[Security] Allow using expressions with the #[IsGranted] attribute

[HypeMC]

Q	A
Branch?	6.2
Bug fix?	no
New feature?	yes
Deprecations?	no
Tickets	Fix #46912
License	MIT
Doc PR	-

Allows using the expression language with the #[IsGranted] attribute:

#[IsGranted( attribute: new Expression('"ROLE_ADMIN" in role_names or is_granted("POST_VIEW", subject)'), subject: 'post', )] public function index(Post $post) { } #[IsGranted( attribute: new Expression('user === subject'), subject: new Expression('args["post"].getAuthor()'), )] public function index(Post $post) { } #[IsGranted( attribute: new Expression('user === subject["author"] and subject["post"].isPublished()'), subject: [ 'author' => new Expression('args["post"].getAuthor()'), 'post' => 'post', ], )] public function index(Post $post) { }

[nicolas-grekas]

$accessDeniedException->setAttributes($attribute->attributes);

Don't we want to provide the resolved values instead? That would solve the issue with accepting Expression into AccessDeniedException and might improve debugging?

[HypeMC]

$accessDeniedException->setAttributes($attribute->attributes);

Don't we want to provide the resolved values instead? That would solve the issue with accepting Expression into AccessDeniedException and might improve debugging?

@nicolas-grekas The problem is that the attributes expression is evaluated by the ExpressionVoter and I don't see a way to get that info with the current implementation:

symfony/src/Symfony/Component/Security/Core/Authorization/Voter/ExpressionVoter.php

Lines 67 to 74 in 9d7ff0c

	$result = VoterInterface::ACCESS_DENIED;
	if ($this->expressionLanguage->evaluate($attribute, $variables)) {
	return VoterInterface::ACCESS_GRANTED;
	}
	}
	return $result;

Also, if I'm not mistaking, the result of the expression is always false (or falsy) if access is denied by the voter, so I'm not sure if that would really help with debugging.

[HypeMC]

@nicolas-grekas Was this closed by accident or did I miss something ?

[lyrixx]

Indeed, this is a mistake because of the other PR description

[nicolas-grekas]

Thank you @HypeMC.