Fix BFLA (Broken Function Level Authorization) in Spiral

BFLA (Broken Function Level Authorization) in Spiral applications occurs when developers assume that hiding a button in the frontend is security. In reality, attackers intercept traffic and hit sensitive controller actions directly. If your Spiral actions lack explicit permission checks, you're wide open. To secure a Spiral app, you must enforce authorization at the function level using the Security component and GuardInterface.

The Vulnerable Pattern

namespace App\Controller;\n\nclass AdminController\n{\n    // VULNERABLE: This endpoint is reachable by any user who knows the URL.\n    // It lacks server-side verification of the user's role or permissions.\n    public function deleteSystemLog(string $id, LogService $logs): array\n    {\n        $logs->delete($id);\n        return ['status' => 'deleted'];\n    }\n}

The Secure Implementation

The fix involves moving from 'Security by Obscurity' to 'Explicit Authorization'. By injecting the `GuardInterface` (part of the spiral/security component), we force the application to validate the actor's permissions against a defined RBAC/ABAC policy before executing the logic. The `allows()` call checks the current user's role against the 'logs.delete' permission. If the check fails, we throw a `ForbiddenException`, which Spiral's internal middleware catches to return a proper 403 response. For a cleaner 'hacker-proof' architecture, these checks can also be abstracted into Domain Interceptors to ensure security logic is decoupled from business logic.

namespace App\Controller;\n\nuse Spiral\Security\GuardInterface;\nuse Spiral\Http\Exception\ClientException\ForbiddenException;\n\nclass AdminController\n{\n    private GuardInterface $guard;\n\n    public function __construct(GuardInterface $guard)\n    {\n        $this->guard = $guard;\n    }\n\n    public function deleteSystemLog(string $id, LogService $logs): array\n    {\n        // SECURE: Explicitly check if the current actor has the 'logs.delete' permission.\n        if (!$this->guard->allows('logs.delete', ['id' => $id])) {\n            throw new ForbiddenException('Unauthorized access to administrative function.');\n        }\n\n        $logs->delete($id);\n        return ['status' => 'success'];\n    }\n}