Question

I want to use isGranted(‘EDIT’, $userObject) for allow edit given user data by all administrators and managers and that one user.

Should I use ACL for control edit $userObject?
I have written extra Voter which check if logged user and given object are the same or user is manager or admin.

In acl I must add ACE for userObject for all administrators, managers and that one user.

Wchich way is recommended?
I am new in Symfony..

below is voter’s code:

function vote(TokenInterface $token, $object, array $attributes)
{
    $intersect=array_intersect(array('EDIT','VIEW' ), $attributes);
    if (!empty($intersect))
    {
        //intersect is not empty, it seems to edit or view are in $attributes
        //voter grants privileges for [user->granted object]
        //manager->every customer, child-manager
        //admin->every customer and manager
        if ($token->getUser()->isAdmin())
        {
            return VoterInterface::ACCESS_GRANTED;
        }
        elseif ($token->getUser()->isCustomer())
        {
            //voter not want to think about customer grants, because customer grants currently are held in ACL
            return VoterInterface::ACCESS_ABSTAIN;
        }
        /* @var $object \PSB\StoreBundle\Entity\Customer */
        if (is_a($object, '\PSB\StoreBundle\Entity\Customer'))
        {

            if ($token->getUser()->isManager())
            {
                //managers also edit customers
                return VoterInterface::ACCESS_GRANTED;
            }
        }
        elseif (is_a($object, '\PSB\StoreBundle\Entity\Manager'))
        {
            /* @var $object \PSB\StoreBundle\Entity\Manager */
            if ($token->getUser()->isManager())
            {
                //manager can edit own children
                if ($token->getUser() == $object->getParent())
                {
                    return VoterInterface::ACCESS_GRANTED;
                }
            }
        }
    }
    return VoterInterface::ACCESS_ABSTAIN;
}

Answer 1

When your model already stores the data required to know if an action should be granted or not, it’s really annoying to keep the ACL in sync with your real data.

So you should obviously implement your own voters for this.

PS: You should use $object instanceof Class instead of is_a($object, 'Class')