TYPO3.Flow

Patch set 2 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/20555

Patch set 3 for branch master has been pushed to the review server.
It is available at https://review.typo3.org/20555

We could try to use VO here. That should solve the mentioned problem. At least for doctrine our implementation should do what is needed.

One thing we could discuss is what methods should (alternatively) be able to take a string (role identifier). But then again, checking for roles is not really a clever thing in most cases.

Why? Because it ignores the fact that roles might get reconfigured permissions. So if you want to check for access to something, you should rather check if permission to access things is granted, not if a certain role is assigned!

Karsten Dambekalns wrote:

if you want to check for access to something, you should rather check if permission to access things is granted, not if a certain role is assigned!

I agree!
Unfortunately the API for this is not very usable yet (at least some convenience method would do good). Currently I have to add this snippet in my base controllers:

 1/**
 2 * Check if we currently have access to the given resource
 3 *
 4 * @param string $resource The resource to check
 5 * @return boolean TRUE if we currently have access to the given resource
 6 */
 7protected function hasAccessToResource($resource) {
 8    try {
 9        $this->accessDecisionManager->decideOnResource($resource);
10    } catch (AccessDeniedException $e) {
11        return FALSE;
12    }
13    return TRUE;
14}

Bastian Waidelich wrote:

Unfortunately the API for this is not very usable yet (at least some convenience method would do good). Currently I have to add this snippet in my base controllers:
[...]

Full Ack. What about adding that to some clever place?

Thanks for all those information, I update my application based on it, and everything work fine.

I need to spend more time on the decisionMaker, but currently my role configuration are really simple so I can rely on simple hasRole logic.

All the information in this issue will have a better visibility in the official documentation I think. The change around Role can be frustrating without that.