Download the PHP package epubli4/permission-bundle without Composer

API Platform Permissions

Package to ease the use of permissions for microservices in e4 which use api-platform.

Installation

Make sure Composer is installed globally, as explained in the installation chapter of the Composer documentation.

Applications that use Symfony Flex

Open a command console, enter your project directory and execute:

Recommended for unit tests:

Applications that don't use Symfony Flex

Step 1: Download the Bundle

Open a command console, enter your project directory and execute the following command to download the latest stable version of this bundle:

Recommended for unit tests:

Step 2: Enable the Bundle

Then, enable the bundle by adding it to the list of registered bundles in the config/bundles.php file of your project:

Configuration

Make sure to insert the name of your microservice in config/packages/epubli_permission.yaml (create this file if it doesn't already exist) Example:

Create this file if it doesn't already exist config/packages/test/epubli_permission.yaml:

Activate the doctrine filter in config/packages/doctrine.yaml:

Usage

Generally

You need to specify the security key to enable this bundle for this endpoint.

If you want the bundle to differentiate between users who own an entity of this class or not, then you need to implement the SelfPermissionInterface.

Or use the SelfPermissionTrait for the default implementation of the SelfPermissionInterface:

If you have an entity without an userId but with a relationship to another entity with an userId, you need to implement the methods of SelfPermissionInterface yourself.

AccessToken

You can use this like a service. It supports autowiring. This gives you access to the properties of the access token of the user.

Custom permissions

For custom permissions to work you need to add an annotation to the method you are using it in.

Example:

The name of your microservice will be prepended automatically to the permission key.

Tests

To test your application with this bundle you need some way to send JsonWebTokens to it, otherwise testing the endpoints would be impossible, your requests would be denied.

You will need at least version v0.1.21 of https://github.com/epubli/api-platform-test

The easiest way is to just include the following into your test cases. That way every request will have the access rights to every endpoint.

If you want more control and don't want every request to have a token:

The trait UnitTestTrait exists to help you write unit tests for the common use cases. This trait has a config (self::$unitTestConfig) in which you describe your entity. This trait executes/generates unit tests for you. It requires you to implement methods which return the data used in the unit tests. Here is an example on how to use it for an entity which supports any operation:

If your entity does not support every operation, you need to adjust the config:

Export Command

To export the permissions of your microservice to the user microservice you need to execute the following in the docker container:

Testing

Execute the following:

or

How to change/add code to this bundle

The easiest way to further develop this bundle is to copy the src folder oder to another project (e.g. user microservice).

Create a folder named permission-bundle in the project and copy the src folder into it.

Then look for this in composer.json:

and replace it with:

Delete the original permission-bundle in the vendor folder.

Execute:

You may need to delete a few things in var/cache/dev.

Problems

When requesting multiple entities through a GET-Request hydra:totalItems can be incorrect when using the SelfPermissionInterface.

Because the paginator gets called before any filters are applied to the query the count of items/entities will be wrong. hydra:totalItems does not equal the number of items/entities returned.

The solution in this thread did not work: https://github.com/api-platform/core/issues/1185

Things which need to be done

• ApiPlatform Subresources
• Permissions from the anonymous role need to be applied if no token exists