feat(symfony): isGranted before provider #7500
Conversation
soyuka
force-pushed
the
isgranted
branch
4 times, most recently
from
db77ad4 to
75e24e9
Compare
soyuka
force-pushed
the
isgranted
branch
5 times, most recently
from
7da1eef to
f13daf2
Compare
| public function provide(Operation $operation, array $uriVariables = [], array $context = []): object|array|null | ||
| { | ||
| switch ($this->event) { | ||
| case 'post_denormalize': |
There was a problem hiding this comment.
Nit: maybe move these constants to an @internal class constants, so we can reference them in the XML files?
| ]; | ||
| } | ||
|
|
||
| if ('pre_read' === $this->event && $this->resourceAccessChecker instanceof ObjectVariableCheckerInterface && $this->resourceAccessChecker->usesObjectVariable($isGranted, $resourceAccessCheckerContext)) { |
There was a problem hiding this comment.
| if ('pre_read' === $this->event && $this->resourceAccessChecker instanceof ObjectVariableCheckerInterface && $this->resourceAccessChecker->usesObjectVariable($isGranted, $resourceAccessCheckerContext)) { | |
| if ($preRead && $this->resourceAccessChecker instanceof ObjectVariableCheckerInterface && $this->resourceAccessChecker->usesObjectVariable($isGranted, $resourceAccessCheckerContext)) { |
There was a problem hiding this comment.
Also, there is likely a missing test, because the missing use statement hasn't been caught.
src/Symfony/Security/State/IsGrantedAccessCheckerProvider.php.bak
Outdated
Show resolved
Hide resolved
|
|
||
| #[ApiResource( | ||
| operations: [ | ||
| new Get(uriTemplate: 'is_granted_tests/{id}', security: 'is_granted("ROLE_ADMIN")', uriVariables: ['id'], provider: [self::class, 'provide']), |
There was a problem hiding this comment.
Is the test really working? Because I expected object in the expression where provider is called before security check
There was a problem hiding this comment.
Yes this test is working, when no object is present in the security check it'll be called before the provider. If object is present it'll be called after.
There was a problem hiding this comment.
Okay, that's on me then. I expected the test to work a little bit differently and I was looking for tests both with and without object in security to see that it behaves correctly in all cases
3 participants
#[ApiResource( operations: [ new Get(uriTemplate: 'is_granted_test_call_provider/{id}', uriVariables: ['id'], security: 'is_granted("ROLE_ADMIN")', provider: [self::class, 'provideShouldNotBeCalled']), ] )] class IsGrantedTest { private ?int $id = null; public function getId(): ?int { return $this->id; } public static function provideShouldNotBeCalled(Operation $operation, array $uriVariables = [], array $context = []) { throw new \RuntimeException('provider should not get called'); } }