Improve custom actions and custom routes in CRUD controllers (#4794)

Author: grossmannmartin

config/services.yaml

@@ -20,6 +20,10 @@ services:
             $crudControllers: '%shopsys.admin.crud_controllers%'
             $crudControllerExtensions: '%shopsys.admin.crud_controllers_extensions%'
 
+    Shopsys\AdministrationBundle\Component\Crud\CrudRoleConstantProvider:
+        arguments:
+            $customRoleConstants: '%shopsys.admin.crud_role_constants%'
+
     Shopsys\AdministrationBundle\Component\Menu\CrudMenuSubscriber:
         tags:
             - { name: kernel.event_subscriber }

src/Component/Action/AbstractAction.php

@@ -45,7 +45,10 @@ public function setIcon(string $icon): static
     /**
      * Set function that will determine if action should be displayed
      *
-     * @param \Closure(): bool $function Function must return boolean value. If function returns false, action will not be displayed
+     * @param \Closure(mixed): bool $function Function must return boolean value. If function returns false, action will not be displayed.
+     *      The closure receives the data the action is built with, depending on the action kind:
+     *      a top action (Action) gets the data of the current page — the entity on the edit page, null on the list, create, and detail pages;
+     *      a row action (RowAction) gets the data of the grid row it is rendered in
      */
     public function displayIf(Closure $function): static
     {

src/Component/Config/CrudConfig.php

@@ -41,8 +41,6 @@ final class CrudConfig
 
     private ?string $routePrefix = null;
 
-    private ?string $customRoleConstant = null;
-
     private ?string $customRoleSection = null;
 
     private ?string $menuIcon = null;
@@ -63,8 +61,13 @@ final class CrudConfig
         ActionType::CREATE->value => null,
     ];
 
-    public function __construct(private readonly string $entityName)
-    {
+    /**
+     * @param string|null $customRoleConstant role declared by the ForRole attribute on the CRUD controller (or its extension), resolved at compile time
+     */
+    public function __construct(
+        private readonly string $entityName,
+        private readonly ?string $customRoleConstant = null,
+    ) {
         $this->enabledActions = new ArrayCollection([
             ActionType::LIST,
         ]);
@@ -210,19 +213,6 @@ public function setRoutePrefix(?string $routePrefix): self
         return $this;
     }
 
-    /**
-     * Set custom role constant for the CRUD controller. This will be used for access control checks.
-     * If not set, role constant will be generated from the controller name automatically.
-     *
-     * @return $this
-     */
-    public function setCustomRoleConstant(?string $roleConstant): self
-    {
-        $this->customRoleConstant = $roleConstant;
-
-        return $this;
-    }
-
     /**
      * Set role section for role constant. If not set, role section will be got from menu section automatically.
      *

src/Component/Crud/CrudControllerRegistry.php

@@ -9,7 +9,6 @@
 use Shopsys\AdministrationBundle\Component\Config\CrudConfig;
 use Shopsys\AdministrationBundle\Component\Config\CrudConfigData;
 use Shopsys\FrameworkBundle\Component\EntityExtension\EntityNameResolver;
-use SplPriorityQueue;
 use Symfony\Component\DependencyInjection\Attribute\TaggedLocator;
 use Symfony\Component\DependencyInjection\ServiceLocator;
 use Webmozart\Assert\Assert;
@@ -36,10 +35,11 @@ final class CrudControllerRegistry
 
     /**
      * @param array<int, array{class: class-string<\Shopsys\AdministrationBundle\Controller\AbstractCrudController>, entityClass: string}> $crudControllers
-     * @param array<int, array{extensionClass: class-string<\Shopsys\AdministrationBundle\Controller\AbstractCrudControllerExtension>, controllerClass: class-string<\Shopsys\AdministrationBundle\Controller\AbstractCrudController>, priority: int}> $crudControllerExtensions
+     * @param array<int, array{extensionClass: class-string<\Shopsys\AdministrationBundle\Controller\AbstractCrudControllerExtension>, controllerClass: class-string<\Shopsys\AdministrationBundle\Controller\AbstractCrudController>, priority: int}> $crudControllerExtensions sorted by ascending priority
      */
     public function __construct(
         private readonly EntityNameResolver $entityNameResolver,
+        private readonly CrudRoleConstantProvider $crudRoleConstantProvider,
         #[TaggedLocator('shopsys.admin.crud_controllers')]
         private readonly ServiceLocator $controllers,
         #[TaggedLocator('shopsys.admin.crud_handler')]
@@ -113,7 +113,7 @@ private function buildConfig(string $controllerClass): CrudConfigData
         /** @var \Shopsys\AdministrationBundle\Controller\AbstractCrudController $crudController */
         $crudController = $this->controllers->get($controllerClass);
 
-        $config = new CrudConfig($meta['entityName']);
+        $config = new CrudConfig($meta['entityName'], $this->crudRoleConstantProvider->findCustomRoleConstant($controllerClass));
         $crudController->configure($config);
 
         foreach ($extensions as $extension) {
@@ -153,23 +153,9 @@ private function getResolvedExtensions(): array
     {
         if ($this->resolvedExtensions === null) {
             $this->resolvedExtensions = [];
-            $queueByController = [];
 
             foreach ($this->crudControllerExtensions as $extension) {
-                if (isset($queueByController[$extension['controllerClass']]) === false) {
-                    $queueByController[$extension['controllerClass']] = new SplPriorityQueue();
-                }
-
-                $queueByController[$extension['controllerClass']]->insert(
-                    $this->controllers->get($extension['extensionClass']),
-                    $extension['priority'],
-                );
-            }
-
-            foreach ($queueByController as $controller => $queue) {
-                $queue->top();
-                $queue->setExtractFlags(SplPriorityQueue::EXTR_DATA);
-                $this->resolvedExtensions[$controller] = array_reverse(iterator_to_array($queue));
+                $this->resolvedExtensions[$extension['controllerClass']][] = $this->controllers->get($extension['extensionClass']);
             }
         }
 

src/Component/Crud/CrudRoleConstantProvider.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Shopsys\AdministrationBundle\Component\Crud;
+
+/**
+ * Reads the custom role constants of CRUD controllers resolved at compile time by ResolveCrudRoleConstantsCompilerPass
+ */
+final class CrudRoleConstantProvider
+{
+    public const string CRUD_ROLE_CONSTANTS_PARAMETER = 'shopsys.admin.crud_role_constants';
+
+    /**
+     * @param array<class-string<\Shopsys\AdministrationBundle\Controller\AbstractCrudController>, string|null> $customRoleConstants role declared by the ForRole attribute, or null for the generated role, indexed by controller class
+     */
+    public function __construct(
+        private readonly array $customRoleConstants = [],
+    ) {
+    }
+
+    /**
+     * Returns the role declared by the ForRole attribute on the CRUD controller or one of its extensions, or null when the controller uses its generated role
+     *
+     * @param class-string<\Shopsys\AdministrationBundle\Controller\AbstractCrudController> $controllerClass
+     */
+    public function findCustomRoleConstant(string $controllerClass): ?string
+    {
+        return $this->customRoleConstants[$controllerClass] ?? null;
+    }
+}

src/Component/Security/Attribute/AttributeProcessor.php

@@ -7,7 +7,10 @@
 use InvalidArgumentException;
 use ReflectionClass;
 use ReflectionMethod;
+use Shopsys\AdministrationBundle\Component\Crud\CrudRoleConstantProvider;
+use Shopsys\AdministrationBundle\Component\Crud\Helper\CrudTransformationHelper;
 use Shopsys\AdministrationBundle\Component\Security\AccessControl\AccessControlRuleFactory;
+use Shopsys\AdministrationBundle\Controller\AbstractCrudController;
 use Shopsys\FrameworkBundle\Component\Security\Attribute\CanCreate;
 use Shopsys\FrameworkBundle\Component\Security\Attribute\CanDelete;
 use Shopsys\FrameworkBundle\Component\Security\Attribute\CanEdit;
@@ -27,6 +30,7 @@ final class AttributeProcessor
 {
     public function __construct(
         private readonly AccessControlRuleFactory $accessControlRuleFactory,
+        private readonly CrudRoleConstantProvider $crudRoleConstantProvider,
     ) {
     }
 
@@ -75,8 +79,13 @@ public function processMethod(ReflectionClass $class, ReflectionMethod $method):
             $rules[] = $this->accessControlRuleFactory->create($roleWithPermission, $attribute->getMethods());
         }
 
-        // Get class-level role if ForRole attribute is present
-        $classRole = $this->getClassAttribute($class, ForRole::class)?->role;
+        // CRUD controllers use their role constant (generated, or set by ForRole — resolved at compile time including extension overrides) so custom routes are guarded by the same role as the built-in actions, other classes read the ForRole attribute directly
+        $classRole = $class->isSubclassOf(AbstractCrudController::class)
+            ? CrudTransformationHelper::generateRoleConstant(
+                $class->getShortName(),
+                $this->crudRoleConstantProvider->findCustomRoleConstant($class->getName()),
+            )
+            : $this->getClassAttribute($class, ForRole::class)?->role;
 
         // Process CRUD attributes
         $this->processPermissionAttributes($method, $rules, CanView::class, $classRole);

src/Controller/AbstractCrudController.php

@@ -298,6 +298,7 @@ public function editAction(Request $request, int $id): Response
         return $this->render($this->getEditTemplate(), [
             'title' => $config->getTitle(ActionType::EDIT, $recordName),
             'topActions' => $this->getConfiguredActions(ActionType::EDIT),
+            'entity' => $entity,
             'form' => $form->createView(),
             ...$this->getEditViewData($entity),
         ]);

src/Controller/BlogArticleAuthorController.php

@@ -15,6 +15,7 @@
 use Shopsys\FrameworkBundle\Component\Grid\Grid;
 use Shopsys\FrameworkBundle\Component\Grid\GridFactory;
 use Shopsys\FrameworkBundle\Component\Grid\QueryBuilderDataSourceFactory;
+use Shopsys\FrameworkBundle\Component\Security\Attribute\ForRole;
 use Shopsys\FrameworkBundle\Component\Security\Role\AdminRoleConstant;
 use Shopsys\FrameworkBundle\Form\Admin\Blog\BlogArticleAuthorFormType;
 use Shopsys\FrameworkBundle\Model\AdminNavigation\SideMenuBuilder;
@@ -23,6 +24,7 @@
 use Shopsys\FrameworkBundle\Model\Localization\Localization;
 
 #[CrudController(BlogArticleAuthor::class)]
+#[ForRole(AdminRoleConstant::ROLE_BLOG_ARTICLE_AUTHOR)]
 class BlogArticleAuthorController extends AbstractCrudController
 {
     protected const int ARTICLES_GRID_DEFAULT_LIMIT = 10;
@@ -40,8 +42,7 @@ public function configure(CrudConfig $config): void
     {
         $config
             ->registerHandler(BlogArticleAuthorCrudHandler::class)
-            ->setMenuSection(SideMenuBuilder::SECTION_BLOG)
-            ->setCustomRoleConstant(AdminRoleConstant::ROLE_BLOG_ARTICLE_AUTHOR);
+            ->setMenuSection(SideMenuBuilder::SECTION_BLOG);
     }
 
     #[Override]

src/Controller/TransportGroupController.php

@@ -10,12 +10,14 @@
 use Shopsys\AdministrationBundle\Component\Crud\Form\CrudFormConfigurator;
 use Shopsys\AdministrationBundle\Component\Datagrid\Datagrid;
 use Shopsys\AdministrationBundle\Model\Transport\TransportGroupCrudHandler;
+use Shopsys\FrameworkBundle\Component\Security\Attribute\ForRole;
 use Shopsys\FrameworkBundle\Component\Security\Role\AdminRoleConstant;
 use Shopsys\FrameworkBundle\Form\Admin\Transport\TransportGroupFormType;
 use Shopsys\FrameworkBundle\Model\AdminNavigation\SideMenuBuilder;
 use Shopsys\FrameworkBundle\Model\Transport\TransportGroup;
 
 #[CrudController(TransportGroup::class)]
+#[ForRole(AdminRoleConstant::ROLE_TRANSPORT_AND_PAYMENT)]
 class TransportGroupController extends AbstractCrudController
 {
     #[Override]
@@ -28,7 +30,6 @@ public function configure(CrudConfig $config): void
                 SideMenuBuilder::SECTION_LISTS,
                 ['after' => SideMenuBuilder::LIST_TRANSPORT_AND_PAYMENT],
             )
-            ->setCustomRoleConstant(AdminRoleConstant::ROLE_TRANSPORT_AND_PAYMENT)
             ->registerHandler(TransportGroupCrudHandler::class);
     }
 

src/DependencyInjection/Compiler/LoadControllersExtensionCompilerPass.php

@@ -30,6 +30,9 @@ public function process(ContainerBuilder $container): void
             }
         }
 
+        // ascending priority is the order the extensions are applied in, consumers rely on it instead of sorting again
+        usort($extensions, static fn (array $a, array $b): int => $a['priority'] <=> $b['priority']);
+
         $container->setParameter(
             CrudControllerRegistry::CRUD_CONTROLLERS_EXTENSIONS_PARAMETER,
             $extensions,