Symfony Workflow Component and Security Voters?

Question

TL;DR: how can you add custom constraints (i.e. security voters) to transitions?

My application needs some workflow management system, so I'd like to try Symfony's new Workflow Component. Let's take a Pull Request workflow as an example.

In this example, only states and their transitions are describes. But what if I want to add other constraints to this workflow? I can image some constraints:

Only admins can accept Pull Request
Users can only reopen their own Pull Request
Users can not reopen PR's older than 1 year

While you can use Events in this case, I don't think that's the best way to handle it, because an event is fired after $workflow->apply(). I want to know beforehand if a user is allowed to change the state, so I can hide or disable the button. (not like this).

The LexikWorkflowBundle solved this problem partially, by adding roles to the steps (transitions). Switching to this bundle might be a good idea, but I'd like to figure out how I can solve this problem without.

What is the best way to add custom entity constraints ('PR older than 1 year can't be reopened') and security constraints ('only admins can accept PR's', maybe by using Symfony's Security Voters) to transitions?

Update: To clarify: I want to add permission control to my workflow, but that doesn't necessarily mean I want to tightly couple it to the Workflow Component. I'd like to stick to good practices, so the given solution should respect the single responsibility principle.

Yagni. Workflow component should be responsible for workflow only. Think about it other way round - transition is one of the constraint you are using in your application. Apply other constrains before or after $workflow->can is resolved, same way as you would use it in combination with ACL, for example. — Alex Blex
I understand the other constraints should not be tightly coupled with the Workflow Component. But on the other hand, I want to have a single place where I validate all constraints (workflow, entity, security) for each transition to prevent spaghetti code in my controllers. — Stephan Vierkant
What stops you to create such place as a service which uses workflow as one of the constraints? — Alex Blex
Even if you don't take single responsibility principle as the best solution, it is a good one. After all Bolivar does its best with a lone rider. Let the workflow do the transition logic, write your own constrains specific to your business logic, and compose them in a single service if you like. I wouldn't even mess with workflow Events. — Alex Blex
Another approach might be to pass the workflow to the voter? Just a thought. Probably does not make sense. Let us know how it turns out. — Cerad

Stephan Vierkant Stephan Vierkant · Accepted Answer · 2017-02-20T10:34:27

The best way I found was implementing the AuthorizationChecker in the Workflow's GuardListener.

The demo application gives a good example:

namespace Acme\DemoBundle\Entity\Listener;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\Security\Core\Authorization\AuthorizationChecker;
use Symfony\Component\Workflow\Event\GuardEvent;

class GuardListener implements EventSubscriberInterface
{
    public function __construct(AuthorizationCheckerInterface $checker)
    {
        $this->checker = $checker;
    }
    public function onTransition(GuardEvent $event)
    {
        // For all action, user should be logger
        if (!$this->checker->isGranted('IS_AUTHENTICATED_FULLY')) {
            $event->setBlocked(true);
        }
    }
    public function onTransitionJournalist(GuardEvent $event)
    {
        if (!$this->checker->isGranted('ROLE_JOURNALIST')) {
            $event->setBlocked(true);
        }
    }
    public function onTransitionSpellChecker(GuardEvent $event)
    {
        if (!$this->checker->isGranted('ROLE_SPELLCHECKER')) {
            $event->setBlocked(true);
        }
    }
    public static function getSubscribedEvents()
    {
        return [
            'workflow.article.guard' => 'onTransition',
            'workflow.article.guard.journalist_approval' => 'onTransitionJournalist',
            'workflow.article.guard.spellchecker_approval' => 'onTransitionSpellChecker',
        ];
    }

Symfony Workflow Component and Security Voters?

1 Answers