[Security] Add retrieval of encompassing role names

PierreCapel · PierreCapel · commit f1cc872311e2 · 2024-02-19T16:03:26.000+01:00
The aim of this method is to provide a handy way of getting the roles that encompass (or are parent of) an array of roles.

It is similar to the getReachableRoleNames from the same interface but instead of retrieving the children roles it retrieves the parent roles.

A typical use case would be when we get a user role from a database and need to get all the roles that also have access to what this role can access.
diff --git a/src/Symfony/Component/Security/Core/CHANGELOG.md b/src/Symfony/Component/Security/Core/CHANGELOG.md
@@ -2,6 +2,11 @@ CHANGELOG
 =========
 
 
+7.1
+---
+
+* Add `getEncompassingRoleNames` method to `RoleHierarchyInterface`
+
 7.0
 ---
 
diff --git a/src/Symfony/Component/Security/Core/Role/RoleHierarchy.php b/src/Symfony/Component/Security/Core/Role/RoleHierarchy.php
@@ -50,6 +50,21 @@ public function getReachableRoleNames(array $roles): array
         return array_values(array_unique($reachableRoles));
     }
 
+    public function getEncompassingRoleNames(array $roles): array
+    {
+        $encompassingRoles = $roles;
+
+        foreach ($roles as $role) {
+            foreach ($this->map as $parent => $children) {
+                if (\in_array($role, $children)) {
+                    $encompassingRoles[] = $parent;
+                }
+            }
+        }
+
+        return array_values(array_unique($encompassingRoles));
+    }
+
     protected function buildRoleMap(): void
     {
         $this->map = [];
diff --git a/src/Symfony/Component/Security/Core/Role/RoleHierarchyInterface.php b/src/Symfony/Component/Security/Core/Role/RoleHierarchyInterface.php
@@ -14,6 +14,8 @@
 /**
  * RoleHierarchyInterface is the interface for a role hierarchy.
  *
+ * @method array getEncompassingRoleNames(array $roles)
+ *
  * @author Fabien Potencier <fabien@symfony.com>
  */
 interface RoleHierarchyInterface
diff --git a/src/Symfony/Component/Security/Core/Tests/Role/RoleHierarchyTest.php b/src/Symfony/Component/Security/Core/Tests/Role/RoleHierarchyTest.php
@@ -30,4 +30,21 @@ public function testGetReachableRoleNames()
         $this->assertEquals(['ROLE_SUPER_ADMIN', 'ROLE_ADMIN', 'ROLE_FOO', 'ROLE_USER'], $role->getReachableRoleNames(['ROLE_SUPER_ADMIN']));
         $this->assertEquals(['ROLE_SUPER_ADMIN', 'ROLE_ADMIN', 'ROLE_FOO', 'ROLE_USER'], $role->getReachableRoleNames(['ROLE_SUPER_ADMIN', 'ROLE_SUPER_ADMIN']));
     }
+
+    public function testGetEncompassingRoleNames()
+    {
+        $role = new RoleHierarchy([
+            'ROLE_ADMIN' => ['ROLE_USER'],
+            'ROLE_SUPER_ADMIN' => ['ROLE_ADMIN', 'ROLE_FOO'],
+            'ROLE_USER' => ['ROLE_BAR'],
+        ]);
+
+        $this->assertEquals(['ROLE_SUPER_ADMIN'], $role->getEncompassingRoleNames(['ROLE_SUPER_ADMIN']));
+        $this->assertEquals(['ROLE_ADMIN', 'ROLE_SUPER_ADMIN'], $role->getEncompassingRoleNames(['ROLE_ADMIN']));
+        $this->assertEquals(['ROLE_USER', 'ROLE_ADMIN', 'ROLE_SUPER_ADMIN'], $role->getEncompassingRoleNames(['ROLE_USER']));
+        $this->assertEquals(['ROLE_BAR', 'ROLE_ADMIN', 'ROLE_SUPER_ADMIN', 'ROLE_USER'], $role->getEncompassingRoleNames(['ROLE_BAR']));
+        $this->assertEquals(['ROLE_SUPER_ADMIN'], $role->getEncompassingRoleNames(['ROLE_SUPER_ADMIN', 'ROLE_SUPER_ADMIN']));
+        $this->assertEquals(['ROLE_SUPER_ADMIN', 'ROLE_USER', 'ROLE_ADMIN'], $role->getEncompassingRoleNames(['ROLE_SUPER_ADMIN', 'ROLE_USER']));
+        $this->assertEquals(['ROLE_BAR', 'ROLE_FOO', 'ROLE_ADMIN', 'ROLE_SUPER_ADMIN', 'ROLE_USER'], $role->getEncompassingRoleNames(['ROLE_BAR', 'ROLE_FOO']));
+    }
 }

Original file line number	Diff line number	Diff line change
`@@ -14,6 +14,8 @@`
`14`	`14`	`/**`
`15`	`15`	`* RoleHierarchyInterface is the interface for a role hierarchy.`
`16`	`16`	`*`
	`17`	`+ * @method array getEncompassingRoleNames(array $roles)`
	`18`	`+ *`
`17`	`19`	`* @author Fabien Potencier <fabien@symfony.com>`
`18`	`20`	`*/`
`19`	`21`	`interface RoleHierarchyInterface`