CODEWITHSUNDEEP
phpsymfonysymfony4api-platform.com
Danielle Suurlant
Danielle Suurlant

Reputation: 161

Using Api-Platform, how to automatically add the authorized user as a resource owner when creating it?

How to automatically add the currently authorized user to a resource upon creation (POST).

I am using JWT authentication, and /api/ routes are protected from unauthorized users. I want to set it up so that when an authenticated user creates a new resource (i.e. by sending a POST request to /api/articles) the newly created Article resource is related to the authenticated user.

I'm currently using a custom EventSubscriber per resource type to add the user from token storage.

Here's the gist for the subscriber base class: https://gist.github.com/dsuurlant/5988f90e757b41454ce52050fd502273

And the entity subscriber that extends it: https://gist.github.com/dsuurlant/a8af7e6922679f45b818ec4ddad36286

However this does not work if for example, the entity constructor requires the user as a parameter.

E.g.

class Book {

    public User $owner;
    public string $name;

    public class __construct(User $user, string $name) {
        $this->owner = $user;
        $this->name  = $name;
    }
}

How to automatically inject the authorized user upon entity creation?

Upvotes: 6

Views: 2639

Answers (2)

D. Schreier
D. Schreier

Reputation: 1788

As @nealio82 and @lavb said, you should have a look on Gedmo\Blameable which help you to handle properties as createdBy or updatedBy where you can store the User who create the ressource.

Blameable StofDoctrineExtensionsBundle

Then to handle access, have a look on Voters which is awesome to handle security and different access.

Official Symfony documentation about Voters

e.g

Book entity

...
use Gedmo\Mapping\Annotation as Gedmo;

class Book {

    ...

    /**
     * @var string $createdBy
     *
     * @Gedmo\Blameable(on="create")
     * @ORM\Column
     */
    public User $owner;

    public function getOwner() {
        return $this->owner;
    }

    public function setOwner(User $owner) {
        $this->owner = $owner
    }
}

src/Security/Voter/BookVoter

namespace App\Security;

use App\Entity\Book;
use App\Entity\User;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;

class BookVoter extends Voter
{
    const VIEW = 'view';
    const EDIT = 'edit';

    protected function supports(string $attribute, $subject)
    {
        // if the attribute isn't one we support, return false
        if (!in_array($attribute, [self::VIEW, self::EDIT])) {
            return false;
        }

        // only vote on `Book` objects
        if (!$subject instanceof Book) {
            return false;
        }

        return true;
    }

    protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token) {
        $user = $token->getUser();

        if (!$user instanceof User) {
            // the user must be logged in; if not, deny access
            return false;
        }

        /** @var Book $book */
        $book = $subject;

        switch ($attribute) {
            case self::VIEW:
                return $this->canView($book, $user);
            case self::EDIT:
                return $this->canEdit($book, $user);
        }

        throw new \LogicException('This code should not be reached!');
    }

    private function canEdit(Book $book, User $user) {
        // ONLY OWNER CAN EDIT BOOK
        return $user === $book->getOwner();
    }

    private function canView(Book $book, User $user) {
        // DIFFERENT LOGIC ?
        return $user === $book->getOwner();
    }

    ...

}

Upvotes: 0

yivi
yivi

Reputation: 47649

For the time being, I'm using DTOs and data transformers.

The main disadvantage is having to create a new DTO for each resource where this behaviour is required.

As a simple example, I'm doing something like this:

class BootDtoTransformer implements DataTransformerInterface
{

    private Security $security;

    public function __construct(Security $security)
    {
        $this->security = $security;
    }

    public function transform($data, string $to, array $context = [])
    {

        $owner = $this->security->getUser();

        return $new Book($owner, $data->name);;
    }

    public function supportsTransformation($data, string $to, array $context = []): bool
    {

        if ($data instanceof Book) {
            return false;
        }

        return Book::class === $to && null !== ($context['input']['class'] ?? null);
    }

}

This logically works only for a single resource. To have a generic transformer for multiple resources I end up using some interfaces to set apart the "owneable" resources, and a bit of reflection to instantiate each class.

I would have thought this were doable during the denormalization phase, but I couldn't get it work.

Upvotes: 1

Related Questions