AxiamAccessAttributeListener
in package
implements
EventSubscriberInterface
Symfony CONTRACT.md §11 declarative-authorization enforcement listener: an `EventSubscriberInterface` on `KernelEvents::CONTROLLER` — the SAME extension point Symfony's own `#[IsGranted]` attribute is enforced from (`Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener`).
Once the framework has resolved the controller callable for the matched route,
this listener reflects that callable for #[RequireAuth]/#[RequireAccess]/
#[RequireRole] (method-level attributes take precedence over class-level ones,
mirroring the same override rule as annotation-based enforcement in every other
AXIAM SDK that ships this feature) and, when any are present, delegates the
actual decision to AccessEnforcer — this class contains NO authorization
logic of its own, only reflection + wiring.
Identity comes from the axiam_user request attribute — the same one
AxiamAuthSubscriber populates on kernel.request (which runs strictly
BEFORE kernel.controller, so the identity is always already resolved by the
time this listener runs). A missing attribute (guard not installed, or the
request never authenticated) is treated as "no identity", which
AccessEnforcer maps to 401 — this listener never attempts its own token
extraction or verification (CONTRACT.md §11.2.1).
Short-circuiting on kernel.controller: ControllerEvent (unlike
RequestEvent) has no setResponse() — the idiomatic way to abort at this stage
(the same technique Symfony's own IsGrantedAttributeListener effectively
achieves via the exception listener) is to REPLACE the resolved controller with
a zero-argument closure that simply returns the precomputed error response;
kernel.view/the HTTP kernel then invokes that closure instead of the original
controller, and its return value becomes the final response unchanged.
MUST be manually registered (Pitfall 5, same as AxiamAuthSubscriber and
AxiamVoter): tag this class kernel.event_subscriber in the consuming
app's own config/services.yaml — see examples/symfony_app/services.yaml.
Table of Contents
Interfaces
- EventSubscriberInterface
Methods
- __construct() : mixed
- getSubscribedEvents() : array<string, string>
- onKernelController() : void
- Reflects the resolved controller for `#[RequireAuth]`/`#[RequireRole]`/ `#[RequireAccess]` and, when any are present, enforces them via {@see AccessEnforcer} — replacing the controller with a closure returning the error response on the first failing check. Checks are evaluated in the order auth -> role -> access (each of {@see AccessEnforcer}'s own methods re-checks authentication internally too, so this ordering only affects which message a caller sees first, never the correctness of the final decision).
Methods
__construct()
public
__construct(AccessEnforcer $enforcer) : mixed
Parameters
- $enforcer : AccessEnforcer
getSubscribedEvents()
public
static getSubscribedEvents() : array<string, string>
Return values
array<string, string>onKernelController()
Reflects the resolved controller for `#[RequireAuth]`/`#[RequireRole]`/ `#[RequireAccess]` and, when any are present, enforces them via {@see AccessEnforcer} — replacing the controller with a closure returning the error response on the first failing check. Checks are evaluated in the order auth -> role -> access (each of {@see AccessEnforcer}'s own methods re-checks authentication internally too, so this ordering only affects which message a caller sees first, never the correctness of the final decision).
public
onKernelController(ControllerEvent $event) : void
Parameters
- $event : ControllerEvent
-
The kernel's controller-resolution event; its controller is replaced with an error-returning closure on a failing check.