Option to disable guards if one granted access

[Moongazer]

Hi everyone. I would like to have a chain of guards for different tasks, but not all of them should be excecuted. Means, if one Guard granted access already, the following guards do not need to check by their logic. Lets see an example:

In an application I have a standard user auth and RBAC permission system, which is working great with ZFC-RBAC. Now I need to access some resources without a previous user authentication and without a user session, instead I want to use a JWT (JSON Web Token). My idea was to create a JwtGuard which proofes the X-Auth header of the current request and validate the JWT in isGranted(). The JwtGuard has the priority -10, so it will executed before the default RouteGuard (what is working great). Unfortunately the following RouteGuard is executed after it and deny the access, because no user identity with roles/permissions is found. It is possible do disable this check somehow?

Workflow: Order of defined Guards: 1) JwtGuard, 2) RouteGuard Example:

• Request has no JWT: JwtGuard->isGranted() return false; RouteGuard->isGrated() return based on current user-session/roles/permissions
• Request has a JWT: JwtGuard->isGranted() return based on JWT validation; RouteGuard->isGrated() is not executed because access is grated already.

[danizord]

Ok, we can make it the way middlewares works, instead of not running next guards, you can tell next guards that you already authorized the user. In case of successful authorization in JwtGuard, you can add some param to MvcEvent telling that user is already authorized, and your RouteGuard will check this param and return true if already authorized.

In case of failure, it is AbstractGuard::onResult() that makes the request fail if not authorized. Your JwtGuard can override this method and remove this behavior (or better you can use a generic event listener instead of a guard).

What do you think @Moongazer?

[Moongazer]

That sounds like a simple and smart solution, I will try it tomorrow, thank you! I was asking myself anyway if there is maybe a complete different and better solution from the architectural perspective how to implement something like this.

[danizord]

Yeah, there are the PSR-7 middlewares, they allow you to implement it easily with ServerRequest attributes :)

So I'm closing here, let me know if it works for you.