Symfony Role management and permissions - symfony

Question

I have a problem. I'm making a new application with Symfony (6) and ApiPlatform (2.8).
I need to make an access system with roles and permissions on my users.
A role gives access to several permissions and a user can have additional permissions.
Therefore, I have a "User" entity which has a "role" attribute of type relation on the "Role" table which defines all possible roles.
I also have a "Permissions" table that defines the possible permissions.
A "RolePermissions" table that defines the possible permissions according to the role.
A "UserPermissions" table that will contain the possible permissions complementary to a user.
Now, I want to use "is_granted("ROLE_ADMIN")" from Symfony. But is_granted() uses the role field of type string. As I have a relationship, how can I check the accesses?
I would like to secure my API routes.
`#[ApiResource(
collectionOperations: [
'get' => [
'security' => 'object == user or is_granted("ROLE_ADMIN")',
],
'post' => [
'security' => 'is_granted("ROLE_ADMIN")',
])]`
Do I need to create a special system?
https://symfony.com/doc/current/security/voters.html
If so, how do I do it?

Answer 1

I might have done something like this:
/**
* Get the permissions of the current user.
*
* #return array An array of permissions
*/
public function getRoles()
{
// Get the user's role
$role = $this->getRole();
// If the user doesn't have a role defined, use the default role ROLE_USER
if (!$role) {
$role[] = 'ROLE_USER';
}
// Get the permissions of the user's role
$rolePermissions = $role->getPermissions();
// Get the additional permissions of the user
$userPermissions = $this->getUserPermissions();
// Merge the role permissions and additional permissions using array_unique to avoid duplicates
$permissions = array_unique(array_merge($rolePermissions, $userPermissions));
return $permissions;
}
/**
* Check if the current user has the given permission.
*
* #param string $permission The name of the permission to check
* #return bool True if the user has the permission, false otherwise
*/
public function hasPermission(string $permission): bool
{
// Get the user's permissions
$permissions = $this->getRoles();
// Check if the given permission is in the user's permissions array
return in_array($permission, $permissions);
}
/**
* Get the role object associated with the user.
*
* #return Role|null The role object, or null if no role is defined for the user
*/
public function getRole()
{
return $this->role;
}
/**
* Get the additional permissions of the user.
*
* #return array An array of permissions
*/
public function getUserPermissions()
{
// Retrieve additional user permissions from the UserPermissions table
$userPermissions = $this->getDoctrine()->getRepository(UserPermissions::class)->findBy(['user' => $this]);
// Transformation of Permission objects into an array of permission names
$permissions = array_map(function ($permission) {
return $permission->getName();
}, $userPermissions);
return $permissions;
}
And in role entity:
/**
* Get the permissions associated with the role.
*
* #return array An array of permissions
*/
public function getPermissions()
{
// Retrieving role permissions from the RolePermissions table
$rolePermissions = $this->getDoctrine()->getRepository(RolePermissions::class)->findBy(['role' => $this]);
// Transformation of Permission objects into an array of permission names
$permissions = array_map(function ($permission) {
return $permission->getName();
}, $rolePermissions);
return $permissions;
}
I haven't tried it yet. But this is what I have in mind. And according to the documentation, my roles will start with ROLE_ as well as my permissions.
"The only rule is that every role must start with the ROLE_ prefix - otherwise, things won't work as expected. Other than that, a role is just a string and you can invent whatever you need (e.g. ROLE_PRODUCT_ADMIN)."
I'm going to sleep. I'll be back soon.