vendor/symfony/security-bundle/DataCollector/SecurityDataCollector.php line 169

  1. <?php
  3. /*
  4.  * This file is part of the Symfony package.
  5.  *
  6.  * (c) Fabien Potencier <fabien@symfony.com>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. namespace Symfony\Bundle\SecurityBundle\DataCollector;
  14. use Symfony\Bundle\SecurityBundle\Debug\TraceableFirewallListener;
  15. use Symfony\Bundle\SecurityBundle\Security\FirewallMap;
  16. use Symfony\Component\HttpFoundation\Request;
  17. use Symfony\Component\HttpFoundation\Response;
  18. use Symfony\Component\HttpKernel\DataCollector\DataCollector;
  19. use Symfony\Component\HttpKernel\DataCollector\LateDataCollectorInterface;
  20. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  21. use Symfony\Component\Security\Core\Authentication\Token\SwitchUserToken;
  22. use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
  23. use Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager;
  24. use Symfony\Component\Security\Core\Authorization\Voter\TraceableVoter;
  25. use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
  26. use Symfony\Component\Security\Http\Firewall\SwitchUserListener;
  27. use Symfony\Component\Security\Http\FirewallMapInterface;
  28. use Symfony\Component\Security\Http\Logout\LogoutUrlGenerator;
  29. use Symfony\Component\VarDumper\Caster\ClassStub;
  30. use Symfony\Component\VarDumper\Cloner\Data;
  32. /**
  33.  * @author Fabien Potencier <fabien@symfony.com>
  34.  *
  35.  * @final
  36.  */
  37. class SecurityDataCollector extends DataCollector implements LateDataCollectorInterface
  38. {
  39.     private ?TokenStorageInterface $tokenStorage;
  40.     private ?RoleHierarchyInterface $roleHierarchy;
  41.     private ?LogoutUrlGenerator $logoutUrlGenerator;
  42.     private ?AccessDecisionManagerInterface $accessDecisionManager;
  43.     private ?FirewallMapInterface $firewallMap;
  44.     private ?TraceableFirewallListener $firewall;
  45.     private bool $hasVarDumper;
  47.     public function __construct(TokenStorageInterface $tokenStorage = null, RoleHierarchyInterface $roleHierarchy = null, LogoutUrlGenerator $logoutUrlGenerator = null, AccessDecisionManagerInterface $accessDecisionManager = null, FirewallMapInterface $firewallMap = null, TraceableFirewallListener $firewall = null)
  48.     {
  49.         $this->tokenStorage = $tokenStorage;
  50.         $this->roleHierarchy = $roleHierarchy;
  51.         $this->logoutUrlGenerator = $logoutUrlGenerator;
  52.         $this->accessDecisionManager = $accessDecisionManager;
  53.         $this->firewallMap = $firewallMap;
  54.         $this->firewall = $firewall;
  55.         $this->hasVarDumper = class_exists(ClassStub::class);
  56.     }
  58.     public function collect(Request $request, Response $response, \Throwable $exception = null)
  59.     {
  60.         if (null === $this->tokenStorage) {
  61.             $this->data = [
  62.                 'enabled' => false,
  63.                 'authenticated' => false,
  64.                 'impersonated' => false,
  65.                 'impersonator_user' => null,
  66.                 'impersonation_exit_path' => null,
  67.                 'token' => null,
  68.                 'token_class' => null,
  69.                 'logout_url' => null,
  70.                 'user' => '',
  71.                 'roles' => [],
  72.                 'inherited_roles' => [],
  73.                 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  74.             ];
  75.         } elseif (null === $token = $this->tokenStorage->getToken()) {
  76.             $this->data = [
  77.                 'enabled' => true,
  78.                 'authenticated' => false,
  79.                 'impersonated' => false,
  80.                 'impersonator_user' => null,
  81.                 'impersonation_exit_path' => null,
  82.                 'token' => null,
  83.                 'token_class' => null,
  84.                 'logout_url' => null,
  85.                 'user' => '',
  86.                 'roles' => [],
  87.                 'inherited_roles' => [],
  88.                 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  89.             ];
  90.         } else {
  91.             $inheritedRoles = [];
  92.             $assignedRoles = $token->getRoleNames();
  94.             $impersonatorUser = null;
  95.             if ($token instanceof SwitchUserToken) {
  96.                 $originalToken = $token->getOriginalToken();
  97.                 $impersonatorUser = $originalToken->getUserIdentifier();
  98.             }
  100.             if (null !== $this->roleHierarchy) {
  101.                 foreach ($this->roleHierarchy->getReachableRoleNames($assignedRoles) as $role) {
  102.                     if (!\in_array($role, $assignedRoles, true)) {
  103.                         $inheritedRoles[] = $role;
  104.                     }
  105.                 }
  106.             }
  108.             $logoutUrl = null;
  109.             try {
  110.                 $logoutUrl = $this->logoutUrlGenerator?->getLogoutPath();
  111.             } catch (\Exception) {
  112.                 // fail silently when the logout URL cannot be generated
  113.             }
  115.             $this->data = [
  116.                 'enabled' => true,
  117.                 'authenticated' => method_exists($token, 'isAuthenticated') ? $token->isAuthenticated(false) : (bool) $token->getUser(),
  118.                 'impersonated' => null !== $impersonatorUser,
  119.                 'impersonator_user' => $impersonatorUser,
  120.                 'impersonation_exit_path' => null,
  121.                 'token' => $token,
  122.                 'token_class' => $this->hasVarDumper ? new ClassStub($token::class) : $token::class,
  123.                 'logout_url' => $logoutUrl,
  124.                 'user' => $token->getUserIdentifier(),
  125.                 'roles' => $assignedRoles,
  126.                 'inherited_roles' => array_unique($inheritedRoles),
  127.                 'supports_role_hierarchy' => null !== $this->roleHierarchy,
  128.             ];
  129.         }
  131.         // collect voters and access decision manager information
  132.         if ($this->accessDecisionManager instanceof TraceableAccessDecisionManager) {
  133.             $this->data['voter_strategy'] = $this->accessDecisionManager->getStrategy();
  135.             foreach ($this->accessDecisionManager->getVoters() as $voter) {
  136.                 if ($voter instanceof TraceableVoter) {
  137.                     $voter = $voter->getDecoratedVoter();
  138.                 }
  140.                 $this->data['voters'][] = $this->hasVarDumper ? new ClassStub($voter::class) : $voter::class;
  141.             }
  143.             // collect voter details
  144.             $decisionLog = $this->accessDecisionManager->getDecisionLog();
  145.             foreach ($decisionLog as $key => $log) {
  146.                 $decisionLog[$key]['voter_details'] = [];
  147.                 foreach ($log['voterDetails'] as $voterDetail) {
  148.                     $voterClass = \get_class($voterDetail['voter']);
  149.                     $classData = $this->hasVarDumper ? new ClassStub($voterClass) : $voterClass;
  150.                     $decisionLog[$key]['voter_details'][] = [
  151.                         'class' => $classData,
  152.                         'attributes' => $voterDetail['attributes'], // Only displayed for unanimous strategy
  153.                         'vote' => $voterDetail['vote'],
  154.                     ];
  155.                 }
  156.                 unset($decisionLog[$key]['voterDetails']);
  157.             }
  159.             $this->data['access_decision_log'] = $decisionLog;
  160.         } else {
  161.             $this->data['access_decision_log'] = [];
  162.             $this->data['voter_strategy'] = 'unknown';
  163.             $this->data['voters'] = [];
  164.         }
  166.         // collect firewall context information
  167.         $this->data['firewall'] = null;
  168.         if ($this->firewallMap instanceof FirewallMap) {
  169.             $firewallConfig = $this->firewallMap->getFirewallConfig($request);
  170.             if (null !== $firewallConfig) {
  171.                 $this->data['firewall'] = [
  172.                     'name' => $firewallConfig->getName(),
  173.                     'request_matcher' => $firewallConfig->getRequestMatcher(),
  174.                     'security_enabled' => $firewallConfig->isSecurityEnabled(),
  175.                     'stateless' => $firewallConfig->isStateless(),
  176.                     'provider' => $firewallConfig->getProvider(),
  177.                     'context' => $firewallConfig->getContext(),
  178.                     'entry_point' => $firewallConfig->getEntryPoint(),
  179.                     'access_denied_handler' => $firewallConfig->getAccessDeniedHandler(),
  180.                     'access_denied_url' => $firewallConfig->getAccessDeniedUrl(),
  181.                     'user_checker' => $firewallConfig->getUserChecker(),
  182.                     'authenticators' => $firewallConfig->getAuthenticators(),
  183.                 ];
  185.                 // generate exit impersonation path from current request
  186.                 if ($this->data['impersonated'] && null !== $switchUserConfig = $firewallConfig->getSwitchUser()) {
  187.                     $exitPath = $request->getRequestUri();
  188.                     $exitPath .= null === $request->getQueryString() ? '?' : '&';
  189.                     $exitPath .= sprintf('%s=%s', urlencode($switchUserConfig['parameter']), SwitchUserListener::EXIT_VALUE);
  191.                     $this->data['impersonation_exit_path'] = $exitPath;
  192.                 }
  193.             }
  194.         }
  196.         // collect firewall listeners information
  197.         $this->data['listeners'] = [];
  198.         if ($this->firewall) {
  199.             $this->data['listeners'] = $this->firewall->getWrappedListeners();
  200.         }
  202.         $this->data['authenticators'] = $this->firewall ? $this->firewall->getAuthenticatorsInfo() : [];
  203.     }
  205.     public function reset()
  206.     {
  207.         $this->data = [];
  208.     }
  210.     public function lateCollect()
  211.     {
  212.         $this->data = $this->cloneVar($this->data);
  213.     }
  215.     /**
  216.      * Checks if security is enabled.
  217.      */
  218.     public function isEnabled(): bool
  219.     {
  220.         return $this->data['enabled'];
  221.     }
  223.     /**
  224.      * Gets the user.
  225.      */
  226.     public function getUser(): string
  227.     {
  228.         return $this->data['user'];
  229.     }
  231.     /**
  232.      * Gets the roles of the user.
  233.      */
  234.     public function getRoles(): array|Data
  235.     {
  236.         return $this->data['roles'];
  237.     }
  239.     /**
  240.      * Gets the inherited roles of the user.
  241.      */
  242.     public function getInheritedRoles(): array|Data
  243.     {
  244.         return $this->data['inherited_roles'];
  245.     }
  247.     /**
  248.      * Checks if the data contains information about inherited roles. Still the inherited
  249.      * roles can be an empty array.
  250.      */
  251.     public function supportsRoleHierarchy(): bool
  252.     {
  253.         return $this->data['supports_role_hierarchy'];
  254.     }
  256.     /**
  257.      * Checks if the user is authenticated or not.
  258.      */
  259.     public function isAuthenticated(): bool
  260.     {
  261.         return $this->data['authenticated'];
  262.     }
  264.     public function isImpersonated(): bool
  265.     {
  266.         return $this->data['impersonated'];
  267.     }
  269.     public function getImpersonatorUser(): ?string
  270.     {
  271.         return $this->data['impersonator_user'];
  272.     }
  274.     public function getImpersonationExitPath(): ?string
  275.     {
  276.         return $this->data['impersonation_exit_path'];
  277.     }
  279.     /**
  280.      * Get the class name of the security token.
  281.      */
  282.     public function getTokenClass(): string|Data|null
  283.     {
  284.         return $this->data['token_class'];
  285.     }
  287.     /**
  288.      * Get the full security token class as Data object.
  289.      */
  290.     public function getToken(): ?Data
  291.     {
  292.         return $this->data['token'];
  293.     }
  295.     /**
  296.      * Get the logout URL.
  297.      */
  298.     public function getLogoutUrl(): ?string
  299.     {
  300.         return $this->data['logout_url'];
  301.     }
  303.     /**
  304.      * Returns the FQCN of the security voters enabled in the application.
  305.      *
  306.      * @return string[]|Data
  307.      */
  308.     public function getVoters(): array|Data
  309.     {
  310.         return $this->data['voters'];
  311.     }
  313.     /**
  314.      * Returns the strategy configured for the security voters.
  315.      */
  316.     public function getVoterStrategy(): string
  317.     {
  318.         return $this->data['voter_strategy'];
  319.     }
  321.     /**
  322.      * Returns the log of the security decisions made by the access decision manager.
  323.      */
  324.     public function getAccessDecisionLog(): array|Data
  325.     {
  326.         return $this->data['access_decision_log'];
  327.     }
  329.     /**
  330.      * Returns the configuration of the current firewall context.
  331.      */
  332.     public function getFirewall(): array|Data|null
  333.     {
  334.         return $this->data['firewall'];
  335.     }
  337.     public function getListeners(): array|Data
  338.     {
  339.         return $this->data['listeners'];
  340.     }
  342.     public function getAuthenticators(): array|Data
  343.     {
  344.         return $this->data['authenticators'];
  345.     }
  347.     public function getName(): string
  348.     {
  349.         return 'security';
  350.     }
  351. }