Decoración del normalizador y "Normalizer Aware" (consciente del normalizador)

Hey there :)

Could you briefly explain the difference between our two approaches to add dynamic groups?

For the admin:read and admin:write, we decorated the context builder. Got the security, checked out, if user is admin and added the groups.

For the owner:read, we now decorated the NormalizerInterface and same here: Got the security, checked if user === owner and added the groups.

My question is:
Could we also add the adminGroups in the AddOwnerGroupsNormalizer (of course it needs a new name then)? (I think we could?)
Could we also add the owner:read group in the context builder? (We can, but then it's not DragonTreasure related?)

Theoretically, the contextbuilder is triggered before the normalizer, because if "is responsible for building the normalization or denormalization contexts that are then passed into the serializer"
And there our custom Normalizer is used used.

So to sum this up:
When is it necessary to add a dynamic group in the ContextBuilder, and when is it necessary to add it in the normalization process?

Because we can't refer to the ApiEntity/Object in the ContextBuilder?

Hello,

I'm trying to make a denormalizer but I don't fit in it while I fit well in if ($this->denormalizer instanceof DenormalizerInterface) {
Thanks for your help

namespace App\Serializer;

use App\Entity\DragonTreasure;
use Symfony\Component\DependencyInjection\Attribute\AsDecorator;
use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;

#[AsDecorator('api_platform.serializer.normalizer.item')]
class PlainIdentifierDenormalizer implements /*NormalizerInterface, */ DenormalizerInterface, DenormalizerAwareInterface
{
    public function __construct(
        private DenormalizerInterface $denormalizer,
    ) {
    }

    public function setDenormalizer(DenormalizerInterface $denormalizer)
    {
        if ($this->denormalizer instanceof DenormalizerInterface) {
            $this->denormalizer->setSerializer($denormalizer);
        }
    }

    public function denormalize(mixed $data, string $type, string $format = null, array $context = [])
    {
        dd('yes');
    }

    public function supportsDenormalization(mixed $data, string $type, string $format = null)
    {
        dd('ok');
        return $this->denormalizer->supportsDenormalization($data, $format);
    }
}

I doubt if this is the way to go.

From the Symfony docs to create a custom Normalizer (https://symfony.com/doc/6.4/serializer/custom_normalizer.html#creating-a-new-normalizer):

Injecting an ObjectNormalizer in your custom normalizer is deprecated since Symfony 6.1. Implement the NormalizerAwareInterface and use the NormalizerAwareTrait instead to inject the $normalizer property.

So even the maker-bundle (Which I might not have updated to the latest version since I used the starting project from this tutorial) has a make:serializer:normalizer that isn't 100% correct for Symfony these days.

1. Create a class, make it implement NormalizerInterface, and also make it implement NormalizerAwareInterface.
2. Make it use the NormalizerAwareTrait, by adding a use NormalizerAwareTrait; in the top of the class. This is now already enough to have a copy of the 'normal' normalizer available as $this->normalizer.
3. Implement the required methods (normalize(), supportsNormalization() and also the newer getSupportedTypes()).
4. Let's start with supportsNormalization(). We want to work on data, if data is a DragonTreasure. So a simple return $data instanceof DragonTreasure seems like it will be enough. It's not, but we'll get back to that.
5. Now getSupportedTypes(). We must answer what we support and if it's cacheable or not. Now, it seems that we can say we always support $data of type DragonTreasure. Again, this is not true :), but we'll get back to that. For now, let's say it is: return [ DragonTreasure::class => true ];
6. Now the real normalize() method. Just like decorating a service, we call the normal normalizer we received from the NormalizerAwareTrait. So we start with a simple return $this->normalizer->normalize($object, $format, $context);.

If you try this... you'll notice your application / tests will really crash. Yes, crash. A segfault, or you will see 'it is killed'.
Why?

The serializer checks if we support a DragonTreaure. We do, so our normalize() method gets called. But in that method, we call the normal normalizer to do the business. What does it do? It will check for available normalizers. It will find 'us', we say 'yes, we support that DragonTreasure object', and our normalize() method gets called. And again, and again and again, and boom.

What we need to do, is somehow make sure we only do our normalizer only once per object.
This is pretty simple. In the first line of normalize(), we adjust the $context and set something in it, that will tell us that we already handled it. We can set all kind of things in the $context, but a little convention of myself is to set the array key of my class-string to true. So, above the return statement in normalize() add a line:

$context[self::class] = true;

Now, in supportsNormalization(), we need to say we only support this object if we didn't handle it before.
So, change the return line to:

return $data instanceof DragonTreasure && !isset($context[self::class]);

The last problem we have now, is that in getSupportedTypes() we told that our supportsNormalization() method is cacheable. But since we now have a check for the $context, it's not. So change getSupportedTypes() to be:

return [ DragonTreaure::class => false ];

Now, we have a normalizer that isn't a decorated service, gets only called for DragonTreasure objects and only gets called once.

Ready to do te job we were here for. Under the $context[self::class] = true; line in normalize(), we're going to check if the current user is the owner for this DragonTreasure. If it is, we add 'owner:read' to the $context['groups']. After that, we're going to call the 'normal' normalizer, to do its thing like it normally would. Since we now have the proper groups set, the proper properties will show up in the object.

public function normalize(....)
{
    $context[self::class] = true;
    
    assert($object instanceof DragonTreasure); // Help our IDE to know what kind of object this is
    
    // Don't forget to inject the Security service in your constructor
    $user = $this->security->getUser();
    
    if ($object->getOwner() === $user) {
        // As Ryan did in the previous chapter, check if 'groups' is really set.
        // Otherwise, we won't touch it, just to be sure.
        
        if (isset($context['groups'])) {
            $context['groups'][] = 'owner:read';
        }
    }
    
    // Let the normal normalizer do its thing
    return $this->normalizer->normalize($object, $format, $context);
 }

I'll summarize my final normalizer, including strict typing for phpstan:

<?php

namespace App\Serializer\Normalizer;

use App\Entity\DragonTreasure;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\Serializer\Normalizer\NormalizerAwareInterface;
use Symfony\Component\Serializer\Normalizer\NormalizerAwareTrait;
use Symfony\Component\Serializer\Normalizer\NormalizerInterface;

class AddOwnerGroupsNormalizer implements NormalizerInterface, NormalizerAwareInterface
{
    use NormalizerAwareTrait;

    public function __construct(
        private readonly Security $security
    ) {
    }

    /**
     * @param array<string,mixed> $context
     *
     * @return array<int|string,mixed>|string|int|float|bool|\ArrayObject<int|string,mixed>|null
     */
    public function normalize($object, string $format = null, array $context = []): array|string|int|float|bool|\ArrayObject|null
    {
        // Mark in the context that we already handled this object, don't do it again
        $context[self::class] = true;

        assert($object instanceof DragonTreasure);

        $user = $this->security->getUser();

        if ($object->getOwner() === $user) {
            // This object is owned by the current user.
            // Add owner:read to the groups before handing of to the normal normalizer
            if (isset($context['groups'])) {
                $context['groups'][] = 'owner:read';
            }
        }

        // Hand it over to the normal normalizer like usual
        $data = $this->normalizer->normalize($object, $format, $context);

        return $data;
    }

    /**
     * @param array<string,mixed> $context
     */
    public function supportsNormalization($data, string $format = null, array $context = []): bool
    {
        // We only support it if it's a DragonTreasure, and if we didn't handle it before
        return $data instanceof DragonTreasure && !isset($context[self::class]);
    }

    /**
     * @return array<class-string|'*'|'object'|string, bool|null>
     */
    public function getSupportedTypes(?string $format): array
    {
        return [
            DragonTreasure::class => false,
        ];
    }
}

If someone knows a way to keep the supportsNormalization() call cacheable, it would be nicer. Maybe just accept it and make it cacheable, and in the normalize() call just return $data as is, if we handled the object before? I'm just thinking out loud here, no clue if this will work. The above code does, and also seems easier to extend to a denormalizer as well.

I'm running into the following error trying to create a denormalizer. I can't seem to figure out the cause.

Circular reference detected for service "api_platform.serializer.normalizer.validation_exception", path: "api_platform.serializer.normalizer.validation_exception -> Ap <br /> p\Normalizer\AddOwnerGroupsDenormalizer -> debug.serializer -> debug.serializer.inner -> api_platform.serializer.normalizer.validation_exception".

Any idea as to what might be happening?

Here's my code:

namespace App\Normalizer;

use App\Entity\User;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\DependencyInjection\Attribute\AsDecorator;
use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
use Symfony\Component\Serializer\Normalizer\NormalizerInterface;


#[AsDecorator('api_platform.serializer.normalizer.item')]
class AddOwnerGroupsDenormalizer implements DenormalizerInterface, DenormalizerAwareInterface
{
    public function __construct(private NormalizerInterface|DenormalizerInterface $denormalize, private Security $security)
    {
    }

    public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): mixed
    {
        if ($data instanceof User && $this->security->getUser() === $data) {
            $context['groups'][] = 'owner:write';
        }

        return $this->denormalize->denormalize($data, $type, $format, $context);
    }

    public function supportsDenormalization(mixed $data, string $type, ?string $format = null, array $context = []): bool
    {
        return $this->denormalize->supportsDenormalization($data, $type, $format, $context);
    }

    public function setDenormalizer(DenormalizerInterface $denormalizer): void
    {
        if ($this->denormalize instanceof DenormalizerAwareInterface) {
            $this->denormalize->setDenormalizer($denormalizer);
        }
    }

    public function getSupportedTypes(?string $format): array
    {
        return [
            User::class => true,
        ];
    }
}