1000 search results

Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Deny Access with The "security" Option
252 lines | src/Entity/User.php
// ... lines 1 - 25
#[ApiResource(
// ... lines 27 - 35
security: 'is_granted("ROLE_USER")',
)]
// ... lines 38 - 40
class User implements UserInterface, PasswordAuthenticatedUserInterface
{
// ... lines 43 - 250
}
See Code Block in Script
Comment

Learn Symfony 2

 >

Starting in Symfony2: Course 2 (2.4+)

 >

Denying Access: AccessDeniedException
Adding security checks in controller methods could quickly lead to massive code duplication. Say that I have a few controllers with a few dozens of methods - the code will be almost unmaintainable. So the question is: does Symphony have something like AOP to deal with…
Ivan
Ivan
Read Full Comment
Comment

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

API Token Scopes
Hey |mention:90254| `security.yaml` is the best place to keep your "static" user roles. I'm a bit confused about your question. What do you mean by "access that from the ApiToken entity" Cheers!
MolloKhan
MolloKhan
Read Full Comment
Code

Learn Symfony

 >

Lemon Squeezy Payment Processor

 >

Dynamic Data
117 lines | src/Controller/OrderController.php
// ... lines 1 - 12
use Symfony\Component\Security\Http\Attribute\CurrentUser;
// ... lines 14 - 15
class OrderController extends AbstractController
{
// ... lines 18 - 57
#[Route('/checkout', name: 'app_order_checkout')]
public function checkout(
// ... lines 60 - 62
#[CurrentUser] ?User $user,
): Response {
$lsCheckoutUrl = $this->createLsCheckoutUrl($lsClient, $cart, $user);
// ... lines 66 - 67
}
// ... line 69
private function createLsCheckoutUrl(HttpClientInterface $lsClient, ShoppingCart $cart, ?User $user): string
{
// ... lines 72 - 114
}
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 3: Custom Resources

 >

Quick! Create a DragonTreasure DTO
53 lines | src/Mapper/DragonTreasureEntityToApiMapper.php
// ... lines 1 - 7
use Symfony\Bundle\SecurityBundle\Security;
// ... lines 9 - 13
class DragonTreasureEntityToApiMapper implements MapperInterface
{
public function __construct(
// ... line 17
private Security $security,
)
{
}
// ... lines 22 - 33
public function populate(object $from, object $to, array $context): object
{
// ... lines 36 - 47
$dto->isMine = $this->security->getUser() && $this->security->getUser() === $entity->getOwner();
// ... lines 49 - 50
}
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 3: Custom Resources

 >

DTO Validation & Security
72 lines | src/ApiResource/UserApi.php
// ... lines 1 - 20
#[ApiResource(
// ... line 22
operations: [
// ... lines 24 - 25
new Post(
security: 'is_granted("PUBLIC_ACCESS")',
// ... line 28
),
// ... lines 30 - 33
],
// ... line 35
security: 'is_granted("ROLE_USER")',
// ... lines 37 - 39
)]
// ... lines 41 - 43
class UserApi
{
// ... lines 46 - 70
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 3: Custom Resources

 >

DTO Validation & Security
72 lines | src/ApiResource/UserApi.php
// ... lines 1 - 20
#[ApiResource(
// ... line 22
operations: [
// ... lines 24 - 25
new Post(
security: 'is_granted("PUBLIC_ACCESS")',
// ... line 28
),
new Patch(
security: 'is_granted("ROLE_USER_EDIT")'
),
// ... line 33
],
// ... line 35
security: 'is_granted("ROLE_USER")',
// ... lines 37 - 39
)]
// ... lines 41 - 43
class UserApi
{
// ... lines 46 - 70
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 3: Custom Resources

 >

Simpler State Processor
275 lines | src/Entity/DragonTreasure.php
// ... lines 1 - 30
#[ApiResource(
// ... lines 32 - 33
operations: [
// ... lines 35 - 43
new Patch(
security: 'is_granted("EDIT", object)',
),
// ... lines 47 - 49
],
// ... lines 51 - 68
)]
// ... lines 70 - 90
class DragonTreasure
// ... lines 92 - 275
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

404 On Unpublished Items
52 lines | src/ApiPlatform/DragonTreasureIsPublishedExtension.php
// ... lines 1 - 10
use Symfony\Bundle\SecurityBundle\Security;
class DragonTreasureIsPublishedExtension implements QueryCollectionExtensionInterface, QueryItemExtensionInterface
{
public function __construct(private Security $security)
{
}
// ... lines 18 - 50
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Custom Validator
36 lines | src/Validator/IsValidOwnerValidator.php
// ... lines 1 - 5
use Symfony\Bundle\SecurityBundle\Security;
// ... lines 7 - 9
class IsValidOwnerValidator extends ConstraintValidator
{
public function __construct(private Security $security)
{
}
// ... lines 15 - 34
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Auto Setting the "owner"
27 lines | src/State/DragonTreasureSetOwnerProcessor.php
// ... lines 1 - 7
use Symfony\Bundle\SecurityBundle\Security;
// ... lines 9 - 11
class DragonTreasureSetOwnerProcessor implements ProcessorInterface
{
public function __construct(private ProcessorInterface $innerProcessor, private Security $security)
{
}
// ... lines 17 - 25
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Normalizer Decoration & "Normalizer Aware"
40 lines | src/Normalizer/AddOwnerGroupsNormalizer.php
// ... lines 1 - 5
use Symfony\Bundle\SecurityBundle\Security;
// ... lines 7 - 12
class AddOwnerGroupsNormalizer implements NormalizerInterface, SerializerAwareInterface
{
public function __construct(private NormalizerInterface $normalizer, private Security $security)
{
}
// ... lines 18 - 38
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Dynamic Groups: Context Builder
252 lines | src/Entity/DragonTreasure.php
// ... lines 1 - 88
class DragonTreasure
{
// ... lines 91 - 129
#[ApiProperty(security: 'is_granted("EDIT", object)')]
private bool $isPublished = false;
// ... lines 132 - 250
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Dynamic Groups: Context Builder
28 lines | src/ApiPlatform/AdminGroupsContextBuilder.php
// ... lines 1 - 5
use Symfony\Bundle\SecurityBundle\Security;
// ... lines 7 - 9
#[AsDecorator('api_platform.serializer.context_builder')]
class AdminGroupsContextBuilder implements SerializerContextBuilderInterface
{
public function __construct(private SerializerContextBuilderInterface $decorated, private Security $security)
{
}
// ... lines 16 - 26
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Conditional Fields by User: ApiProperty
252 lines | src/Entity/DragonTreasure.php
// ... lines 1 - 88
class DragonTreasure
{
// ... lines 91 - 129
#[ApiProperty(security: 'is_granted("EDIT", object)')]
private bool $isPublished = false;
// ... lines 132 - 250
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Security Voter
249 lines | src/Entity/DragonTreasure.php
// ... lines 1 - 27
#[ApiResource(
// ... lines 29 - 30
operations: [
// ... lines 32 - 40
new Patch(
security: 'is_granted("EDIT", object)',
// ... line 43
),
// ... lines 45 - 47
],
// ... lines 49 - 65
)]
// ... lines 67 - 87
class DragonTreasure
{
// ... lines 90 - 247
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Security Voter
249 lines | src/Entity/DragonTreasure.php
// ... lines 1 - 27
#[ApiResource(
// ... lines 29 - 30
operations: [
// ... lines 32 - 40
new Patch(
security: 'is_granted("EDIT", object)',
securityPostDenormalize: 'is_granted("EDIT", object)',
),
// ... lines 45 - 47
],
// ... lines 49 - 65
)]
// ... lines 67 - 87
class DragonTreasure
{
// ... lines 90 - 247
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Allow Admin Users to Edit any Treasure
249 lines | src/Entity/DragonTreasure.php
// ... lines 1 - 27
#[ApiResource(
// ... lines 29 - 30
operations: [
// ... lines 32 - 40
new Patch(
security: 'is_granted("ROLE_ADMIN") or (is_granted("ROLE_TREASURE_EDIT") and object.getOwner() == user)',
// ... line 43
),
// ... lines 45 - 47
],
// ... lines 49 - 65
)]
// ... lines 67 - 87
class DragonTreasure
{
// ... lines 90 - 247
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Allow Admin Users to Edit any Treasure
249 lines | src/Entity/DragonTreasure.php
// ... lines 1 - 27
#[ApiResource(
// ... lines 29 - 30
operations: [
// ... lines 32 - 40
new Patch(
security: 'is_granted("ROLE_ADMIN") or (is_granted("ROLE_TREASURE_EDIT") and object.getOwner() == user)',
securityPostDenormalize: 'is_granted("ROLE_ADMIN") or object.getOwner() == user',
),
// ... lines 45 - 47
],
// ... lines 49 - 65
)]
// ... lines 67 - 87
class DragonTreasure
{
// ... lines 90 - 247
}
See Code Block in Script
Code

Learn APIs

 >

API Platform 3 Part 2: Security for your Treasures

 >

Only Allow Owners to Edit
251 lines | src/Entity/DragonTreasure.php
// ... lines 1 - 27
#[ApiResource(
// ... lines 29 - 30
operations: [
// ... lines 32 - 40
new Put(
security: 'is_granted("ROLE_TREASURE_EDIT")',
),
new Patch(
security: 'is_granted("ROLE_TREASURE_EDIT")',
),
// ... lines 47 - 49
],
// ... lines 51 - 67
)]
// ... lines 69 - 89
class DragonTreasure
{
// ... lines 92 - 249
}
See Code Block in Script
46 47 48 49 50