feat(subresource): Link Security

[KDederichs]

Q	A
Branch?	main
Tickets	#4819
License	MIT
Doc PR	api-platform/docs#1692

Here's an idea how Link Security (as described in the issue) might work.
There's still an open issue with choosing the right provider programmatically and mapping the uri variables automatically but I wanted to ask if that's going in the right direction first before investing more work (and making tests)

[soyuka]

Hello I need to find time to really understand the need behind that, why don't you put the security on the top level?

Also, not a huge fan of the work done in the ReadListener it doesn't look it'll work with all cases. Still I only took a quick look I want to try this.

[KDederichs]

The issue with toplevel is:
When you have permissions that are based on the parent object you can't enforce them using subresources (at least not as I understand it).

For example lets say you got an an Order that has some transactions (/orders/{id}/transactions) :
You could link it and do some global checks but that won't work if you have requirements that pretain the order object , lets say check the owner or something, since you can't check it in a subresource.

Sure you could define your own custom provider for it but IMO it's something that should be doable with subresources, since that's basically the usecase.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[KDederichs]

Not stale, still a thing I'd like to see added in some way

[usu]

@KDederichs This seems like a very interesting enhancement. Are you still working on this? What do you believe is missing to get this mergeable and is there anything that could be supported with?

[KDederichs]

@usu I'd still like it done because I think it's a valid use case.
Technically it's done even, if I were to resolve the merge conflicts since my initial PR did have the whole functionality.

I'm just not sure why it wasn't merged back then, maybe the team doesn't like it or wants some changes? Dunno.
If you can get some API-Platform members to tell you why that's what would be missing :)

[soyuka]

Too much work, forgot that PR sorry! I think it's a valid use case. Only thing is that implementation in the ReadListener that I don't like. Please take a look at what we did in the CreateProvider. I think it's the same logic where we try to find another resource. When doing so, its needed that the user can specify an operation to get no?

[KDederichs]

Hmm yeah I'll try to get it out of there into it's own thing.
I'll probably get on it tomorrow or something and get rid of the merge conflicts and then try to change that.

Edit: Or do you just not like the way I did it there and the place itself is fine?

[usu]

@soyuka Is this ready to be merged? Would be awesome to see this in the 3.3 release.

[KDederichs]

@soyuka
Anything missing? :)

Was wondering what the general status of this is

[soyuka]

let me review this

[soyuka]

Made a few comments, if something is not clear feel free to pm me on the symfony slack.

[soyuka]

Can you add a configuration option and load the xml file for these providers only when it's enabled? Thanks.

[soyuka]

Love it! you also need to add your configuration at https://github.com/api-platform/core/blob/main/src/Symfony/Bundle/DependencyInjection/Configuration.php

[soyuka]

thanks! please also add a documentation entry on api-platform.com/docs

[KDederichs]

@soyuka There's a docs PR already, the only thing that's missing there is the enable_link_security flag I guess :)
It's linked here so maybe give it a quick look if something else is missing in there

[ghost]

I'm looking for YAML configuration of this feature. The docs provide an example using attributes only.

Adding the security option as a sibling of a link's fromClass/toProperty/etc is ignored in YAML. @KDederichs can I request a docs update for YAML and/or XML config? Or if you tell me how to configure it, I'd be happy to make the docs update myself.

[KDederichs]

There's no YAML/XML config for this.
You'd have to make a PR for that, it should be fairly simple though? Not completely sure never really dug into how Api Platform loads config values from XML/YAML.
Maybe @soyuka can tell you how much work that'd be

[ytilotti]

@amacrobert-meq same issue here! And it's really blocking me. Don't find why is not set in the config load.