vendor/symfony/security-bundle/DataCollector/SecurityDataCollector.php line 174

Open in your IDE?
  1. <?php
  2. /*
  3.  * This file is part of the Symfony package.
  4.  *
  5.  * (c) Fabien Potencier <fabien@symfony.com>
  6.  *
  7.  * For the full copyright and license information, please view the LICENSE
  8.  * file that was distributed with this source code.
  9.  */
  10. namespace Symfony\Bundle\SecurityBundle\DataCollector;
  11. use Symfony\Bundle\SecurityBundle\Debug\TraceableFirewallListener;
  12. use Symfony\Bundle\SecurityBundle\Security\FirewallMap;
  13. use Symfony\Component\HttpFoundation\Request;
  14. use Symfony\Component\HttpFoundation\Response;
  15. use Symfony\Component\HttpKernel\DataCollector\DataCollector;
  16. use Symfony\Component\HttpKernel\DataCollector\LateDataCollectorInterface;
  17. use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
  18. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  19. use Symfony\Component\Security\Core\Authentication\Token\SwitchUserToken;
  20. use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
  21. use Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager;
  22. use Symfony\Component\Security\Core\Authorization\Voter\TraceableVoter;
  23. use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
  24. use Symfony\Component\Security\Http\Firewall\SwitchUserListener;
  25. use Symfony\Component\Security\Http\FirewallMapInterface;
  26. use Symfony\Component\Security\Http\Logout\LogoutUrlGenerator;
  27. use Symfony\Component\VarDumper\Caster\ClassStub;
  28. use Symfony\Component\VarDumper\Cloner\Data;
  29. /**
  30.  * @author Fabien Potencier <fabien@symfony.com>
  31.  *
  32.  * @final
  33.  */
  34. class SecurityDataCollector extends DataCollector implements LateDataCollectorInterface
  35. {
  36.     private $tokenStorage;
  37.     private $roleHierarchy;
  38.     private $logoutUrlGenerator;
  39.     private $accessDecisionManager;
  40.     private $firewallMap;
  41.     private $firewall;
  42.     private $hasVarDumper;
  43.     public function __construct(TokenStorageInterface $tokenStorage nullRoleHierarchyInterface $roleHierarchy nullLogoutUrlGenerator $logoutUrlGenerator nullAccessDecisionManagerInterface $accessDecisionManager nullFirewallMapInterface $firewallMap nullTraceableFirewallListener $firewall null)
  44.     {
  45.         $this->tokenStorage $tokenStorage;
  46.         $this->roleHierarchy $roleHierarchy;
  47.         $this->logoutUrlGenerator $logoutUrlGenerator;
  48.         $this->accessDecisionManager $accessDecisionManager;
  49.         $this->firewallMap $firewallMap;
  50.         $this->firewall $firewall;
  51.         $this->hasVarDumper class_exists(ClassStub::class);
  52.     }
  53.     /**
  54.      * {@inheritdoc}
  55.      */
  56.     public function collect(Request $requestResponse $response, \Throwable $exception null)
  57.     {
  58.         if (null === $this->tokenStorage) {
  59.             $this->data = [
  60.                 'enabled' => false,
  61.                 'authenticated' => false,
  62.                 'impersonated' => false,
  63.                 'impersonator_user' => null,
  64.                 'impersonation_exit_path' => null,
  65.                 'token' => null,
  66.                 'token_class' => null,
  67.                 'logout_url' => null,
  68.                 'user' => '',
  69.                 'roles' => [],
  70.                 'inherited_roles' => [],
  71.                 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  72.             ];
  73.         } elseif (null === $token $this->tokenStorage->getToken()) {
  74.             $this->data = [
  75.                 'enabled' => true,
  76.                 'authenticated' => false,
  77.                 'impersonated' => false,
  78.                 'impersonator_user' => null,
  79.                 'impersonation_exit_path' => null,
  80.                 'token' => null,
  81.                 'token_class' => null,
  82.                 'logout_url' => null,
  83.                 'user' => '',
  84.                 'roles' => [],
  85.                 'inherited_roles' => [],
  86.                 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  87.             ];
  88.         } else {
  89.             $inheritedRoles = [];
  90.             $assignedRoles $token->getRoleNames();
  91.             $impersonatorUser null;
  92.             if ($token instanceof SwitchUserToken) {
  93.                 $impersonatorUser $token->getOriginalToken()->getUsername();
  94.             }
  95.             if (null !== $this->roleHierarchy) {
  96.                 foreach ($this->roleHierarchy->getReachableRoleNames($assignedRoles) as $role) {
  97.                     if (!\in_array($role$assignedRolestrue)) {
  98.                         $inheritedRoles[] = $role;
  99.                     }
  100.                 }
  101.             }
  102.             $logoutUrl null;
  103.             try {
  104.                 if (null !== $this->logoutUrlGenerator && !$token instanceof AnonymousToken) {
  105.                     $logoutUrl $this->logoutUrlGenerator->getLogoutPath();
  106.                 }
  107.             } catch (\Exception $e) {
  108.                 // fail silently when the logout URL cannot be generated
  109.             }
  110.             $this->data = [
  111.                 'enabled' => true,
  112.                 'authenticated' => $token->isAuthenticated(),
  113.                 'impersonated' => null !== $impersonatorUser,
  114.                 'impersonator_user' => $impersonatorUser,
  115.                 'impersonation_exit_path' => null,
  116.                 'token' => $token,
  117.                 'token_class' => $this->hasVarDumper ? new ClassStub(\get_class($token)) : \get_class($token),
  118.                 'logout_url' => $logoutUrl,
  119.                 'user' => $token->getUsername(),
  120.                 'roles' => $assignedRoles,
  121.                 'inherited_roles' => array_unique($inheritedRoles),
  122.                 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  123.             ];
  124.         }
  125.         // collect voters and access decision manager information
  126.         if ($this->accessDecisionManager instanceof TraceableAccessDecisionManager) {
  127.             $this->data['voter_strategy'] = $this->accessDecisionManager->getStrategy();
  128.             foreach ($this->accessDecisionManager->getVoters() as $voter) {
  129.                 if ($voter instanceof TraceableVoter) {
  130.                     $voter $voter->getDecoratedVoter();
  131.                 }
  132.                 $this->data['voters'][] = $this->hasVarDumper ? new ClassStub(\get_class($voter)) : \get_class($voter);
  133.             }
  134.             // collect voter details
  135.             $decisionLog $this->accessDecisionManager->getDecisionLog();
  136.             foreach ($decisionLog as $key => $log) {
  137.                 $decisionLog[$key]['voter_details'] = [];
  138.                 foreach ($log['voterDetails'] as $voterDetail) {
  139.                     $voterClass = \get_class($voterDetail['voter']);
  140.                     $classData $this->hasVarDumper ? new ClassStub($voterClass) : $voterClass;
  141.                     $decisionLog[$key]['voter_details'][] = [
  142.                         'class' => $classData,
  143.                         'attributes' => $voterDetail['attributes'], // Only displayed for unanimous strategy
  144.                         'vote' => $voterDetail['vote'],
  145.                     ];
  146.                 }
  147.                 unset($decisionLog[$key]['voterDetails']);
  148.             }
  149.             $this->data['access_decision_log'] = $decisionLog;
  150.         } else {
  151.             $this->data['access_decision_log'] = [];
  152.             $this->data['voter_strategy'] = 'unknown';
  153.             $this->data['voters'] = [];
  154.         }
  155.         // collect firewall context information
  156.         $this->data['firewall'] = null;
  157.         if ($this->firewallMap instanceof FirewallMap) {
  158.             $firewallConfig $this->firewallMap->getFirewallConfig($request);
  159.             if (null !== $firewallConfig) {
  160.                 $this->data['firewall'] = [
  161.                     'name' => $firewallConfig->getName(),
  162.                     'allows_anonymous' => $firewallConfig->allowsAnonymous(),
  163.                     'request_matcher' => $firewallConfig->getRequestMatcher(),
  164.                     'security_enabled' => $firewallConfig->isSecurityEnabled(),
  165.                     'stateless' => $firewallConfig->isStateless(),
  166.                     'provider' => $firewallConfig->getProvider(),
  167.                     'context' => $firewallConfig->getContext(),
  168.                     'entry_point' => $firewallConfig->getEntryPoint(),
  169.                     'access_denied_handler' => $firewallConfig->getAccessDeniedHandler(),
  170.                     'access_denied_url' => $firewallConfig->getAccessDeniedUrl(),
  171.                     'user_checker' => $firewallConfig->getUserChecker(),
  172.                     'listeners' => $firewallConfig->getListeners(),
  173.                 ];
  174.                 // generate exit impersonation path from current request
  175.                 if ($this->data['impersonated'] && null !== $switchUserConfig $firewallConfig->getSwitchUser()) {
  176.                     $exitPath $request->getRequestUri();
  177.                     $exitPath .= null === $request->getQueryString() ? '?' '&';
  178.                     $exitPath .= sprintf('%s=%s'urlencode($switchUserConfig['parameter']), SwitchUserListener::EXIT_VALUE);
  179.                     $this->data['impersonation_exit_path'] = $exitPath;
  180.                 }
  181.             }
  182.         }
  183.         // collect firewall listeners information
  184.         $this->data['listeners'] = [];
  185.         if ($this->firewall) {
  186.             $this->data['listeners'] = $this->firewall->getWrappedListeners();
  187.         }
  188.     }
  189.     /**
  190.      * {@inheritdoc}
  191.      */
  192.     public function reset()
  193.     {
  194.         $this->data = [];
  195.     }
  196.     public function lateCollect()
  197.     {
  198.         $this->data $this->cloneVar($this->data);
  199.     }
  200.     /**
  201.      * Checks if security is enabled.
  202.      *
  203.      * @return bool true if security is enabled, false otherwise
  204.      */
  205.     public function isEnabled()
  206.     {
  207.         return $this->data['enabled'];
  208.     }
  209.     /**
  210.      * Gets the user.
  211.      *
  212.      * @return string The user
  213.      */
  214.     public function getUser()
  215.     {
  216.         return $this->data['user'];
  217.     }
  218.     /**
  219.      * Gets the roles of the user.
  220.      *
  221.      * @return array|Data
  222.      */
  223.     public function getRoles()
  224.     {
  225.         return $this->data['roles'];
  226.     }
  227.     /**
  228.      * Gets the inherited roles of the user.
  229.      *
  230.      * @return array|Data
  231.      */
  232.     public function getInheritedRoles()
  233.     {
  234.         return $this->data['inherited_roles'];
  235.     }
  236.     /**
  237.      * Checks if the data contains information about inherited roles. Still the inherited
  238.      * roles can be an empty array.
  239.      *
  240.      * @return bool true if the profile was contains inherited role information
  241.      */
  242.     public function supportsRoleHierarchy()
  243.     {
  244.         return $this->data['supports_role_hierarchy'];
  245.     }
  246.     /**
  247.      * Checks if the user is authenticated or not.
  248.      *
  249.      * @return bool true if the user is authenticated, false otherwise
  250.      */
  251.     public function isAuthenticated()
  252.     {
  253.         return $this->data['authenticated'];
  254.     }
  255.     /**
  256.      * @return bool
  257.      */
  258.     public function isImpersonated()
  259.     {
  260.         return $this->data['impersonated'];
  261.     }
  262.     /**
  263.      * @return string|null
  264.      */
  265.     public function getImpersonatorUser()
  266.     {
  267.         return $this->data['impersonator_user'];
  268.     }
  269.     /**
  270.      * @return string|null
  271.      */
  272.     public function getImpersonationExitPath()
  273.     {
  274.         return $this->data['impersonation_exit_path'];
  275.     }
  276.     /**
  277.      * Get the class name of the security token.
  278.      *
  279.      * @return string|Data|null The token
  280.      */
  281.     public function getTokenClass()
  282.     {
  283.         return $this->data['token_class'];
  284.     }
  285.     /**
  286.      * Get the full security token class as Data object.
  287.      *
  288.      * @return Data|null
  289.      */
  290.     public function getToken()
  291.     {
  292.         return $this->data['token'];
  293.     }
  294.     /**
  295.      * Get the logout URL.
  296.      *
  297.      * @return string|null The logout URL
  298.      */
  299.     public function getLogoutUrl()
  300.     {
  301.         return $this->data['logout_url'];
  302.     }
  303.     /**
  304.      * Returns the FQCN of the security voters enabled in the application.
  305.      *
  306.      * @return string[]|Data
  307.      */
  308.     public function getVoters()
  309.     {
  310.         return $this->data['voters'];
  311.     }
  312.     /**
  313.      * Returns the strategy configured for the security voters.
  314.      *
  315.      * @return string
  316.      */
  317.     public function getVoterStrategy()
  318.     {
  319.         return $this->data['voter_strategy'];
  320.     }
  321.     /**
  322.      * Returns the log of the security decisions made by the access decision manager.
  323.      *
  324.      * @return array|Data
  325.      */
  326.     public function getAccessDecisionLog()
  327.     {
  328.         return $this->data['access_decision_log'];
  329.     }
  330.     /**
  331.      * Returns the configuration of the current firewall context.
  332.      *
  333.      * @return array|Data
  334.      */
  335.     public function getFirewall()
  336.     {
  337.         return $this->data['firewall'];
  338.     }
  339.     /**
  340.      * @return array|Data
  341.      */
  342.     public function getListeners()
  343.     {
  344.         return $this->data['listeners'];
  345.     }
  346.     /**
  347.      * {@inheritdoc}
  348.      */
  349.     public function getName()
  350.     {
  351.         return 'security';
  352.     }
  353. }