Optimized Access Decision Manager Bundle Laravel Package

Getting Started

Minimal Setup

1. Install the Bundle Add to composer.json:

   "require": {
       "dg/optimized-access-decision-manager-bundle": "^1.0"
   }
   

   Run composer update.

2. Enable in AppKernel.php

   new Dg\OptimizedAccessDecisionManagerBundle\DGOptimizedAccessDecisionManagerBundle(),
   

3. First Use Case: Replace Default Access Decision Manager In config/security.yml, replace the default access_decision_manager with:

   security:
       access_decision_manager:
           strategy: optimized
   

Key Files to Review

• config/security.yml (for configuration)
• src/AppBundle/Security/Voter/ (custom voter classes)
• src/AppBundle/Security/AccessDecisionManager/ (if extending further)

Implementation Patterns

Core Workflow: Optimized Voter Selection

1. Register Voters Define voters in services.yml or via autowiring:

   services:
       AppBundle\Security\Voter\AdminVoter:
           tags: ['security.voter']
   

2. Leverage Optimized Strategy The bundle caches voter results for faster access checks. Example usage in a controller:

   use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
   
   public function secureAction(AuthorizationCheckerInterface $checker)
   {
       if ($checker->isGranted('ROLE_ADMIN')) {
           // Fast due to optimized caching
       }
   }
   

3. Dynamic Voter Loading Useful for large applications with many voters:

   // Only loads voters relevant to the current user/attributes
   $this->denyAccessUnlessGranted('EDIT', $entity);
   

Integration Tips

• Symfony Guard: Works seamlessly with Symfony’s Guard system.
• Custom Attributes: Extend AccessDecisionManager to support custom attributes:

  $dm = $container->get('security.access_decision_manager');
  $dm->decide($token, ['CUSTOM_ATTRIBUTE']);
  

• Event Listeners: Attach listeners to security.access_decision_manager events for logging or analytics.

Gotchas and Tips

Pitfalls

1. Caching Invalidation

   • Voters are cached by default. Clear cache after adding/removing voters:

     php bin/console cache:clear
     

   • Override caching behavior in config.yml:

     dg_optimized_access_decision_manager:
         cache_voters: false
     

2. Voter Order Matters

   • Voters are evaluated in registration order. Use priority in services.yml to control order:

     tags: ['security.voter', { priority: 100 }]
     

3. Debugging Denials

   • Enable debug mode to log voter decisions:

     dg_optimized_access_decision_manager:
         debug: true
     

Tips

• Performance Tuning
  • For read-heavy apps, increase cache TTL:

    dg_optimized_access_decision_manager:
        cache_ttl: 3600
    

• Testing
  • Mock AuthorizationCheckerInterface in tests:

    $checker = $this->createMock(AuthorizationCheckerInterface::class);
    $checker->method('isGranted')->willReturn(true);
    

• Extending the Bundle
  • Override the AccessDecisionManager class by binding a custom implementation in services.yml:

    services:
        security.access_decision_manager:
            class: AppBundle\Security\CustomDecisionManager
            arguments: ['@security.token_storage']