Auto Setting the "owner"

process method should return the result, otherwise you get NULL response in the response body

    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = [])
    {
        if ($data instanceof DragonTreasure && $data->getOwner() === null && $this->security->getUser()) {
            $data->setOwner($this->security->getUser());
        }
        return $this->innerProcessor->process($data, $operation, $uriVariables, $context);
    }

hi i'm stuck here
i'm using api 3.3.1 and symfony 7.1

namespace App\State;

use ApiPlatform\Metadata\Operation;
use ApiPlatform\State\ProcessorInterface;
use App\Entity\Park;
use App\Entity\User;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\DependencyInjection\Attribute\AsDecorator;

#[AsDecorator('api_platform.doctrine.orm.state.persist_processor')]
class ParkSetOwnerProcessor implements ProcessorInterface
{
    public function __construct(private ProcessorInterface $innerProcessor, private Security $security)
    {
    }
    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []):mixed
    {

        $user = $this->security->getUser();

        assert($user instanceof User);

        assert($data instanceof Park );

        if ($data instanceof Park  && $this->security->getUser()) {
       
            $data->setOwner($user);
        }
        return $this->innerProcessor->process($data, $operation, $uriVariables, $context);
    }
}

my test:

    public function testPostToCreatePark(): void
    {
        $user = UserFactory::createOne(['password' => 'pass']);
        $this->browser()
            ->actingAs($user)
            ->post('/api/parks',  [
                'json' => [
                    'name' => 'A shiny thing',
                    //'owner' => '/api/users/'.$user->getId(),
                ],
            ])
            ->assertStatus(201);
    }

the owner part on my Park entity:

    #[Groups(['park:read', 'park:write'])]
    #[Assert\Valid]
    #[IsValidOwner]
    #[ApiFilter(SearchFilter::class, strategy: 'exact')]
    #[ORM\ManyToOne(targetEntity: User::class, cascade: ['persist', 'remove'], inversedBy: 'parks')]
    #[ORM\JoinColumn(name: 'owner_id', referencedColumnName: 'id', nullable: false)]
    private ?User $owner = null;

    public function getOwner(): ?User
    {
        return $this->owner;
    }

    public function setOwner(User $owner): self
    {
        $this->owner = $owner;
        return $this;
    }

i'm getting an error i can't understand:

[critical] Uncaught PHP Exception Doctrine\Persistence\Mapping\MappingException: "The class 'AppEntityUserProxy' was not found in the chain configured namespaces App\Entity" at MappingException.php line 26

It appears that the custom processor runs after the security annotations. So when this is set: object.getOwnerUser() on an entity's security annotation - the test just fails :-(

new Post(
            securityPostDenormalize: 'is_granted("NON_REASSIGN", object) and object.getOwnerUser() == user'
        ),

I could put security logic into the processor, but it feels like it belongs in the security annotations as: 'object.getOwnerUser() == user'.

ideally the processor would set ownerUser to: the currently logged in user (when it's not set explicitly via the post) and throw a 403 when the owner is set incorrectly. Or is this not the right approach? I'm just a little confused about how these two concepts work together in a real app.

When will this finally be ready?