sonata-project/SonataAdminBundle — pull request #1146 by morgen2009 (2013-02-02 14:34:17+00:00)
Title: Groups of permissions in role security handler

Q A
Bug fix?	no
New feature?	yes
BC breaks?	no
Tests pass?	yes

If you use the security handler based on the roles, you are intended to include into your role a lot of subroles. The total number of subroles to be distributed is the number of admin classes times the number of permissions. This is too much.

Now the role security handler does not use security information field of the admin class as well sonata_admin.security.infomation parameter does not affect. This pull allows to define groups of permissions in security information field and grant acces for these groups. The groups can be defined globally in sonata_admin.security.information parameter or locally by calling setSecurityInformation method of the admin class.

Before
a) config.yml

sonata_admin:
security:
handler: sonata.admin.security.handler.role
information:
LIST: LIST
SHOW: SHOW
EDIT: EDIT
CREATE: CREATE
DELETE: DELETE
OPERATOR: OPERATOR
EXPORT: EXPORT
MASTER: MASTER

b) security.yml

roles_hierarhie:
ROLE_CLIENT:
- ROLE_ADMIN_MAIN_SECTION_SHOW
- ROLE_ADMIN_MAIN_SECTION_LIST
- ROLE_ADMIN_MAIN_SECTION_EXPORT
ROLE_STAFF:
- ROLE_ADMIN_MAIN_SECTION_EDIT
- ROLE_ADMIN_MAIN_SECTION_CREATE
- ROLE_ADMIN_MAIN_SECTION_DELETE
- ROLE_ADMIN_MAIN_SECTION_OPERATOR
- ROLE_ADMIN_MAIN_SECTION_MASTER
# times the number of admin class

After
a) config.yml

sonata_admin:
security:
handler: sonata.admin.security.handler.role
information:
CLIENT : [LIST, SHOW, EXPORT]
STAFF : [EDIT, CREATE, DELETE, OPERATOR, MASTER]

b) security.yml

security:
role_hierarchy:
ROLE_CLIENT:
- ROLE_ADMIN_MAIN_SECTION_CLIENT # times the number of admin class
ROLE_STAFF:
- ROLE_ADMIN_MAIN_SECTION_STAFF