americancouncils / kalinka-bundle Goto Github PK

Write a plugin for the JMS Serializer that will allow an authorizer to be called on a property-by-property basis during serialization/deserialization, if the object is configured for such.

Allow this property/class configuration via annotations.

There should be multiple configurable authorizer services.

Some needed placeholders are already there, but it's not really implemented yet.

Bundle config isn't really being validated at all... it will also need to change a little to allow multiple authorizer service configurations.

This is currently untested.

Using a pattern like in http://symfony.com/doc/current/cookbook/event_dispatcher/before_after_filters.html we should allow app to mark controllers which should authorize all actions, and then check to make sure that an authorization check was made. There should also be a way for actions to explicitly declare that they do not require authorization.

test this case:

• a class uses a custom setter function
• serializer should use the custom setter, not reflection.

Ideally, the serializer metadata stack, and (in the case of deserialization) maybe something like the resolveMetadata method from serializer graphNavigator should give us this information. Does that work, though? In my tests the 'setter' field in propertyMetadata is always blank - this might only work if we use the @Accessor annotation:

http://jmsyst.com/libs/serializer/master/reference/annotations#accessor

We should be able to hypothetically run any controller action; that is, determine if we would be allowed to do it, but not actually mutate anything. To do this, action methods should have a point right before they actually do any potentially destructive act where they check if the request is hypothetical and, if so, immediately return. This requires:

• That we allow hypothetical sub-requests, which will involve creating a subtype of Request
• That all controller actions check for hypothetical requests. We should do this in a method, rather than using instanceof, because...
• If an action does not check for hypothetical requests, that should be a detectable bug, that we catch in a late listener.

Test this case:

• extend an abstract class
• both abstract class and extending class have annotations
• make sure both are enforced