PHPackages                             kusebauch/nette-security-annotation - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. kusebauch/nette-security-annotation

AbandonedArchivedLibrary[Security](/categories/security)

kusebauch/nette-security-annotation
===================================

Acl security for presenter actions, signals and components by annotations

2.3.1(9y ago)12.5k1MIT X11PHP

Since Jan 15Pushed 9y ago1 watchersCompare

[ Source](https://github.com/patrickkusebauch/nette-security-annotation)[ Packagist](https://packagist.org/packages/kusebauch/nette-security-annotation)[ RSS](/packages/kusebauch-nette-security-annotation/feed)WikiDiscussions master Synced 2mo ago

READMEChangelog (1)Dependencies (7)Versions (12)Used By (0)

[![Build Status](https://camo.githubusercontent.com/e0ec8219e8c97c55a239178edb1be4529816c33cba647b198b108256a67c5376/68747470733a2f2f7472617669732d63692e6f72672f7061747269636b6b75736562617563682f6e657474652d73656375726974792d616e6e6f746174696f6e2e7376673f6272616e63683d6d6173746572)](https://travis-ci.org/patrickkusebauch/nette-security-annotation) [![codecov.io](https://camo.githubusercontent.com/b8da5a87d11082b7ffb2efa40c4dc2e54f989492d99293279eebfb60d81d13b8/68747470733a2f2f636f6465636f762e696f2f6769746875622f7061747269636b6b75736562617563682f6e657474652d73656375726974792d616e6e6f746174696f6e2f636f7665726167652e7376673f6272616e63683d6d6173746572)](https://codecov.io/github/patrickkusebauch/nette-security-annotation?branch=master)[![Latest Stable Version](https://camo.githubusercontent.com/c25dcec38f3277190594f8e53652b2d032e671a60d168429ae169329049afb90/68747470733a2f2f706f7365722e707567782e6f72672f6b75736562617563682f6e657474652d73656375726974792d616e6e6f746174696f6e2f762f737461626c65)](https://packagist.org/packages/kusebauch/nette-security-annotation)[![License](https://camo.githubusercontent.com/29d39e29e405806d7b608d31d250803dca9e27c3d67f7af5dd591d8fb36e56b2/68747470733a2f2f706f7365722e707567782e6f72672f6b75736562617563682f6e657474652d73656375726974792d616e6e6f746174696f6e2f6c6963656e7365)](https://packagist.org/packages/kusebauch/nette-security-annotation)

nette-security-annotation
=========================

[](#nette-security-annotation)

Security by annotations in Nette.

Allows securing presenters by using annotations on presenter "action" and "handle" methods. Also can tie presenter components to specific actions and secure the creation of component by the same manner.

Installation
------------

[](#installation)

The easiest way to install is via [composer](https://getcomposer.org/). Just run: `composer require kusebauch/nette-security-annotation`

Optionally you can just download the source and include the files as needed.

Basic Usage
-----------

[](#basic-usage)

To enable the security just add the `@Secured` annotation to a method. (`action*`, `handle*`, `render*` or `createComponent*`) Optionally you can add the annotation to the class and it will cascade to all methods in the class.

### Resource

[](#resource)

Every method can have exactly one resource associated with it as of right now. The resource is defined by the `@Resource` annotation with string value. Resource defined at the class level is **OVERRIDDEN** by resource defined at method level.

### Privilege

[](#privilege)

Every method can have unlimited amount of privileges associated with it. They are defined by the `@Privilege` annotation. The values are either string or array of strings. Privilege defined at class level are **MERGED** with the privileges defined at method level. Privileges are not strict - You need to have at least one privilege to access the method, not all of them.

### Action

[](#action)

Specific annotation for `createComponent*` methods. Can tie this this component factory to a specific presenter action. It is defined by the `@Action` annotation and the rules are the same as are for the Privilege annotation.

### Violation behavior

[](#violation-behavior)

If a violation of privileges happens in an `action*`, `handle*` or `render*` methods, `ForbiddenRequestException` is thrown. THe same exception is thrown if the user is not logged in. If a method has `@Secured` annotation, but does not have a `@Resource` annotation associated with it, `InvalidStateException` is thrown. Also if a you try to access a component in incorrect method, `ForbiddenRequestException` is thrown.

Example
-------

[](#example)

For examples of usage, see "tests/\_support".

Advanced usage
--------------

[](#advanced-usage)

There are some considerations for advanced usage based on this library.

### Overriding presenter methods

[](#overriding-presenter-methods)

This library overrides the default behavior for `createComponent` and `checkRequirements` presenter methods. For this reason, special care has to be taken if overriding these methods in your own code, especially, if you use "trait" version of this library.

For `createComponent` method, the library calls the `checkRequirements` method and checks the `@Action` annotation.

For `checkRequirements` method, the library parses the annotations and calls the "$presenter->getUser()->isAllowed($resource, $privilege)" for every `@Resource` and `@Privilege` pair, tills it find the first pair, for witch it is allowed (if any).

### Overriding default behavior

[](#overriding-default-behavior)

You might want a different behavior if a violation of permissions happens. In this case you can just "Override the presenter methods" (more above). In this case, you might want a code like this:

```