to the entity, <sub>(*20)</sub>

In app/config/services.yml, <sub>(*21)</sub>

services:
  test_policy:
    class: AppBundle\SomeEntityPolicy
    tags:
      - {name: access_policy}

Now you can check access in the controller:, <sub>(*22)</sub>

use Brzez\AccessPolicyBundle\Traits\AccessCheckerTrait;

class DefaultController extends Controller
{
    use AccessCheckerTrait;
    /**
     * @Route("/", name="homepage")
     */
    public function indexAction(Request $request)
    {
        // get $someObject from somewhere
        ...

        if($this->cannot('view', $someObject)){
            throw new AccessDeniedException('...');
        }

        // render view
        ...
    }
}

You can also check access in twig views:, <sub>(*23)</sub>

    {% if can('view', someObject) %}
        i can view someObject
    {% endif %}
    {% if cannot('view', someObject) %}
        i cannot view someObject
    {% endif %}

Changelog

• 0.9.0 Less strict class checking - is_a (instanceof) instead of strict get_class == classname This way it will work with mocked entities