best design to make sure users access only their information - symfony

Question

I have a symfony2.7 application with doctrine which has a large amount of entities, many of these entities are dependent of a single entity, let me put an example to clarify
School hasMany Student,
Student hasMany Lesson,
Lesson hasMany Test,
Test hasMany Grade
Please imagine a db design like that but larger and that many schools are allowed. Say you have a role "SCHOOL_DIRECTOR" which can edit any grade in the school using this url /grade/{id}/edit, using symfony security I can make it so that only users with the SCHOOL_DIRECTOR role can access that url, so far so good, but right now my problem is that a SCHOOL_DIRECTOR from one school can, if he puts the correct id in the url, edit grades from another school.
I'm looking for the best way to go, because this happens with many entities, I know I could always make queries which joins back to the school entity but I'm worried about the performance impact because I would be constantly making queries with many joins. I wonder what is the best way to make that school directors can only acces the information on their school.

Answer 1

When you are trying to grant access of specific users/roles to specifics object domains(school,grade,test,...) you should take a look to ACL.
In the simplest way acl allows to do what you want.
Hope it helps

Answer 2

You should take a look at the symfony voter
Example:
app/config/services.yml
app.security.voter.grade:
class: AppBundle\Security\Voter\GradeVoter
tags:
- { name: security.voter }
AppBundle\Security\Voter\GradeVoter
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
class GradeVoter extends Voter
{
const EDIT = 'edit';
const VIEW = 'view';
protected function supports($action, $subject)
{
if(!$subject instanceof Grade) {
return false;
}
if(!in_array($action, $this->supportedActions())) {
return false;
}
return true;
}
protected function voteOnAttribute($action, $grade, TokenInterface $token)
{
/** #var Grade $grade */
switch ($action)
{
case self::VIEW:
return true;
break;
case self::EDIT:
// Do your stuff to return true if the the connected user can edit this grade
$user = $token->getUser();
// From the $user variable (which represent the connected user) you have to decide if he can edit this grade, and return true or false.
return true;
break;
default:
return false;
}
}
public function supportedActions()
{
return [self::EDIT, self::VIEW];
}
}
GradeController
public function editAction(Grade $grade)
{
$this->denyAccessUnlessGranted(GradeVoter::EDIT, $grade, 'You can\'t edit this grade');
// Do your stuff to edit
return new JsonResponse($response, Response::HTTP_OK);
}
$this->denyAccessUnlessGranted(GradeVoter::EDIT, $grade, 'You can\'t edit this grade');
This line do all the magic, Symfony will call your Voter service and do the above verification (in this case the edit switch case just return true)
If the voter return false, symfony will throw an AccessDenied exception, that will be catch and finish in a 403 response
I hope my answer helped you. Ask me if something isn't clear :)