Recipe: Actions with CSRF and Voter

Secure edit and delete row actions with session CSRF and entity voters

What / When

Use built-in Action::edit() / Action::delete() when mutations go through the bundle Ajax endpoints and must respect Symfony Security.

Minimal Example

use Pentiminax\UX\DataTables\Enum\Icon;
use Pentiminax\UX\DataTables\Model\Action;
use Pentiminax\UX\DataTables\Model\Actions;

public function configureActions(Actions $actions): Actions
{
    return $actions
        ->add(
            Action::edit('Edit')
                ->icon(Icon::Pencil)
        )
        ->add(
            Action::delete('Delete')
                ->icon(Icon::Trash2)
                ->askConfirmation('Delete this row?')
        );
}

Then:

Import bundle routes.
Add access_control for ^/datatables/ajax.
Register a voter supporting Permission::DT_EDIT_ROW and Permission::DT_DELETE_ROW for your entity.

Pitfalls