[RFC] [3.x] Guards with Method Interception

[aeneasr]

Service protection is still a pain. It needs a lot of boilerplate code (DI, isGranted()) and coupling is encouraged by requiring the dev to inject the AuthorizationService. There is something called method interception which translates to a configurable way for protecting services and classes.

Here are some examples how that could work:

Array

'service_guard' => [
    'My\Namespace\MyService' => [
        'myMethod' => [
            'myPermission'
        ]
    ]
];

Annotations

/**
 * @ServiceGuard\RequiresPermission({'foo', 'bar'}, @Authorization\Or)
 * @ServiceGuard\SetContext('param1')
 */
public function doSomething($param1, $param2)
{
    //...
}

/**
 * @ServiceGuard\RequiresPermission({'foo', 'bar'}, @Authorization\Or)
 * @ServiceGuard\SetContextProvider('MyNamespace\Context\Provider')
 */
public function doSomething($param1, $param2)
{
    //...
}

XML

<?xml ...
<zfc-rbac-service-guard xmlns...>
 <service class="MyNamespace\Service\MyService">
  <method name="foo">
   <requires operator="or">
    <permission name="foo">
    <permission name="bar">
   </requires>
   <context />
  </method>
 </service>
</zfc-rbac>

Java is doing this and there are some frameworks out there which provide that functionality, so go ahead and give it a read:

• https://code.google.com/p/google-guice/wiki/AOP
• http://www.oracle.com/technetwork/articles/javaee/security-annotation-142276.html
• http://projects.spring.io/spring-security/

There are already some interceptor implementations for PHP:

• http://blog.rsuter.com/?p=21
• http://pecl.php.net/package/intercept
• https://github.com/lisachenko/go-aop-php

What do you think? Your feedback is much appreciated!

[aeneasr]

Ping @jmleroux, @danizord, @bakura10, @ocramius ?

[jmleroux]

I don't like annotations ! ;) I prefer to centralize permissions in one file. This is just a personnel preference (not talking about the performance overheat to parse annotations). But i know that many people love annotations, so why not.

[jmleroux]

It coulk make sense for controller guards, or service protections. But for route guards, i definitly prefer a config file.

[aeneasr]

It's definately a feature for service protections :)

[aeneasr]

I have done some research and updated the RFC accordingly