Add new SecurityProvider to allow managing access to resource(s)

src/Bundle/Resources/config/services.xml

@@ -23,6 +23,7 @@
         <import resource="services/listener.xml" />
         <import resource="services/metadata.xml" />
         <import resource="services/routing.xml" />
+        <import resource="services/security.xml" />
         <import resource="services/state.xml" />
         <import resource="services/state_machine.xml" />
         <import resource="services/storage.xml" />

src/Bundle/Resources/config/services/security.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+
+ This file is part of the Sylius package.
+
+ (c) Sylius Sp. z o.o.
+
+ For the full copyright and license information, please view the LICENSE
+ file that was distributed with this source code.
+
+-->
+
+<container xmlns="http://symfony.com/schema/dic/services" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
+    <services>
+        <service id="sylius.security.operation_access_checker" class="Sylius\Resource\Symfony\Security\OperationAccessChecker">
+            <argument type="service" id="sylius.expression_language" on-invalid="null" />
+            <argument type="service" id="security.authentication.trust_resolver" on-invalid="null" />
+            <argument type="service" id="security.role_hierarchy" on-invalid="null" />
+            <argument type="service" id="security.token_storage" on-invalid="null" />
+            <argument type="service" id="security.authorization_checker" on-invalid="null" />
+        </service>
+        <service id="Sylius\Resource\Metadata\OperationAccessCheckerInterface" alias="sylius.security.operation_access_checker" />
+    </services>
+</container>

src/Bundle/Resources/config/services/state/provider.xml

@@ -43,5 +43,10 @@
             <argument type="service" id=".inner" />
             <argument type="service" id="validator" />
         </service>
+
+        <service id="sylius.state_provider.security" class="Sylius\Resource\State\Provider\SecurityProvider" decorates="sylius.state_provider.read" decoration-priority="-100">
+            <argument type="service" id=".inner" />
+            <argument type="service" id="sylius.security.operation_access_checker" />
+        </service>
     </services>
 </container>

src/Component/src/Metadata/Api/Delete.php

@@ -47,6 +47,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
     ) {
         parent::__construct(
@@ -75,6 +77,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
         );
     }

src/Component/src/Metadata/Api/Get.php

@@ -47,6 +47,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
     ) {
         parent::__construct(
@@ -75,6 +77,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
         );
     }

src/Component/src/Metadata/Api/GetCollection.php

@@ -47,6 +47,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
     ) {
         parent::__construct(
@@ -75,6 +77,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
         );
     }

src/Component/src/Metadata/Api/Patch.php

@@ -47,6 +47,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
     ) {
         parent::__construct(
@@ -75,6 +77,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
         );
     }

src/Component/src/Metadata/Api/Post.php

@@ -47,6 +47,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
     ) {
         parent::__construct(
@@ -75,6 +77,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
         );
     }

src/Component/src/Metadata/Api/Put.php

@@ -47,6 +47,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
     ) {
         parent::__construct(
@@ -75,6 +77,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
         );
     }

src/Component/src/Metadata/ApplyStateMachineTransition.php

@@ -37,6 +37,8 @@ public function __construct(
         ?string $formType = null,
         ?array $formOptions = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
         private ?string $stateMachineComponent = null,
         private ?string $stateMachineTransition = null,
@@ -60,6 +62,8 @@ public function __construct(
             formType: $formType,
             formOptions: $formOptions,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
         );
     }

src/Component/src/Metadata/BulkDelete.php

@@ -39,6 +39,8 @@ public function __construct(
         ?array $formOptions = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
         ?array $redirectArguments = null,
         ?array $vars = null,
@@ -63,6 +65,8 @@ public function __construct(
             formOptions: $formOptions,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
             redirectArguments: $redirectArguments,
             vars: $vars,

src/Component/src/Metadata/BulkUpdate.php

@@ -43,6 +43,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?string $redirectToRoute = null,
         ?array $redirectArguments = null,
         ?array $vars = null,
@@ -74,6 +76,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             redirectToRoute: $redirectToRoute,
             redirectArguments: $redirectArguments,
             vars: $vars,

src/Component/src/Metadata/Create.php

@@ -49,6 +49,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         string|callable|null $twigContextFactory = null,
         ?string $redirectToRoute = null,
         ?array $redirectArguments = null,
@@ -81,6 +83,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             twigContextFactory: $twigContextFactory,
             redirectToRoute: $redirectToRoute,
             redirectArguments: $redirectArguments,

src/Component/src/Metadata/Delete.php

@@ -43,6 +43,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         string|callable|null $twigContextFactory = null,
         ?string $redirectToRoute = null,
         ?array $redirectArguments = null,
@@ -72,6 +74,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             twigContextFactory: $twigContextFactory,
             redirectToRoute: $redirectToRoute,
             redirectArguments: $redirectArguments,

src/Component/src/Metadata/HttpOperation.php

@@ -48,6 +48,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         string|callable|null $twigContextFactory = null,
         protected ?string $redirectToRoute = null,
         protected ?array $redirectArguments = null,
@@ -75,6 +77,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
         );
 
         $this->twigContextFactory = $twigContextFactory;

src/Component/src/Metadata/Index.php

@@ -42,6 +42,8 @@ public function __construct(
         ?array $formOptions = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         ?array $validationContext = null,
         string|callable|null $twigContextFactory = null,
         ?string $redirectToRoute = null,
@@ -72,6 +74,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             twigContextFactory: $twigContextFactory,
             redirectToRoute: $redirectToRoute,
             vars: $vars,

src/Component/src/Metadata/Operation.php

@@ -54,6 +54,8 @@ public function __construct(
         protected ?array $validationContext = null,
         protected ?string $eventShortName = null,
         protected ?string $notificationMessage = null,
+        protected string|\Stringable|null $security = null,
+        protected ?string $securityMessage = null,
     ) {
         $this->provider = $provider;
         $this->processor = $processor;
@@ -346,4 +348,30 @@ public function withNotificationMessage(string $notificationMessage): self
 
         return $self;
     }
+
+    public function getSecurity(): ?string
+    {
+        return $this->security instanceof \Stringable ? (string) $this->security : $this->security;
+    }
+
+    public function withSecurity(string|\Stringable|null $security): static
+    {
+        $self = clone $this;
+        $self->security = $security;
+
+        return $self;
+    }
+
+    public function getSecurityMessage(): ?string
+    {
+        return $this->securityMessage;
+    }
+
+    public function withSecurityMessage(?string $securityMessage): static
+    {
+        $self = clone $this;
+        $self->securityMessage = $securityMessage;
+
+        return $self;
+    }
 }

src/Component/src/Metadata/OperationAccessCheckerInterface.php

@@ -0,0 +1,26 @@
+<?php
+
+/*
+ * This file is part of the Sylius package.
+ *
+ * (c) Sylius Sp. z o.o.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Sylius\Resource\Metadata;
+
+use Sylius\Resource\Context\Context;
+
+interface OperationAccessCheckerInterface
+{
+    /**
+     * Checks if the current user can access the given operation.
+     *
+     * @param array{object?: object|array|null} $extraVariables
+     */
+    public function isGranted(Operation $operation, Context $context, array $extraVariables = []): bool;
+}

src/Component/src/Metadata/Show.php

@@ -43,6 +43,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         string|callable|null $twigContextFactory = null,
         ?string $redirectToRoute = null,
         ?array $vars = null,
@@ -71,6 +73,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             twigContextFactory: $twigContextFactory,
             redirectToRoute: $redirectToRoute,
             vars: $vars,

src/Component/src/Metadata/Update.php

@@ -43,6 +43,8 @@ public function __construct(
         ?array $validationContext = null,
         ?string $eventShortName = null,
         ?string $notificationMessage = null,
+        string|\Stringable|null $security = null,
+        ?string $securityMessage = null,
         string|callable|null $twigContextFactory = null,
         ?string $redirectToRoute = null,
         ?array $redirectArguments = null,
@@ -75,6 +77,8 @@ public function __construct(
             validationContext: $validationContext,
             eventShortName: $eventShortName,
             notificationMessage: $notificationMessage,
+            security: $security,
+            securityMessage: $securityMessage,
             twigContextFactory: $twigContextFactory,
             redirectToRoute: $redirectToRoute,
             redirectArguments: $redirectArguments,