docs(articles): English translation of From Magento to Symfony
en/articles/magento-to-symfony/data/security.md
new file +83
โ0
1
+
# Security
2
+
3
+
The Security component answers two questions. Authentication (who you are): firewall, user provider, authenticator. Authorization (what you're allowed to do): roles, `access_control` and voters. You write the user classes yourself: `make:user` creates a `User` entity with `UserInterface`.
4
+
5
+
**Symfony** ยท config/packages/security.yaml
6
+
7
+
```yaml
8
+
security:
9
+
password_hashers:
10
+
Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: auto
11
+
providers:
12
+
users:
13
+
entity: { class: App\Entity\User, property: email }
14
+
role_hierarchy:
15
+
ROLE_ADMIN: [ROLE_FAQ_EDITOR]
16
+
firewalls:
17
+
dev:
18
+
pattern: ^/(_profiler|_wdt|assets)/
19
+
security: false
20
+
main:
21
+
lazy: true
22
+
provider: users
23
+
form_login:
24
+
login_path: app_login
25
+
check_path: app_login
26
+
enable_csrf: true
27
+
logout:
28
+
path: app_logout
29
+
access_control:
30
+
- { path: ^/admin, roles: ROLE_FAQ_EDITOR }
31
+
- { path: ^/account, roles: ROLE_USER }
32
+
```
33
+
34
+
**Magento** ยท acl.xml + ADMIN_RESOURCE
35
+
36
+
```xml
37
+
<acl>
38
+
<resources>
39
+
<resource id="Magento_Backend::admin">
40
+
<resource id="Vendor_Faq::faq" title="FAQ">
41
+
<resource id="Vendor_Faq::question_edit"
42
+
title="Edit questions"/>
43
+
</resource>
44
+
</resource>
45
+
</resources>
46
+
</acl>
47
+
```
48
+
```php
49
+
class Edit extends Action
50
+
{
51
+
const ADMIN_RESOURCE = 'Vendor_Faq::question_edit';
52
+
}
53
+
```
54
+
55
+
**Symfony** ยท Voter + #[IsGranted]
56
+
57
+
```php
58
+
final class QuestionVoter extends Voter
59
+
{
60
+
protected function supports(string $attribute, mixed $subject): bool
61
+
{
62
+
return $attribute === 'QUESTION_EDIT' && $subject instanceof Question;
63
+
}
64
+
65
+
protected function voteOnAttribute(
66
+
string $attribute,
67
+
mixed $subject,
68
+
TokenInterface $token,
69
+
?Vote $vote = null,
70
+
): bool
71
+
{
72
+
$user = $token->getUser();
73
+
return $user instanceof User
74
+
&& ($user->hasRole('ROLE_ADMIN') || $subject->getAuthor() === $user);
75
+
}
76
+
}
77
+
78
+
#[Route('/admin/questions/{id}/edit', name: 'admin_question_edit')]
79
+
#[IsGranted('QUESTION_EDIT', subject: 'question')]
80
+
public function edit(Question $question, Request $request): Response
81
+
```
82
+
83
+
Roles decide general access, voters decide access to a specific object ("the author can edit their own question"). Magento's ACL has no such granularity. The `?Vote $vote` argument appeared in 7.3; in older versions the signature doesn't have it. For APIs you usually take the `access_token` authenticator or a JWT bundle instead of integration tokens.