leaseweb / lswsecurecontrollerbundle Goto Github PK

I would like to pass an object in the annotation. Like

    /**
     * @Secure(roles="ROLE_TEST")
     * @Secure(roles="EDIT", "company")
     * @Route("/company/{id}/edit", name="edit_company")
     */
    public function helloAction($company)
    {
        return array('name' => $company->getName());
    }

This will take the parameter $company and run $this->authorizationChecker->isGranted($role, $company)

Im happy to make a PR to achieve this but I would like to hear your thoughts first.

The dependency to doctrine/doctrine-bundle is very heavy and unfortunately if one doesn't use it (e.g. uses propel or an ODM).

Only the package doctrine/annotations would be required. Can you change this?

When you specifiy several roles une the @secure annotation an AND is done beetwen the roles.
It is more logical to do an OR as done int the JMS bundle because you can filter it in the controller function.

To do it you must change in the Lsw\SecureControllerBundle\Security\ControllerListener onKernelController function

            if (!$this->securityContext->isGranted($role)) {
                throw new AccessDeniedException(
                    'Current user is not granted required role "'.$role.'".'
                );
            }
        }

by

            if ($this->securityContext->isGranted($role)) return;
        }
        throw new AccessDeniedException('Current user is not granted');

The ControllerListener does not check if the $controller is a Symfony Controller object.
By design the controller could be any callable.
So before line: list($object, $method) = $controller
The $controller should be checked if it is an array.
E.g.:

if (!is_array($controller = $event->getController())) {
    return;
}

In Lsw/SecureControllerBundle/Resources/config/services.yml:

services:
    secure_controller.controller_listener:
        class: %secure_controller.controller_listener.class%
        arguments: [@annotation_reader,@security.context]

Both @annotation_reader and @security.context must be quoted for avoiding warnings in Symfony 2.8.

This project will support @SecureParam check in controller?