Repository navigation
feat(security)!: permission attributes instead of ROLE_ADMIN (0.6.0) - #12
Merged
Merged
Conversation
…voter [*] Boot the bundle in a minimal Symfony kernel (SQLite in-memory, stateless firewall) so tests send real requests through API Platform: - TestHeaderAuthenticator reads X-Test-Roles, X-Test-User and X-Test-Auth: anonymous; anonymous requests get 401 - TestPermissionVoter answers apiconfig:* from an example role map - a kernel variant without the voter for deny-by-default tests - AuthorizableDemoExtension for the 303 browser path of authorize - smoke tests pinning the current behaviour No behaviour change; require-dev only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every operation of ApiConfiguration now carries an explicit security expression on a bundle-owned permission attribute instead of a role: - Get, GetCollection, health: apiconfig:read - Post, Put, Patch, Delete: apiconfig:write - authorize: apiconfig:authorize - resource-level fallback: apiconfig:read The attributes live in ApiConfigurationPermissions and are tagged za7_core.permission in config/services.yaml, so an application can collect them. symfony/security-bundle and symfony/expression-language move to require, because security expressions are not evaluated without them. BREAKING CHANGE: the bundle no longer checks ROLE_ADMIN. Without a permission voter that grants apiconfig:* every operation answers 403. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…orize [*] AuthorizeRedirectListener answered GET .../authorize with Accept: text/html by a 303 redirect before API Platform's security ran, so any authenticated caller could start the OAuth flow. It now checks apiconfig:authorize right after the Accept check and before looking up the configuration: denied callers get 403 (401 when anonymous) for existing and unknown ids alike. BREAKING CHANGE: the browser path of authorize requires the apiconfig:authorize permission. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
composer.json, the CI matrix, the compose test runner and CLAUDE.md move from PHP 8.4 to 8.5. BREAKING CHANGE: PHP >= 8.5 is required. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
README: Requirements, the permission table, the za7_core.permission tags and a migration section with a minimal voter. CHANGELOG: [0.6.0] with the breaking changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The bundle no longer checks a role. Every operation of
ApiConfigurationchecks a bundle-owned permission attribute, and an application decides through its own permission voter who holds it.apiconfig:readGet,GetCollection,health(also the resource-level fallback)apiconfig:writePost,Put,Patch,Deleteapiconfig:authorizeauthorize, JSON and browser pathDmstr\ApiConfiguration\Security\ApiConfigurationPermissionsand are taggedza7_core.permissioninconfig/services.yaml. The bundle has no dependency on za7-core, no map and no config node.AuthorizeRedirectListenernow checksapiconfig:authorizebefore looking up the configuration. Before, any authenticated caller got the 303 redirect. Denied callers get 403, anonymous callers 401, with no 404 or 409 first.symfony/security-bundleandsymfony/expression-languagemove torequire, because API Platform does not evaluatesecurityexpressions without them.Breaking changes
Without a voter granting
apiconfig:*, every operation answers 403. The README has a migration section with a minimal voter. The CHANGELOG[0.6.0]lists all breaking changes.Tests
A new HTTP test kernel under
tests/runs requests through the full API Platform pipeline. It uses SQLite in memory and header authentication viaX-Test-Roles,X-Test-UserandX-Test-Auth: anonymous.authorize, read masking andhydra:operationfiltering.^[a-z][a-z0-9]*:[a-z][a-z0-9_]*$and equal the attributes used on the operations.Commits are split: test infrastructure, permissions, browser-path hardening, PHP 8.5, docs.
Known gap upstream
AddHydraOperationsSubscriberofdmstr/api-platform-utils-bundleadds nohydra:operationto collection responses. It matches@typehydra:Collection, while API Platform 4 emitsCollection. Item responses are filtered correctly.🤖 Generated with Claude Code