symfony-bundle acl-manager-bundle {🖫 121, ⚐ 18, ★ 3}

nuxia/acl-manager-bundle

ACL Manager for Symfony2

Monday, March 16, 2015
by Nuxia
Repository
7 Watchers
3 Stars
121 Installations

PHP
0 Dependents
0 Suggesters
35 Forks
0 Open issues
18 Versions
0 % Grown

The README.md

Installation

Add this bundle to your composer.json file:, _(*1)

{
    "require": {
        "nuxia/acl-manager-bundle": "*"
    }
}

<?php

// app/AppKernel.php
public function registerBundles()
{
    return array(
        // ...
        new Problematic\AclManagerBundle\ProblematicAclManagerBundle(),
    );
}

If you haven't configured the ACL enable it in app/config/security.yml:, _(*3)

# app/config/security.yml
security:
    acl:
        connection: default

Finally run the ACL init command, _(*4)

php app/console init:acl

Usage

<?php

$comment = new Comment(); // create some entity
// ... do work on entity

$em->persist($comment);
$em->flush(); // entity must be persisted and flushed before AclManager can act on it (needs identifier)
$aclManager = $this->get('problematic.acl_manager');

// Adds a permission no matter what other permissions existed before
$aclManager->addObjectPermission($comment, MaskBuilder::MASK_OWNER, $userEntity);
// Or:
$aclManager->addObjectPermission($comment, MaskBuilder::MASK_OWNER);
// Replaces all current permissions with this new one
$aclManager->setObjectPermission($comment, MaskBuilder::MASK_OWNER, $userEntity);
$aclManager->revokePermission($comment, MaskBUILDER::MASK_DELETE, $userEntity);
$aclManager->revokeAllObjectPermissions($comment, $userEntity);

// Same with class permissions:
$aclManager->addClassPermission($comment, MaskBuilder::MASK_OWNER, $userEntity);
//Or:
$aclManager->addClassPermission(Comment::CLASS, MaskBuilder::MASK_OWNER, $userEntity);
//Or:
$aclManager->addClassPermission('Acme\\Bundle\\Entity\\Comment', MaskBuilder::MASK_OWNER, $userEntity);
$aclManager->setClassPermission($comment, MaskBuilder::MASK_OWNER, $userEntity);
$aclManager->revokePermission($comment, MaskBUILDER::MASK_DELETE, $userEntity, 'class');
$aclManager->revokeAllClassPermissions($comment, $userEntity);

// You can alse use object-field...
$aclManager->addObjectFieldPermission($comment, 'title', MaskBuilder:MASK_EDIT, $userEntity);
$aclManager->setObjectFieldPermission($comment, 'title', MaskBuilder:MASK_EDIT, $userEntity);
$aclManager->revokeFieldPermission($comment,, 'title' MaskBUILDER::MASK_DELETE, $userEntity);
$aclManager->revokeAllObjectFieldPermissions($comment, 'title', $userEntity);
// ...and class-field scope permissions :
$aclManager->addClassFieldPermission($comment, 'title', MaskBuilder:MASK_EDIT, $userEntity);
$aclManager->setClassFieldPermission($comment, 'title', MaskBuilder:MASK_EDIT, $userEntity);
$aclManager->revokeFieldPermission($comment,, 'title' MaskBUILDER::MASK_DELETE, $userEntity, 'class');
$aclManager->revokeAllClassFieldPermissions($comment, 'title', $userEntity);

$aclManager->deleteAclFor($comment);
$em->remove($comment);
$em->flush();

If no $userEntity is provided, the current session user will be used instead., _(*5)

If you'll be doing work on a lot of entities, use AclManager#preloadAcls():, _(*6)

<?php

$products = $repo->findAll();

$aclManager = $this->get('problematic.acl_manager');
$aclManager->preloadAcls($products);

// ... carry on

ACL ORM Filter

If you are using Doctrine ORM, you can use our filter to directly retrieve granted rows., _(*7)

//Repository class
$qb = $this->getEntityManager()->createQueryBuilder();
$qb
    ->select('client_alias', 'client_user_alias')
    ->from($this->getEntityName(), 'client_alias')
    ->leftJoin('client_alias.user', 'client_user_alias')
;

$query = $this->aclFilter->apply($qb, ['VIEW', 'EDIT'], $currentUser, 'client_alias');
return $query->getResult();
//Will return only rows where $currentUser is granted VIEW,EDIT on Client (retrieved form table alias client_alias)

You can add extra criteria., _(*8)

$query = $this->aclFilter->apply($query, ['OPERATOR'], $user, 'client_alias', function(ExtraAclCriteria $criteria){
$criteria->setExpression(sprintf('OR %s.status = ?', $criteria->getSQLTableAlias('user_table_name', 'client_user_alias')));
    $criteria->setParameters([User::STATUS_INACTIVE]);
});