I'm in Symfony 4.4
My first permission is
* @IsGranted(
* ModulePermission::MODULE_MODERATOR,
* subject="module",
* )
My second permission is
* @IsGranted(
* ItemPermission::DELETE_ITEM,
* subject="cm",
* )
Every permission works independently as expected, but as I don't have access yet to @security (update to SF5 scheduled but not done), how can I use both permission in my controller for MODULE_MODERATOR OR DELETE_ITEM ?
I have tried different 'googled' solution without success:
Access denied:
* @IsGranted(
* "is_granted('ITEM_PERMISSION::DELETE_ITEM',cm) OR is_granted('MODULE_PERMISSION::MODULE_MODERATOR',module)",
* )
Access denied:
* @IsGranted(
* "ITEM_PERMISSION::DELETE_ITEM cm OR ModulePermission::MODULE_MODERATOR module",
* )
I would say that you can only concatenate your isGranted annotations (it's even an example in documentation: https://symfony.com/bundles/SensioFrameworkExtraBundle/current/annotations/security.html#isgranted):
They say in this documentation:
But it's weird according to their example (being ADMIN + having right SHOW the post), moreover, Symfony applies the stategy "affirmative" by default for the voters, it means: