James Morris - JMOZ

Symfony2 FOSUserBundle Role entities

Mon, 12 Dec 2011 13:51:00 -0800

I’ve been working with FOSUserBundle Roles recently, adding database persistence using a simple Doctrine array mapping. We needed a better implementation where the Roles could be managed from the database and dynamically added and removed to a User through an admin interface. I found quite a few posts on stackoverflow and the Symfony2 google group asking how best to implement Role entities but very few answers or solutions, and no documentation on the FOSUserBundle github page.

Symfony2’s security system is one of the most complex parts of the framework. Couple this with FOSUserBundle’s weird AOP implementation and you’ve basically got a big massive ball ache when it comes to figuring out what’s going on. After staring through a lot of code and not really getting anywhere, I figured I’d write some tests to cover the existing functionality then refactor the User and Role classes until everything went green.

Unit test to cover existing functionality

For reference here is the unit test I was working with.



namespace JMOZ\Bundle\SecurityBundle\Tests\Functional;

use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
use JMOZ\Bundle\SecurityBundle\Entity\User;
use JMOZ\Bundle\SecurityBundle\DataFixtures\LoadSecurityData;

/**
 * @author James Morris 
 */
class SecurityTest extends WebTestCase
{

    private $_em;
    private $_container;

    /**
     * Remember when testing User's they have a default role ROLE_USER which will show +1 in counts
     */
    protected function setUp()
    {
        $kernel = static::createKernel();
        $kernel->boot();
        $this->_container = $kernel->getContainer();
        $this->_em = $this->_container->get( 'doctrine' )->getEntityManager( 'user' );
    }

    private function loadData()
    {
        $data = new LoadSecurityData( $this->_container->get( 'security.encoder_factory' ) );
        $data->truncate( $this->_em );
        $data->load( $this->_em );
    }
    
    private function getRole( $role )
    {
        return $this->_em->getRepository( 'JMOZSecurityBundle:Role' )->findOneBy( array( 'role' => $role) );
    }

    public function testNewUserHasRoleDefaultRole()
    {
        $user = new User();
        $this->assertTrue( $user->hasRole( 'ROLE_USER' ) );
        $this->assertTrue( $user->hasRole( 'ROLE_USER' ) ); // call again in case of the addition of duplicate objects (was a bug)
        $this->assertEquals( 1, count( $user->getRoles() ) );
    }
    
    public function testNewUserNotHasRole()
    {
        $user = new User();
        $this->assertTrue( $user->hasRole( 'ROLE_USER' ) );
        $this->assertFalse( $user->hasRole( 'ROLE_FOO' ) );
    }
    
    public function testNewUserDefaultRoleDoesNotSaveToDb()
    {
        $user = new User();
        $user->setUsername( 'testusertemp' );
        $user->setAlgorithm( 'sha512' );
        $user->setPassword( 'testpass' );
        $user->setEmail( 'testuser1@test.com' );
        
        $this->_em->persist( $user );
        $this->_em->flush();
        $userId = $user->getId();
        $this->_em->clear();
        
        $user = $this->_em->getRepository( 'JMOZSecurityBundle:User' )->find( $userId );
        $this->assertTrue( $user->hasRole( 'ROLE_USER' ) );
        $this->assertEquals( 1, count( $user->getRoles() ) );
        $this->assertEquals( 0, $user->getRolesCollection()->count() ); // the real collection from the db, not the roles array with added default
    }
    
    public function testNewUserAddRoleSaves()
    {
        $this->loadData();

        $user = new User();
        $user->setUsername( 'testusertemp' );
        $user->setAlgorithm( 'sha512' );
        $user->setPassword( 'testpass' );
        $user->setEmail( 'testuser1@test.com' );
        $user->addRole( $this->getRole( 'ROLE_TEST1' ) );
        
        $this->assertEquals( 2, count( $user->getRoles() ) );
        
        $this->_em->persist( $user );
        $this->_em->flush();
        
        $user = $this->_em->getRepository( 'JMOZSecurityBundle:User' )->find( 3 );
        $this->assertTrue( $user->hasRole( 'ROLE_TEST1' ) );
        $this->assertTrue( $user->hasRole( 'ROLE_USER' ) );
        $this->assertEquals( 2, count( $user->getRoles() ) );
    }
    
    public function testNewUserRoleUniqueness()
    {
        $user = new User();
        $user->addRole( $this->getRole( 'ROLE_TEST1' ) );
        $user->addRole( $this->getRole( 'ROLE_TEST2' ) );
        $user->addRole( $this->getRole( 'ROLE_TEST2' ) );
        $user->addRole( $this->getRole( 'ROLE_TEST2' ) );
        $this->assertEquals( 3, count( $user->getRoles() ) );
    }
    
    public function testNewUserRemoveRole()
    {
        $user = new User();
        $user->addRole( $this->getRole( 'ROLE_TEST1' ) );
        $user->addRole( $this->getRole( 'ROLE_TEST2' ) );
        $this->assertEquals( 3, count( $user->getRoles() ) );
        $user->removeRole( 'ROLE_TEST1' );
        $user->removeRole( 'ROLE_TEST2' );
        $this->assertEquals( 1, count( $user->getRoles() ) );
    }
    
    public function testExistingUserRemoveRoleSaves()
    {
        $this->loadData();

        $user = $this->_em->getRepository( 'JMOZSecurityBundle:User' )->find( 1 );
        $this->assertEquals( 3, count( $user->getRoles() ) );
        $user->removeRole( 'ROLE_TEST2' );
        $this->_em->flush();
        $this->_em->clear();
        $user = $this->_em->getRepository( 'JMOZSecurityBundle:User' )->find( 1 );
        $this->assertEquals( 2, count( $user->getRoles() ) );
    }
    
    public function testNewUserSetRoles()
    {
        $user = new User();
        $user->addRole( $this->getRole( 'ROLE_TEST1' ) );
        $user->addRole( $this->getRole( 'ROLE_TEST2' ) );
        $this->assertEquals( 3, count( $user->getRoles() ) );
        $this->assertTrue( $user->hasRole( 'ROLE_TEST1' ) );
        $this->assertTrue( $user->hasRole( 'ROLE_TEST2' ) );
        
        $user->setRoles( array( $this->getRole( 'ROLE_TAXONOMY_VIEW' ), $this->getRole( 'ROLE_TEST2' ) ) );
        $this->assertEquals( 3, count( $user->getRoles() ) );
        $this->assertTrue( $user->hasRole( 'ROLE_TAXONOMY_VIEW' ) );
        $this->assertTrue( $user->hasRole( 'ROLE_TEST2' ) );
        $this->assertFalse( $user->hasRole( 'ROLE_TEST1' ) );
    }

    public function testExistingUserWithRoles()
    {
        $this->loadData();

        $user = $this->_em->getRepository( 'JMOZSecurityBundle:User' )->find( 1 );
        $this->assertTrue( $user->hasRole( 'ROLE_TEST1' ) );
        $this->assertTrue( $user->hasRole( 'ROLE_TEST2' ) );
        $this->assertTrue( $user->hasRole( 'ROLE_USER' ) );
        $this->assertFalse( $user->hasRole( 'ROLE_FOO' ) );
        $this->assertEquals( 3, count( $user->getRoles() ) );
    }

    /**
     * Login the testuser (from fixture data) into the system.
     * The login proxess will trigger a lot of the User and Role code so is a useful test.
     * @return $client 
     */
    private function login( $username = 'testuser', $password = 'testpass' )
    {
        $client = self::createClient();
        $crawler = $client->request( 'GET', '/login' );
        $form = $crawler->selectButton( 'Login' )->form( array( '_username' => $username, '_password' => $password ) );
        $client->submit( $form );
        $this->assertEquals( 302, $client->getResponse()->getStatusCode() );
        $client->followRedirect();
        $this->assertEquals( 200, $client->getResponse()->getStatusCode() );
        return $client;
    }

    /**
     * testuser does not have ROLE_TAXONOMY_VIEW which /taxonomy is locked down with
     */
    public function testTaxonomyRoleTaxonomyView()
    {
        $client = $this->login();
        $client->request( 'GET', '/taxonomy/' );
        $this->assertEquals( 403, $client->getResponse()->getStatusCode() );
    }

    /**
     * testuser2 has ROLE_TAXONOMY_VIEW
     */
    public function testTaxonomyRoleTaxonomyViewOk()
    {
        $client = $this->login( 'testuser2', 'testpass' );
        $client->request( 'GET', '/taxonomy/' );
        $this->assertEquals( 200, $client->getResponse()->getStatusCode() );
    }
    
}

Creating the Role entity

FOSUserBundle provides no Role entity. Symfony2 provides a Role object but some class members are private so we just implement the Role interface, hoping it will ensure the new Role implementation works correctly with the security system.



namespace JMOZ\Bundle\SecurityBundle\Entity;

use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\Role\RoleInterface;

/**
 * Role Entity
 *
 * @ORM\Entity
 * @ORM\Table( name="security_roles" )
 * 
 * @author James Morris 
 * @package SecurityBundle
 */
class Role implements RoleInterface
{

    /**
     * @ORM\Id
     * @ORM\Column(type="integer", name="id")
     * @ORM\GeneratedValue(strategy="AUTO")
     */
    private $id;

    /**
     * @ORM\Column(type="string", name="role", unique="true", length="70")
     */
    private $role;

    /**
     * Populate the role field
     * @param string $role ROLE_FOO etc
     */
    public function __construct( $role )
    {
        $this->role = $role;
    }

    /**
     * Return the role field.
     * @return string 
     */
    public function getRole()
    {
        return $this->role;
    }

    /**
     * Return the role field.
     * @return string 
     */
    public function __toString()
    {
        return (string) $this->role;
    }

}

It’s a simple object, I’m implementing a __toString() method so we can loop in the template over User::getRoles() and echo the $role.

Creating the User, Role relationship

This is the User class with the Role relationship mapped. I tried to implement the same Role functionality as FOSUserBundle. You are restricted to certain method parameters due to the type hinting in the parent class, e.g. setRoles() must take an array. I found type hinting and return type expectations in some of the symfony2 security layer code, such as:

UsernamePasswordToken::__construct($user, $credentials, $providerKey, array $roles = array())

Because of this, I mixed up an ArrayCollection and array implementation. You can see I also provided the (set|get)RolesCollection() methods to make things easier when working with doctrine.



namespace JMOZ\Bundle\SecurityBundle\Entity;

use Doctrine\ORM\Mapping as ORM;
use Doctrine\Common\Collections\ArrayCollection;
use Doctrine\Common\Collections\Collection;
use FOS\UserBundle\Model\User as BaseUser;

/**
 * User Entity
 *
 * @ORM\Entity( repositoryClass="JMOZ\Bundle\SecurityBundle\Entity\Repository\UserRepository" )
 * @ORM\Table( name="security_users" )
 * 
 * @author James Morris 
 * @package SecurityBundle
 */
class User extends BaseUser
{
    //... existing class members

    /**
     * @ORM\ManyToMany(targetEntity="Role")
     * @ORM\JoinTable(name="security_users_roles")
     */
    protected $roles;
    
    public function __construct()
    {
        parent::__construct();
        $this->roles = new ArrayCollection();
    }
    
   //... existing setters/getters
    
    /**
     * Returns an ARRAY of Role objects with the default Role object appended.
     * @return array
     */
    public function getRoles()
    {
        return array_merge( $this->roles->toArray(), array( new Role( parent::ROLE_DEFAULT ) ) );
    }
    
    /**
     * Returns the true ArrayCollection of Roles.
     * @return Doctrine\Common\Collections\ArrayCollection 
     */
    public function getRolesCollection()
    {
        return $this->roles;
    }
    
    /**
     * Pass a string, get the desired Role object or null.
     * @param string $role
     * @return Role|null
     */
    public function getRole( $role )
    {
        foreach ( $this->getRoles() as $roleItem )
        {
            if ( $role == $roleItem->getRole() )
            {
                return $roleItem;
            }
        }
        return null;
    }
    
    /**
     * Pass a string, checks if we have that Role. Same functionality as getRole() except returns a real boolean.
     * @param string $role
     * @return boolean
     */
    public function hasRole( $role )
    {
        if ( $this->getRole( $role ) )
        {
            return true;
        }
        return false;
    }

    /**
     * Adds a Role OBJECT to the ArrayCollection. Can't type hint due to interface so throws Exception.
     * @throws Exception
     * @param Role $role 
     */
    public function addRole( $role )
    {
        if ( !$role instanceof Role )
        {
            throw new \Exception( "addRole takes a Role object as the parameter" );
        }
        
        if ( !$this->hasRole( $role->getRole() ) )
        {
            $this->roles->add( $role );
        }
    }
    
    /**
     * Pass a string, remove the Role object from collection.
     * @param string $role 
     */
    public function removeRole( $role )
    {
        $roleElement = $this->getRole( $role );
        if ( $roleElement )
        {
            $this->roles->removeElement( $roleElement );
        }
    }
    
    /**
     * Pass an ARRAY of Role objects and will clear the collection and re-set it with new Roles.
     * Type hinted array due to interface.
     * @param array $roles Of Role objects.
     */
    public function setRoles( array $roles )
    {
        $this->roles->clear();
        foreach ( $roles as $role )
        {
            $this->addRole( $role );
        }
    }
    
    /**
     * Directly set the ArrayCollection of Roles. Type hinted as Collection which is the parent of (Array|Persistent)Collection.
     * @param Doctrine\Common\Collections\Collection $role 
     */
    public function setRolesCollection( Collection $collection )
    {
        $this->roles = $collection;
    }
}

Modify the schema

Check the changes to the database:

$ php app/console --env=test doctrine:schema:update --em=user --dump-sql
CREATE TABLE security_roles (id INT AUTO_INCREMENT NOT NULL, role VARCHAR(70) NOT NULL, UNIQUE INDEX UNIQ_5A82CD6D57698A6A (role), PRIMARY KEY(id)) ENGINE = InnoDB;
CREATE TABLE security_users_roles (user_id INT NOT NULL, role_id INT NOT NULL, INDEX IDX_71E6DDEFA76ED395 (user_id), INDEX IDX_71E6DDEFD60322AC (role_id), PRIMARY KEY(user_id, role_id)) ENGINE = InnoDB;
ALTER TABLE security_users_roles ADD CONSTRAINT FK_71E6DDEFA76ED395 FOREIGN KEY (user_id) REFERENCES security_users(id) ON DELETE CASCADE;
ALTER TABLE security_users_roles ADD CONSTRAINT FK_71E6DDEFD60322AC FOREIGN KEY (role_id) REFERENCES security_roles(id) ON DELETE CASCADE;
ALTER TABLE security_users DROP roles

Either run this using the --force parameter or create a migration.

Issues

This will break the FOSUserBundle promote and demote commands as they are hard coded to use addRole(string).

Summary

I managed to get all the tests to pass:

$ phpunit --stop-on-error --stop-on-failure -c app src/JMOZ/Bundle/SecurityBundle/Tests/Functional/SecurityTest.php
PHPUnit 3.5.5 by Sebastian Bergmann.

...........

Time: 30 seconds, Memory: 82.25Mb

OK (11 tests, 35 assertions)

I would rather have not mixed the array/ArrayCollection implementation but was forced to do so due to the existing functionality and interfaces. I’d have liked to have seen some other implementations or solutions but could not seem to find any. If anyone has seen anything better please let me know. I hope this helps someone out there!

James Morris - JMOZ

Symfony2 FOSUserBundle Role entities

Unit test to cover existing functionality

Creating the Role entity

Creating the User, Role relationship

Modify the schema

Issues

Summary

How to find out your Ubuntu version

Symfony2 Warning: session_start(): The session id is too long or contains illegal characters...

Symfony2 FOSUserBundle Roles - a simple solution

Schema changes

PHP news

Twitter

Web Sites

Too many channels

A Symfony2 console Command and the Foursquare API venuehistory

How to strip exif data using Imagick

Nginx 301 to external url

Mixcloud Downloader is on Twitter!

Vietnamese in Shoreditch

SplObserver, SplSubject - Removing dependencies with the Observer pattern

The Observer pattern

The Scenario

The Action

The Client

Refactoring out sfContext

Implementing the Observer pattern

Virgin Media Super Hub a.k.a. How Virgin Media effed my life

SCRUM planning poker iPhone app - Agile Poker

Shoreditch PHP?

Firewatir and sudo gem update --system

Double Netbeans icon on Docky

Mixcloud downloader - clouddownload.co.uk

Skype plugin for Pidgin on Ubuntu Lucid crashes!

Untitled

Untitled