Symfony 4 Form handling - forms

Question

I am not quite sure how symfony is providing the possibility of different forms for different users/views.
For my understanding you have the action:
public function new(Request $request): Response
{
$order = new Orders();
$form = $this->createForm(OrdersType::class, $order);
$form->handleRequest($request);
if ($form->isSubmitted() && $form->isValid()) {
$em = $this->getDoctrine()->getManager();
$em->persist($order);
$em->flush();
return $this->redirectToRoute('orders_index');
}
return $this->render('orders/new.html.twig', [
'order' => $order,
'form' => $form->createView(),
]);
}
Which is generating the form with the, in this case OrdersType. And then the view gets loaded in the new.html.twig file. But some users only are allowed on the action "add" which should not show the option of calculated price or what ever.
How do I do that?

Answer 1

The solution depends of the structure of your application.
If the calculation price is in the new.html.twig you can use another file for users with limited access.
In the example below "ROLE_RESTRICTED" is the role of users allowed only to add and not to see the price.
For example :
public function new(Request $request): Response
{
$logged_user = $this->get('security.token_storage')->getToken()->getUser();
$order = new Orders();
$form = $this->createForm(OrdersType::class, $order);
$form->handleRequest($request);
if ($form->isSubmitted() && $form->isValid()) {
$em = $this->getDoctrine()->getManager();
$em->persist($order);
$em->flush();
return $this->redirectToRoute('orders_index');
}
if($logged_user->hasRole('ROLE_RESTRICTED')){
$view = 'orders/newRestricted.html.twig'
}else{
$view = 'orders/new.html.twig';
}
return $this->render($view , [
'order' => $order,
'form' => $form->createView(),
]);
}
If the difference are small between new.html.twig and newRestricter.html.twig you can keep only one twig file and just make some conditional zones :
{% if not app.user.hasRole('ROLE_RESTRICTED') %}
Edit an order
{% else %}
Do not forget to secure the route corresponding to avoir direct URL access (in controller) :
public function edit($id)
{
$logged_user = $this->get('security.token_storage')->getToken()->getUser();
if($logged_user->has_role('ROLE_RESTRICTED')) {
throw $this->createAccessDeniedException('Access denied');
}
// create form, return render, etc.
}
In fact you have to restrict access to the page or part of the views.
You can find more details on the security section on the official doc :
https://symfony.com/doc/current/security.html
Another solution would be to make the filter in the form builder :
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
class OrdersType extends AbstractType
{
private $tokenStorage;
public function __construct(TokenStorageInterface $tokenStorage)
{
$this->tokenStorage = $tokenStorage;
}
public function buildForm(FormBuilderInterface $builder, array $options)
{
$logged_user = $this->tokenStorage->getUser();
if(!$logged_user->hasRole('ROLE_RESTRICTED')){
$builder->add('MyField', TextType::class,array(
'required' => false
));
}
}
...