Skip to content

Commit 8451cec

Browse files
mnoconmnocon
committed
Updated performAccessCheck doc
1 parent 6ec7555 commit 8451cec

File tree

4 files changed

+69
-53
lines changed

4 files changed

+69
-53
lines changed

‎code_samples/back_office/limitation/src/Controller/CustomController.php‎

Lines changed: 1 addition & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -2,56 +2,16 @@
22

33
namespace App\Controller;
44

5-
use App\Security\Limitation\CustomLimitationValue;
65
use Ibexa\Contracts\AdminUi\Controller\Controller;
7-
use Ibexa\Contracts\AdminUi\Permission\PermissionCheckerInterface;
8-
use Ibexa\Contracts\Core\Repository\PermissionResolver;
96
use Ibexa\Contracts\User\Controller\AuthenticatedRememberedCheckTrait;
10-
use Ibexa\Contracts\User\Controller\RestrictedControllerInterface;
117
use Ibexa\Core\MVC\Symfony\Security\Authorization\Attribute;
12-
use Symfony\Component\HttpFoundation\Request;
13-
use Symfony\Component\HttpFoundation\Response;
148

15-
class CustomController extends Controller implements RestrictedControllerInterface
9+
class CustomController extends Controller
1610
{
1711
use AuthenticatedRememberedCheckTrait {
1812
AuthenticatedRememberedCheckTrait::performAccessCheck as public traitPerformAccessCheck;
1913
}
2014

21-
public function __construct(
22-
// ...,
23-
private readonly PermissionResolver $permissionResolver,
24-
private readonly PermissionCheckerInterface $permissionChecker
25-
) {
26-
}
27-
28-
// Controller actions...
29-
public function customAction(Request $request): Response
30-
{
31-
// ...
32-
if ($this->getCustomLimitationValue()) {
33-
// Action only for user having the custom limitation checked
34-
}
35-
36-
return new Response('<html><body>...</body></html>');
37-
}
38-
39-
private function getCustomLimitationValue(): bool
40-
{
41-
$hasAccess = $this->permissionResolver->hasAccess('custom_module', 'custom_function_2');
42-
43-
if (is_bool($hasAccess)) {
44-
return $hasAccess;
45-
}
46-
47-
$customLimitationValues = $this->permissionChecker->getRestrictions(
48-
$hasAccess,
49-
CustomLimitationValue::class
50-
);
51-
52-
return $customLimitationValues['value'] ?? false;
53-
}
54-
5515
public function performAccessCheck(): void
5616
{
5717
$this->traitPerformAccessCheck();

‎code_samples/back_office/limitation/src/Controller/CustomLimitationController.php‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?php declare(strict_types=1);
2+
3+
namespace App\Controller;
4+
5+
use App\Security\Limitation\CustomLimitationValue;
6+
use Ibexa\Contracts\AdminUi\Controller\Controller;
7+
use Ibexa\Contracts\AdminUi\Permission\PermissionCheckerInterface;
8+
use Ibexa\Contracts\Core\Repository\PermissionResolver;
9+
use Ibexa\Contracts\User\Controller\AuthenticatedRememberedCheckTrait;
10+
use Ibexa\Core\MVC\Symfony\Security\Authorization\Attribute;
11+
use Symfony\Component\HttpFoundation\Request;
12+
use Symfony\Component\HttpFoundation\Response;
13+
14+
class CustomLimitationController extends Controller
15+
{
16+
use AuthenticatedRememberedCheckTrait {
17+
AuthenticatedRememberedCheckTrait::performAccessCheck as public traitPerformAccessCheck;
18+
}
19+
20+
public function __construct(
21+
// ...,
22+
private readonly PermissionResolver $permissionResolver,
23+
private readonly PermissionCheckerInterface $permissionChecker
24+
) {
25+
}
26+
27+
// Controller actions...
28+
public function customAction(Request $request): Response
29+
{
30+
// ...
31+
if ($this->getCustomLimitationValue()) {
32+
// Action only for user having the custom limitation checked
33+
}
34+
35+
return new Response('<html><body>...</body></html>');
36+
}
37+
38+
private function getCustomLimitationValue(): bool
39+
{
40+
$hasAccess = $this->permissionResolver->hasAccess('custom_module', 'custom_function_2');
41+
42+
if (is_bool($hasAccess)) {
43+
return $hasAccess;
44+
}
45+
46+
$customLimitationValues = $this->permissionChecker->getRestrictions(
47+
$hasAccess,
48+
CustomLimitationValue::class
49+
);
50+
51+
return $customLimitationValues['value'] ?? false;
52+
}
53+
54+
public function performAccessCheck(): void
55+
{
56+
$this->traitPerformAccessCheck();
57+
$this->denyAccessUnlessGranted(new Attribute('custom_module', 'custom_function_2'));
58+
}
59+
}

‎docs/permissions/custom_policies.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,5 +251,5 @@ For example, `translations/ibexa_content_forms_policies.en.yaml`:
251251
Check if current user has this custom limitation set to true from a custom controller:
252252

253253
```php
254-
[[= include_file('code_samples/back_office/limitation/src/Controller/CustomController.php') =]]
254+
[[= include_file('code_samples/back_office/limitation/src/Controller/CustomLimitationController.php') =]]
255255
```

‎docs/permissions/permission_overview.md‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -34,30 +34,27 @@ The more role assignments and complex policies you add for a given user, the mor
3434

3535
## Permissions for custom controllers
3636

37-
You can control access to a custom controller by implementing the `performAccessCheck()` method.
37+
You can control access to a custom controller by implementing the [`RestrictedControllerInterface`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-User-Controller-RestrictedControllerInterface.html) interface directly or, for back office controllers, by inheriting from [`\Ibexa\Contracts\AdminUi\Controller\Controller`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-AdminUi-Controller-Controller.html).
3838

39-
In the following example the user doesn't have access to the controller unless they have the `section/view` policy:
39+
In the following example the user doesn't have access to the controller unless they have the `section/view` policy and are [logged in using the "rememeber me cookie"]([[= symfony_doc =]]/security.html#checking-to-see-if-a-user-is-logged-in).
40+
It uses the [`AuthenticatedRememberedCheckTrait`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-User-Controller-AuthenticatedRememberedCheckTrait.html)
4041

41-
``` php
42-
use Ibexa\Core\MVC\Symfony\Security\Authorization\Attribute;
43-
44-
public function performAccessCheck(): void
45-
{
46-
parent::performAccessCheck();
47-
$this->denyAccessUnlessGranted(new Attribute('section', 'view'));
48-
}
42+
``` php hl_lines="17-18"
43+
[[= include_file('code_samples/back_office/limitation/src/Controller/CustomController.php', 0, 20) =]]
4944
```
5045

5146
`Attribute` accepts three arguments:
5247

53-
- `module` is the policy module (for example,`content`)
48+
- `module` is the policy module (for example, `content`)
5449
- `function` is the function inside the module (for example, `read`)
5550
- `limitations` are optional limitations to check against. Here you can provide two keys:
5651
- `valueObject` is the object you want to check for, for example `ContentInfo`.
5752
- `targets` are a table of value objects that are the target of the operation.
5853
For example, to check if content can be assigned to a Section, provide the Section as `targets`.
5954
`targets` accept location, object state and section objects.
6055

56+
[`AuthenticatedRememberedCheckTrait`](/api/php_api/php_api_reference/classes/Ibexa-Contracts-User-Controller-AuthenticatedRememberedCheckTrait.html)
57+
6158
### Checking user access
6259

6360
To check if a user has access to an operation, use the `isGranted()` method.

0 commit comments

Comments
 (0)