PHP Authorization\AuthorizationCheckerInterface类代码示例

 function it_gets_customer_from_currently_logged_user(TokenStorageInterface $tokenStorage, AuthorizationCheckerInterface $authorizationChecker, TokenInterface $token, ShopUserInterface $user, CustomerInterface $customer)
 {
     $tokenStorage->getToken()->willReturn($token);
     $authorizationChecker->isGranted('IS_AUTHENTICATED_REMEMBERED')->willReturn(true);
     $token->getUser()->willReturn($user);
     $user->getCustomer()->willReturn($customer);
     $this->getCustomer()->shouldReturn($customer);
 }

 /**
  * {@inheritdoc}
  */
 public function isGranted(MediaInterface $media, Request $request)
 {
     try {
         return $this->security->isGranted($this->roles);
     } catch (AuthenticationCredentialsNotFoundException $e) {
         // The token is not set in an AuthorizationCheckerInterface object
         return false;
     }
 }

 /**
  * @param FilterResponseEvent $event
  */
 public function onKernelResponse(FilterResponseEvent $event)
 {
     if (!$event->isMasterRequest()) {
         return;
     }
     try {
         if (!$this->authorizationChecker->isGranted('ROLE_ADMIN')) {
             return;
         }
     } catch (AuthenticationCredentialsNotFoundException $e) {
         return;
     }
     $request = $event->getRequest();
     if ($request->isXmlHttpRequest()) {
         return;
     }
     $response = $event->getResponse();
     if ($response->isRedirection() || false === strpos($response->headers->get('Content-Type', ''), 'text/html')) {
         return;
     }
     $html = $this->editor->renderEditor($response);
     if (!empty($html)) {
         $this->injectEditor($response, $html);
     }
 }

 public function onKernelRequest(GetResponseEvent $event, $eventName, EventDispatcherInterface $dispatcher)
 {
     if (HttpKernel::MASTER_REQUEST != $event->getRequestType()) {
         // don't do anything if it's not the master request
         return;
     }
     $token = $this->tokenStorage->getToken();
     if (is_null($token) || $token instanceof OAuthToken || $this->authChecker->isGranted('IS_AUTHENTICATED_REMEMBERED') === false) {
         return;
     }
     if (!$token->getUser() instanceof PersonInterface) {
         // We don't have a PersonInterface... Nothing to do here.
         return;
     }
     try {
         $this->handleTargetPath($event);
         $tasks = $this->checkTasks($event, $dispatcher);
         if (!$tasks) {
             $this->checkIntent($event);
         }
         $this->checkUnconfirmedEmail();
     } catch (RedirectResponseException $e) {
         $event->setResponse($e->getResponse());
     }
 }

 /**
  * {@inheritdoc}
  */
 public function filter(QueryBuilder $qb, UserInterface $user = null)
 {
     if (!$this->isFilterable($qb)) {
         throw new UserException('Query builder is not filterable.');
     }
     if (empty($user)) {
         $user = $this->getUser();
         if (empty($user)) {
             return;
         }
     }
     $userIds = $this->extendedMetadataFactory->getDoctrineMetadata($user)->getIdentifierValues($user);
     $userId = reset($userIds);
     if (empty($userId)) {
         throw new UserException('User ID is empty.');
     }
     foreach (array_combine($qb->getRootAliases(), $qb->getRootEntities()) as $alias => $entity) {
         $meta = $this->extendedMetadataFactory->getExtendedMetadata($entity)['user'];
         if (empty($meta)) {
             continue;
         }
         $filter = false;
         foreach ($meta['roles'] as $role) {
             if ($this->authorizationChecker->isGranted($role)) {
                 $filter = true;
                 break;
             }
         }
         if (!$filter) {
             continue;
         }
         $key = $meta['property'] . '_id';
         $qb->innerJoin(sprintf('%s.%s', $alias, $meta['property']), $meta['property'])->andWhere(sprintf('%s = :%s', $meta['property'], $key))->setParameter($key, $userId);
     }
 }

 public function checkIfUserIsGranted(FilterControllerEvent $event)
 {
     $request = $event->getRequest();
     foreach ($request->attributes->get('_security', array()) as $rule) {
         $roles = array();
         if (isset($rule['roles']) && !empty($rule['roles'])) {
             $roles = $rule['roles'];
         } else {
             throw new \RuntimeException('You should provide "roles" parameter.');
         }
         if (is_string($roles)) {
             $roles = array($roles);
         }
         $subject = null;
         $subjectName = isset($rule['subject']) ? $rule['subject'] : null;
         if (!empty($subjectName)) {
             if (!$request->attributes->has($subjectName)) {
                 throw new \RuntimeException(sprintf("Subject '%s' is not available in the request attributes.", $subjectName));
             }
             $subject = $request->attributes->get($subjectName);
         }
         if (!$this->checker->isGranted($roles, $subject)) {
             throw new AccessDeniedException();
         }
     }
 }

 /**
  * Renders the legacy website toolbar template.
  *
  * If the logged in user doesn't have the required permission, an empty response is returned
  *
  * @param mixed $locationId
  * @param Request $request
  *
  * @return Response
  */
 public function websiteToolbarAction($locationId, Request $request)
 {
     $response = new Response();
     if (isset($this->csrfProvider)) {
         $parameters['form_token'] = $this->csrfProvider->generateCsrfToken('legacy');
     }
     if ($this->previewHelper->isPreviewActive()) {
         $template = 'design:parts/website_toolbar_versionview.tpl';
         $previewedContent = $authValueObject = $this->previewHelper->getPreviewedContent();
         $previewedVersionInfo = $previewedContent->versionInfo;
         $parameters = array('object' => $previewedContent, 'version' => $previewedVersionInfo, 'language' => $previewedVersionInfo->initialLanguageCode, 'is_creator' => $previewedVersionInfo->creatorId === $this->getRepository()->getCurrentUser()->id);
     } elseif ($locationId === null) {
         return $response;
     } else {
         $authValueObject = $this->loadContentByLocationId($locationId);
         $template = 'design:parts/website_toolbar.tpl';
         $parameters = array('current_node_id' => $locationId, 'redirect_uri' => $request->attributes->get('semanticPathinfo'));
     }
     $authorizationAttribute = new AuthorizationAttribute('websitetoolbar', 'use', array('valueObject' => $authValueObject));
     if (!$this->authChecker->isGranted($authorizationAttribute)) {
         return $response;
     }
     $response->setContent($this->legacyTemplateEngine->render($template, $parameters));
     return $response;
 }

 /**
  * Determines if a node should be skipped from rendering based on the current
  * user's role
  *
  * @param CreateMenuItemFromNodeEvent $event
  */
 public function onCreateMenuItemFromNode(CreateMenuItemFromNodeEvent $event)
 {
     $node = $event->getNode();
     if ($node instanceof MenuNode) {
         $addRole = $node->getAddWhenGranted();
         $removeRole = $node->getRemoveWhenGranted();
         //This avoids issue when rendering error pages with menus
         //Defaults all menu items with any role requirements to no be displayed
         if ($this->token->getToken() === null) {
             if ($addRole !== null || $removeRole !== null) {
                 $event->setSkipNode(true);
             }
             return;
         }
         if ($addRole !== null) {
             if (!$this->security->isGranted($addRole)) {
                 $event->setSkipNode(true);
             }
         }
         if ($removeRole !== null) {
             if ($this->security->isGranted($removeRole)) {
                 $event->setSkipNode(true);
             }
         }
     }
 }

 /**
  * @throws NotImplementedException If Content is missing location as this is not supported in current version
  */
 public function previewContentAction(Request $request, $contentId, $versionNo, $language, $siteAccessName = null)
 {
     $this->previewHelper->setPreviewActive(true);
     try {
         $content = $this->contentService->loadContent($contentId, array($language), $versionNo);
         $location = $this->locationProvider->loadMainLocation($contentId);
         if (!$location instanceof Location) {
             throw new NotImplementedException("Preview for content without locations");
         }
         $this->previewHelper->setPreviewedContent($content);
         $this->previewHelper->setPreviewedLocation($location);
     } catch (UnauthorizedException $e) {
         throw new AccessDeniedException();
     }
     if (!$this->authorizationChecker->isGranted(new AuthorizationAttribute('content', 'versionread', array('valueObject' => $content)))) {
         throw new AccessDeniedException();
     }
     $siteAccess = $this->previewHelper->getOriginalSiteAccess();
     // Only switch if $siteAccessName is set and different from original
     if ($siteAccessName !== null && $siteAccessName !== $siteAccess->name) {
         $siteAccess = $this->previewHelper->changeConfigScope($siteAccessName);
     }
     $response = $this->kernel->handle($this->getForwardRequest($location, $content, $siteAccess, $request), HttpKernelInterface::SUB_REQUEST);
     $response->headers->remove('cache-control');
     $response->headers->remove('expires');
     $this->previewHelper->restoreConfigScope();
     $this->previewHelper->setPreviewActive(false);
     return $response;
 }

 /**
  * {@inheritdoc}
  */
 public function isGranted($action, $object)
 {
     if (!$this->parameterResolver->resolveVoter()) {
         return true;
     }
     return $this->authorizationChecker->isGranted('lug.' . $action, $object);
 }

 public function onKernelResponse(FilterResponseEvent $event)
 {
     if (HttpKernelInterface::MASTER_REQUEST !== $event->getRequestType()) {
         return;
     }
     $response = $event->getResponse();
     $request = $event->getRequest();
     // do not capture redirects or modify XML HTTP Requests
     if ($request->isXmlHttpRequest()) {
         return;
     }
     // do not capture admin cms urls
     if (preg_match('/.*\\/admin\\/.*/', $request->getRequestUri())) {
         return;
     }
     try {
         $isGranted = $this->authorizationChecker->isGranted('ROLE_ADMIN');
     } catch (AuthenticationCredentialsNotFoundException $e) {
         $isGranted = false;
     }
     if (self::DISABLED === $this->mode || $response->isRedirection() || $response->headers->has('Content-Type') && false === strpos($response->headers->get('Content-Type'), 'html') || 'html' !== $request->getRequestFormat()) {
         return;
     }
     $this->injectToolbar($response, $request);
 }

 /**
  * Returns callback for configuration of grid/actions visibility per row
  *
  * @return callable
  */
 public function getActionConfigurationClosure()
 {
     return function (ResultRecordInterface $record) {
         $role = $record->getRootEntity();
         return ['update' => $this->authorizationChecker->isGranted('EDIT', $role), 'delete' => $this->authorizationChecker->isGranted('DELETE', $role)];
     };
 }

 /**
  * {@inheritdoc}
  */
 public function can($transition, array $parameters = array())
 {
     $transition = $transition instanceof TransitionInterface ? $transition : $this->getTransition($transition);
     if (!$this->authorizationChecker->isGranted($transition->getName(), $this->getObject())) {
         return false;
     }
     return parent::can($transition, $parameters);
 }

 /**
  * @return mixed
  * @throws AccessDeniedException
  */
 private function getUser()
 {
     if (!$this->authorizationChecker->isGranted('IS_AUTHENTICATED_FULLY')) {
         throw new AccessDeniedException();
     } else {
         return $this->tokenStorage->getToken()->getUser();
     }
 }

 /**
  * @param \BackBee\Event\Event $event
  */
 public function onPostLoad(Event $event)
 {
     $page = $event->getTarget();
     if (!$page instanceof Page) {
         return;
     }
     $isBbSessionActive = $this->authorizationChecker->isGranted('IS_AUTHENTICATED_REMEMBERED') === false;
     $page->setUseUrlRedirect($isBbSessionActive);
 }