Allow to specify policies per action through annotations #2060
Comments
4 tasks
|
I was sceptical of this, but I do see it's usefulness now. Yes, policy:action is not always 1:1, but for the cases where it is, being able to annotate the action directly is super helpful. |
albe
moved this from In progress
to Review in progress
in Neos & Flow 7.1 Release Board
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 3, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This avoids having to create / extend the Policy.yaml in projects
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
6 tasks
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 3, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This avoids having to create / extend the Policy.yaml in projects
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 3, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This avoids having to create / extend the Policy.yaml in projects
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 3, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This avoids having to create / extend the Policy.yaml in projects
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 3, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This avoids having to create / extend the Policy.yaml in projects
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 3, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This avoids having to create / extend the Policy.yaml in projects
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 3, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This allows to avoid dealing with Policy.yaml in projects in simple cases where is sometimes is annoying to look up the exact syntax for that.
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
6 tasks
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 4, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This allows to avoid dealing with Policy.yaml in projects in simple cases where is sometimes is annoying to look up the exact syntax for that.
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 4, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This allows to avoid dealing with Policy.yaml in projects in simple cases where is sometimes is annoying to look up the exact syntax for that.
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 4, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This allows to avoid dealing with Policy.yaml in projects in simple cases where is sometimes is annoying to look up the exact syntax for that.
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
mficzel
added a commit
to mficzel/flow-development-collection
that referenced
this issue
Mar 15, 2024
The `Flow\Policy` attribute allows to assign the required policies (mostly roles) directly on the affected method.
This allows to avoid dealing with Policy.yaml in projects in simple cases where is sometimes is annoying to look up the exact syntax for that.
Hint: While this is a very convenient way to add policies in project code it should not be used in libraries/packages that expect to be configured for the outside.
In such cases the policy.yaml is still preferred as it is easier to overwrite.
Usage:
```php
use Neos\Flow\Mvc\Controller\ActionController;
use Neos\Flow\Annotations as Flow;
use Neos\Flow\Security\Authorization\Privilege\PrivilegeInterface;
class ExampleController extends ActionController
{
/**
* By assigning a policy with a role argument access to the method is granted to the specified role
*/
#[Flow\Policy(role: 'Neos.Flow:Everybody')]
public function everybodyAction(): void
{
}
/**
* By specifying the permission in addition and the DENY and ABSTAIN can be configured aswell
* Flow\Policy attributes can be assigned multiple times if multiple roles are to be configured
*/
#[Flow\Policy(role: 'Neos.Flow:Administrator', permission: PrivilegeInterface::GRANT)]
#[Flow\Policy(role: 'Neos.Flow:Anonymous', permission: PrivilegeInterface::DENY)]
public function adminButNotAnonymousAction(): void
{
}
}
```
The package: `Meteko.PolicyAnnotation` by @sorenmalling implemented the same ideas earlier.
Resolves: neos#2060
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Issue/suggestion original posted in #2059As a helping hand to developers and integrators, creating
Policyconfiguration via annotation from the method could be introduced.To do this, we introduce a
Policyannotation that let you annotated methods and have Flow automatically register aprivilegeTargetin theMethodPriviliegeconfiguration of the security frameworkOriginal comments from #2059
The text was updated successfully, but these errors were encountered: