form-types-validation_skill

Overview

This skill strengthens Symfony authorization and validation boundaries by enforcing explicit checks at form type and controller boundaries. It guides mapping actor-resource-action matrices, placing voters and constraints correctly, and producing test-backed negative and positive path coverage. The result is clearer responsibility, fewer duplicated policies, and safer error exposure.

How this skill works

The skill inspects form types, validators, and voter implementations to ensure access control and validation live at the correct boundary. It recommends wiring checks into controllers and API operations, and it generates a test matrix that exercises allowed, forbidden, and invalid paths. Outputs include suggested boundary updates, integration points, and failing negative-path tests to prevent regressions.

When to use it

• Hardening access-control around sensitive domain actions
• Aligning security voters or expressions with domain validation rules
• Ensuring form input validation and authorization occur at intended boundaries
• Reducing duplicated policy logic across layers
• Auditing error messages to avoid leaking privileged state

Best practices

• Map actor-resource-action decisions before implementing checks
• Place policy logic in voters or dedicated constraints, not duplicated in controllers and forms
• Wire explicit deny behavior for sensitive actions and test it
• Keep error responses minimal to avoid leaking privileged state
• Cover positive, forbidden, and invalid cases in automated tests

Example use cases

• Move a permission check from a controller into a voter used by a form submit to centralize policy
• Add a custom constraint to a form type to enforce domain rules already used by a voter
• Create a test suite that asserts forbidden users receive 403 and invalid input yields validation errors
• Audit a code path that returned detailed errors to ensure sensitive state is not exposed
• Document integration points where authorization and validation intersect for future maintainers