What problem does it solve? Securing routes in a Nodefony application is error-prone when done by hand: checks written inside controller actions are invisible to the firewall, audits, and route introspection, and quick fixes like disabling CSRF protection silently open the application to attack. This Skill guides you to protect routes using the framework's own building blocks instead. ## Core Features & Use Cases - Two-layer protection: Combine firewall zones (URL prefix patterns in security config) with per-route guards via the @IsGranted decorator. - Role hierarchy: Declare role implications once (e.g. ROLE_ADMIN implies ROLE_BILLING) instead of duplicating role lists on accounts or actions. - Partner and machine access: Open routes to third-party origins via trustedOrigins without disabling CSRF, and serve API clients through a stateless apikey-authenticated zone. - Object-level permissions: Express business rules like "authors edit their own documents" with voters instead of inventing permission tables. - Use Case: You need an admin-only reporting endpoint. Declare the guard with @IsGranted("ROLE_REPORTS"), map ROLE_ADMIN to it in roleHierarchy, then prove it with three identities: anonymous refused, logged-in user without the role refused, admin served. ## Quick Start Ask the AI to protect a specific Nodefony route so only users with a given role can access it, using the framework firewall and guards rather than manual checks.
