如何使用Voter检查用户权限

abstract class Voter implements VoterInterface
{
    abstract protected function supports($attribute, $subject);
    abstract protected function voteOnAttribute($attribute, $subject, TokenInterface $token);
}

// src/AppBundle/Controller/PostController.php
// ...
 
class PostController extends Controller
{
    /**
     * @Route("/posts/{id}", name="post_show")
     */
    public function showAction($id)
    {
        // get a Post object - e.g. query for it
        // 获取 Post 对象 - 比如通过查询取得
        $post = ...;
 
        // check for "view" access: calls all voters
        // 检查 "view" 访问权限：调用全部voters
        $this->denyAccessUnlessGranted('view', $post);
 
        // ...
    }
 
    /**
     * @Route("/posts/{id}/edit", name="post_edit")
     */
    public function editAction($id)
    {
        // get a Post object - e.g. query for it
        // 获取 Post 对象 - 比如通过查询取得
        $post = ...;
 
        // check for "edit" access: calls all voters
        // 检查 "edit" 访问权限：调用全部voters
        $this->denyAccessUnlessGranted('edit', $post);
 
        // ...
    }
}

// src/AppBundle/Security/PostVoter.php
namespace AppBundle\Security;
 
use AppBundle\Entity\Post;
use AppBundle\Entity\User;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;
 
class PostVoter extends Voter
{
    // these strings are just invented: you can use anything
    // 这些字符串都是随便起的：你可以使用任何字符
    const VIEW = 'view';
    const EDIT = 'edit';
 
    protected function supports($attribute, $subject)
    {
        // if the attribute isn't one we support, return false
        // 如果属性并非我们所支持的，返回 false
        if (!in_array($attribute, array(self::VIEW, self::EDIT))) {
            return false;
        }
 
        // only vote on Post objects inside this voter
        // 在这个voter中，只对 Post 对象进行表决
        if (!$subject instanceof Post) {
            return false;
        }
 
        return true;
    }
 
    protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
    {
        $user = $token->getUser();
 
        if (!$user instanceof User) {
            // the user must be logged in; if not, deny access
            // 用户必须已登录；否则，拒绝访问
            return false;
        }
 
        // you know $subject is a Post object, thanks to supports
        // 多亏了supports，你知道 $subject 是 Post 对象
        /** @var Post $post */
        $post = $subject;
 
        switch ($attribute) {
            case self::VIEW:
                return $this->canView($post, $user);
            case self::EDIT:
                return $this->canEdit($post, $user);
        }
 
        throw new \LogicException('This code should not be reached!');
    }
 
    private function canView(Post $post, User $user)
    {
        // if they can edit, they can view / 若用户能编辑，表明其亦可查看
        if ($this->canEdit($post, $user)) {
            return true;
        }
 
        // the Post object could have, for example, a method isPrivate()
        // that checks a boolean $private property
        // Post 对象可以拥有，例如，一个用于检查布尔值 $private 属性的 isPrivate() 方法
        return !$post->isPrivate();
    }
 
    private function canEdit(Post $post, User $user)
    {
        // this assumes that the data object has a getOwner() method
        // to get the entity of the user who owns this data object
        // 这里假设数据对象中有一个 getOwner() 方法用于获取该对象拥有者的 User entity
        return $user === $post->getOwner();
    }
}

// src/AppBundle/Security/PostVoter.php
 
// ...
use Symfony\Component\Security\Core\Authorization\AccessDecisionManagerInterface;
 
class PostVoter extends Voter
{
    // ...
 
    private $decisionManager;
 
    public function __construct(AccessDecisionManagerInterface $decisionManager)
    {
        $this->decisionManager = $decisionManager;
    }
 
    protected function voteOnAttribute($attribute, $subject, TokenInterface $token)
    {
        // ...
 
        // ROLE_SUPER_ADMIN can do anything! The power!
        // ROLE_SUPER_ADMIN 可以做任何事！威力大！
        if ($this->decisionManager->decide($token, array('ROLE_SUPER_ADMIN'))) {
            return true;
        }
 
        // ... all the normal voter logic / 所有常规的voter逻辑
    }
}