Chapters

37 Chapters | 3:43:31 |

01

API Docs on Production?

8:22
02

API Tokens? Session Cookies?

8:07
03

API Login Form with json_login

5:36
04

Handling Authentication Errors

3:47
05

On Authentication Success

6:03
06

Logout & Passing API Data to JavaScript

5:45
07

Passing Values to Stimulus

4:32
08

Token Types & The ApiToken Entity

5:59
09

Generating the API Token & Fixtures

5:58
10

Access Token Authenticator

8:56
11

Customizing the OpenAPI Docs

7:31
12

API Token Scopes

5:51
13

Deny Access with The "security" Option

7:11
14

Bootstrapping a Killer Test System

8:18
15

JSON Test Assertions & Seeding the Database

3:41
16

Advanced & Flexible JSON Test Assertions

4:04
17

Testing Authentication

4:59
18

Customizing Browser Globally

3:50
19

Testing Token Authentication

3:24
20

New PUT Behavior

4:46
21

Only Allow Owners to Edit

7:49
22

Allow Admin Users to Edit any Treasure

4:11
23

Security Voter

6:13
24

Conditional Fields by User: ApiProperty

5:13
25

User Test + Plain Password

4:21
26

State Processors: Hashing the User Password

6:55
27

Validation Groups & Patch Formats

8:01
28

Dynamic Groups: Context Builder

8:26
29

Custom Normalizer

5:08
30

Normalizer Decoration & "Normalizer Aware"

6:29
31

Totally Custom Fields

3:24
32

Custom Validator

7:58
33

Validating how Values Change

8:30
34

Auto Setting the "owner"

4:19
35

Query Extension: Auto-Filter a Collection

6:15
36

404 On Unpublished Items

8:00
37

Filtering Relation Collection

5:39

> APIs > API Platform 3 Part 2: Security for your Treasures

Buy Access to Course

24.

Conditional Fields by User: ApiProperty

|

|

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Buy just this tutorial for $12.00

Previous Chapter

Next Challenge

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

Login or register to check out the script

12 Comments

Sort By

Login or Register to join the conversation

Lola-Slade 1 year ago edited

I tried to change the test testAdminCanPatchToEditTreasure to actually edit the isPublished status.
That was not passing at the current time.

EG. From the script this is OK and passes when the only field changed is value.

public function testAdminCanPatchToEditTreasure(): void
{
    $admin = UserFactory::new()->asAdmin()->create();
    $treasure = DragonTreasureFactory::createOne([
        'isPublished' => false,
    ]);
    $this->browser()
        ->actingAs($admin)
        ->patch('/api/treasures/'.$treasure->getId(), [
            'json' => [
                'value' => 12345,
            ],
            'headers' => ['Content-Type' => 'application/merge-patch+json'],
        ])
        ->assertStatus(200)
        ->assertJsonMatches('value', 12345)
        ->assertJsonMatches('isPublished', false)
    ;
}

But this test does not pass, changing the value of isPublished doesn't seem to work.
Should this work at this point? I think so but maybe I have missed something.

    public function testAdminCanPatchToEditTreasure(): void
    {
        $admin = UserFactory::new()->asAdmin()->create();
        $treasure = DragonTreasureFactory::createOne([
            'isPublished' => false,
        ]);
        $this->browser()
            ->actingAs($admin)
            ->patch('/api/treasures/'.$treasure->getId(), [
                'json' => [
                    'value' => 12345,
                    'isPublished' => true,
                ],
                'headers' => ['Content-Type' => 'application/merge-patch+json'],
            ])
            ->assertStatus(200)
            ->assertJsonMatches('value', 12345)
            ->assertJsonMatches('isPublished', true)
        ;
    }

|

weaverryan SFCASTS Lola-Slade 1 year ago edited

Hey @Lola-Slade!

Sorry for the very slow reply! So the test only passes if you include 'isPublished' => true,? If you don't include it, where is the failure exactly? Do you get a 200 status code, but the value returned is wrong? Or is the failure elsewhere?

Let me know and I bet we can unravel this mystery :).

Cheers!

1 |

acran weaverryan 1 year ago

I think I found the explanation for this one after much debugging:

The issue is that the security argument of the ApiProperty attribute is evaluated before the denormalization in order to find out which properties are allowed to be written to.
But since the treasure object is not denormalized yet the object in the security expression will always be null while denormalizing, effectively failing ever time and thus never writing to the property.

In this case this could be fixed by letting the security expression pass in case object is not instantiated yet and validate the permissions with securityPostDenormalize for denormalization:

    #[ApiProperty(
        security: 'not object or is_granted("EDIT", object)',
        securityPostDenormalize: 'is_granted("EDIT", object)',
    )]
    private bool $isPublished = false;

I found this behavior of object being null in the security expression while denormalizing very surprising and against my expectation. Especially as the documentation for the same arguments for the operations (Get, Put etc.) attributes mentions a different behavior:

Access control checks in the security attribute are always executed before the denormalization step. It means that for PUT or PATCH requests, object doesn’t contain the value submitted by the user, but values currently stored in the persistence layer.
-- https://api-platform.com/docs/symfony/security/

And since securityPostDenormalize is only evaluated after denormalization of the user provided data into the object this causes huge headaches when a property used for the access decision is writable.
Because contrary to the operations

Additionally, in some cases you need to perform security checks on the original data. For example here, only the actual owner should be allowed to edit their book. In these cases, you can use the previous_object variable which contains the object that was read from the state provider.
-- https://api-platform.com/docs/symfony/security/#executing-access-control-rules-after-denormalization

with ApiProperty there is no previous_object available in the expression.

|

weaverryan SFCASTS acran 1 year ago edited

Hey @acran!

Fantastic debugging & explanation! Thanks for filling in for me ;)

|

Lola-Slade weaverryan 1 year ago

Thanks a lot for getting back to me Ryan!

It's the opposite. The issue is that the value of isPublished cannot be changed to true.
So any test that does include isPublished and then tries to validate the changed value fails.

|

weaverryan SFCASTS Lola-Slade 1 year ago edited

Hey @Lola-Slade!

Glacial reply again, but, does this help? https://symfonycasts.com/screencast/api-platform-security/api-property#comment-33098

|

Mantasz 2 years ago edited

Strange Api-platform activity. It looks like ApiProperty Attribute doesn't work with json format. Why? And how to make ApiProperty to work on json format too?

I have simple ApiResource example

#[ApiResource()]
class UserApi
{
  public ?int $id = null;
  
  public ?string $firstName = null;  
  
  #[ApiProperty(readable: false)]
  public ?string $doNotShow = null;
}

If i request jsonld format http://localhost/api/users/1.jsonld, i get:

{
  "@context": "/api/contexts/User",
  "@id": "/api/users/1",
  "@type": "User",
  "id": 1,
  "firstName": "john",
}

'doNotShow' is not visible

If i request json format http://localhost/api/users/1.json, i get:

{
  "id": 1,
  "firstName": "john",
  "doNotShow": "secret",
}

'doNotShow' is visible

PHP 8.2, Symfony 7, "api-platform/core": "3.3.2",

config file: api_platform.yaml

api_platform:
    mapping:
        paths: [ 
           '%kernel.project_dir%/src/Entity',
        ]
    formats:
        json: [ 'application/json' ]
        jsonld: ['application/ld+json']

|

MolloKhan SFCASTS Mantasz 2 years ago edited

Hey @Mantasz

It seems like an ApiPlatform bug. Try upgrading to the latest version. If the problem remains, you may want to open an issue to the ApiPlatform GitHub repository

Cheers!

|

Mantasz MolloKhan 2 years ago

it is the latest version: "api-platform/core": "3.3.2".

|

MolloKhan SFCASTS Mantasz 2 years ago

The only thing I can think of is that it's an ApiPlatform bug. Try asking in their Slack channel
Sorry I cannot help further

|

Gamusta 2 years ago edited

is there a securityMessage for ApiProperty like for Operations ?

|

Victor SFCASTS Gamusta 2 years ago

Hey Gamusta,

Here's the list of possible arguments for ApiProperty: https://github.com/api-platform/core/blob/main/src/Metadata/ApiProperty.php#L45 - there's security, but no securityMessage.

Cheers!

|

API Platform 3 Symfony 6.2

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=8.2",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "api-platform/core": "^3.0", // v3.1.2
        "doctrine/annotations": "^2.0", // 2.0.1
        "doctrine/doctrine-bundle": "^2.8", // 2.8.3
        "doctrine/doctrine-migrations-bundle": "^3.2", // 3.2.2
        "doctrine/orm": "^2.14", // 2.14.1
        "nelmio/cors-bundle": "^2.2", // 2.2.0
        "nesbot/carbon": "^2.64", // 2.66.0
        "phpdocumentor/reflection-docblock": "^5.3", // 5.3.0
        "phpstan/phpdoc-parser": "^1.15", // 1.16.1
        "symfony/asset": "6.2.*", // v6.2.5
        "symfony/console": "6.2.*", // v6.2.5
        "symfony/dotenv": "6.2.*", // v6.2.5
        "symfony/expression-language": "6.2.*", // v6.2.5
        "symfony/flex": "^2", // v2.2.4
        "symfony/framework-bundle": "6.2.*", // v6.2.5
        "symfony/property-access": "6.2.*", // v6.2.5
        "symfony/property-info": "6.2.*", // v6.2.5
        "symfony/runtime": "6.2.*", // v6.2.5
        "symfony/security-bundle": "6.2.*", // v6.2.6
        "symfony/serializer": "6.2.*", // v6.2.5
        "symfony/twig-bundle": "6.2.*", // v6.2.5
        "symfony/ux-react": "^2.6", // v2.7.1
        "symfony/ux-vue": "^2.7", // v2.7.1
        "symfony/validator": "6.2.*", // v6.2.5
        "symfony/webpack-encore-bundle": "^1.16", // v1.16.1
        "symfony/yaml": "6.2.*" // v6.2.5
    },
    "require-dev": {
        "doctrine/doctrine-fixtures-bundle": "^3.4", // 3.4.2
        "mtdowling/jmespath.php": "^2.6", // 2.6.1
        "phpunit/phpunit": "^9.5", // 9.6.3
        "symfony/browser-kit": "6.2.*", // v6.2.5
        "symfony/css-selector": "6.2.*", // v6.2.5
        "symfony/debug-bundle": "6.2.*", // v6.2.5
        "symfony/maker-bundle": "^1.48", // v1.48.0
        "symfony/monolog-bundle": "^3.0", // v3.8.0
        "symfony/phpunit-bridge": "^6.2", // v6.2.5
        "symfony/stopwatch": "6.2.*", // v6.2.5
        "symfony/web-profiler-bundle": "6.2.*", // v6.2.5
        "zenstruck/browser": "^1.2", // v1.2.0
        "zenstruck/foundry": "^1.26" // v1.28.0
    }
}

Previous Chapter

Next Challenge