vendor/api-platform/core/src/Security/EventListener/DenyAccessListener.php line 58

Open in your IDE?
  1. <?php
  3. /*
  4.  * This file is part of the API Platform project.
  5.  *
  6.  * (c) Kévin Dunglas <dunglas@gmail.com>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. declare(strict_types=1);
  14. namespace ApiPlatform\Core\Security\EventListener;
  16. use ApiPlatform\Core\Metadata\Resource\Factory\ResourceMetadataFactoryInterface;
  17. use ApiPlatform\Core\Security\ExpressionLanguage;
  18. use ApiPlatform\Core\Security\ResourceAccessChecker;
  19. use ApiPlatform\Core\Security\ResourceAccessCheckerInterface;
  20. use ApiPlatform\Core\Util\RequestAttributesExtractor;
  21. use Symfony\Component\HttpKernel\Event\GetResponseEvent;
  22. use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolverInterface;
  23. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  24. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  25. use Symfony\Component\Security\Core\Exception\AccessDeniedException;
  26. use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
  28. /**
  29.  * Denies access to the current resource if the logged user doesn't have sufficient permissions.
  30.  *
  31.  * @author Kévin Dunglas <dunglas@gmail.com>
  32.  */
  33. final class DenyAccessListener
  34. {
  35.     private $resourceMetadataFactory;
  36.     /**
  37.      * @var ResourceAccessCheckerInterface
  38.      */
  39.     private $resourceAccessChecker;
  41.     public function __construct(ResourceMetadataFactoryInterface $resourceMetadataFactory, /*ResourceAccessCheckerInterface*/ $resourceAccessCheckerOrExpressionLanguage = null, AuthenticationTrustResolverInterface $authenticationTrustResolver = null, RoleHierarchyInterface $roleHierarchy = null, TokenStorageInterface $tokenStorage = null, AuthorizationCheckerInterface $authorizationChecker = null)
  42.     {
  43.         $this->resourceMetadataFactory = $resourceMetadataFactory;
  45.         if ($resourceAccessCheckerOrExpressionLanguage instanceof ResourceAccessCheckerInterface) {
  46.             $this->resourceAccessChecker = $resourceAccessCheckerOrExpressionLanguage;
  48.             return;
  49.         }
  51.         $this->resourceAccessChecker = new ResourceAccessChecker($resourceAccessCheckerOrExpressionLanguage, $authenticationTrustResolver, $roleHierarchy, $tokenStorage, $authorizationChecker);
  52.         @trigger_error(sprintf('Passing an instance of "%s" or null as second argument of "%s" is deprecated since API Platform 2.2 and will not be possible anymore in API Platform 3. Pass an instance of "%s" and no extra argument instead.', ExpressionLanguage::class, self::class, ResourceAccessCheckerInterface::class), E_USER_DEPRECATED);
  53.     }
  55.     /**
  56.      * @throws AccessDeniedException
  57.      */
  58.     public function onKernelRequest(GetResponseEvent $event): void
  59.     {
  60.         $request = $event->getRequest();
  61.         if (!$attributes = RequestAttributesExtractor::extractAttributes($request)) {
  62.             return;
  63.         }
  65.         $resourceMetadata = $this->resourceMetadataFactory->create($attributes['resource_class']);
  67.         $isGranted = $resourceMetadata->getOperationAttribute($attributes, 'access_control', null, true);
  69.         if (null === $isGranted) {
  70.             return;
  71.         }
  73.         $extraVariables = $request->attributes->all();
  74.         $extraVariables['object'] = $request->attributes->get('data');
  75.         $extraVariables['previous_object'] = $request->attributes->get('previous_data');
  76.         $extraVariables['request'] = $request;
  78.         if (!$this->resourceAccessChecker->isGranted($attributes['resource_class'], $isGranted, $extraVariables)) {
  79.             throw new AccessDeniedException($resourceMetadata->getOperationAttribute($attributes, 'access_control_message', 'Access Denied.', true));
  80.         }
  81.     }
  82. }