true, 'pim_api_product_edit' => true, 'pim_api_product_remove' => true, ]; private ?ContainerInterface $container; public function up(Schema $schema): void { $this->disableMigrationWarning(); $roles = $this->getRoles(); foreach (self::ACLS as $acl => $granted) { if (!$this->aclIsRegistered($acl)) { $this->registerAcl($acl); } foreach ($roles as $role) { if ($this->aclIsAlreadyDefinedForRole($role, $acl)) { continue; } if ($granted && $this->roleIsGrantedEverythingByDefault($role)) { continue; } $this->addAclToRole($role, $acl, $granted); } } /** @var AclManager $aclManager */ $aclManager = $this->container->get('oro_security.acl.manager'); $aclManager->clearCache(); } private function aclIsRegistered(string $acl): bool { return (bool) $this->connection->fetchOne( << $acl, ] ); } private function registerAcl(string $acl): void { $this->connection->executeQuery( << $acl, ] ); $aclClassId = (int) $this->connection->fetchOne( << $acl, ] ); $this->connection->executeQuery( << $aclClassId, ] ); $aclObjectIdentityId = (int) $this->connection->fetchOne( << $aclClassId, ] ); $this->connection->executeQuery( << $aclObjectIdentityId, ] ); } private function aclIsAlreadyDefinedForRole(string $role, string $acl): bool { return (bool) $this->connection->fetchOne( << $acl, 'role' => $role, ] ); } private function addAclToRole(string $role, string $acl, bool $granted): void { $classId = (int) $this->connection->fetchOne( << $acl, ] ); $securityEntityId = (int) $this->connection->fetchOne( << $role, ] ); // ace_order is numeroted from 0 to n, across all the roles for a given acl_class. // the observed behavior is that the last added entry for the acl_class will have the ace_order "0" // and all the previous ones increase by one. // I'm not sure why. // Also, the ace_order is also discrimated through the 2 trees of permissions "entities" & "action", // and each tree is ordered separatly. That's why I'm restricting the query to only the ones related // to the "action" tree. // Anyway, I'm increasing all the existing ones by one and in the follow-up query, with the insert into, // I will insert "0". $this->connection->executeQuery( << $classId, ] ); $this->connection->executeQuery( << $classId, 'security_identity_id' => $securityEntityId, 'granting' => $granted, ] ); } private function roleIsGrantedEverythingByDefault(string $role): bool { return (bool) $this->connection->fetchOne( << $role, ] ); } /** * @return string[] */ private function getRoles(): array { return array_map(function($row) { return $row['identifier']; }, $this->connection->fetchAllAssociative( <<addSql('SELECT 1'); } public function down(Schema $schema): void { $this->throwIrreversibleMigrationException(); } /** * {@inheritdoc} */ public function setContainer(ContainerInterface $container = null): void { $this->container = $container; } }