The Server & New IsGranted

I'm unfamiliar with the @IsGranted stuff.

In my TWIG code I sometimes use
{% if is_granted('ROLE_SUPER_ADMIN') %}
to hide menu options etc from non-admins.

In my controllers I often use
if ( $this->get('security.authorization_checker')->isGranted('ROLE_EXTRAOPENING_ADMIN') )

And I also have access config in security.yaml
` access_control:

    - { path: /price, role: ROLE_EXTRAOPENING_ADMIN }
    - { path: /extraopening/, role: ROLE_EXTRAOPENING_USER }`

Is this sufficient or am I missing something when I'm not using the @IsGranted directive for certain classes (or functions, I suppose the @IsGranted could go before a specific function such as ::editAction as well?)

Hey Mattias,

It should be OK, if you prefer annotations (or PHP 8 attributes) - you can use IsGranted annotation/attribute above your controller's action. Or you can call that isGranted method explicitly in the method as you did. There is no difference, but the 1st option would make your controller cleaner (less code) while the 2nd option gives you a more control as you can write a PHP code and add more checks if needed.

Well, isGranted() PHP function will just return you either true or false, i.e. you should throw an AccessDeniedException manually to actually deny the access. Btw, it depends on what class your controller extends, but if you extends Symfony base controller - you could shorten that method call to just "$this->isGranted(...)" instead of doing it via "security.authorization_checker" service. And btw, there's another method call createAccessDeniedException() that helps to create the actual exception for you, i.e. you can do something like:

if ($this->isGranted(...)) {
    throw $this->createAccessDeniedException(...);
}

But of course, it would be great to check that your code works and you see that access denied exception in your browser :)

Cheers!

The Controller class is created like this

`
namespace AppBundle\Controller\ExtraOpening;

use AppBundle\Entity\ACRGroup as ACRGroup;
use AppBundle\Entity\ExtraOpening\DebitPeriod;
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
use Symfony\Component\HttpFoundation\Request;
use AppBundle\Service\globalHelper;

/**

• Debitperiod controller.
  
  /
  class DebitPeriodController extends Controller {
  ...`

Is the Base controller you mentioned different from the <b>Symfony\Bundle\FrameworkBundle\Controller\Controller</b> I'm using?

In this particular case I did this with the logic, but I see what you're saying.

` if ( $this->get('security.authorization_checker')->isGranted('ROLE_EXTRAOPENING_ADMIN') ) {

        //If user is extraopening admin, list debit periods for all units...
        $units = $em->getRepository('AppBundle:ACRGroup')->findAll();
    } else {
        //...otherwise list only units that user has permission to work with
        $units = $user->getACRGroups();`

Hey Mattias,

Ah, yes, I was mention the Symfony\Bundle\FrameworkBundle\Controller\AbstractController - this one should have that isGranted() method. Otherwise, using a special service for this is fine, it's up to you!

Cheers!

Will IsGranted work with 2 different roles?

I.E.

* @IsGranted('ROLE_THIS_ACCESS')
* @IsGranted('ROLE_SUPER_USER')

will allow any user with either role to access?

Hey Matt,

Yes, it should work according to the docs:

> Each IsGranted() must grant access for the user to have access to the controller.

See https://symfony.com/doc/mas... . Or you can use @Security for more flexibility.

Cheers!