{"action":"closed","issue":{"url":"https://api.github.com/repos/symfony/symfony/issues/15130","repository_url":"https://api.github.com/repos/symfony/symfony","labels_url":"https://api.github.com/repos/symfony/symfony/issues/15130/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony/issues/15130/comments","events_url":"https://api.github.com/repos/symfony/symfony/issues/15130/events","html_url":"https://github.com/symfony/symfony/issues/15130","id":91590776,"number":15130,"title":"[Security] Allow to override access decision strategy in isGranted","user":{"login":"WouterJ","id":749025,"avatar_url":"https://avatars.githubusercontent.com/u/749025?v=3","gravatar_id":"","url":"https://api.github.com/users/WouterJ","html_url":"https://github.com/WouterJ","followers_url":"https://api.github.com/users/WouterJ/followers","following_url":"https://api.github.com/users/WouterJ/following{/other_user}","gists_url":"https://api.github.com/users/WouterJ/gists{/gist_id}","starred_url":"https://api.github.com/users/WouterJ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WouterJ/subscriptions","organizations_url":"https://api.github.com/users/WouterJ/orgs","repos_url":"https://api.github.com/users/WouterJ/repos","events_url":"https://api.github.com/users/WouterJ/events{/privacy}","received_events_url":"https://api.github.com/users/WouterJ/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/symfony/symfony/labels/Enhancement","name":"Enhancement","color":"02d7e1"},{"url":"https://api.github.com/repos/symfony/symfony/labels/Security","name":"Security","color":"DDDDDD"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-06-28T11:52:04Z","updated_at":"2016-03-08T15:52:32Z","closed_at":"2016-03-08T15:52:32Z","body":"While rewriting the access decision strategy documentation, I discovered that it probably is quite strange to have this configured at a global level. To me, it makes more sense to specify the strategy on a usage basis.\r\n\r\nFor instance, imagine a `PersonalPost` object. 2 voters are related to this object: `UserIsAuthorOfPostVoter` and `UserIsAdminVoter`. If one of these grants access, the user is allowed to see this post. Strategy: *affirmative*\r\n\r\nNow imagine the same application to have a `ViewRestrictedPost` object. This one has a `UserIsMemberVoter` and a `UserIsOlderThan18Voter`. In order to see this post, both voters should grant access. Strategy: *unanimous*\r\n\r\nAt the moment, unless I'm missing something, this is not possible to do without extending `AccessDecisionManager` to add a feature like this.\r\n\r\nI imagine something like this would be much nicer:\r\n\r\n```pp\r\nif ($authorizationChecker->isGranted('VIEW', $personalPost, 'affirmative')) {\r\n    // ...\r\n}\r\n\r\nif ($authorizationChecker->isGranted('VIEW', $viewRestrictedPost, 'unanimous')) {\r\n    // ...\r\n}\r\n```"}}