Chapters

39 Chapters | 4:45:13 |

01

Hello API Security + API Docs on Production?

8:55
02

API Auth 101: Session? Cookies? Tokens?

4:05
03

Login with json_login

6:27
04

Authentication Errors

5:55
05

Login Success & the Session

4:28
06

On Authentication Success

7:40
07

Logout & Passing API Data to JS on Page Load

8:49
08

SameSite Cookies & CSRF Attacks

8:06
09

ApiResource access_control

6:03
10

Bootstrapping a Test Suite

4:29
11

Backport the API Platform 2.5 Test Tools

5:01
12

Api Tests & Assertions

6:51
13

Logging in Inside the Test

6:57
14

Resetting the Database Between Tests

4:51
15

Base Test Class full of Goodies

8:30
16

ACL: Only Owners can PUT a CheeseListing

9:23
17

ACL & previousObject

8:04
18

Access Control & Voters

8:25
19

Adding the plainPassword Field

7:31
20

Data Persister: Encoding the Plain Password

8:03
21

Validation Groups

5:44
22

Conditional Field Setup

6:42
23

Testing, Updating Roles & Refreshing Data

9:22
24

Context Builder & Service Decoration

6:50
25

Context Builder: Dynamic Fields/Groups

7:47
26

Automatic Serialization Groups

5:59
27

Resource Metadata Factory: Dynamic ApiResource Options

8:45
28

Dynamic Groups without Caching

10:34
29

Custom Normalizer: Object-by-Object Dynamic Fields

9:30
30

Diving into the Normalizer Internals

4:49
31

A "Normalizer Aware" Normalizer

6:49
32

Normalizer & Completely Custom Fields

7:32
33

Locking down the CheeseListing.owner Field

8:16
34

Custom Validator

5:40
35

Security Logic in the Validator

6:46
36

Auto-set the Owner: Entity Listener

9:46
37

Query Extension: Auto-Filter a Collection

9:37
38

Automatic 404 on Unpublished Items

5:26
39

Filtering Related Collections

10:50

This tutorial has a new version, check it out!

> Symfony 5 > API Platform 2 Part 2: Security

Buy Access to Course

13.

Logging in Inside the Test

|

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Buy just this tutorial for $12.00

Previous Chapter

Next Chapter

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

Login or register to check out the script

28 Comments

Sort By

Login or Register to join the conversation

Maciej 6 years ago

The PR you mentioned has been merged and released in v2.5.0 of api-platform: https://github.com/api-plat..., and it seems that all it takes to switch to the fixed method is to use `security` instead of `access_control` in annotations.

6 |

Victor SFCASTS Maciej 6 years ago

Just FYI, we added a note about it a bit earlier when we're talking about "access_control" for the first time: https://symfonycasts.com/sc...

Cheers!

1 |

Victor SFCASTS Maciej 6 years ago

Hey Hawk,

Thank you for this tip!

Cheers!

|

teh_policer Maciej 6 years ago

You saved me from reading the docs prematurely

|

Evozon S. 5 years ago edited

Just an FYI:
There is a temporal coupling.
To access the container you need to execute the bootKernel() method first (inherited from KernelTestCase)
The createClient() method calls bootKernel()
A look at the bootKernel() method will make clear that the kernel is shut down and rebooted again at each createClient() call. This is probably because the create client method takes kernel options as the first argument.

A question:
I see that the \ApiPlatform\Core\Bridge\Symfony\Bundle\Test\ApiTestCase is still marked as <b>experimental</b> in the latest api-platform/core and the last commit was <b>2 years ago</b>.
Does anyone recommend, or uses this in production?

Thanks in advance.

|

MolloKhan SFCASTS Evozon S. 5 years ago edited

Hey Evozon S.

That's a good question, to be honest I'm not sure why it's still experimental, I'd say it's a good testing library that you can use in your projects but would be better if someone from the ApiPlatform project can confirm it. Perhaps you could ask this question here? https://github.com/api-plat...

Cheers!

|

Florentin O. 5 years ago edited

Hi,
I am getting an error when trying to login via the json_login and I can't get what's the problem. Every time I get a 401.


        $client->request('POST', "/login", [
            'headers' => ['Content-Type' => 'application/json'],
            'json' => [
                'email' => 'a@yahoo.com',
                'password' => 'foo'
            ],
        ]);

       
        $this->assertResponseStatusCodeSame(204);


PHPUnit 8.5.14 by Sebastian Bergmann and contributors.

Testing Project Test Suite
F                                                                   1 / 1 (100%)

Time: 667 ms, Memory: 26.00 MB

There was 1 failure:

1) App\Tests\Functional\CheeseListingResourceTest::testCreateCheeseListing
Failed asserting that the Response status code is 204.
HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, private
Content-Type:  application/json
Date:          Mon, 01 Mar 2021 13:50:45 GMT
Link:          <http://example.com/api/docs.jsonld>; rel="http://www.w3.org/ns/hydra/core#apiDocumentation"
X-Robots-Tag:  noindex

{"error":"Authentication request could not be processed due to a system problem."}

/Users/api-2/src/ApiPlatform/Test/BrowserKitAssertionsTrait.php:47
/Users/api-2/tests/Functional/CheeseListingResourceTest.php:31

FAILURES!
Tests: 1, Assertions: 1, Failures: 1.

|

MolloKhan SFCASTS Florentin O. 5 years ago edited

Hey @Max

Did you configure your firewall correctly?


// config/packages/security.yaml
security:
    firewalls:
        main:
            anonymous: true

            json_login:
                check_path: app_login
                username_path: email
                password_path: password

and the User you're trying to log in exists in the database?

Cheers!

|

Carlos 5 years ago edited

I got stuck with Symfony 5.2 (and even with Api Plaform ^v2.6.0-alpha.1)...

I can login succesfully...

$this->logIn($client, 'admin', 'admin@123');

... but in the next call ...

`
$client->request('POST', '/api/convenio',

        [
            'headers' => ['Content-Type' => 'application/ld+json'],
            'json' => [
                'nome' => 'CONVENIO ' . rand(0, 9999),
                'ativo' => true
            ]
        ]);

`

It always returns <b>HTTP/1.1 401 Unauthorized</b>.

Debugging, I can see that the security-core/Authorization/Voter/RoleVoter.php always receives a Symfony\Component\Security\Core\Authentication\Token\AnonymousToken

DEBUG:
`Symfony\Component\Security\Core\Authentication\Token\AnonymousToken Object
(

[secret:Symfony\Component\Security\Core\Authentication\Token\AnonymousToken:private] => PPgg3IR
[user:Symfony\Component\Security\Core\Authentication\Token\AbstractToken:private] => <b>anon.</b>
[roleNames:Symfony\Component\Security\Core\Authentication\Token\AbstractToken:private] => Array
    (
    )

[authenticated:Symfony\Component\Security\Core\Authentication\Token\AbstractToken:private] => 1
[attributes:Symfony\Component\Security\Core\Authentication\Token\AbstractToken:private] => Array
    (
    )

)
`

It seems that the ApiPlatform\Core\Bridge\Symfony\Bundle\Test\Client doesn't keep the authentication between the calls.

Here's my config/packages/test/security.yaml

`
security:

encoders:
    CrosierSource\CrosierLibBaseBundle\Entity\Security\User:
        algorithm: auto
# https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
providers:
    app_user_provider:
        entity:
            class: CrosierSource\CrosierLibBaseBundle\Entity\Security\User
            property: username
firewalls:
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false
    test:
        anonymous: true
        lazy: true
        
        json_login:
            check_path: /testingApiLogin
            username_path: username
            password_path: password

        logout:
            path: app_logout

# Easy way to control access for large sections of your site
# Note: Only the *first* access control that matches will be used
access_control:
    # but, definitely allow /login to be accessible anonymously
    # - { path: ^/testingApiLogin, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    # if you wanted to force EVERY URL to be protected
#    - { path: ^/, roles: IS_AUTHENTICATED_REMEMBERED }
# - { path: ^/admin, roles: ROLE_ADMIN }
# - { path: ^/profile, roles: ROLE_USER }

`

Almost two days up on this now :-(

|

weaverryan SFCASTS Carlos 5 years ago

Hey @Carlos!

Sorry for my slow reply! This is super frustrating! First, I don’t see any obvious problems. To debug, I want to initially determine if this is a problem with the test not keeping authentication (this is possible, though I’m not familiar with cases of this happening) or if there is something bigger wrong and you lose authentication even in a browser.

To test this, I would write a tiny bit of javascript that does the same thing as your test: sends an ajax request to log in, then sends another ajax request to the api endpoint. Heck, you could even just make an ajax call to the login endpoint and then refresh the page. If everything is working, the web debug toolbar will show you authenticated. There *are* some reasons why you could lose authentication immediately after logging in, which is why I’d check this first.

Also, do you have any special cookie settings? Probably not, but I thought I’d ask just in case.

Cheers!

|

Fränz F. 5 years ago

I followed your awesome cheese course up until this point but got stuck at this unauthenticated test case.

I am using the new `security` attribute in the collection operation post object: `"post"={"security"="is_granted('ROLE_ADMIN')"}`. Instead of producing status code 401 I get error code 500 with the message "The current token must be set to use the "security" attribute (is the URL behind a firewall?)." at `/Users/ff/Projects/Kescht/kescht/vendor/api-platform/core/src/Security/ResourceAccessChecker.php` line 52. The token seems to be missing. But is there a token for a not authenticated user?

|

weaverryan SFCASTS Fränz F. 5 years ago edited

Hey Fränz F.!

Are you using the new Symfony 5.1/5.2 security - the enable_authenticator_manager option inside of security.yaml? If so, there is a bug in it with API Platform. Or, to be more fair to them, API Platform needed to make an update to fully support the new security system ... and they HAVE - https://github.com/api-platform/core/pull/3899 - but it has not been released yet. It should be released in 2.6.0 - which is currently at BETA 1 (and the fix IS included in that release).

If you are NOT using the new security system and I am TOTALLY wrong, please let me know ;).

Cheers!

|

Fränz F. weaverryan 5 years ago edited

Hi weaverryan! Yes, indeed, I am using the new authentication manager. I completely missed this incompatibility issue with it. After upgrading to the 2.6.0-beta.1 version of api-platform/core all tests are passing and I get lovely 401 error messages. Awesome! Thank you!

|

ahmedbhs 6 years ago

Does ther a way to authenticate the user with a fictive token ? I already tried this example https://symfony.com/doc/cur... but unforthenlly the client of api test case does not have getCookieJar() function. any idea !

|

weaverryan SFCASTS ahmedbhs 6 years ago edited

Hey ahmedbhs!

Sorry for the late reply! Yes, this should indeed be possible :). In API Platform, they use their own custom Client service (as you've noticed). But inside that services is the "normal" one. So, try this:


$client = self::createClient();
$client->getKernelBrowser()->getCookieJar()->set(...);

Let me know if that works!

Cheers!

|

gabb 6 years ago edited

I have a weird issue:

`public function testCreatePostAuthorized(): void
{
    $client = self::createClient();
    $client->request(
        'POST',
        '/login',
        [
            'json' => [
                'email' => 'gab@gmail.com',
                'password' => '123123'
            ]
        ]
    );
    self::assertResponseStatusCodeSame(204);

    $client->request(
        'POST',
        '/api/posts'
    );

    self::assertResponseStatusCodeSame(200);
}`

The login assert works fine I get 204, but the 2nd request I still get 401. Seems that the client object is maybe not storing the session id?

|

gabb gabb 6 years ago

Seems the issue was because I had setup a session.cookie_domain = 'symfony.localhost' inside the framework.yaml

|

MolloKhan SFCASTS gabb 6 years ago

Did you manage to fix the problem then?

|

gabb MolloKhan 6 years ago

Yes removing that fixed the issue, but that was there because I had a different issue when trying to login from my front end angular project, I will see later if there's a way to fix both issues.

1 |

abdounikarim 6 years ago edited

Hello SfCasts team, i have no problem with this actual version of the app. But when i do a composer update and i just relaunch the tests, i have this huge error:


App\Tests\Functional\UserResourceTest::testCreateUser
Failed asserting that the Response status code is 201.
HTTP/1.1 401 Unauthorized
Cache-Control:          no-cache, private
Content-Type:           application/ld+json; charset=utf-8
Date:                   Mon, 16 Dec 2019 20:18:38 GMT
Link:                   <http://example.com/api/docs.jsonld>; rel="http://www.w3.org/ns/hydra/core#apiDocumentation"
X-Content-Type-Options: nosniff
X-Frame-Options:        deny
X-Robots-Tag:           noindex

{"@context":"\/api\/contexts\/Error","@type":"hydra:Error","hydra:title":"An error occurred","hydra:description":"Full authentication is required to access this resource.","trace":[{"namespace":"","short_class":"","class":"","type":"","function":"","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/security-http\/Firewall\/ExceptionListener.php","line":187,"args":[]},{"namespace":"Symfony\\Component\\Security\\Http\\Firewall","short_class":"ExceptionListener","class":"Symfony\\Component\\Security\\Http\\Firewall\\ExceptionListener","type":"-\u003E","function":"startAuthentication","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/security-http\/Firewall\/ExceptionListener.php","line":142,"args":[["object","Symfony\\Component\\HttpFoundation\\Request"],["object","Symfony\\Component\\Security\\Core\\Exception\\InsufficientAuthenticationException"]]},{"namespace":"Symfony\\Component\\Security\\Http\\Firewall","short_class":"ExceptionListener","class":"Symfony\\Component\\Security\\Http\\Firewall\\ExceptionListener","type":"-\u003E","function":"handleAccessDeniedException","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/security-http\/Firewall\/ExceptionListener.php","line":101,"args":[["object","Symfony\\Component\\HttpKernel\\Event\\ExceptionEvent"],["object","Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException"]]},{"namespace":"Symfony\\Component\\Security\\Http\\Firewall","short_class":"ExceptionListener","class":"Symfony\\Component\\Security\\Http\\Firewall\\ExceptionListener","type":"-\u003E","function":"onKernelException","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/event-dispatcher\/Debug\/WrappedListener.php","line":126,"args":[["object","Symfony\\Component\\HttpKernel\\Event\\ExceptionEvent"],["string","kernel.exception"],["object","Symfony\\Component\\HttpKernel\\Debug\\TraceableEventDispatcher"]]},{"namespace":"Symfony\\Component\\EventDispatcher\\Debug","short_class":"WrappedListener","class":"Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener","type":"-\u003E","function":"__invoke","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/event-dispatcher\/EventDispatcher.php","line":260,"args":[["object","Symfony\\Component\\HttpKernel\\Event\\ExceptionEvent"],["string","kernel.exception"],["object","Symfony\\Component\\HttpKernel\\Debug\\TraceableEventDispatcher"]]},{"namespace":"Symfony\\Component\\EventDispatcher","short_class":"EventDispatcher","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"-\u003E","function":"doDispatch","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/event-dispatcher\/EventDispatcher.php","line":235,"args":[["array",[["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"]]],["string","kernel.exception"],["object","Symfony\\Component\\HttpKernel\\Event\\ExceptionEvent"]]},{"namespace":"Symfony\\Component\\EventDispatcher","short_class":"EventDispatcher","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"-\u003E","function":"callListeners","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/event-dispatcher\/EventDispatcher.php","line":73,"args":[["array",[["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"],["object","Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener"]]],["string","kernel.exception"],["object","Symfony\\Component\\HttpKernel\\Event\\ExceptionEvent"]]},{"namespace":"Symfony\\Component\\EventDispatcher","short_class":"EventDispatcher","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"-\u003E","function":"dispatch","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/event-dispatcher\/Debug\/TraceableEventDispatcher.php","line":168,"args":[["object","Symfony\\Component\\HttpKernel\\Event\\ExceptionEvent"],["string","kernel.exception"]]},{"namespace":"Symfony\\Component\\EventDispatcher\\Debug","short_class":"TraceableEventDispatcher","class":"Symfony\\Component\\EventDispatcher\\Debug\\TraceableEventDispatcher","type":"-\u003E","function":"dispatch","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/http-kernel\/HttpKernel.php","line":222,"args":[["object","Symfony\\Component\\HttpKernel\\Event\\ExceptionEvent"],["string","kernel.exception"]]},{"namespace":"Symfony\\Component\\HttpKernel","short_class":"HttpKernel","class":"Symfony\\Component\\HttpKernel\\HttpKernel","type":"-\u003E","function":"handleException","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/http-kernel\/HttpKernel.php","line":79,"args":[["object","Symfony\\Component\\Security\\Core\\Exception\\AccessDeniedException"],["object","Symfony\\Component\\HttpFoundation\\Request"],["integer",1]]},{"namespace":"Symfony\\Component\\HttpKernel","short_class":"HttpKernel","class":"Symfony\\Component\\HttpKernel\\HttpKernel","type":"-\u003E","function":"handle","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/http-kernel\/Kernel.php","line":198,"args":[["object","Symfony\\Component\\HttpFoundation\\Request"],["integer",1],["boolean",true]]},{"namespace":"Symfony\\Component\\HttpKernel","short_class":"Kernel","class":"Symfony\\Component\\HttpKernel\\Kernel","type":"-\u003E","function":"handle","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/http-kernel\/Client.php","line":68,"args":[["object","Symfony\\Component\\HttpFoundation\\Request"],["integer",1],["boolean",true]]},{"namespace":"Symfony\\Component\\HttpKernel","short_class":"Client","class":"Symfony\\Component\\HttpKernel\\Client","type":"-\u003E","function":"doRequest","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/framework-bundle\/Client.php","line":131,"args":[["object","Symfony\\Component\\HttpFoundation\\Request"]]},{"namespace":"Symfony\\Bundle\\FrameworkBundle","short_class":"Client","class":"Symfony\\Bundle\\FrameworkBundle\\Client","type":"-\u003E","function":"doRequest","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/browser-kit\/Client.php","line":407,"args":[["object","Symfony\\Component\\HttpFoundation\\Request"]]},{"namespace":"Symfony\\Component\\BrowserKit","short_class":"Client","class":"Symfony\\Component\\BrowserKit\\Client","type":"-\u003E","function":"request","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/src\/ApiPlatform\/Test\/Client.php","line":124,"args":[["string","POST"],["string","http:\/\/example.com\/api\/users"],["array",[]],["array",[]],["array",{"HTTP_USER_AGENT":["string","Symfony BrowserKit"],"HTTP_ACCEPT":["string","application\/ld+json"],"CONTENT_TYPE":["string","application\/json"],"HTTP_HOST":["string","example.com"],"HTTPS":["boolean",false]}],["string","{\u0022email\u0022:\u0022cheeseplease@example.com\u0022,\u0022username\u0022:\u0022cheeseplease\u0022,\u0022password\u0022:\u0022brie\u0022}"]]},{"namespace":"App\\ApiPlatform\\Test","short_class":"Client","class":"App\\ApiPlatform\\Test\\Client","type":"-\u003E","function":"request","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/tests\/Functional\/UserResourceTest.php","line":19,"args":[["string","POST"],["array",{"scheme":["string","http:"],"authority":["string","\/\/example.com"],"path":["string","\/api\/users"],"query":["null",null],"fragment":["null",null]}],["array",{"normalized_headers":["array",{"accept":["array",[["string","accept: application\/ld+json"]]],"content-type":["array",[["string","Content-Type: application\/json"]]]}],"headers":["array",[["string","accept: application\/ld+json"],["string","Content-Type: application\/json"]]],"query":["array",[]],"body":["string","{\u0022email\u0022:\u0022cheeseplease@example.com\u0022,\u0022username\u0022:\u0022cheeseplease\u0022,\u0022password\u0022:\u0022brie\u0022}"],"base_uri":["array",{"scheme":["string","http:"],"authority":["string","\/\/example.com"],"path":["null",null],"query":["null",null],"fragment":["null",null]}],"http_version":["null",null],"timeout":["float",60]}]]},{"namespace":"App\\Tests\\Functional","short_class":"UserResourceTest","class":"App\\Tests\\Functional\\UserResourceTest","type":"-\u003E","function":"testCreateUser","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/Framework\/TestCase.php","line":1329,"args":[]},{"namespace":"PHPUnit\\Framework","short_class":"TestCase","class":"PHPUnit\\Framework\\TestCase","type":"-\u003E","function":"runTest","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/Framework\/TestCase.php","line":949,"args":[]},{"namespace":"PHPUnit\\Framework","short_class":"TestCase","class":"PHPUnit\\Framework\\TestCase","type":"-\u003E","function":"runBare","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/Framework\/TestResult.php","line":680,"args":[]},{"namespace":"PHPUnit\\Framework","short_class":"TestResult","class":"PHPUnit\\Framework\\TestResult","type":"-\u003E","function":"run","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/Framework\/TestCase.php","line":678,"args":[["object","App\\Tests\\Functional\\UserResourceTest"]]},{"namespace":"PHPUnit\\Framework","short_class":"TestCase","class":"PHPUnit\\Framework\\TestCase","type":"-\u003E","function":"run","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/Framework\/TestSuite.php","line":568,"args":[["object","PHPUnit\\Framework\\TestResult"]]},{"namespace":"PHPUnit\\Framework","short_class":"TestSuite","class":"PHPUnit\\Framework\\TestSuite","type":"-\u003E","function":"run","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/Framework\/TestSuite.php","line":568,"args":[["object","PHPUnit\\Framework\\TestResult"]]},{"namespace":"PHPUnit\\Framework","short_class":"TestSuite","class":"PHPUnit\\Framework\\TestSuite","type":"-\u003E","function":"run","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/TextUI\/TestRunner.php","line":619,"args":[["object","PHPUnit\\Framework\\TestResult"]]},{"namespace":"PHPUnit\\TextUI","short_class":"TestRunner","class":"PHPUnit\\TextUI\\TestRunner","type":"-\u003E","function":"doRun","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/TextUI\/Command.php","line":201,"args":[["object","PHPUnit\\Framework\\TestSuite"],["array",{"listGroups":["boolean",false],"listSuites":["boolean",false],"listTests":["boolean",false],"listTestsXml":["boolean",false],"loader":["null",null],"useDefaultConfiguration":["boolean",true],"loadedExtensions":["array",[]],"notLoadedExtensions":["array",[]],"colors":["string","always"],"testSuffixes":["array",[["string","Test.php"],["string",".phpt"]]],"configuration":["object","PHPUnit\\Util\\Configuration"],"listeners":["array",[["object","Symfony\\Bridge\\PhpUnit\\Legacy\\SymfonyTestsListenerForV7"]]],"debug":["boolean",false],"filter":["boolean",false],"backupGlobals":["boolean",false],"bootstrap":["string","\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/config\/bootstrap.php"],"testdoxGroups":["array",[]],"testdoxExcludeGroups":["array",[]],"addUncoveredFilesFromWhitelist":["boolean",true],"backupStaticAttributes":["null",null],"beStrictAboutChangesToGlobalState":["null",null],"beStrictAboutResourceUsageDuringSmallTests":["boolean",false],"cacheResult":["boolean",true],"cacheTokens":["boolean",false],"columns":["integer",80],"convertDeprecationsToExceptions":["boolean",true],"convertErrorsToExceptions":["boolean",true],"convertNoticesToExceptions":["boolean",true],"convertWarningsToExceptions":["boolean",true],"crap4jThreshold":["integer",30],"disallowTestOutput":["boolean",false],"disallowTodoAnnotatedTests":["boolean",false],"defaultTimeLimit":["integer",0],"enforceTimeLimit":["boolean",false],"excludeGroups":["array",[]],"executionOrder":["integer",0],"executionOrderDefects":["integer",0],"failOnRisky":["boolean",false],"failOnWarning":["boolean",false],"groups":["array",[]],"noInteraction":["boolean",false],"processIsolation":["boolean",false],"processUncoveredFilesFromWhitelist":["boolean",false],"randomOrderSeed":["integer",1576527511],"registerMockObjectsFromTestArgumentsRecursively":["boolean",false],"repeat":["boolean",false],"reportHighLowerBound":["integer",90],"reportLowUpperBound":["integer",50],"reportUselessTests":["boolean",true],"reverseList":["boolean",false],"resolveDependencies":["boolean",true],"stopOnError":["boolean",false],"stopOnFailure":["boolean",false],"stopOnIncomplete":["boolean",false],"stopOnRisky":["boolean",false],"stopOnSkipped":["boolean",false],"stopOnWarning":["boolean",false],"stopOnDefect":["boolean",false],"strictCoverage":["boolean",false],"timeoutForLargeTests":["integer",60],"timeoutForMediumTests":["integer",10],"timeoutForSmallTests":["integer",1],"verbose":["boolean",false],"cacheResultFile":["string","\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish"]}],["boolean",true]]},{"namespace":"PHPUnit\\TextUI","short_class":"Command","class":"PHPUnit\\TextUI\\Command","type":"-\u003E","function":"run","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/src\/TextUI\/Command.php","line":160,"args":[["array",[["string","bin\/phpunit"],["string","--colors=always"]]],["boolean",true]]},{"namespace":"PHPUnit\\TextUI","short_class":"Command","class":"PHPUnit\\TextUI\\Command","type":"::","function":"main","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/phpunit","line":17,"args":[]},{"namespace":"","short_class":"","class":"","type":"","function":"include","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/phpunit-bridge\/bin\/simple-phpunit.php","line":293,"args":[["string","\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/.phpunit\/phpunit-8.2-0\/phpunit"]]},{"namespace":"","short_class":"","class":"","type":"","function":"require","file":"\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/bin\/phpunit","line":13,"args":[["string","\/Users\/casrime\/Downloads\/code-api-platform-security (3)\/finish\/vendor\/symfony\/phpunit-bridge\/bin\/simple-phpunit.php"]]}]}

/Users/casrime/Downloads/code-api-platform-security (3)/finish/src/ApiPlatform/Test/BrowserKitAssertionsTrait.php:47
/Users/casrime/Downloads/code-api-platform-security (3)/finish/tests/Functional/UserResourceTest.php:24

Do you have the same problem ?

Thanks you 😉

|

Victor SFCASTS abdounikarim 6 years ago

Hey Abdelkarim,

Yeah, more info about it: It seems access_control was replaced with security. see their changelog: https://github.com/api-plat...

So, if you replace "access_control" with security in User object - it should pass :)

Cheers!

|

abdounikarim Victor 6 years ago

Hello Victor,

Yes, i already use security in new versions.

Cheers 😉

|

Victor SFCASTS abdounikarim 6 years ago

Hey Abdelkarim,

Yes, the new minor version of "api-platform/core" causes it to fail. If you downgrade it to "2.4.*" - it will work. So, it sounds like a BC break in 2.5.* but I'm not sure what exactly causes it though.

Cheers!

|

abdounikarim Victor 6 years ago

Hey Victor,

I think it comes from Symfony and not API Platform, like this issue : https://github.com/symfony/...

Cheers 😉

|

MolloKhan SFCASTS abdounikarim 6 years ago

Ohh, that's interesting and it seems very likely that that's the problem. You may want to try what they recommend, downgrading to Symfony 4.3.8 and see if it works, meanwhile we wait for a patch fix :)

Cheers!

|

abdounikarim MolloKhan 6 years ago edited

Hello MolloKhan , i solved my problem. It was because i used an old version of User entity (which implements UserInterface), with a roles field, who had an array type. I change it to a json type and now everything is good.

Cheers 😉

|

MolloKhan SFCASTS abdounikarim 6 years ago

Aha! That was a tricky one. Nice job tracking down the problem :)

|

abdounikarim abdounikarim 6 years ago edited

I also add my composer.json :


{
    "type": "project",
    "license": "proprietary",
    "require": {
        "php": "^7.1.3",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "api-platform/api-pack": "^1.2",
        "doctrine/doctrine-migrations-bundle": "^2.0",
        "nesbot/carbon": "^2.17",
        "symfony/console": "4.3.*",
        "symfony/dotenv": "4.3.*",
        "symfony/flex": "^1.1",
        "symfony/framework-bundle": "4.3.*",
        "symfony/http-client": "4.3.*",
        "symfony/monolog-bundle": "^3.4",
        "symfony/webpack-encore-bundle": "^1.6",
        "symfony/yaml": "4.3.*"
    },
    "config": {
        "preferred-install": {
            "*": "dist"
        },
        "sort-packages": true,
        "platform": {
            "php": "7.2.0"
        }
    },
    "autoload": {
        "psr-4": {
            "App\\": "src/"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "App\\Tests\\": "tests/"
        }
    },
    "replace": {
        "paragonie/random_compat": "2.*",
        "symfony/polyfill-ctype": "*",
        "symfony/polyfill-iconv": "*",
        "symfony/polyfill-php71": "*",
        "symfony/polyfill-php70": "*",
        "symfony/polyfill-php56": "*"
    },
    "scripts": {
        "auto-scripts": {
            "cache:clear": "symfony-cmd",
            "assets:install %PUBLIC_DIR%": "symfony-cmd"
        },
        "post-install-cmd": [
            "@auto-scripts"
        ],
        "post-update-cmd": [
            "@auto-scripts"
        ]
    },
    "conflict": {
        "symfony/symfony": "*"
    },
    "extra": {
        "symfony": {
            "allow-contrib": false,
            "require": "4.3.*"
        }
    },
    "require-dev": {
        "hautelook/alice-bundle": "^2.5",
        "symfony/maker-bundle": "^1.11",
        "symfony/profiler-pack": "^1.0",
        "symfony/test-pack": "^1.0"
    }
}

|

This tutorial works great for Symfony 5 and API Platform 2.5/2.6.

Symfony 4 API Platform 2.4

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": "^7.1.3, <8.0",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "api-platform/core": "^2.1", // v2.4.5
        "composer/package-versions-deprecated": "^1.11", // 1.11.99
        "doctrine/annotations": "^1.0", // 1.13.2
        "doctrine/doctrine-bundle": "^1.6", // 1.11.2
        "doctrine/doctrine-migrations-bundle": "^2.0", // v2.0.0
        "doctrine/orm": "^2.4.5", // v2.7.2
        "nelmio/cors-bundle": "^1.5", // 1.5.6
        "nesbot/carbon": "^2.17", // 2.21.3
        "phpdocumentor/reflection-docblock": "^3.0 || ^4.0", // 4.3.1
        "symfony/asset": "4.3.*", // v4.3.2
        "symfony/console": "4.3.*", // v4.3.2
        "symfony/dotenv": "4.3.*", // v4.3.2
        "symfony/expression-language": "4.3.*", // v4.3.2
        "symfony/flex": "^1.1", // v1.21.6
        "symfony/framework-bundle": "4.3.*", // v4.3.2
        "symfony/http-client": "4.3.*", // v4.3.3
        "symfony/monolog-bundle": "^3.4", // v3.4.0
        "symfony/security-bundle": "4.3.*", // v4.3.2
        "symfony/twig-bundle": "4.3.*", // v4.3.2
        "symfony/validator": "4.3.*", // v4.3.2
        "symfony/webpack-encore-bundle": "^1.6", // v1.6.2
        "symfony/yaml": "4.3.*" // v4.3.2
    },
    "require-dev": {
        "hautelook/alice-bundle": "^2.5", // 2.7.3
        "symfony/browser-kit": "4.3.*", // v4.3.3
        "symfony/css-selector": "4.3.*", // v4.3.3
        "symfony/maker-bundle": "^1.11", // v1.12.0
        "symfony/phpunit-bridge": "^4.3", // v4.3.3
        "symfony/stopwatch": "4.3.*", // v4.3.2
        "symfony/web-profiler-bundle": "4.3.*" // v4.3.2
    }
}

Previous Chapter

Next Chapter