Sf2SecurityVoters.md

Разграничение прав

Реализация

Реализация VoterInterface:

class AccessVoter implements VoterInterface
{
    /**
     * Checks if the voter supports the given attribute.
     *
     * @param string $attribute An attribute
     *
     * @return Boolean true if this Voter supports the attribute, false otherwise
     */
    public function supportsAttribute($attribute)
    {
     	// $attribute = 'EDIT' | 'DELETE' | 'UPDATE' | ...
        return true;
    }

    /**
     * Checks if the voter supports the given class.
     *
     * @param string $class A class name
     *
     * @return Boolean true if this Voter can process the class
     */
    public function supportsClass($class)
    {
        return in_array($class, array(
            'Artsofte\SomeBundle\Propel\OurSecureModel',
        ));
    }

    /**
     * Returns the vote for the given parameters.
     *
     * This method must return one of the following constants:
     * ACCESS_GRANTED, ACCESS_DENIED, or ACCESS_ABSTAIN.
     *
     * @param TokenInterface $token A TokenInterface instance
     * @param object         $object The object to secure
     * @param array          $attributes An array of attributes associated with the method being invoked
     *
     * @return integer either ACCESS_GRANTED, ACCESS_ABSTAIN, or ACCESS_DENIED
     */
    public function vote(TokenInterface $token, $object, array $attributes)
    {
		// $token->getUser()
		// $object->...
		
		return VoterInterface::ACCESS_ABSTAIN || VoterInterface::ACCESS_DENIED || VoterInterface::ACCESS_GRANTED;
    }
}

Проверка разрешений

В сервисах/контроллерах:

if (!$this->get('security.context')->isGranted('EDIT', $item)) {
	// ...
}