[Security][SecurityBundle] Dump role hierarchy as mermaid chart #61034

damienfern · 2025-07-04T10:01:53Z

Q	A
Branch?	7.4
Bug fix?	no
New feature?	yes
Deprecations?	no
License	MIT

From a developer POV, Roles and the SecurityBundle are so convenient, specially role hierarchy in the config. But as a web app grows, the number of roles also grows and with role inheritance, it can be painful to clearly see which role implies another which implies another which implies another (and its possible consequences).

I'm proposing a new command in the security bundle to generate a Mermaid flowchart, easing the understanding of the roles and its hierarchy. An example of the graph generated from the role hierarchy in the doc :

# config/packages/security.yaml
security:
    # ...

    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

graph TB
    ROLE_ADMIN
    ROLE_USER
    ROLE_SUPER_ADMIN
    ROLE_ALLOWED_TO_SWITCH
    ROLE_ADMIN --> ROLE_USER
    ROLE_SUPER_ADMIN --> ROLE_ADMIN
    ROLE_SUPER_ADMIN --> ROLE_ALLOWED_TO_SWITCH

For now, only the mermaid format is suggested (the only format I know) but as the worfklow dump command, we could implement graphviz and plantuml format later.

src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php

src/Symfony/Bundle/SecurityBundle/Tests/Command/SecurityRoleHierarchyDumpCommandTest.php

welcoMattic · 2025-07-04T14:04:07Z

src/Symfony/Component/Security/Core/Dumper/MermaidDumper.php

+    ];
+
+    public function __construct(
+        private readonly string $direction = self::DIRECTION_TOP_TO_BOTTOM,


Moving $direction argument to dump method would allow to dump multiple times the same role hierarchy in different directions without the need to instanciate multiple dumpers. WDYT?

src/Symfony/Component/Security/Core/CHANGELOG.md

94noni · 2025-07-06T15:38:44Z

Nice one 👍🏻
Question: would it be possible to include this in the profiler like the workflow dump ?
We can even imagine each role box colored depending on the current user roles from this config map

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php

src/Symfony/Bundle/SecurityBundle/Tests/Command/SecurityRoleHierarchyDumpCommandTest.php

src/Symfony/Component/Security/Core/Dumper/MermaidDumper.php

src/Symfony/Component/Security/Core/Tests/Dumper/MermaidDumperTest.php

damienfern · 2025-07-07T15:39:32Z

Nice one 👍🏻
Question: would it be possible to include this in the profiler like the workflow dump ?

Yes, I had also this in mind for a second PR, once this one gets merged.

We can even imagine each role box colored depending on the current user roles from this config map

Great idea ! I'll keep it in mind :)

chalasr · 2025-07-07T16:00:40Z

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php

+        $this
+            ->setDefinition([
+                new InputOption('direction', 'd', InputOption::VALUE_REQUIRED, 'The direction of the flowchart ['.implode('|', MermaidDumper::VALID_DIRECTIONS).']', MermaidDumper::DIRECTION_TOP_TO_BOTTOM),
+                new InputOption('format', 'f', InputOption::VALUE_REQUIRED, 'The output format', 'mermaid'),


The command implementation being strongly tight to mermaid at the moment, I suggest not to add this format option until we consider supporting another format.

94noni · 2025-07-07T16:22:01Z

src/Symfony/Component/Security/Core/Dumper/MermaidDumper.php

+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Dumper;


is this dumper really "core" inside this component ?
namespace feels weird

the role hierarchy belongs to symfony/security-core, so it makes sense to put the dumper there as well.

i was seeing this class tooling more like a "debug or dev" class, that is what I wanted to comment (perhaps poorly ^^)

AFAIK, it's the only "debug" class of security component for now, and it is quite tied to roles and role hierarchy. IMO, it can stay here for now.

94noni · 2025-07-07T16:23:04Z

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php

+class SecurityRoleHierarchyDumpCommand extends Command
+{
+    public function __construct(
+        private readonly ?RoleHierarchyInterface $roleHierarchy = null,


how can it be null via service declaration service() ?

We remove the role hierarchy service if you don't configure any hierarchy.

can we then better remove this command as well ? useless to register a command if its to dump nothing

stof · 2025-07-07T16:13:56Z

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php

+    {
+        $this
+            ->setDefinition([
+                new InputOption('direction', 'd', InputOption::VALUE_REQUIRED, 'The direction of the flowchart ['.implode('|', MermaidDumper::VALID_DIRECTIONS).']', MermaidDumper::DIRECTION_TOP_TO_BOTTOM),


please add support for completion by providing the valid choices

Isn't the completion method in the command okay for this ?

ah, I missed that you implemented this method. For static values, it is better to configure the completion values in the definition (and let symfony/console provide them) as it is simpler and also visible directly when looking at the definition that completion is supported.

stof · 2025-07-07T16:16:23Z

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php

+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        if (null === $this->roleHierarchy) {
+            $output->writeln('<comment>No role hierarchy is configured.</comment>');


this should be written to STDERR as it is about human-readable message. this is especially important for that command which will generally send the output to a file.

When using the SymfonyStyle class, you have a method to access easily the error output, and you can also use the usual symfony style for command output.

stof · 2025-07-07T16:16:39Z

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php

+        $format = $input->getOption('format');
+
+        if ('mermaid' !== $format) {
+            $output->writeln('<error>Only "mermaid" format is currently supported.</error>');


should also be written to STDERR.

stof · 2025-07-07T16:16:45Z

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php

+        }
+
+        if (!in_array($direction, MermaidDumper::VALID_DIRECTIONS, true)) {
+            $output->writeln('<error>Invalid direction. Available options: '.implode(', ', MermaidDumper::VALID_DIRECTIONS).'</error>');


should also be written to STDERR.

stof · 2025-07-07T16:18:01Z

src/Symfony/Component/Security/Core/Dumper/MermaidDumper.php

+    public const DIRECTION_TOP_DOWN = 'TD';
+    public const DIRECTION_BOTTOM_TO_TOP = 'BT';
+    public const DIRECTION_RIGHT_TO_LEFT = 'RL';
+    public const DIRECTION_LEFT_TO_RIGHT = 'LR';


those look like a perfect use case for a backed enum instead of using string constants in that class (and then redoing lots of manual validation)

stof · 2025-07-07T16:28:58Z

src/Symfony/Component/Security/Core/Dumper/MermaidDumper.php

+    {
+        $reflection = new \ReflectionClass($roleHierarchy);
+
+        if ($reflection->hasProperty('hierarchy')) {


If the RoleHierarchyInterface is not a child of RoleHierarchy, it could have a hierarchy property that has a totally unrelated type.

And if the RoleHierarchyInterface is a child of RoleHierarchy, this check will return false as the property is private: https://3v4l.org/jtqTG#vnull

You should check $roleHierarchy instanceof RoleHierarchy and then create the ReflectionClass for RoleHierarchy::class

…finition

damienfern added 2 commits July 4, 2025 08:56

feat(security): add command to dump role hierarchy as a mermaid chart

02f2761

add changelog entries

dcfe489

damienfern requested a review from chalasr as a code owner July 4, 2025 10:01

carsonbot added Status: Needs Review Feature Security SecurityBundle labels Jul 4, 2025

carsonbot added this to the 7.4 milestone Jul 4, 2025

carsonbot changed the title ~~[Security] [SecurityBundle] Dump role hierarchy as mermaid chart~~ [Security][SecurityBundle] Dump role hierarchy as mermaid chart Jul 4, 2025

fix author name

d1a118c

OskarStark reviewed Jul 4, 2025

View reviewed changes

src/Symfony/Bundle/SecurityBundle/CHANGELOG.md Outdated Show resolved Hide resolved

OskarStark reviewed Jul 4, 2025

View reviewed changes

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php Outdated Show resolved Hide resolved

OskarStark reviewed Jul 4, 2025

View reviewed changes

src/Symfony/Bundle/SecurityBundle/Command/SecurityRoleHierarchyDumpCommand.php Outdated Show resolved Hide resolved

src/Symfony/Bundle/SecurityBundle/Tests/Command/SecurityRoleHierarchyDumpCommandTest.php Outdated Show resolved Hide resolved

welcoMattic reviewed Jul 4, 2025

View reviewed changes

damienfern added 4 commits July 5, 2025 16:21

review: use dumper direction const

c120b3c

review: test the string

bac240e

chore: psalm fix

8e135fe

review: typo fixes

a61751b

OskarStark reviewed Jul 5, 2025

View reviewed changes

src/Symfony/Component/Security/Core/CHANGELOG.md Outdated Show resolved Hide resolved

alexandre-daubois requested changes Jul 7, 2025

View reviewed changes

carsonbot added Status: Needs Work and removed Status: Needs Review labels Jul 7, 2025

review cs and tests

c39867b

damienfern requested a review from alexandre-daubois July 7, 2025 15:35

carsonbot added Status: Needs Review and removed Status: Needs Work labels Jul 7, 2025

damienfern requested a review from OskarStark July 7, 2025 15:35

chalasr reviewed Jul 7, 2025

View reviewed changes

94noni reviewed Jul 7, 2025

View reviewed changes

stof reviewed Jul 7, 2025

View reviewed changes

damienfern added 3 commits July 8, 2025 08:40

review: remove format option

cfc4e24

review: use MermaidEnumDirection instead of string

b21d28d

review: used named argument for command and add suggestedValues in de…

0b86dfa

…finition

Uh oh!

[Security][SecurityBundle] Dump role hierarchy as mermaid chart #61034

Are you sure you want to change the base?

[Security][SecurityBundle] Dump role hierarchy as mermaid chart #61034

Uh oh!

Conversation

damienfern commented Jul 4, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

94noni commented Jul 6, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

damienfern commented Jul 7, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.