[Security] be able to know the reasons of the denied access

Co-Authored-By: Dany Maillard <danymaillard93b@gmail.com> Co-Authored-By: Antoine Makdessi <antoine.makdessi@agriconomie.com>
symfony · azjezz · Apr 4, 2021 · Apr 4, 2021 · Apr 4, 2021 · e9e653ddea6b860d530e3b9566e58b8f78ef9d9d
commit e9e653ddea6b860d530e3b9566e58b8f78ef9d9d
diff --git a/src/Symfony/Bundle/FrameworkBundle/Controller/AbstractController.php b/src/Symfony/Bundle/FrameworkBundle/Controller/AbstractController.php
@@ -233,6 +233,7 @@ protected function denyAccessUnlessGranted($attribute, $subject = null, string $
             $exception = $this->createAccessDeniedException($message);
             $exception->setAttributes($attribute);
             $exception->setSubject($subject);
+            $exception->setAccessDecision($this->container->get('security.authorization_checker')->getLastAccessDecision());
 
             throw $exception;
         }

@@ -346,16 +346,17 @@
                                             <td class="font-normal text-small">attribute {{ voter_detail['attributes'][0] }}</td>
                                             {% endif %}
                                             <td class="font-normal text-small">
-                                                {% if voter_detail['vote'] == constant('Symfony\\Component\\Security\\Core\\Authorization\\Voter\\VoterInterface::ACCESS_GRANTED') %}
+                                                {% if voter_detail['vote'].access == constant('Symfony\\Component\\Security\\Core\\Authorization\\Voter\\VoterInterface::ACCESS_GRANTED') %}
                                                     ACCESS GRANTED
-                                                {% elseif voter_detail['vote'] == constant('Symfony\\Component\\Security\\Core\\Authorization\\Voter\\VoterInterface::ACCESS_ABSTAIN') %}
+                                                {% elseif voter_detail['vote'].access == constant('Symfony\\Component\\Security\\Core\\Authorization\\Voter\\VoterInterface::ACCESS_ABSTAIN') %}
                                                     ACCESS ABSTAIN
-                                                {% elseif voter_detail['vote'] == constant('Symfony\\Component\\Security\\Core\\Authorization\\Voter\\VoterInterface::ACCESS_DENIED') %}
+                                                {% elseif voter_detail['vote'].access == constant('Symfony\\Component\\Security\\Core\\Authorization\\Voter\\VoterInterface::ACCESS_DENIED') %}
                                                     ACCESS DENIED
                                                 {% else %}
-                                                    unknown ({{ voter_detail['vote'] }})
+                                                    unknown ({{ voter_detail['vote'].access }})
                                                 {% endif %}
                                             </td>
+                                            <td class="font-normal text-small">{{ voter_detail['vote'].reason|default('~') }}</td>
                                         </tr>
                                     {% endfor %}
                                     </tbody>

@@ -0,0 +1,93 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization;
+
+use Symfony\Component\Security\Core\Authorization\Voter\AccessTrait;
+use Symfony\Component\Security\Core\Authorization\Voter\Vote;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+/**
+ * An AccessDecision is returned by an AccessDecisionManager and contains the access verdict and all the related votes.
+ *
+ * @author Dany Maillard <danymaillard93b@gmail.com>
+ */
+final class AccessDecision
+{
+    use AccessTrait;
+
+    /** @var Vote[] */
+    private $votes = [];
+
+    /**
+     * @param int    $access One of the VoterInterface::ACCESS_* constants
+     * @param Vote[] $votes
+     */
+    private function __construct(int $access, array $votes = [])
+    {
+        $this->access = $access;
+        $this->votes = $votes;
+    }
+
+    /**
+     * @param Vote[] $votes
+     */
+    public static function createGranted(array $votes = []): self
+    {
+        return new self(VoterInterface::ACCESS_GRANTED, $votes);
+    }
+
+    /**
+     * @param Vote[] $votes
+     */
+    public static function createDenied(array $votes = []): self
+    {
+        return new self(VoterInterface::ACCESS_DENIED, $votes);
+    }
+
+    /**
+     * @return Vote[]
+     */
+    public function getVotes(): array
+    {
+        return $this->votes;
+    }
+
+    /**
+     * @return Vote[]
+     */
+    public function getGrantedVotes(): array
+    {
+        return $this->getVotesByAccess(Voter::ACCESS_GRANTED);
+    }
+
+    /**
+     * @return Vote[]
+     */
+    public function getAbstainedVotes(): array
+    {
+        return $this->getVotesByAccess(Voter::ACCESS_ABSTAIN);
+    }
+
+    /**
+     * @return Vote[]
+     */
+    public function getDeniedVotes(): array
+    {
+        return $this->getVotesByAccess(Voter::ACCESS_DENIED);
+    }
+
+    private function getVotesByAccess(int $access): array
+    {
+        return array_filter($this->votes, function (Vote $vote) use ($access) { return $vote->getAccess() === $access; });
+    }
+}
@@ -12,6 +12,7 @@
 namespace Symfony\Component\Security\Core\Authorization;
 
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Vote;
 use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
 use Symfony\Component\Security\Core\Exception\InvalidArgumentException;
 
@@ -77,28 +78,29 @@ public function decide(TokenInterface $token, array $attributes, $object = null/
      * If all voters abstained from voting, the decision will be based on the
      * allowIfAllAbstainDecisions property value (defaults to false).
      */
-    private function decideAffirmative(TokenInterface $token, array $attributes, $object = null): bool
+    private function decideAffirmative(TokenInterface $token, array $attributes, $object = null): AccessDecision
     {
+        $votes = [];
         $deny = 0;
         foreach ($this->voters as $voter) {
-            $result = $voter->vote($token, $object, $attributes);
+            $votes[] = $vote = $this->vote($voter, $token, $object, $attributes);
 
-            if (VoterInterface::ACCESS_GRANTED === $result) {
-                return true;
+            if ($vote->isGranted()) {
+                return AccessDecision::createGranted($votes);
             }
 
-            if (VoterInterface::ACCESS_DENIED === $result) {
+            if ($vote->isDenied()) {
                 ++$deny;
             } elseif (VoterInterface::ACCESS_ABSTAIN !== $result) {
                 trigger_deprecation('symfony/security-core', '5.3', 'Returning "%s" in "%s::vote()" is deprecated, return one of "%s" constants: "ACCESS_GRANTED", "ACCESS_DENIED" or "ACCESS_ABSTAIN".', var_export($result, true), get_debug_type($voter), VoterInterface::class);
             }
         }
 
         if ($deny > 0) {
-            return false;
+            return AccessDecision::createDenied($votes);
         }
 
-        return $this->allowIfAllAbstainDecisions;
+        return $this->decideIfAllAbstainDecisions();
     }
 
     /**
@@ -115,35 +117,39 @@ private function decideAffirmative(TokenInterface $token, array $attributes, $ob
      * If all voters abstained from voting, the decision will be based on the
      * allowIfAllAbstainDecisions property value (defaults to false).
      */
-    private function decideConsensus(TokenInterface $token, array $attributes, $object = null): bool
+    private function decideConsensus(TokenInterface $token, array $attributes, $object = null): AccessDecision
     {
+        $votes = [];
         $grant = 0;
         $deny = 0;
         foreach ($this->voters as $voter) {
-            $result = $voter->vote($token, $object, $attributes);
+            $votes[] = $vote = $this->vote($voter, $token, $object, $attributes);
 
-            if (VoterInterface::ACCESS_GRANTED === $result) {
+            if ($vote->isGranted()) {
                 ++$grant;
-            } elseif (VoterInterface::ACCESS_DENIED === $result) {
+            } elseif ($vote->isDenied()) {
                 ++$deny;
             } elseif (VoterInterface::ACCESS_ABSTAIN !== $result) {
                 trigger_deprecation('symfony/security-core', '5.3', 'Returning "%s" in "%s::vote()" is deprecated, return one of "%s" constants: "ACCESS_GRANTED", "ACCESS_DENIED" or "ACCESS_ABSTAIN".', var_export($result, true), get_debug_type($voter), VoterInterface::class);
             }
         }
 
         if ($grant > $deny) {
-            return true;
+            return AccessDecision::createGranted($votes);
         }
 
         if ($deny > $grant) {
-            return false;
+            return AccessDecision::createDenied($votes);
         }
 
         if ($grant > 0) {
-            return $this->allowIfEqualGrantedDeniedDecisions;
+            return $this->allowIfEqualGrantedDeniedDecisions
+                ? AccessDecision::createGranted()
+                : AccessDecision::createDenied()
+            ;
         }
 
-        return $this->allowIfAllAbstainDecisions;
+        return $this->decideIfAllAbstainDecisions();
     }
 
     /**
@@ -152,18 +158,19 @@ private function decideConsensus(TokenInterface $token, array $attributes, $obje
      * If all voters abstained from voting, the decision will be based on the
      * allowIfAllAbstainDecisions property value (defaults to false).
      */
-    private function decideUnanimous(TokenInterface $token, array $attributes, $object = null): bool
+    private function decideUnanimous(TokenInterface $token, array $attributes, $object = null): AccessDecision
     {
+        $votes = [];
         $grant = 0;
         foreach ($this->voters as $voter) {
             foreach ($attributes as $attribute) {
-                $result = $voter->vote($token, $object, [$attribute]);
+                $votes[] = $vote = $this->vote($voter, $token, $object, [$attribute]);
 
-                if (VoterInterface::ACCESS_DENIED === $result) {
-                    return false;
+                if ($vote->isDenied()) {
+                    return AccessDecision::createDenied($votes);
                 }
 
-                if (VoterInterface::ACCESS_GRANTED === $result) {
+                if ($vote->isGranted()) {
                     ++$grant;
                 } elseif (VoterInterface::ACCESS_ABSTAIN !== $result) {
                     trigger_deprecation('symfony/security-core', '5.3', 'Returning "%s" in "%s::vote()" is deprecated, return one of "%s" constants: "ACCESS_GRANTED", "ACCESS_DENIED" or "ACCESS_ABSTAIN".', var_export($result, true), get_debug_type($voter), VoterInterface::class);
@@ -173,10 +180,10 @@ private function decideUnanimous(TokenInterface $token, array $attributes, $obje
 
         // no deny votes
         if ($grant > 0) {
-            return true;
+            return AccessDecision::createGranted($votes);
         }
 
-        return $this->allowIfAllAbstainDecisions;
+        return $this->decideIfAllAbstainDecisions();
     }
 
     /**
@@ -206,4 +213,22 @@ private function decidePriority(TokenInterface $token, array $attributes, $objec
 
         return $this->allowIfAllAbstainDecisions;
     }
+
+    private function decideIfAllAbstainDecisions(): AccessDecision
+    {
+        return $this->allowIfAllAbstainDecisions
+            ? AccessDecision::createGranted()
+            : AccessDecision::createDenied()
+        ;
+    }
+
+    private function vote(VoterInterface $voter, TokenInterface $token, $subject, array $attributes): Vote
+    {
+        if (\is_int($vote = $voter->vote($token, $subject, $attributes))) {
+            trigger_deprecation('symfony/security', 5.1, 'Returning an int from the "%s::vote()" method is deprecated. Return a "%s" object instead.', \get_class($this->voter), Vote::class);
+            $vote = Vote::create($vote);
+        }
+
+        return $vote;
+    }
 }
@@ -26,7 +26,7 @@ interface AccessDecisionManagerInterface
      * @param array  $attributes An array of attributes associated with the method being invoked
      * @param object $object     The object to secure
      *
-     * @return bool true if the access is granted, false otherwise
+     * @return bool|AccessDecision Returning a boolean is deprecated since Symfony 5.1. Return an AccessDecision object instead.
      */
     public function decide(TokenInterface $token, array $attributes, $object = null);
 }
@@ -31,6 +31,8 @@ class AuthorizationChecker implements AuthorizationCheckerInterface
     private $authenticationManager;
     private $alwaysAuthenticate;
     private $exceptionOnNoToken;
+    /** @var AccessDecision */
+    private $lastAccessDecision;
 
     public function __construct(TokenStorageInterface $tokenStorage, AuthenticationManagerInterface $authenticationManager, AccessDecisionManagerInterface $accessDecisionManager, bool $alwaysAuthenticate = false, bool $exceptionOnNoToken = true)
     {
@@ -60,6 +62,19 @@ final public function isGranted($attribute, $subject = null): bool
             }
         }
 
-        return $this->accessDecisionManager->decide($token, [$attribute], $subject);
+        $this->lastAccessDecision = $this->accessDecisionManager->decide($token, [$attribute], $subject);
+
+        if (\is_bool($this->lastAccessDecision)) {
+            trigger_deprecation('symfony/security', 5.1, 'Returning a boolean from the "%s::decide()" method is deprecated. Return an "%s" object instead', \get_class($this->accessDecisionManager), AccessDecision::class);
+
+            return $this->lastAccessDecision;
+        }
+
+        return $this->lastAccessDecision->isGranted();
+    }
+
+    public function getLastAccessDecision(): AccessDecision
+    {
+        return $this->lastAccessDecision;
     }
 }
@@ -12,6 +12,7 @@
 namespace Symfony\Component\Security\Core\Authorization;
 
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Vote;
 use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
 
 /**
@@ -50,7 +51,7 @@ public function __construct(AccessDecisionManagerInterface $manager)
      *
      * @param bool $allowMultipleAttributes Whether to allow passing multiple values to the $attributes array
      */
-    public function decide(TokenInterface $token, array $attributes, $object = null/*, bool $allowMultipleAttributes = false*/): bool
+    public function decide(TokenInterface $token, array $attributes, $object = null/*, bool $allowMultipleAttributes = false*/)
     {
         $currentDecisionLog = [
             'attributes' => $attributes,
@@ -73,9 +74,9 @@ public function decide(TokenInterface $token, array $attributes, $object = null/
      * Adds voter vote and class to the voter details.
      *
      * @param array $attributes attributes used for the vote
-     * @param int   $vote       vote of the voter
+     * @param Vote  $vote       vote of the voter
      */
-    public function addVoterVote(VoterInterface $voter, array $attributes, int $vote)
+    public function addVoterVote(VoterInterface $voter, array $attributes, Vote $vote)
     {
         $currentLogIndex = \count($this->currentLog) - 1;
         $this->currentLog[$currentLogIndex]['voterDetails'][] = [

@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+/**
+ * @author Dany Maillard <danymaillard93b@gmail.com>
+ */
+trait AccessTrait
+{
+    /** @var int One of the VoterInterface::ACCESS_* constants */
+    protected $access;
+
+    public function getAccess(): int
+    {
+        return $this->access;
+    }
+
+    public function isGranted(): bool
+    {
+        return VoterInterface::ACCESS_GRANTED === $this->access;
+    }
+
+    public function isAbstain(): bool
+    {
+        return VoterInterface::ACCESS_ABSTAIN === $this->access;
+    }
+
+    public function isDenied(): bool
+    {
+        return VoterInterface::ACCESS_DENIED === $this->access;
+    }
+}
@@ -35,7 +35,7 @@ public function __construct(VoterInterface $voter, EventDispatcherInterface $eve
 
     public function vote(TokenInterface $token, $subject, array $attributes)
     {
-        $result = $this->voter->vote($token, $subject, $attributes);
+        $result = \is_int($vote = $this->voter->vote($token, $subject, $attributes)) ? Vote::create($vote) : $vote;
 
         $this->eventDispatcher->dispatch(new VoteEvent($this->voter, $subject, $attributes, $result), 'debug.security.authorization.vote');