Added security configuration

[wouterj]

/fixes #45

This makes it easier to secure the API routes exposed by this bundle. By default, no access is granted (already in master). Users can configure which access is granted to which roles (added in this PR). For instance:

cmf_resource_rest:
  security:
    access_control:
      # All visitors can read from /cms/public
      - { path: ^/cms/public, attributes: [CMF_RESOURCE_READ], require: IS_AUTHENTICATED_ANONYMOUSLY }

      # Only users can read from /cms/members-only
      - { path: ^/cms/members-only, attributes: [CMF_RESOURCE_READ], require: ROLE_USER }

      # Only admins can write
      - { path: ^/, attributes: [CMF_RESOURCE_WRITE], require: ROLE_ADMIN }

[dbu]

looks good to me. just to be sure, can you clarify why its not enough to configure routing security in the security.yml? are there operations where the resource path is not part of the url?

please rebase on master to get the style fixes, and then let styleci fix the new ones.

the ConfigurationTest needs to be adjusted for the new config

[wouterj]

@dbu the big difference is whitelisting vs blacklisting. The default Symfony security works using blacklisting, while this bundle's security works using whitelisting.

Security is extremely important for this bundle: If not configured correctly, people will have access to the complete CR backend and all data that's stored inside it. That's why I think it's extremely important to not allow any access by default, forcing the developer to think correctly about what and who to allow accessing the API.

[dbu]

thanks, agree with that! lets use this in the introduction to the bundle documentation...

[ElectricMaxxx]

I know you don't like them, but i would expect a unit test case for the security map (from configuration into param and as arguemnt into service), cause you expect a behavior in the unit test for the voter depending on a map you hopefully get through the configiguration.

[wouterj]

@ElectricMaxxx there is already a configuration test in this PR. It should cover all cases.

[dbu]

created symfony-cmf/symfony-cmf-docs#813 about the documentation.