User API Resource

... or just @Orm\Table(name=“users”). I mostly like name table with plurals.

Yeah, that would be even easier :D

Hi Roozbeh S. !

Nice to chat with you :). I do need to tell you that I don't have any practical experience with React Native apps, but I will do my best to answer your questions!

> 1. Should my method be "GET" or "POST"?

GET - because you are "fetching" user data.

> 2-How can I retrieve the User data by submitting a Bearer Authorization Token instead of adding an id to the Url.
> Does API Platform support this?

Good question. You have two options for this:

A) The more "pure" option would say that, when you log in, you should receive back some "user data"... most importantly the current user IRI. Then, you can store that in your app and whenever you need to fetch the user's data, you will know what URL to use (e.g. /api/users/5). You will, of course, still need to send the Authorization token. But the point is that the API won't use the token to *identify* the user (you are already telling it which user you want)... it will just be using it to make sure that this Bearer token has *access* to read that user's information.

B) It's also fairly common to make an endpoint like /api/me which you can use to request the "users information" that is related to the sent Token. In API Platform, you would probably implement this as a custom controller on your User resource. I think... I have not actually done that before... which is why I'm slightly guessing on the implementation :).

Cheers!

Yes! I have the IRI now!

You've explained it very clearly Ryan!
Thank you!

Hey JavierMendezK

That's a bit odd. I'd expect the password field to be present in the POST operation. Do you have a setter method for the password field? I think I'd need to see your entity code

Cheers!

namespace App\Entity;

use ApiPlatform\Core\Annotation\ApiFilter;
use ApiPlatform\Core\Annotation\ApiResource;
use ApiPlatform\Core\Serializer\Filter\PropertyFilter;
use App\Repository\UserRepository;
use Doctrine\Common\Collections\ArrayCollection;
use Doctrine\Common\Collections\Collection;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Serializer\Annotation\Groups;
use Symfony\Component\Validator\Constraints as Assert;

/**
* @ApiResource(
* attributes={"security"="is_granted('ROLE_USER')"},
* collectionOperations={
* "get",
* "post" = { "security" = "is_granted('IS_AUTHENTICATED_ANONYMOUSLY')" }
* },
* itemOperations={
* "get",
* "put" = { "security" = "is_granted('ROLE_USER') and object == user" },
* "delete" = { "security" = "is_granted('ROLE_ADMIN')" }
* },
* normalizationContext={"groups"={"user:read"}},
* denormalizationContext={"groups"={"user:write"}},
* )
* @ApiFilter(PropertyFilter::class)
* @UniqueEntity(fields={"username"})
* @UniqueEntity(fields={"email"})
* @ORM\Entity(repositoryClass=UserRepository::class)
*/
class User implements UserInterface
{
/**
* @ORM\Id
* @ORM\GeneratedValue
* @ORM\Column(type="integer")
*/
private $id;

/**
* @ORM\Column(type="string", length=180, unique=true)
* @Groups({"user:read", "user:write"})
* @Assert\NotBlank()
* @Assert\Email()
*/
private $email;

/**
* @ORM\Column(type="json")
*/
private $roles = [];

/**
* @var string The hashed password
* @ORM\Column(type="string")
*/
private $password;

/**
* @Groups({"user:write"})
*/
private $plainPassword;

/**
* @ORM\Column(type="string", length=255, unique=true)
* @Groups({"user:read", "user:write","computer_listing:item:get", "computer_listing:write"})
* @Assert\NotBlank()
*/
private $username;

// use orphanRemoval=true to remove the computers that have no owner
/**
* @ORM\OneToMany(targetEntity=ComputerListing::class, mappedBy="owner", cascade={"persist"})
* @Groups({"user:read","user:write"})
* @Assert\Valid()
*/
private $computerListings;

public function __construct()
{
$this->computerListings = new ArrayCollection();
}

public function getId(): ?int
{
return $this->id;
}

public function getEmail(): ?string
{
return $this->email;
}

public function setEmail(string $email): self
{
$this->email = $email;

return $this;
}

/**
* A visual identifier that represents this user.
*
* @see UserInterface
*/
public function getUsername(): string
{
return (string) $this->username;
}

/**
* @see UserInterface
*/
public function getRoles(): array
{
$roles = $this->roles;
// guarantee every user at least has ROLE_USER
$roles[] = 'ROLE_USER';

return array_unique($roles);
}

public function setRoles(array $roles): self
{
$this->roles = $roles;

return $this;
}

/**
* @see UserInterface
*/
public function getPassword(): string
{
return (string) $this->password;
}

public function setPassword(string $password): self
{
$this->password = $password;

return $this;
}

/**
* Returning a salt is only needed, if you are not using a modern
* hashing algorithm (e.g. bcrypt or sodium) in your security.yaml.
*
* @see UserInterface
*/
public function getSalt(): ?string
{
return null;
}

/**
* @see UserInterface
*/
public function eraseCredentials()
{
// If you store any temporary, sensitive data on the user, clear it here
$this->plainPassword = null;
}

public function setUsername(string $username): self
{
$this->username = $username;

return $this;
}

/**
* @return Collection|ComputerListing[]
*/
public function getComputerListings(): Collection
{
return $this->computerListings;
}

public function addComputerListing(ComputerListing $computerListing): self
{
if (!$this->computerListings->contains($computerListing)) {
$this->computerListings[] = $computerListing;
$computerListing->setOwner($this);
}

return $this;
}

public function removeComputerListing(ComputerListing $computerListing): self
{
if ($this->computerListings->removeElement($computerListing)) {
// set the owning side to null (unless already changed)
if ($computerListing->getOwner() === $this) {
$computerListing->setOwner(null);
}
}

return $this;
}

public function getPlainPassword(): ?string
{
return $this->plainPassword;
}

public function setPlainPassword(string $plainPassword): self
{
$this->plainPassword = $plainPassword;

return $this;
}

}

Hey Javier, sorry for my slow reply. The field password should not be shown on any operation because you don't have any serialization group for it, but the plainPassword field should be shown on POST operations due to the user:write group

I have got the same problem and my code is exactly the same as the example code as i followed the tutorial step by step.
To verify that i made no errors i then just copied from the codeblock in this chapter. The schemas for read and write are shown as intended in the part of the bottom of the swagger doc page:

ApiUser-user.write{
email*	string($email)
externalDocs: OrderedMap { "url": "http://schema.org/email" }
password	string

The hashed password
username*	string

But: above, under POST and PUT my password fild is missing, my example values are the following:

{
  "email": "user@example.com",
  "username": "string"

When i manually add the "password" : "some string" field and click on "execute", everything works as intended.

Even more interestingy, when i click on "schema" right next to "Example Value", is says:

ApiUser.jsonld-user.read{
email*	string($email)
externalDocs: OrderedMap { "url": "http://schema.org/email" }

Shouldn't it use the write model here?

Hey Tristan P.!

Hmm. It's interesting that we now have two people with the same issue in a short period of time. And in fact (as you already noticed @Tristano! ) there is a third person with an issue that is suspiciously similar: https://symfonycasts.com/sc...

My gut is that there has been a change in API Platform that is causing this. And if so, I believe it is a bug. If you can open an issue and link me to it, I can help push that along.

Cheers!

Hi,
I have the same issue using symfony 5.3.1

Yup, there's an open issue about it - no fix proposed at the moment :/ https://github.com/api-plat...

UPDATE ERROR

I'm having the same problem here, I installed api platform by the official guide with docker, so the version is different the one you used for the tutorial, api platform 2.6 symfony 5.2

Yea, it looks like there is a bug in 2.6.3 related to this - there are several open issues about it - it looks like you already found the main one ;) https://github.com/api-plat...

Cheers!

Hey,
did you find the solution? if yes then please show us because i face exactly same problem.

Hey Monoranjan,

Unfortunately, no official possible solution as I can see the main issue is still open: https://github.com/api-plat... - you probably may look over the thread to find possible workaround if any.

Cheers!

Hey Thomas C.

That's odd. Can you double-check that your roles property is initially set to an empty array?

// User.php

private $roles = [];

Cheers!

Yes i have check this. To solve i have modify this in the db ALTER TABLE `user` CHANGE `roles` `roles` TEXT NULL.

My code was :
/*
*
* @ORM\Column(type="json")
*/
private $roles = [];

Hmm, that's odd. If you persist an User with an empty array in its roles property, it should store a json like this <code[]` and that's not considered as empty for a Database

Hey @Szabo!

This *should* be possible, but it would be a PUT request. It's an HTTP "spec" thing - if you're creating an object but *providing* the primary key, then the proper HTTP method is PUT. Try PUT and let me know if it works.

Cheers!

Hey man,

Good observation. Hashing the password and adding roles is a job you have to do and has nothing to do with ApiPlatform. Ryan talks more about that in the next course: https://symfonycasts.com/sc...

About the id thing. How's your configuration? If you are using UUID's then it should be totally different than an auto-incremented id

Cheers!

Hey Adam D.!

Good job finding the solution! Like all errors, it's a tough error the first time you see it - hopefully it won't be next time! Our code *does* have this use statement, but you're right that you don't see it in the video. The reason is that we *often* allow classes (or annotations) to auto-complete in PhpStorm. When we do this, it automatically adds the use statement needed on top (you need the php-annotations plugin installed for this to work with annotations). I try to mention that this is happening from time-to-time... but if I mention it *every* time, it gets laborious. It's a tricky balance :/. But now that you know it, I think you should be good. If you ever have some mysterious problem, you can also expand the full code block below the video and see *exactly* what our code looks like.

Cheers!

Hey @Codsworth

You can try pecl install libsodium just be sure that brew installed php is fully configured

Cheers

Thanks Vladimir,

I'll give that a try!