How to implement complex user privilege checking logic in Zend Framework 2?

Question

Doctrine ORM

I'm working on a Zend Framework 2.4 project with Doctrine ORM and BjyAuthorize module . Whether there was a question how to define the given action over the given resource is authorized to the given user. Simply declaring roles and their privileges in the config, as described in the examples, is not enough. Tried to use Assertions by examples from documentation . I wrote a factory that creates an instance of Assertion and passes it the Doctrine EntityManager (to make a request to the database in assert and check the necessary data). Explanation code:
Factory:

<?php
namespace Foo\Permissions\Acl\Assertion;

use Zend\ServiceManager\FactoryInterface;
use Zend\ServiceManager\ServiceLocatorInterface;
use Foo\Permissions\Acl\Assertion\IsUserDrunkAssertion;

class IsUserDrunkAssertionFactory implements FactoryInterface
{
    public function createService(ServiceLocatorInterface $serviceLocator)
    {
        $em = $serviceLocator->get('doctrine.entitymanager.orm_default');
        $assertion = new IsUserDrunkAssertion();
        $assertion->setObjectManager($em);
        return $assertion;
    }
}

assertion:

<?php
namespace Foo\Permissions\Acl\Assertion;

use Zend\Permissions\Acl\Assertion\AssertionInterface;
use Doctrine\Common\Persistence\ObjectManager;
// ...

class IsUserDrunkAssertion implements AssertionInterface
{
    protected $objectManager;

    public function setObjectManager(ObjectManager $objectManager)
    {
        $this->objectManager = $objectManager;
        return $this;
    }

    public function getObjectManager()
    {
        return $this->objectManager;
    }

    public function assert(Acl $acl, RoleInterface $role = null, ResourceInterface $resource = null, $privilege = null)
    {
        $decision = // ... здесь бы запрос сделать
        return $decision;
    }
}

However, this approach results in a cache error:

Fatal error: Uncaught exception 'PDOException' with message 
'You cannot serialize or unserialize PDO instances' in 
/var/www/vendor/zendframework/zendframework/library/Zend/Serializer/Adapter/PhpSerialize.php:48 

Stack trace: 
#0 [internal function]: PDO->__sleep() 
#1 /var/www/vendor/zendframework/zendframework/library/Zend/Serializer/Adapter/PhpSerialize.php(48): serialize(Object(Zend\Permissions\Acl\Acl)) 
#2 /var/www/vendor/zendframework/zendframework/library/Zend/Cache/Storage/Plugin/Serializer.php(102): Zend\Serializer\Adapter\PhpSerialize->serialize(Object(Zend\Permissions\Acl\Acl)) 
#3 [internal function]: Zend\Cache\Storage\Plugin\Serializer->onWriteItemPre(Object(Zend\Cache\Storage\Event)) 
#4 /var/www/vendor/zendframework/zendframework/library/Zend/EventManager/EventManager.php(444): call_user_func(Array, Object(Zend\Cache\Storage\Event)) 
#5 /var/www/vendor/zendframework/zendframework/library/Zend/EventManager/EventManager.php(205): Zend\EventManager\EventManager->triggerListeners('setItem.pre', Object(Zend\Cache\Stor in /var/www/vendor/zendframework/zendframework/library/Zend/Serializer/Adapter/PhpSerialize.php on line 48

It turns out from assertion to a DB in any way to not address? Need to make requests somewhere else? Or even change the approach to the implementation of checks?

Answer 1

Smoke towards Security Voters. If this is not supported by zend out of the box, you can quickly build your own implementation or take some ready-made implementation. I personally have not yet seen a more convenient way to resolve the rights to perform actions.