Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using isGranted() without a Session #43372

Open
natewiebe13 opened this issue Oct 8, 2021 · 1 comment
Open

Using isGranted() without a Session #43372

natewiebe13 opened this issue Oct 8, 2021 · 1 comment

Comments

@natewiebe13
Copy link
Contributor

@natewiebe13 natewiebe13 commented Oct 8, 2021

Description
isGranted() assumes that it's checking against the currently logged in user. It would be great to be able to use something similar to check against another user or during times when there isn't a session (cronjobs/commands, message queue, etc.).

I would see this as a userIsGranted() function to make a distinction. There's cases we'd have to consider, such as if IS_AUTHENTICATED_* is used in conjunction with this method, as those are based on sessions. Return false, or throw a logic exception, etc.

Having this functionality would allow for removing the dependency on sessions entirely for services reducing the number of issues that come up during a project because some underlying function was session dependent.

I'm assuming we'd also want to create a new Token class to represent checking against a non-logged in user.

Example
Checking to see if you could assign another user to review an article:

$security->userIsGranted($reviewer, ArticleVoter::REVIEW, $article);
@xabbuh xabbuh added the Security label Oct 8, 2021
@lyrixx
Copy link
Member

@lyrixx lyrixx commented Oct 11, 2021

You can use the AccessDecisionManager Directly

$adm->decide(new PostAuthenticationToken($reviewer, '', $reviewer->getRoles()), [ArticleVoter::REVIEW], $article);

But indeed, it simpler way could be better 👍🏼

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants