Skip to content

[SecurityBundle] error helper added symfony/symfony#11147 #11324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

[SecurityBundle] error helper added symfony/symfony#11147 #11324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
44f700d
[SecurityBundle] error helper added symfony/symfony#11147
i3or1s Jul 5, 2014
693cc2f
[SecurityBundle] error helper added symfony/symfony#11147
Aug 20, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/Symfony/Bundle/SecurityBundle/Resources/config/security.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,8 @@
<parameter key="security.validator.user_password.class">Symfony\Component\Security\Core\Validator\Constraints\UserPasswordValidator</parameter>

<parameter key="security.expression_language.class">Symfony\Component\Security\Core\Authorization\ExpressionLanguage</parameter>

<parameter key="security.authentication_utils.class">Symfony\Component\Security\Http\Authentication\AuthenticationUtils</parameter>
</parameters>

<services>
Expand Down Expand Up @@ -84,6 +86,10 @@

<service id="security.expression_language" class="%security.expression_language.class%" public="false" />

<service id="security.authentication_utils" class="%security.authentication_utils.class%">
<argument type="service" id="request_stack" />
</service>

<!-- Authorization related services -->
<service id="security.access.decision_manager" class="%security.access.decision_manager.class%" public="false">
<argument type="collection"></argument>
Expand Down
5 changes: 5 additions & 0 deletions src/Symfony/Component/Security/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
CHANGELOG
=========

2.6.0
-----

* added Symfony\Component\Security\Http\Authentication\AuthenticationUtils

2.4.0
-----

Expand Down
87 changes: 87 additions & 0 deletions src/Symfony/Component/Security/Http/Authentication/AuthenticationUtils.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,87 @@
<?php

/*
* This file is part of the Symfony package.
*
* (c) Fabien Potencier <fabien@symfony.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/

namespace Symfony\Component\Security\Http\Authentication;

use Symfony\Component\HttpFoundation\RequestStack;
use Symfony\Component\Security\Core\Exception\AuthenticationException;
use Symfony\Component\Security\Core\SecurityContextInterface;
use Symfony\Component\HttpFoundation\Request;

/**
* Extracts Security Errors from Request
*
* @author Boris Vujicic <boris.vujicic@gmail.com>
*/
class AuthenticationUtils
{
/**
* @var RequestStack
*/
private $requestStack;

/**
* @param RequestStack $requestStack
*/
public function __construct(RequestStack $requestStack)
{
$this->requestStack = $requestStack;
}

/**
* @param bool $clearSession
* @return null|AuthenticationException
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's more developer friendly to provide some more documentation comments here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any suggestion on what it should be?
"Retrieves last Authentication Error, if $clearSession is true it will also remove the error form session."?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Retrieves last Authentication Error, if $clearSession is true it will also remove the error form session." - this can be read from the code and I don't think we need duplicating it in a comment.

@xabbuh could you explain what kind of a documentation you mean here?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would write something like this:

/**
 * Returns the last authentication error.
 *
 * Authentication errors are read from the current request or fom the session. Keeping
 * errors in the session may cause issues when calling the method several times cause
 * you don't know if the errors has been read before. Therefore, after retrieving the error,
 * it is erased by default. If you want to keep the error in the session, you'll have to pass
 * false to this method.
 */

I know that the method name is quite self-explanatory, but when I look at the generated API documentation I find it useful if there is some more explanation.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm against documenting WHAT the code is doing. It's redundant, since you can read what the code is doing from the code itself... Also, this kind of comments often lie, since people tend to forget to update them.

We should rather explain WHY we're doing something, or document potential pitfalls. Anything that's not self-evident from reading the code.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, you can have a look at the code. I just think that this isn't a nice experience from the user's (the developer that uses Symfony) point of view. I feel that the best experience is when one just reads the API documentation and you do know how to use a particular class and which implications its usage has.

Given this method, it's useful to know what the clearSession argument is used for, why I should set it to false and what it'll imply if I do that (so maybe my suggestion doesn't fit right how it should be done).

Though I'm not sure if this pull request is the right place to discuss this topic since it's somehow is related to the API documentation as a whole, isn't it?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You wouldn't be able to use Symfony's API docs this way, as it hardly contains comments of that kind. You're right it starts going out of the scope for this PR ;)

*/
public function getLastAuthenticationError($clearSession = true)
{
$request = $this->getRequest();
$session = $request->getSession();
$authenticationException = null;

if ($request->attributes->has(SecurityContextInterface::AUTHENTICATION_ERROR)) {
$authenticationException = $request->attributes->get(SecurityContextInterface::AUTHENTICATION_ERROR);
} elseif ($session !== null && $session->has(SecurityContextInterface::AUTHENTICATION_ERROR)) {
$authenticationException = $session->get(SecurityContextInterface::AUTHENTICATION_ERROR);

if ($clearSession) {
$session->remove(SecurityContextInterface::AUTHENTICATION_ERROR);
}

}

return $authenticationException;
}

/**
* @return string
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here too

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought method name is self explanatory.
How about: "Retrieves last username from session"?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For me the method name is self explanatory. Let's avoid comments like 'Gets last username' for a method 'getLastUsername'.

*/
public function getLastUsername()
{
$session = $this->getRequest()->getSession();

return null === $session ? '' : $session->get(SecurityContextInterface::LAST_USERNAME);
}

/**
* @return Request
* @throws \LogicException
*/
private function getRequest()
{
$request = $this->requestStack->getCurrentRequest();

if (null === $request) {
throw new \LogicException('Request should exist so it can be processed for error.');
}

return $request;
}
}