Repository navigation
feat(security)!: flowable:* permission attributes instead of roles (0.11.0) - #21
Merged
Merged
Conversation
Kernel-based test suite against the current role checks, as the groundwork for the switch to permission attributes: - TestKernel on SQLite in memory with API Platform, the utils bundle (filter_operations_by_security), api-configuration, the MCP bundle and all three MCP switches on; variant without permission voter - TestHeaderAuthenticator (X-Test-Roles, X-Test-User, X-Test-Auth) - TestPermissionVoter with an example map and one test role per permission - TestFlowableEngine as MockHttpClient behind the real client locator - ApiTestCase with HTTP and MCP JSON-RPC helpers, smoke tests - GitHub Action and docker-compose CLI runner on PHP 8.5 Manifest: php >=8.5, dmstr/api-configuration-bundle ^0.6, doctrine/orm ^3.0, symfony/expression-language and symfony/object-mapper (API Platform enables its MCP integration only with object-mapper installed). Refs #14 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…les [*] Every operation and every MCP tool now checks one of 13 own permission attributes (flowable:read, read_stacktrace, mcp_read, deploy, deploy_delete, decision_evaluate, process_start, process_delete, task_complete, event_send, execution_trigger, worker, job_execute) with subject null. FlowablePermissions holds the constants; the 13 attributes are registered as za7_core.permission tags. No role name is left in src/ or config/. Tests: HTTP operation matrix (exactly one permission allows, the other twelve deny), MCP tools/list and tools/call per tool, kernel without voter denies everything, hydra:operation of item responses, and the registration test comparing tags, constants and resource metadata. BREAKING CHANGE: without a permission voter that maps the flowable:* attributes to roles, every operation and tool is denied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
README: requirements (PHP 8.5, api-configuration 0.6), permission per MCP tool, Security section with the 13 permissions and their tags, migration from 0.10 with an example voter using placeholders. The walkthrough and the bundle CLAUDE.md drop the role names; CHANGELOG gets the [0.11.0] entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rs [*]
GET /jobs/{id}/stacktrace, /tasks/{id}/input_schema and
/process_definitions/{id}/input_schema use a custom controller with
read: false, so API Platform never evaluated their security expression
and any request got the data (already the case in 0.10.0). The
controllers now deny unless flowable:read_stacktrace or flowable:read
is granted, before any engine call.
The skipped gap test becomes ControllerOperationPermissionTest (403
without the permission, 401 anonymous, engine untouched). CHANGELOG
gets a Security item and the new symfony/expression-language and
symfony/object-mapper requirements.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Nov 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 0.11.0. The bundle no longer checks role names: every HTTP operation and every one of the 14 MCP tools checks one of 13 own permission attributes with
is_granted('<permission>')and subjectnull.Permissions
flowable:read,flowable:read_stacktrace,flowable:mcp_read,flowable:deploy,flowable:deploy_delete,flowable:decision_evaluate,flowable:process_start,flowable:process_delete,flowable:task_complete,flowable:event_send,flowable:execution_trigger,flowable:worker,flowable:job_execute. Constants inDmstr\Flowable\Security\FlowablePermissions, registered as 13za7_core.permissiontags inconfig/services.yaml. No permission map, no config node, no za7-core dependency. The MCP switches are unchanged: a tool needs its switch and its permission.Breaking changes
flowable:*attributes, every operation and tool answers 403. The README has a migration section with an example voter.dmstr/api-configuration-bundle^0.6anddoctrine/orm^3;symfony/expression-languageandsymfony/object-mapperare now required (API Platform enables its MCP integration only with object-mapper).Security fix
GET /jobs/{id}/stacktrace,/tasks/{id}/input_schemaand/process_definitions/{id}/input_schemause custom controllers withread: false, so API Platform never evaluated theirsecurityexpression and any request got the data (0.10.0 and earlier). The controllers now checkflowable:read_stacktrace/flowable:readthemselves (commit 3f25d77; the test fails without the fix).Tests and CI
New kernel-based HTTP and MCP suite with its own test authentication (
X-Test-Roles, only undertests/), GitHub Action (PHP 8.5) and adocker-compose.ymlCLI runner. Covered: operation matrix (exactly one permission allows, the other twelve deny),tools/listandtools/callper tool, kernel without voter denies everything,hydra:operationof item responses unchanged for authorised users, registration test (tags = constants = attributes in the resource metadata). Partially addresses #14.The test infrastructure is a separate first commit that is green against the old behaviour.
🤖 Generated with Claude Code