add method isGrantedUser

Security/Acl/Model/AbstractAclManager.php

@@ -7,6 +7,7 @@
 use Symfony\Component\Security\Acl\Domain\UserSecurityIdentity;
 use Symfony\Component\Security\Acl\Exception\AclNotFoundException;
 use Symfony\Component\Security\Acl\Model\SecurityIdentityInterface;
+use Symfony\Component\Security\Acl\Permission\MaskBuilder;
 use Symfony\Component\Security\Acl\Voter\FieldVote;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Role\RoleInterface;
@@ -283,6 +284,18 @@ public function isGranted($attributes, $object = null, $field = null)
         return $this->getSecurityContext()->isGranted($attributes, $object);
     }
 
+    public function isGrantedUser($user, $object, $mask)
+    {
+        if (!is_int($mask)) {
+            $builder = new MaskBuilder;
+            $builder->add($mask);
+            $mask = $builder->get();
+        }
+
+        $oid = $this->createObjectIdentity($object);
+        return $this->getProvider()->userHasAclOnObject($user, $oid, $mask);
+    }
+
     protected function revokePermissions($object, $identity)
     {
         if (!is_object($object)) {

Security/Authorization/Acl/AclProvider.php

@@ -47,18 +47,11 @@ public function findObjectIdentitiesForUser(
         $type = null,
         $withRoles = false
     ) {
-        /** @var UserSecurityIdentity $securityIdentity */
-        $securityIdentity = $this->getSecurityEntity($identityObject);
-        if (!$securityIdentity) {
+        $identifier = $this->getSecurityIdentifier($identityObject);
+        if (!$identifier) {
             return null;
         }
 
-        $identifier = sprintf(
-            '%s-%s',
-            $securityIdentity->getClass(),
-            $securityIdentity->getUsername()
-        );
-
         if ($withRoles) {
             $identifiers = array($identifier);
             foreach ($identityObject->getRoles() as $role) {
@@ -94,6 +87,22 @@ public function findObjectIdentitiesForUser(
         return $objectIdentities;
     }
 
+    public function userHasAclOnObject(
+        $securityObject,
+        $objectIdentity,
+        $mask = MaskBuilder::MASK_VIEW
+    ) {
+        $identifier = $this->getSecurityIdentifier($securityObject);
+        if (!$identifier) {
+            return null;
+        }
+
+        $sql = $this->getQuery($identifier, $mask, $objectIdentity->getType(), $objectIdentity->getIdentifier());
+        $sql .= ' LIMIT 1';
+
+        return (bool) $this->connection->executeQuery($sql)->fetch();
+    }
+
     /** Locates all objects that the specified Role has access to.
      *
      * Note that this method has a few limitations:
@@ -142,7 +151,7 @@ public function findObjectIdentitiesForRole(
         return $objectIdentities;
     }
 
-    private function getQuery($identifier, $mask, $type)
+    private function getQuery($identifier, $mask, $type, $objectIdentifier = null)
     {
         $sql = "SELECT
               o.object_identifier
@@ -175,6 +184,10 @@ private function getQuery($identifier, $mask, $type)
             $sql .= ' AND c.class_type = ' . $this->connection->quote($type);
         }
 
+        if ($objectIdentifier) {
+            $sql .= ' AND o.object_identifier = ' . $this->connection->quote($objectIdentifier);
+        }
+
         return $sql;
     }
 
@@ -197,4 +210,20 @@ private function getSecurityEntity($identityObject)
 
         return null;
     }
+
+    private function getSecurityIdentifier($identityObject)
+    {
+        /** @var UserSecurityIdentity $securityIdentity */
+        $securityIdentity = $this->getSecurityEntity($identityObject);
+
+        if (!$securityIdentity) {
+            return null;
+        }
+
+        return sprintf(
+            '%s-%s',
+            $securityIdentity->getClass(),
+            $securityIdentity->getUsername()
+        );
+    }
 }