{"action":"created","issue":{"url":"https://api.github.com/repos/orocrm/platform/issues/417","repository_url":"https://api.github.com/repos/orocrm/platform","labels_url":"https://api.github.com/repos/orocrm/platform/issues/417/labels{/name}","comments_url":"https://api.github.com/repos/orocrm/platform/issues/417/comments","events_url":"https://api.github.com/repos/orocrm/platform/issues/417/events","html_url":"https://github.com/orocrm/platform/issues/417","id":141466245,"number":417,"title":"Not possible to make an acl check for non-logged in user","user":{"login":"alex-kuzmenko","id":3186921,"avatar_url":"https://avatars.githubusercontent.com/u/3186921?v=3","gravatar_id":"","url":"https://api.github.com/users/alex-kuzmenko","html_url":"https://github.com/alex-kuzmenko","followers_url":"https://api.github.com/users/alex-kuzmenko/followers","following_url":"https://api.github.com/users/alex-kuzmenko/following{/other_user}","gists_url":"https://api.github.com/users/alex-kuzmenko/gists{/gist_id}","starred_url":"https://api.github.com/users/alex-kuzmenko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex-kuzmenko/subscriptions","organizations_url":"https://api.github.com/users/alex-kuzmenko/orgs","repos_url":"https://api.github.com/users/alex-kuzmenko/repos","events_url":"https://api.github.com/users/alex-kuzmenko/events{/privacy}","received_events_url":"https://api.github.com/users/alex-kuzmenko/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-17T03:05:21Z","updated_at":"2016-03-18T00:57:18Z","closed_at":null,"body":"Hey guys,\r\n\r\nIt looks like you've overlooked a possibility to check permissions for a random user, i.e. not the one that's logged in at the moment.\r\nI'm referring to the `supports()` methods in EntityOwnershipDecisionMaker and OwnershipMetadataProvider:\r\nhttps://github.com/orocrm/platform/blob/ae09ef7175a0febc079b33d7a0b4d2ceab7cbc91/src/Oro/Bundle/SecurityBundle/Owner/EntityOwnershipDecisionMaker.php#L125\r\nhttps://github.com/orocrm/platform/blob/ae09ef7175a0febc079b33d7a0b4d2ceab7cbc91/src/Oro/Bundle/SecurityBundle/Owner/Metadata/OwnershipMetadataProvider.php#L174\r\n\r\nOf course, technically, this becomes a problem only for certain cases when you have more than one type of Users. E.g. in my case there is another \"loginable\" User (similar to AccountUser in OroCommerce) that needs to be notified (when he's not logged in) about certain changes in the database, and for that we need to check his permissions to make sure he's not notified about stuff he is not supposed to know about.\r\nBut even if we leave this strange use-case aside, there seems to be a conceptual issue, since Symfony `AccessDecisionManager` accepts a security token in the `decide()` method, and everything seems to work marvellously, since this token gets passed all the way through, up until those `supports()` methods, which in my mind should also accept the token (or a user from it) as an argument.\r\nI could have tried contributing a pull request, but the issue seems to dwell rather deep inside the platform - this would mean changing at least 2 interfaces (which is not bc safe) and also making some changes to the OroCommerce :cold_sweat: \r\nCould you, please, let me know if you also think this is an issue and if I can expect this to be solved on the platform level?\r\n\r\nOn a side note: I'd also appreciate having a `priority` for those decision-makers and metadata-providers in the chain; using bundle priority isn't exactly convenient :wink: \r\n\r\nThank you."},"comment":{"url":"https://api.github.com/repos/orocrm/platform/issues/comments/198148383","html_url":"https://github.com/orocrm/platform/issues/417#issuecomment-198148383","issue_url":"https://api.github.com/repos/orocrm/platform/issues/417","id":198148383,"user":{"login":"mbessolov","id":2725121,"avatar_url":"https://avatars.githubusercontent.com/u/2725121?v=3","gravatar_id":"","url":"https://api.github.com/users/mbessolov","html_url":"https://github.com/mbessolov","followers_url":"https://api.github.com/users/mbessolov/followers","following_url":"https://api.github.com/users/mbessolov/following{/other_user}","gists_url":"https://api.github.com/users/mbessolov/gists{/gist_id}","starred_url":"https://api.github.com/users/mbessolov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbessolov/subscriptions","organizations_url":"https://api.github.com/users/mbessolov/orgs","repos_url":"https://api.github.com/users/mbessolov/repos","events_url":"https://api.github.com/users/mbessolov/events{/privacy}","received_events_url":"https://api.github.com/users/mbessolov/received_events","type":"User","site_admin":false},"created_at":"2016-03-18T00:57:18Z","updated_at":"2016-03-18T00:57:18Z","body":"Hi Alex,\r\n\r\nCan you please elaborate your use case a little bit deeper?\r\n\r\nFor example, see how an additional ownership security model is handled in OroCommerce:\r\n- https://github.com/orocommerce/orocommerce/blob/master/src/OroB2B/Bundle/AccountBundle/Resources/config/ownership.yml\r\n- https://github.com/orocommerce/orocommerce/blob/master/src/OroB2B/Bundle/AccountBundle/Owner/FrontendOwnerTreeProvider.php\r\n- https://github.com/orocommerce/orocommerce/blob/master/src/OroB2B/Bundle/AccountBundle/Owner/EntityOwnershipDecisionMaker.php\r\n- https://github.com/orocommerce/orocommerce/blob/master/src/OroB2B/Bundle/AccountBundle/Owner/Metadata/FrontendOwnershipMetadataProvider.php\r\n- https://github.com/orocommerce/orocommerce/blob/master/src/OroB2B/Bundle/AccountBundle/Owner/Metadata/FrontendOwnershipMetadata.php\r\n\r\nWouldn't a similar approach work for your use case as well?\r\n"}}