Dynamic Roles

Hey gstanto ,

Thanks for sharing it with others!

Cheers!

Yo Steven Carré!

if a user has several roles and I just want to remove one, I have to get the roles first and then reset them all after removing the one from the roles array(). Is there a more convenient way to achieve this?

The way the code is written out-of-the-box, there is not. You have a few options:

1) Say ok! No big deal - I'll just keep my code that does all this work :).
2) Create a new method on User called (for example) removeRole(string $roleName) and move the logic there for finding the role. Basically the same thing... but the code is more centralized.
3) If you want to, you can actually have an entire UserRole entity that you could relate to User and store roles there. Each UserRole would have an id, so you would know exactly which to delete. This might be overkill... to solve the problem ;).

Cheers!

Hey DaveKnifeman!

Ah man! Let's see if we can debug this. First, if you add a -vvv flag at the end of your command (so bin/console doctrine:fixtures:load -vvv) you will get a stacktrace on your error, which is usually very helpful to see exactly where the error is coming from!

Second, make sure that when you call setRoles() that you're passing it an array. I think that you might be setting this to a string. And then inside our setRoles() method in User, we are trying to foreach over that.

Let me know if that helps!

Cheers!

Hey Marcelo,

Do you mean you need to have a user that may impersonate other users? e.g. you have a ROLE_SELLER_ADMIN that can log in as any ROLE_SELLER_USER and do some things on their behalf?

Then this Symfony docs might be useful for you: https://symfony.com/doc/cur...
We also say about impersonation here: https://knpuniversity.com/s...

I hope it helps!

Cheers!

Hey Man !

Finally after a little study I was able to solve this problem by creating a Voter with the extractRoles method.

Thanks for help.

Hey Marcelo,

Glad you got it working!

Cheers!

Hey Johan,

Nice notice, thanks! Actually, we require only the latest 2.5 version of doctrine ORM due to the next line in composer.json: "doctrine/orm": "^2.5". So Composer won't use 2.6 for this project even when it'll be available.

But I think we could add a note about it, I'll add it.

Cheers!

UPD: Note added in https://github.com/knpuniversity/symfony/commit/cfae786aa1f6535885fa8d5d09e578870082c672

Hey Richard,

That's different things. The "@Route" annotation at the top of any controller class is just a prefix for <em>all</em> routes, which this controller has. It means, that if you have:

/**
 * @Route("/admin")
 */
 class GenusController
{
  /**
   * @Route("/genus")
   */
  public function indexAction()
  {
    // code here...
  }
}

so the indexAction() URL will be the "/admin/genus" (i.e. with "/admin" prefix) but not just the "/genus". That's it!

Firewall in turn allows you to configure <em>who</em> has access to a page.

Cheers!

Hi Victor, sorry my bad, What I want to say, was, what is the different about using @Security(/admin) vs using in the firewall ^/admin.

Hey Richard!

Ah, that makes more sense :). Or, more specifically - you mean @Security("ROLE_ADMIN").

It's more or less perfectly equivalent. The ^/admin in the firewall causes some code to run that compares the URL and if matches, checks for ROLE_ADMIN. If you use @Security, it does the same thing - except instead of checking if the URL matches, it checks to see if that controller class is being executed on this request.

So it comes down to a matter or preference: do you like protecting by URL better? Or do you like to secure specific controller classes. It's nice to have both options :).

Cheers!

Thanks guys, is clear now :)

Regards,

Hey Julien,

There's a lot of ways to do it. If you're good at JavaScript, you could write a simple JS script which will allow you to select only one checkbox, i.e. reset all checkboxes except the latest. But probably there's another better solution: since UserInterface enforce you to have setRoles()/getRoles(), you can add a new "virtual" ChoiceType form field which name is "role", make it "mapped => false" and add User::setRole() method which will get a role string value, add it to an empty array and set this array to the $this->roles property overwriting the current role. The 3rd is more complex I think, but should work well too - choiceType with multiple false and create a Data Transformer for this field, which will convert single role string to an array and back: array with a single role to the single role string.

Cheers!

Hi Victor, tanks for the reply. Until I get your answer I used jquery. But I would like to use the virtual choice type method. But I can it make it... :-(
The roles column in the database is empty.
Where do I have to create the method? In the User entity or in the form?

Hey Julien,

Let me a bit improve and probably simplify my original idea: if you want to be able to set only one single role for your users, then you don't need User::$roles property at all, you just need the User::$role field. So your User entity may looks like:

User
{
    // other properties...

    /**
     * @ORM\Column(type="string")
     */
    private $role;

    public function getRole()
    {
        return $this->role;
    }

    public function setRole($role)
    {
        $this->role = $role;
    }

    // You have to keep this method due to the UserInterface
    public function getRoles()
    {
        return [$this->role];
    }

    public function setRoles(array $roles)
    {
        throw new \Exception('You probably never need to call it, but UserInterface enforce you to have this method')
    }

    // other methods...
}

How does it looks like? I.e. you replace User::$roles property with User::$role one. And then in your form just add a normal field for this $role property, so you event don't need "mapped => false" now.

P.S. Sorry for misleading you in my first reply.

Cheers!

Thank you so much. I realized that the pb was not (only) a lack of understanding of symphony, but OOP in general... I have to work more and more. By the way your courses are so great... I spent hours and hours on reading, searching and following different courses... But yours are so well executed and make me feel less dumb :-)!!!

Hey Julien,

Thank you for the kind words! Btw, we have a separate track for OOP if you're interested in it:
https://knpuniversity.com/t...

Cheers!

Hey Daan!

This "shouldn't" happen, because the command calculates the correct order that the tables should be truncated. But, it can happen if you have some circular relationships (e.g. two tables - or maybe a bigger loop - that each have foreign keys that point back to each other). One way to fix that - if it's appropriate for your app - is to add some @JoinColumn(onDelete="CASCADE") (or SET NULL) functionality, so that when items in one of those relationships is deleted, it cascades in the database.

But, if that's not really appropriate for your app (i.e. CASCADE would be potentially dangerous for that relationship in production), then you will need a workaround, as you suggested. There are no hook points that I know of, so I would recommend just making a simple shell script that runs all the commands for you (database:drop, database:create, migrations:migrate, fixtures:load).

Cheers!

Aaah to bad. Thanks for the reply. I'll make a bash script then :)

Hey Yang,

Let me help you. Yes, it's definitely possible! The UserInterface just enforce you to have authentication-related fields on an entity, that's it. So you can add whatever you need fields to the User entity besides UserInterface required fields, even some relation properties like ManyToMany, etc.

Yes, you're right! You wouldn't need to add these extra properties, but you could if it'll be useful for you, i.e. to build some complex join queries or just for convenience to get a collection of related entities.

Cheers!

Hey Danijela

I'm not sure why that's happening, but can you double check that you chose "json_array" as the type of your $roles property?
Another thing you can do is passing the User instance as a second parameter to your FormType (when creating it), so it automatically updates the properties.

// UserController.php
public function editAction(Request $request, User $user) {
    ...    
   $editForm = $this->createForm(UserEditType::class, $user)
   ...
}

Cheers!

Hey MolloKhan

I choose json_array type, and also set second parameter for createForm(..). Maybe I missed something else, I will check it all again.

I found the similar issue here, maybe it is smilar issue, i dont know.. :)

Thank you for response :)

Or maybe is something related to your environment. Which OS, and database driver are you using?

I had the same problem and ended up swapping json_array for simple_array which saved everything as a comma delimited list.

Oh, that's interesting. I've never have that problem - Maybe it's because of the MySql version. On which version are you running?

Hi James!

I'm not 100% sure I'm going to answer what you're actually asking, but let me give it a shot - then you can tell me that I didn't fully understand your question if I miss :).

Giving each user a different role is cool, but it's still a "global" property - it helps to answer questions like "should the user have access to the blog admin area in general". But, roles can't be used for security that's based on an object - e.g. perhaps a user should have access to only the blog posts that they author. So, they will have access to edit some blog posts, but not others. Is this kind of what you're asking?

In short, there are 2 ways to solve this:

1) Manually (I don't often do this, but you'll see how simple it is). For example, suppose there is some url like /users/{id}, but I should only be able to see my page. Then, you might do this in the controller:

`<em>
public function showAction($id)
{

$user = // query for the User

if ($user != $this->getUser)) {
    throw $this->createAccessDeniedException('this is not your account!');
}

}
</em>`

So, you can simply put whatever security logic you need in your controller and then deny access like this.

2) A better solution is to use voters: https://knpuniversity.com/screencast/new-in-symfony3/voter. These are very similar to doing what I just did above, but you centralize your security logic so that you can more easily re-use it.

Does this help? Or did I totally answer the wrong question? :)

Cheers!

Voters is it ! Thanks again! But if I still want admin to have access, how do I add the admin to the if statement? And is there some king of super admin for developers like you talked about in one of you tuto?

Thanks

Hey James,

In if statement you could check whether the current user has a role ROLE_ADMIN <em>or</em> the current user is owner (like in Ryan's example) - then allow access:

public function showAction($id)
{
  $user = // query for the User
  
  $this->denyAccessUnlessGranted('ROLE_ADMIN');

  if ($user != $this->getUser()) {
    throw $this->createAccessDeniedException('this is not your account!');
  }
}

Cheers!

Hey Karol Goraus

Thanks for sharing your problem and solution :)
But instead of setting a default value at the DataBase level, you can do it in your entity code

// User.php
class User {
    ....
    // Set default to an empty array
    private $roles = [];
    ....
}

I believe it should give you the same result

Cheers!

Hey Mounir,

Check your setter/getter methods - maybe you just made a logic typo there. Also, try to debug roles before doing persist() and flush() with:

dump($user->getRoles());
die;
$em->persist($user);
$em->flush();

Or if you set roles only in data fixtures, try to dump the result array which your getter returns:

    public function getRoles()
    {
        $roles = [];
        
        // loop over some ManyToMany relation to a Group entity
        foreach ($this->groups as $group) {
            $roles = array_merge($roles, $group->getRoles());
        }
        
        dump($roles); die;
        return $roles;
    }

Btw, do you use MySQL database?

Cheers!

Sorry, i have just seen your reply.

Yes i do use MySQL dababase.

My getRoles() look like this:

public function getRoles()
{
$roles = $this->roles;

// give everyone ROLE_USER!
if ( !in_array('ROLE_USER', $roles) ) {
$roles[] = 'ROLE_USER';
}

return $roles;
}

I have no groups property in User class.

when i dump $roles in getRoles() i get ['ROLE_USER']
and when i dump $user->getRoles() in registerAction(), before persist method, i get ['ROLE_USER'].

But dumping $user in registerAction(), before persist method returns roles with empty array.

Thanks Victor!

Hey Mounir,

Great! This's exactly the correct behavior. So ROLE_USER in this case is dynamicly added to all your users at runtime, even if they don't have any roles. It allows you do not worry about assigning default ROLE_USER to all your users. But if you add a different role to a user - it will be stored into the DB! So check if it works correctly by adding a new ROLE_ADMIN for the admin user, then persist() and flush() - you should see the only ROLE_ADMIN in database as we expected.

Cheers!

Thanks guys, is clear now :)

Hey Dennis,

I suppose it's because in your code you're passing role as a string to setRoles() method, i.e. $user->setRoles('ROLE_ADMIN'). Check your setRoles() setter, in our project it has "setRoles(array $roles)" signature, which means your should pass an array of roles like: $user->setRoles(['ROLE_ADMIN']). If you still have some problems with it - please, show your setRoles() method declaration.

Cheers!

Hi victor,

I did not have that indeed.
I passed a string to the setRoles method. Now I've changed that, and adjusted the setRoles function to setRoles(array $roles)!

Thanks!