security with method not working

Question

I'm trying to set up security on my entities in API Platform and found that I can call a method instead of the property example used in the docs (found this in some example somewhere on the web):

 * attributes={"access_control"="is_granted('ROLE_USER') and object.belongsTo(user)"},

This is necessary in my case as I keep the user account data seperate from the user profile data and the entity in question is linked to the profile, not the user entity.

This works like charm on an individual getter (/api/data/{id}) but fails with a server 500 error on the list (/api/data):

"hydra:description": "Unable to call method \"belongsTo\" of object \"ApiPlatform\Core\Bridge\Doctrine\Orm\Paginator\".",

Wondering what is going wrong and how to fix it.

the "belongsTo()" method is fairly simple:

public function belongsTo(User $user) {
    return $user == $this->owner->user;
}

Answer 1

Try this way

Create custom extension