Secured Container Bundle Laravel Package

Getting Started

Minimal Setup

1. Installation Add the bundle via Composer:

   composer require adrien-mallet/secured-container-bundle
   

   Enable it in config/bundles.php:

   return [
       // ...
       AdrienMallet\SecuredContainerBundle\SecuredContainerBundle::class => ['all' => true],
   ];
   

2. Basic Configuration Define unauthorized commands in config/packages/secured_container.yaml:

   secured_container:
       unauthorized:
           - "doctrine:database:drop"
           - "doctrine:schema:drop"
           - "app:custom_command"
   

3. First Use Case Immediately test by running a restricted command (e.g., php bin/console doctrine:database:drop). The command should fail with a CommandNotFoundException if properly configured.

Implementation Patterns

Workflow Integration

1. Command Whitelisting/Blacklisting

   • Use the bundle to restrict sensitive commands (e.g., doctrine:database:drop, cache:clear) in production.
   • Example: Block all doctrine commands except doctrine:schema:update:

     secured_container:
         unauthorized:
             - "doctrine:*"
             - "!doctrine:schema:update"
     

2. Environment-Specific Restrictions Override config per environment (e.g., config/packages/dev/secured_container.yaml):

   secured_container:
       unauthorized: [] # Allow all commands in dev
   

3. Dynamic Command Filtering Extend the bundle by implementing CommandFilterInterface to add runtime checks (e.g., user roles):

   // src/Command/SecuredCommandFilter.php
   use AdrienMallet\SecuredContainerBundle\Command\CommandFilterInterface;
   
   class SecuredCommandFilter implements CommandFilterInterface {
       public function isAuthorized(string $commandName): bool {
           return in_array($commandName, ['app:safe-command']);
       }
   }
   

   Register the filter in services.yaml:

   services:
       App\Command\SecuredCommandFilter:
           tags: [secured_container.command_filter]
   

4. Command Alias Handling Use the command.identifier format (e.g., command.identifier:doctrine:database:drop) to restrict aliases explicitly.

Gotchas and Tips

Pitfalls

1. Case Sensitivity Command names are case-sensitive. Ensure exact matches (e.g., doctrine:database:drop vs. doctrine:database:drop:all).

2. Wildcard Overuse Wildcards (*) are greedy. Use them sparingly to avoid unintended restrictions:

   # ❌ Blocks ALL commands starting with "doctrine:"
   unauthorized:
       - "doctrine:*"
   # ✅ Explicitly list commands
   unauthorized:
       - "doctrine:database:drop"
       - "doctrine:schema:drop"
   

3. Caching Issues Clear Symfony’s cache after modifying secured_container.yaml:

   php bin/console cache:clear
   

4. Debugging Unauthorized Commands

   • Check the exact command name with:

     php bin/console list --raw
     

   • Verify config with:

     php bin/console debug:config secured_container
     

Tips

1. Combine with Symfony’s Security Use the bundle alongside security.yaml for layered protection:

   # security.yaml
   access_control:
       - { path: ^/admin, roles: ROLE_ADMIN }
   

   Restrict CLI commands for non-admin users via SecuredContainerBundle.

2. Log Unauthorized Attempts Extend the bundle to log blocked commands:

   // src/EventListener/SecuredCommandListener.php
   use Symfony\Component\HttpKernel\EventListener\ExceptionListener;
   
   class SecuredCommandListener extends ExceptionListener {
       public function onKernelException(GetResponseForExceptionEvent $event) {
           $exception = $event->getThrowable();
           if ($exception instanceof CommandNotFoundException) {
               // Log the blocked command
           }
       }
   }
   

3. Test Coverage Write tests to verify command restrictions:

   public function testCommandIsBlocked() {
       $this->expectException(CommandNotFoundException::class);
       $this->executeCommand('doctrine:database:drop');
   }
   

4. Integration with Deployment Automate config updates during deployment (e.g., restrict commands in prod but not staging). Example in deploy.php:

   task('configure-secured-commands', function () {
       if (env('APP_ENV') === 'prod') {
           putenv('SECURED_COMMANDS=doctrine:database:drop,doctrine:schema:drop');
       }
   })->run();