Security Voter & Entity Permissions

Hey Chris N. !

Hmm. To help with this, click the security part of your web debug toolbar to go into the security part of the profiler. Then check the "access decision log" to see what is denying access. But I think I can track it in the code

$user = new User();
$this->denyAccessUnlessGranted('EA_ACCESS_ENTITY', $user);

And THAT is failing. This is actually handled by this voter: https://github.com/EasyCorp/EasyAdminBundle/blob/321966f365fb809699014d3011d2a40ecb2e2261/src/Security/SecurityVoter.php#L48-L50 - which curiously checks that your "entity permission" returns "true" for the new, empty User object. I didn't realize it did this!

If I'm correct, what you need to do is, in your custom voter, is basically this (before the switch statement):

// allow NEW objects to be created
if (!$user->getId()) {
    return;
}

Let me know if that does the trick :).

Cheers!

Hi Ryan

Thanks for the response.

Unfortunately, your solution doesn't quite work. When creating a new Entity, EasyAdmin first checks for voters on ADMIN_USER_EDIT with a subject of `null`.

My solution requires modifying both the `supports(..)` method and the `voteOnAttribute(..)` methods of the `AdminUserVoter` as so:

```
protected function supports(string $attribute, $subject): bool
{
// replace with your own logic
// https://symfony.com/doc/cur...
return in_array($attribute, ['ADMIN_USER_EDIT']);
}

protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
{
$user = $token->getUser();
// if the user is anonymous, do not grant access
if (!$user instanceof UserInterface) {
return false;
}

// ... (check conditions and return true to grant permission) ...
// allow NEW objects to be created
switch ($attribute) {
case 'ADMIN_USER_EDIT':
return $user === $subject || $this->security->isGranted('ROLE_SUPER_ADMIN');
}

return false;
}
```

Hey Chris N.!

Sorry for my very slow reply - but thanks for posting this solution! I'm going to add a note to the tutorial about this.

Thanks!

Hey Nick,

Yes, it is... Roles system in Security component is more complex, it allows you to use "roles inheritance". And your example with in_array() won't cover inherited roles. Better always use isGranted() for security checks unless you on purpose want to ignore roles inheritance, though it might just mislead others or even you in the future.

Cheers!

Thanks, I just ran into that exact problem of it not including inherited roles.
Plus, this inheritance structure saves a lot of space in the database by not having to store duplicate roles for everyone.