Important

You are browsing documentation for version 6.1 of OroCommerce, supported until 2029. Read the documentation for the latest LTS version to get up-to-date information.

See our Release Process documentation for more information on the currently supported and upcoming releases.

#[Acl]

Use the #[Acl] attribute to create a new access control list and protect the controller it is attached to:

// ...
use Oro\Bundle\SecurityBundle\Attribute\Acl;

#[Acl(
    id="user_user_view",
    type="entity",
    class="Oro\Bundle\UserBundle\Entity\User",
    permission="VIEW"
)]
public function demoAction()
{
    // ...
}

Arguments

class

type: string

When the type option is set to entity, the fully qualified class name in the class option determines whether to evaluate the ACL when checking a user’s access to a class. If the given action is annotated with the ParamConverter parameter, and the class of this parameter is the same as the class parameter from the ACL attribute, the check will be done on the object level (check if the user has access to the given object).

group

type: string

ACLs can optionally be grouped. A group is identified by its name.

id

A unique identifier, used for example to reference an access control list with the #[AclAncestor] attribute.

label

type: string

A human-readable label to present to users.

permission

type: string

When the type is set to entity, you can grant access based on the action to perform on a domain object. You can grant a user four types of permission:

ASSIGN

By default, a user who creates a new entity becomes the owner of that object. With the ASSIGN permission on other users, organizations, or business units, they can transfer ownership to users for which they have this permission.

Note

This permission is not meant to be used in an ACL.

CREATE

The user can create new objects of this entity. This permission limits the list of available owners for an entity.

DELETE

The user can delete the object.

EDIT

The user can modify a particular entity.

SHARE

Added in version 1.9: Support for the SHARE permission will be introduced in OroPlatform release 1.9.

With the SHARE permission on other users, organizations, or business units, a user can share an entity with those users so that they can view it too.

VIEW

The user can see the data of an object.

type

type: string

The type of resource to protect. Possible values are:

action

An action in the user interface that is not bound to a particular domain object or to the type (class) of a domain object.

Tip

With the action type, you can only grant or deny a user access to a given action. To grant access to an action for just a subset of the data, configure ACLs for each object individually by setting the action option to entity, then control the allowed action with the permission option.

entity

When type is set to entity, each domain object can be protected individually, so you can grant access based on a particular domain object.