symfony-security-voters

Name: symfony-security-voters
Author: aligundogdu

32stars3forks

How to install symfony-security-voters?

aligundogdu/symfony-hexagonal-skill/symfony-security-voters

$npx -y skills add aligundogdu/symfony-hexagonal-skill --skill symfony-security-voters

Installs into the current project.

Summary

Symfony security voters — role hierarchy, voter pattern, access control, authorization, permissions, IsGranted attribute. Triggers on: security, voter, role, authorization, access control, permission, IsGranted, role hierarchy, RBAC

Files · 1

View on GitHub

SKILL.md

1	# Symfony Security & Voters
2
3	You are an expert in Symfony security with Voters pattern within hexagonal architecture.
4
5	## When to Activate
6
7	- User needs authorization on endpoints
8	- User asks about voters or role hierarchy
9	- User wants access control logic
10	- User mentions RBAC, permissions, or security
11
12	## Core Rule: Every Endpoint Has a ROLE
13
14	No endpoint is publicly accessible without explicit `#[IsGranted]` or Voter check.
15
16	```php
17	#[Route('/api/users', methods: ['GET'])]
18	#[IsGranted('ROLE_USER_LIST')] // ALWAYS required
19	public function list(): JsonResponse { ... }
20	```
21
22	## Role Hierarchy
23
24	Define roles in `security.yaml`:
25
26	```yaml
27	security:
28	role_hierarchy:
29	ROLE_ADMIN: [ROLE_USER_CREATE, ROLE_USER_EDIT, ROLE_USER_DELETE, ROLE_USER_LIST, ROLE_USER_VIEW]
30	ROLE_MANAGER: [ROLE_USER_LIST, ROLE_USER_VIEW, ROLE_ORDER_MANAGE]
31	ROLE_USER: [ROLE_USER_VIEW]
32	```
33
34	### Naming Convention
35	- Module-scoped: `ROLE_{MODULE}_{ACTION}`
36	- Examples: `ROLE_USER_CREATE`, `ROLE_ORDER_VIEW`, `ROLE_REPORT_GENERATE`
37
38	## Simple Cases: Use `#[IsGranted]`
39
40	```php
41	#[IsGranted('ROLE_USER_CREATE')]
42	public function create(): JsonResponse { ... }
43	```
44
45	## Complex Cases: Use Voters
46
47	When authorization depends on the resource (e.g., "can this user edit THIS order?"):
48
49	```php
50	namespace App\Infrastructure\{Module}\Security;
51
52	use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
53	use Symfony\Component\Security\Core\Authorization\Voter\Voter;
54
55	final class {Entity}Voter extends Voter
56	{
57	public const VIEW = 'VIEW';
58	public const EDIT = 'EDIT';
59	public const DELETE = 'DELETE';
60
61	protected function supports(string $attribute, mixed $subject): bool
62	{
63	return in_array($attribute, [self::VIEW, self::EDIT, self::DELETE])
64	&& $subject instanceof {Entity};
65	}
66
67	protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
68	{
69	$user = $token->getUser();
70	if (!$user instanceof UserInterface) {
71	return false;
72	}
73
74	return match ($attribute) {
75	self::VIEW => $this->canView($subject, $user),
76	self::EDIT => $this->canEdit($subject, $user),
77	self::DELETE => $this->canDelete($subject, $user),
78	default => false,
79	};
80	}
81
82	private function canView({Entity} $entity, UserInterface $user): bool
83	{
84	// Owner or admin can view
85	return $entity->ownerId() === $user->getId()
86	\|\| in_array('ROLE_ADMIN', $user->getRoles());
87	}
88
89	private function canEdit({Entity} $entity, UserInterface $user): bool
90	{
91	return $entity->ownerId() === $user->getId();
92	}
93
94	private function canDelete({Entity} $entity, UserInterface $user): bool
95	{
96	return in_array('ROLE_ADMIN', $user->getRoles());
97	}
98	}
99	```
100
101	### Using Voter in Controller
102	```php
103	#[Route('/{id}', methods: ['PUT'])]
104	public function update(string $id): JsonResponse
105	{
106	$order = $this->getOrder($id);
107	$this->denyAccessUnlessGranted('EDIT', $order);
108	// ... proceed
109	}
110	```
111
112	## References
113
114	See `references/` for detailed guides:
115	- `voter-patterns.md` — Full voter examples and testing
116	- `role-hierarchy.md` — Role hierarchy design patterns

People who liked this also viewed

6 picks

Type

symfony-security-voters

32stars3forks

View on GitHub

How to install symfony-security-voters?

aligundogdu/symfony-hexagonal-skill/symfony-security-voters

$npx -y skills add aligundogdu/symfony-hexagonal-skill --skill symfony-security-voters

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Symfony Security & Voters
2
3	You are an expert in Symfony security with Voters pattern within hexagonal architecture.
4
5	## When to Activate
6
7	- User needs authorization on endpoints
8	- User asks about voters or role hierarchy
9	- User wants access control logic
10	- User mentions RBAC, permissions, or security
11
12	## Core Rule: Every Endpoint Has a ROLE
13
14	No endpoint is publicly accessible without explicit `#[IsGranted]` or Voter check.
15
16	```php
17	#[Route('/api/users', methods: ['GET'])]
18	#[IsGranted('ROLE_USER_LIST')] // ALWAYS required
19	public function list(): JsonResponse { ... }
20	```
21
22	## Role Hierarchy
23
24	Define roles in `security.yaml`:
25
26	```yaml
27	security:
28	role_hierarchy:
29	ROLE_ADMIN: [ROLE_USER_CREATE, ROLE_USER_EDIT, ROLE_USER_DELETE, ROLE_USER_LIST, ROLE_USER_VIEW]
30	ROLE_MANAGER: [ROLE_USER_LIST, ROLE_USER_VIEW, ROLE_ORDER_MANAGE]
31	ROLE_USER: [ROLE_USER_VIEW]
32	```
33
34	### Naming Convention
35	- Module-scoped: `ROLE_{MODULE}_{ACTION}`
36	- Examples: `ROLE_USER_CREATE`, `ROLE_ORDER_VIEW`, `ROLE_REPORT_GENERATE`
37
38	## Simple Cases: Use `#[IsGranted]`
39
40	```php
41	#[IsGranted('ROLE_USER_CREATE')]
42	public function create(): JsonResponse { ... }
43	```
44
45	## Complex Cases: Use Voters
46
47	When authorization depends on the resource (e.g., "can this user edit THIS order?"):
48
49	```php
50	namespace App\Infrastructure\{Module}\Security;
51
52	use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
53	use Symfony\Component\Security\Core\Authorization\Voter\Voter;
54
55	final class {Entity}Voter extends Voter
56	{
57	public const VIEW = 'VIEW';
58	public const EDIT = 'EDIT';
59	public const DELETE = 'DELETE';
60
61	protected function supports(string $attribute, mixed $subject): bool
62	{
63	return in_array($attribute, [self::VIEW, self::EDIT, self::DELETE])
64	&& $subject instanceof {Entity};
65	}
66
67	protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
68	{
69	$user = $token->getUser();
70	if (!$user instanceof UserInterface) {
71	return false;
72	}
73
74	return match ($attribute) {
75	self::VIEW => $this->canView($subject, $user),
76	self::EDIT => $this->canEdit($subject, $user),
77	self::DELETE => $this->canDelete($subject, $user),
78	default => false,
79	};
80	}
81
82	private function canView({Entity} $entity, UserInterface $user): bool
83	{
84	// Owner or admin can view
85	return $entity->ownerId() === $user->getId()
86	\|\| in_array('ROLE_ADMIN', $user->getRoles());
87	}
88
89	private function canEdit({Entity} $entity, UserInterface $user): bool
90	{
91	return $entity->ownerId() === $user->getId();
92	}
93
94	private function canDelete({Entity} $entity, UserInterface $user): bool
95	{
96	return in_array('ROLE_ADMIN', $user->getRoles());
97	}
98	}
99	```
100
101	### Using Voter in Controller
102	```php
103	#[Route('/{id}', methods: ['PUT'])]
104	public function update(string $id): JsonResponse
105	{
106	$order = $this->getOrder($id);
107	$this->denyAccessUnlessGranted('EDIT', $order);
108	// ... proceed
109	}
110	```
111
112	## References
113
114	See `references/` for detailed guides:
115	- `voter-patterns.md` — Full voter examples and testing
116	- `role-hierarchy.md` — Role hierarchy design patterns

People who liked this also viewed

6 picks

Type