SecurityDataCollector.php 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Bundle\SecurityBundle\DataCollector;
  11. use Symfony\Bundle\SecurityBundle\Debug\TraceableFirewallListener;
  12. use Symfony\Bundle\SecurityBundle\Security\FirewallMap;
  13. use Symfony\Component\HttpFoundation\Request;
  14. use Symfony\Component\HttpFoundation\Response;
  15. use Symfony\Component\HttpKernel\DataCollector\DataCollector;
  16. use Symfony\Component\HttpKernel\DataCollector\LateDataCollectorInterface;
  17. use Symfony\Component\Security\Core\Authentication\Token\AnonymousToken;
  18. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  19. use Symfony\Component\Security\Core\Authentication\Token\SwitchUserToken;
  20. use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
  21. use Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager;
  22. use Symfony\Component\Security\Core\Authorization\Voter\TraceableVoter;
  23. use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
  24. use Symfony\Component\Security\Http\Firewall\SwitchUserListener;
  25. use Symfony\Component\Security\Http\FirewallMapInterface;
  26. use Symfony\Component\Security\Http\Logout\LogoutUrlGenerator;
  27. use Symfony\Component\VarDumper\Caster\ClassStub;
  28. use Symfony\Component\VarDumper\Cloner\Data;
  29. /**
  30. * @author Fabien Potencier <fabien@symfony.com>
  31. *
  32. * @final
  33. */
  34. class SecurityDataCollector extends DataCollector implements LateDataCollectorInterface
  35. {
  36. private $tokenStorage;
  37. private $roleHierarchy;
  38. private $logoutUrlGenerator;
  39. private $accessDecisionManager;
  40. private $firewallMap;
  41. private $firewall;
  42. private $hasVarDumper;
  43. public function __construct(TokenStorageInterface $tokenStorage = null, RoleHierarchyInterface $roleHierarchy = null, LogoutUrlGenerator $logoutUrlGenerator = null, AccessDecisionManagerInterface $accessDecisionManager = null, FirewallMapInterface $firewallMap = null, TraceableFirewallListener $firewall = null)
  44. {
  45. $this->tokenStorage = $tokenStorage;
  46. $this->roleHierarchy = $roleHierarchy;
  47. $this->logoutUrlGenerator = $logoutUrlGenerator;
  48. $this->accessDecisionManager = $accessDecisionManager;
  49. $this->firewallMap = $firewallMap;
  50. $this->firewall = $firewall;
  51. $this->hasVarDumper = class_exists(ClassStub::class);
  52. }
  53. /**
  54. * {@inheritdoc}
  55. */
  56. public function collect(Request $request, Response $response, \Throwable $exception = null)
  57. {
  58. if (null === $this->tokenStorage) {
  59. $this->data = [
  60. 'enabled' => false,
  61. 'authenticated' => false,
  62. 'impersonated' => false,
  63. 'impersonator_user' => null,
  64. 'impersonation_exit_path' => null,
  65. 'token' => null,
  66. 'token_class' => null,
  67. 'logout_url' => null,
  68. 'user' => '',
  69. 'roles' => [],
  70. 'inherited_roles' => [],
  71. 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  72. ];
  73. } elseif (null === $token = $this->tokenStorage->getToken()) {
  74. $this->data = [
  75. 'enabled' => true,
  76. 'authenticated' => false,
  77. 'impersonated' => false,
  78. 'impersonator_user' => null,
  79. 'impersonation_exit_path' => null,
  80. 'token' => null,
  81. 'token_class' => null,
  82. 'logout_url' => null,
  83. 'user' => '',
  84. 'roles' => [],
  85. 'inherited_roles' => [],
  86. 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  87. ];
  88. } else {
  89. $inheritedRoles = [];
  90. $assignedRoles = $token->getRoleNames();
  91. $impersonatorUser = null;
  92. if ($token instanceof SwitchUserToken) {
  93. $impersonatorUser = $token->getOriginalToken()->getUsername();
  94. }
  95. if (null !== $this->roleHierarchy) {
  96. foreach ($this->roleHierarchy->getReachableRoleNames($assignedRoles) as $role) {
  97. if (!\in_array($role, $assignedRoles, true)) {
  98. $inheritedRoles[] = $role;
  99. }
  100. }
  101. }
  102. $logoutUrl = null;
  103. try {
  104. if (null !== $this->logoutUrlGenerator && !$token instanceof AnonymousToken) {
  105. $logoutUrl = $this->logoutUrlGenerator->getLogoutPath();
  106. }
  107. } catch (\Exception $e) {
  108. // fail silently when the logout URL cannot be generated
  109. }
  110. $this->data = [
  111. 'enabled' => true,
  112. 'authenticated' => $token->isAuthenticated(),
  113. 'impersonated' => null !== $impersonatorUser,
  114. 'impersonator_user' => $impersonatorUser,
  115. 'impersonation_exit_path' => null,
  116. 'token' => $token,
  117. 'token_class' => $this->hasVarDumper ? new ClassStub(\get_class($token)) : \get_class($token),
  118. 'logout_url' => $logoutUrl,
  119. 'user' => $token->getUsername(),
  120. 'roles' => $assignedRoles,
  121. 'inherited_roles' => array_unique($inheritedRoles),
  122. 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  123. ];
  124. }
  125. // collect voters and access decision manager information
  126. if ($this->accessDecisionManager instanceof TraceableAccessDecisionManager) {
  127. $this->data['voter_strategy'] = $this->accessDecisionManager->getStrategy();
  128. foreach ($this->accessDecisionManager->getVoters() as $voter) {
  129. if ($voter instanceof TraceableVoter) {
  130. $voter = $voter->getDecoratedVoter();
  131. }
  132. $this->data['voters'][] = $this->hasVarDumper ? new ClassStub(\get_class($voter)) : \get_class($voter);
  133. }
  134. // collect voter details
  135. $decisionLog = $this->accessDecisionManager->getDecisionLog();
  136. foreach ($decisionLog as $key => $log) {
  137. $decisionLog[$key]['voter_details'] = [];
  138. foreach ($log['voterDetails'] as $voterDetail) {
  139. $voterClass = \get_class($voterDetail['voter']);
  140. $classData = $this->hasVarDumper ? new ClassStub($voterClass) : $voterClass;
  141. $decisionLog[$key]['voter_details'][] = [
  142. 'class' => $classData,
  143. 'attributes' => $voterDetail['attributes'], // Only displayed for unanimous strategy
  144. 'vote' => $voterDetail['vote'],
  145. ];
  146. }
  147. unset($decisionLog[$key]['voterDetails']);
  148. }
  149. $this->data['access_decision_log'] = $decisionLog;
  150. } else {
  151. $this->data['access_decision_log'] = [];
  152. $this->data['voter_strategy'] = 'unknown';
  153. $this->data['voters'] = [];
  154. }
  155. // collect firewall context information
  156. $this->data['firewall'] = null;
  157. if ($this->firewallMap instanceof FirewallMap) {
  158. $firewallConfig = $this->firewallMap->getFirewallConfig($request);
  159. if (null !== $firewallConfig) {
  160. $this->data['firewall'] = [
  161. 'name' => $firewallConfig->getName(),
  162. 'allows_anonymous' => $firewallConfig->allowsAnonymous(),
  163. 'request_matcher' => $firewallConfig->getRequestMatcher(),
  164. 'security_enabled' => $firewallConfig->isSecurityEnabled(),
  165. 'stateless' => $firewallConfig->isStateless(),
  166. 'provider' => $firewallConfig->getProvider(),
  167. 'context' => $firewallConfig->getContext(),
  168. 'entry_point' => $firewallConfig->getEntryPoint(),
  169. 'access_denied_handler' => $firewallConfig->getAccessDeniedHandler(),
  170. 'access_denied_url' => $firewallConfig->getAccessDeniedUrl(),
  171. 'user_checker' => $firewallConfig->getUserChecker(),
  172. 'listeners' => $firewallConfig->getListeners(),
  173. ];
  174. // generate exit impersonation path from current request
  175. if ($this->data['impersonated'] && null !== $switchUserConfig = $firewallConfig->getSwitchUser()) {
  176. $exitPath = $request->getRequestUri();
  177. $exitPath .= null === $request->getQueryString() ? '?' : '&';
  178. $exitPath .= sprintf('%s=%s', urlencode($switchUserConfig['parameter']), SwitchUserListener::EXIT_VALUE);
  179. $this->data['impersonation_exit_path'] = $exitPath;
  180. }
  181. }
  182. }
  183. // collect firewall listeners information
  184. $this->data['listeners'] = [];
  185. if ($this->firewall) {
  186. $this->data['listeners'] = $this->firewall->getWrappedListeners();
  187. }
  188. }
  189. /**
  190. * {@inheritdoc}
  191. */
  192. public function reset()
  193. {
  194. $this->data = [];
  195. }
  196. public function lateCollect()
  197. {
  198. $this->data = $this->cloneVar($this->data);
  199. }
  200. /**
  201. * Checks if security is enabled.
  202. *
  203. * @return bool true if security is enabled, false otherwise
  204. */
  205. public function isEnabled()
  206. {
  207. return $this->data['enabled'];
  208. }
  209. /**
  210. * Gets the user.
  211. *
  212. * @return string The user
  213. */
  214. public function getUser()
  215. {
  216. return $this->data['user'];
  217. }
  218. /**
  219. * Gets the roles of the user.
  220. *
  221. * @return array|Data
  222. */
  223. public function getRoles()
  224. {
  225. return $this->data['roles'];
  226. }
  227. /**
  228. * Gets the inherited roles of the user.
  229. *
  230. * @return array|Data
  231. */
  232. public function getInheritedRoles()
  233. {
  234. return $this->data['inherited_roles'];
  235. }
  236. /**
  237. * Checks if the data contains information about inherited roles. Still the inherited
  238. * roles can be an empty array.
  239. *
  240. * @return bool true if the profile was contains inherited role information
  241. */
  242. public function supportsRoleHierarchy()
  243. {
  244. return $this->data['supports_role_hierarchy'];
  245. }
  246. /**
  247. * Checks if the user is authenticated or not.
  248. *
  249. * @return bool true if the user is authenticated, false otherwise
  250. */
  251. public function isAuthenticated()
  252. {
  253. return $this->data['authenticated'];
  254. }
  255. /**
  256. * @return bool
  257. */
  258. public function isImpersonated()
  259. {
  260. return $this->data['impersonated'];
  261. }
  262. /**
  263. * @return string|null
  264. */
  265. public function getImpersonatorUser()
  266. {
  267. return $this->data['impersonator_user'];
  268. }
  269. /**
  270. * @return string|null
  271. */
  272. public function getImpersonationExitPath()
  273. {
  274. return $this->data['impersonation_exit_path'];
  275. }
  276. /**
  277. * Get the class name of the security token.
  278. *
  279. * @return string|Data|null The token
  280. */
  281. public function getTokenClass()
  282. {
  283. return $this->data['token_class'];
  284. }
  285. /**
  286. * Get the full security token class as Data object.
  287. *
  288. * @return Data|null
  289. */
  290. public function getToken()
  291. {
  292. return $this->data['token'];
  293. }
  294. /**
  295. * Get the logout URL.
  296. *
  297. * @return string|null The logout URL
  298. */
  299. public function getLogoutUrl()
  300. {
  301. return $this->data['logout_url'];
  302. }
  303. /**
  304. * Returns the FQCN of the security voters enabled in the application.
  305. *
  306. * @return string[]|Data
  307. */
  308. public function getVoters()
  309. {
  310. return $this->data['voters'];
  311. }
  312. /**
  313. * Returns the strategy configured for the security voters.
  314. *
  315. * @return string
  316. */
  317. public function getVoterStrategy()
  318. {
  319. return $this->data['voter_strategy'];
  320. }
  321. /**
  322. * Returns the log of the security decisions made by the access decision manager.
  323. *
  324. * @return array|Data
  325. */
  326. public function getAccessDecisionLog()
  327. {
  328. return $this->data['access_decision_log'];
  329. }
  330. /**
  331. * Returns the configuration of the current firewall context.
  332. *
  333. * @return array|Data
  334. */
  335. public function getFirewall()
  336. {
  337. return $this->data['firewall'];
  338. }
  339. /**
  340. * @return array|Data
  341. */
  342. public function getListeners()
  343. {
  344. return $this->data['listeners'];
  345. }
  346. /**
  347. * {@inheritdoc}
  348. */
  349. public function getName()
  350. {
  351. return 'security';
  352. }
  353. }