Ownership in OneToMany relations

Hi i have the following problem.

When loading the EntityA the OneToMany collection is loaded not filtered with the ownership. I’m getting always in OneToMany collections all the entities owned by different organizations. Is it possible to use ownership for OneToMany relations when loading on the inverse side ? Maybe i’m doing something wrong ?!

/** * @Entity * @Table(name="......") * */ class EntityA{ protected $id; /** * @OneToMany(targetEntity="EntityB",mappedBy="entityA") */ protected $entityBs; } /** * @Entity * @Table(name="......") * @Config( * defaultValues={ * "security"={ * "type"="ACL", * "group_name"="" * }, * "ownership"={ * "owner_type"="ORGANIZATION", * "owner_field_name"="organization", * "owner_column_name"="organization_id" * }, * "dataaudit"={ * "auditable"=true * } * } * ) */ class EntityB{ protected $id; /** * @ManyToOne(targetEntity="EntityA",inversedBy="entityBs") * @JoinColumn(name="entity_a_id",referencedColumnName="id") */ protected $entityA; /** * @ManyToOne(targetEntity="Oro\Bundle\OrganizationBundle\Entity\Organization") * @JoinColumn(name="organization_id",referencedColumnName="id") */ protected $organization; }

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51

/** * @Entity * @Table(name="......") * */ class EntityA{   protected $id; /** * @OneToMany(targetEntity="EntityB",mappedBy="entityA") */ protected $entityBs; }   /** * @Entity * @Table(name="......") * @Config( *      defaultValues={ *          "security"={ *              "type"="ACL", *              "group_name"="" *          }, *          "ownership"={ *              "owner_type"="ORGANIZATION", *              "owner_field_name"="organization", *              "owner_column_name"="organization_id" *          }, *          "dataaudit"={ *              "auditable"=true *          } *      } * ) */ class EntityB{   protected $id; /** * @ManyToOne(targetEntity="EntityA",inversedBy="entityBs") * @JoinColumn(name="entity_a_id",referencedColumnName="id") */ protected $entityA; /** * @ManyToOne(targetEntity="Oro\Bundle\OrganizationBundle\Entity\Organization") * @JoinColumn(name="organization_id",referencedColumnName="id") */ protected $organization;   }

Topic

[andeskParticipant]

I am also interested in that topic.

[hugevalParticipant]

Hi @dimonixx, @andesk. Let me clarify oro security protection. Data grids and param converters are automatically protected with security protection. Please check

https://github.com/laboro/platform/blob/master/src/Oro/Bundle/SecurityBundle/Resources/doc/access-levels.md#data-grids-protections
https://github.com/laboro/platform/blob/master/src/Oro/Bundle/SecurityBundle/Resources/doc/access-levels.md#protection-with-param-converters.

But if you load objects manually, you should protect them with oro_security.acl_helper or oro_security.security_facade. Please check

https://github.com/laboro/platform/blob/master/src/Oro/Bundle/SecurityBundle/Resources/doc/access-levels.md#manual-protection-of-select-queries
https://github.com/laboro/platform/blob/master/src/Oro/Bundle/SecurityBundle/Resources/doc/access-levels.md#manual-access-check-on-object

To be able use protection you should make several steps:
1 Add ownership annotation to entity, as you made:

... /** * * @ORM\Entity * @ORM\Table(name="tbl_name_1") * @Config( * defaultValues={ * "security"={ * "type"="ACL", * "group_name"="" * }, * "ownership"={ * "owner_type"="ORGANIZATION", * "owner_field_name"="owner", * "owner_column_name"="organization_id" * } * } * ) */ class EntityB { ... }

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

...   /** * * @ORM\Entity * @ORM\Table(name="tbl_name_1") * @Config( *      defaultValues={ *          "security"={ *              "type"="ACL", *              "group_name"="" *          }, *          "ownership"={ *              "owner_type"="ORGANIZATION", *              "owner_field_name"="owner", *              "owner_column_name"="organization_id" *          } *      } * ) */ class EntityB { ... }

2 Make migration to create new acl_classes entry

... class AcmeBundle implements Migration { public function up(Schema $schema, QueryBag $queries) { $queries->addQuery( new UpdateEntityConfigEntityValueQuery( 'Oro\Bundle\AcmeBundle\Entity\EntityB', 'security', 'permissions', 'VIEW;CREATE;EDIT' ) ); } }

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

... class AcmeBundle implements Migration {     public function up(Schema $schema, QueryBag $queries)     {         $queries->addQuery(             new UpdateEntityConfigEntityValueQuery(                 'Oro\Bundle\AcmeBundle\Entity\EntityB',                 'security',                 'permissions',                 'VIEW;CREATE;EDIT'             )         );     } }

3 Add annotation to controller if you want to use param converters protection

... /** * * @Route("/acme/{id}/view", name="acme_entity_view", requirements={"id"="\d+"}) * @Acl( * id="acme_entity_view", * type="entity", * class="OroAcmeBundle:Entity", * permission="VIEW" * ) */ public function viewAction(Entity $entity) { ... } ...

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

...      /**      *      * @Route("/acme/{id}/view", name="acme_entity_view", requirements={"id"="\d+"})      * @Acl(      *      id="acme_entity_view",      *      type="entity",      *      class="OroAcmeBundle:Entity",      *      permission="VIEW"      * )      */     public function viewAction(Entity $entity)     { ...     } ...

4 run app/console oro:platform:update console command

[Dima MakarukParticipant]

@hugeval thank you for your answer. That’s exactly the way i’m using it.
I have the following problem:
– When loading the EntityA the OneToMany collection is not filtered with the ownership

[hugevalParticipant]

@dimonixx, there are several ways to load entities. Could you please show an example how do you load entities?

[Dima MakarukParticipant]

i’m loading it with repository method for example findOneBy. And then $entityA->getEntityBs() returns the collection that is not filtered with owner .

[hugevalParticipant]

In this case you should protect entities manually, as mentioned at page https://github.com/laboro/platform/blob/master/src/Oro/Bundle/SecurityBundle/Resources/doc/access-levels.md#manual-protection-of-select-queries.

For example, with QueryBuilder:

$repository = $this->getDoctrine() ->getRepository('AcmeDemoBundle:EntityB'); $queryBuilder = $repository->createQueryBuilder('e') $queryBuilder ->select('e') ->join('e.entityA'); $query = $this->get('ro_security.acl_helper')->apply($queryBuilder, 'VIEW');

1 2 3 4 5 6 7 8 9

$repository = $this->getDoctrine()    ->getRepository('AcmeDemoBundle:EntityB'); $queryBuilder = $repository->createQueryBuilder('e') $queryBuilder     ->select('e')     ->join('e.entityA'); $query = $this->get('ro_security.acl_helper')->apply($queryBuilder, 'VIEW');

Or with objects:

$entityB = $entityA->getEntityBs()->first(); if (!$this->securityFacade->isGranted('VIEW', $entityB)) { throw new AccessDeniedException('Access denided'); } else { // access is granted }

1 2 3 4 5 6 7 8

$entityB = $entityA->getEntityBs()->first(); if (!$this->securityFacade->isGranted('VIEW', $entityB)) {     throw new AccessDeniedException('Access denided'); } else {     // access is granted }

[Author]

Replies