feat(tests): Add DenyAccessListener tests

Author: KDederichs

src/Symfony/EventListener/DenyAccessListener.php

@@ -86,16 +86,12 @@ private function checkSecurity(Request $request, string $attribute, array $extra
                 $message = $operation->getSecurityMessage();
         }
 
-        if (null === $isGranted) {
-            return;
-        }
-
         $extraVariables += $request->attributes->all();
         $extraVariables['object'] = $request->attributes->get('data');
         $extraVariables['previous_object'] = $request->attributes->get('previous_data');
         $extraVariables['request'] = $request;
 
-        if (!$this->resourceAccessChecker->isGranted($attributes['resource_class'], $isGranted, $extraVariables)) {
+        if ($isGranted && !$this->resourceAccessChecker->isGranted($attributes['resource_class'], $isGranted, $extraVariables)) {
             throw new AccessDeniedException($message ?? 'Access Denied.');
         }
 
@@ -105,7 +101,7 @@ private function checkSecurity(Request $request, string $attribute, array $extra
                     continue;
                 }
 
-                if (!$this->resourceAccessChecker->isGranted($uriVariable->getToProperty(), $uriVariable->getSecurity(), $extraVariables)) {
+                if (!$this->resourceAccessChecker->isGranted($uriVariable->getFromClass(), $uriVariable->getSecurity(), $extraVariables)) {
                     throw new AccessDeniedException($uriVariable->getSecurityMessage() ?? 'Access Denied.');
                 }
             }

tests/Symfony/EventListener/DenyAccessListenerTest.php

@@ -15,6 +15,8 @@
 
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Link;
 use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
 use ApiPlatform\Metadata\Resource\ResourceMetadataCollection;
 use ApiPlatform\Symfony\EventListener\DenyAccessListener;
@@ -140,6 +142,92 @@ public function testSecurityMessage(): void
         $listener->onSecurity($event);
     }
 
+    public function testIsGrantedLink(): void
+    {
+        $request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get_collection']);
+
+        $eventProphecy = $this->prophesize(RequestEvent::class);
+        $eventProphecy->getRequest()->willReturn($request)->shouldBeCalled();
+        $event = $eventProphecy->reveal();
+
+        $resourceMetadataFactoryProphecy = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
+        $resourceMetadataFactoryProphecy->create('Foo')->shouldBeCalled()->willReturn(new ResourceMetadataCollection('Foo', [
+            new ApiResource(
+                uriTemplate: '/bars/{barId}/foos',
+                operations: [
+                    'get_collection' => new GetCollection(uriVariables: [
+                        'barId' => new Link(toProperty: 'bar', fromClass: 'Bar', security: 'is_granted("some_voter", "bar")'),
+                    ], ),
+                ],
+            ),
+        ]));
+
+        $resourceAccessCheckerProphecy = $this->prophesize(ResourceAccessCheckerInterface::class);
+        $resourceAccessCheckerProphecy->isGranted('Bar', 'is_granted("some_voter", "bar")', Argument::type('array'))->willReturn(true)->shouldBeCalled();
+
+        $listener = $this->getListener($resourceMetadataFactoryProphecy->reveal(), $resourceAccessCheckerProphecy->reveal());
+        $listener->onSecurity($event);
+    }
+
+    public function testIsNotGrantedLink(): void
+    {
+        $this->expectException(AccessDeniedException::class);
+
+        $request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get_collection']);
+
+        $eventProphecy = $this->prophesize(RequestEvent::class);
+        $eventProphecy->getRequest()->willReturn($request)->shouldBeCalled();
+        $event = $eventProphecy->reveal();
+
+        $resourceMetadataFactoryProphecy = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
+        $resourceMetadataFactoryProphecy->create('Foo')->shouldBeCalled()->willReturn(new ResourceMetadataCollection('Foo', [
+            new ApiResource(
+                uriTemplate: '/bars/{barId}/foos',
+                operations: [
+                    'get_collection' => new GetCollection(uriVariables: [
+                        'barId' => new Link(toProperty: 'bar', fromClass: 'Bar', security: 'is_granted("some_voter", "bar")'),
+                    ], ),
+                ],
+            ),
+        ]));
+
+        $resourceAccessCheckerProphecy = $this->prophesize(ResourceAccessCheckerInterface::class);
+        $resourceAccessCheckerProphecy->isGranted('Bar', 'is_granted("some_voter", "bar")', Argument::type('array'))->willReturn(false)->shouldBeCalled();
+
+        $listener = $this->getListener($resourceMetadataFactoryProphecy->reveal(), $resourceAccessCheckerProphecy->reveal());
+        $listener->onSecurity($event);
+    }
+
+    public function testSecurityMessageLink(): void
+    {
+        $this->expectException(AccessDeniedException::class);
+        $this->expectExceptionMessage('You are not admin.');
+
+        $request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get_collection']);
+
+        $eventProphecy = $this->prophesize(RequestEvent::class);
+        $eventProphecy->getRequest()->willReturn($request)->shouldBeCalled();
+        $event = $eventProphecy->reveal();
+
+        $resourceMetadataFactoryProphecy = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
+        $resourceMetadataFactoryProphecy->create('Foo')->shouldBeCalled()->willReturn(new ResourceMetadataCollection('Foo', [
+            new ApiResource(
+                uriTemplate: '/bars/{barId}/foos',
+                operations: [
+                    'get_collection' => new GetCollection(uriVariables: [
+                        'barId' => new Link(toProperty: 'bar', fromClass: 'Bar', security: 'is_granted("some_voter", "bar")', securityMessage: 'You are not admin.'),
+                    ], ),
+                ],
+            ),
+        ]));
+
+        $resourceAccessCheckerProphecy = $this->prophesize(ResourceAccessCheckerInterface::class);
+        $resourceAccessCheckerProphecy->isGranted('Bar', 'is_granted("some_voter", "bar")', Argument::type('array'))->willReturn(false)->shouldBeCalled();
+
+        $listener = $this->getListener($resourceMetadataFactoryProphecy->reveal(), $resourceAccessCheckerProphecy->reveal());
+        $listener->onSecurity($event);
+    }
+
     public function testSecurityComponentNotAvailable(): void
     {
         $request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get']);