docs(articles): Magento and Symfony examples side by side, request lifecycle as a Mermaid diagram
en/articles/magento-to-symfony/data/security.md
+6
−1
31
31
- { path: ^/account, roles: ROLE_USER }
32
32
```
33
33
34
+
::::columns
35
+
:::col
34
36
**Magento** · acl.xml + ADMIN_RESOURCE
35
37
36
38
```xml
51
53
const ADMIN_RESOURCE = 'Vendor_Faq::question_edit';
52
54
}
53
55
```
54
−
56
+
:::
57
+
:::col
55
58
**Symfony** · Voter + #[IsGranted]
56
59
57
60
```php
79
82
#[IsGranted('QUESTION_EDIT', subject: 'question')]
80
83
public function edit(Question $question, Request $request): Response
81
84
```
85
+
:::
86
+
::::
82
87
83
88
Roles decide general access, voters decide access to a specific object ("the author can edit their own question"). Magento's ACL has no such granularity. The `?Vote $vote` argument appeared in 7.3; in older versions the signature doesn't have it. For APIs you usually take the `access_token` authenticator or a JWT bundle instead of integration tokens.