…you would need to turn it into a UserApiRead and return that. Anyway, that's definitely more advanced, but if it's interesting, and you try it, let me know! Next up: Let's polish our new API resource by re-adding validation and security.

…your browser, refresh this page, and... oh... Full authentication is required to access this resource. Of course. That's because we added security! Head back over to the homepage, click this username and password shortcut... boop... and now try to refresh that page. It works…

…we need to call ->hashPassword() instead of ->encodePassword(). Done! Just one more spot where we need this same change: src/Security/LoginFormAuthenticator.php. We're going to refactor this class later to use the new security system... but let's at least get it working…

…soon. For the else, this is when the user does not send an owner field. To set it to the currently authenticated user, on top, inject the Security service onto a new property. Then back below, set owner to $this->security->getUser(). Beautiful! We are…

…getValues() and refresh the page... perfect! We're back to a regular array of items. Next: We can read from our new DragonTreasureApi resource, but we can't write to it yet. Let's create a DragonTreasureApiToEntityMapper and re-add things like security and validation.

…Oh, and though I didn't do it, we could also inject the Security service to allow admin users to do whatever they want. Up next: when we create a DragonTreasure, we must send the owner field. Let's finally make that optional. If we…

…I'm on the Symfony repository. Hit "t" and search for JsonLoginAuthenticator. This is the code behind the json_login security authenticator. One common need with the JsonLoginAuthenticator is to use it like normal... but then take control of what happens on success: for example…

…have a custom authenticator for our login form, so to make this actually work, we need to make some adjustments. Open src/Security/LoginFormAuthenticator. At the start of the onAuthenticationSuccess() method, add if ($targetPath = $request->query->get('_target_path')). Inside, return new RedirectResponse($targetPath)…

…test mode. In production, this would also list all the customer's orders. Okay, now let's turn our attention to a small security issue here. At the moment, we're filtering orders by the email users have registered with our site. But, in theory…

…if you're allowed to edit or delete a treasure... that means you've already passed a security check... so we don't necessarily need to lock things down via this query extension. The other solution is to change the query to allow owners to…

…security standpoint as we now need to worry about objects being edited or created via the same PUT operation. For that reason, as we go along, you'll see me remove the PUT operation in some cases. Next: let's get more complex with security…

…it to see if the User is logged in because this will return null if they're not. A more "official" way to do this would be to use isGranted() - that's another method on the Security class - and check for IS_AUTHENTICATED_REMEMBERED: Anyways…

…This parameter is absolutely necessary for the API request to work, but isn't actually used by COOP. It's a security measure, and it must exactly equal the original redirect_uri that we used when we redirected the user. Ok, let's try it…

…have Ngrok running, we're still able to sync the LemonSqueezy customer ID with the user via JavaScript events. This approach simplifies local development a bit, but both ways are totally valid. Next: Let's tackle some potential security issues by preventing customer ID hijacking.

…config is no config... which tells Doctrine to figure out things for us. Once again, add all these changes, commit, and... let's keep going! Well, let's keep going in the next chapter, where we upgrade DoctrineExtensionsBundle, some debug recipes, routing, security and more!

…API request, click into the Doctrine section then "view formatted query". Beautiful! The is_published and owner_id check comes from a Doctrine extension we created in the last tutorial and relates to security. And then it searches on the title or description fields. Pretty…

…sweet JavaScript. And we're just starting to scratch the surface of Symfony. What about talking to a database, using forms, setting up security or handling API input and validation? How and why should you register your own services? And what are event listeners? The…

…admin somehow got the "Delete" URL for an approved question, the delete action would still work. The action itself isn't secure. To give us that extra layer of security, right before an entity is deleted, let's check to see if it's approved…

…prevent the user from logging in until they've verified their email. To do that, we first need to learn about the events that happen inside of the security system. And to show off those, we'll leverage a really cool new feature: login throttling…

…the value, open .env.local, copy the long DSN string, then paste here. You won't see the value because the command is hiding it for security purposes. And... boom! This generated the prod vault and encrypted the secret. Check out config/secrets/prod. It…