How can I use OR logic in @Isgranted for Symfony 4.4

197 Views Asked by At

I'm in Symfony 4.4

My first permission is

 * @IsGranted(
 *     ModulePermission::MODULE_MODERATOR,
 *     subject="module",
 * )

My second permission is

 * @IsGranted(
 *     ItemPermission::DELETE_ITEM,
 *     subject="cm",
 * )

Every permission works independently as expected, but as I don't have access yet to @security (update to SF5 scheduled but not done), how can I use both permission in my controller for MODULE_MODERATOR OR DELETE_ITEM ?

I have tried different 'googled' solution without success:

Access denied:

 * @IsGranted(
 *     "is_granted('ITEM_PERMISSION::DELETE_ITEM',cm) OR is_granted('MODULE_PERMISSION::MODULE_MODERATOR',module)",
 * )

Access denied:

 * @IsGranted(
 *     "ITEM_PERMISSION::DELETE_ITEM cm OR ModulePermission::MODULE_MODERATOR module",
 * )
1

There are 1 best solutions below

2
On

I would say that you can only concatenate your isGranted annotations (it's even an example in documentation: https://symfony.com/bundles/SensioFrameworkExtraBundle/current/annotations/security.html#isgranted):

/*
 * @IsGranted(ModulePermission::MODULE_MODERATOR, subject="module")
 * @IsGranted(ItemPermission::DELETE_ITEM, subject="cm")
 */

They say in this documentation:

Each IsGranted() must grant access for the user to have access to the controller.

But it's weird according to their example (being ADMIN + having right SHOW the post), moreover, Symfony applies the stategy "affirmative" by default for the voters, it means:

This grants access as soon as there is one voter granting access;