Skip to content

Commit c374794

Browse files
KDederichsKDederichs
committed
Revert "fix: backport for legacy event system as well"
This reverts commit 16f14c8.
1 parent 16f14c8 commit c374794

File tree

3 files changed

+5
-150
lines changed

3 files changed

+5
-150
lines changed

‎src/Symfony/EventListener/DenyAccessListener.php

Lines changed: 5 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313

1414
namespace ApiPlatform\Symfony\EventListener;
1515

16-
use ApiPlatform\Metadata\Link;
1716
use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
1817
use ApiPlatform\State\Util\OperationRequestInitiatorTrait;
1918
use ApiPlatform\Symfony\Security\ResourceAccessCheckerInterface;
@@ -90,31 +89,17 @@ private function checkSecurity(Request $request, string $attribute, array $extra
9089
$message = $operation->getSecurityMessage();
9190
}
9291

92+
if (null === $isGranted) {
93+
return;
94+
}
95+
9396
$extraVariables += $request->attributes->all();
9497
$extraVariables['object'] = $request->attributes->get('data');
9598
$extraVariables['previous_object'] = $request->attributes->get('previous_data');
9699
$extraVariables['request'] = $request;
97100

98-
if ($isGranted && !$this->resourceAccessChecker->isGranted($attributes['resource_class'], $isGranted, $extraVariables)) {
101+
if (!$this->resourceAccessChecker->isGranted($attributes['resource_class'], $isGranted, $extraVariables)) {
99102
throw new AccessDeniedException($message ?? 'Access Denied.');
100103
}
101-
102-
if ($operation->getUriVariables()) {
103-
foreach ($operation->getUriVariables() as $key => $uriVariable) {
104-
if (!$uriVariable instanceof Link || !$uriVariable->getSecurity()) {
105-
continue;
106-
}
107-
108-
$targetResource = $uriVariable->getFromClass() ?? $uriVariable->getToClass();
109-
110-
if (!$targetResource) {
111-
continue;
112-
}
113-
114-
if (!$this->resourceAccessChecker->isGranted($targetResource, $uriVariable->getSecurity(), $extraVariables)) {
115-
throw new AccessDeniedException($uriVariable->getSecurityMessage() ?? 'Access Denied.');
116-
}
117-
}
118-
}
119104
}
120105
}

‎src/Symfony/EventListener/ReadListener.php

Lines changed: 0 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
use ApiPlatform\Api\UriVariablesConverterInterface;
1717
use ApiPlatform\Exception\InvalidIdentifierException;
1818
use ApiPlatform\Exception\InvalidUriVariableException;
19-
use ApiPlatform\Metadata\Link;
2019
use ApiPlatform\Metadata\Put;
2120
use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
2221
use ApiPlatform\Metadata\Util\CloneTrait;
@@ -117,47 +116,6 @@ public function onKernelRequest(RequestEvent $event): void
117116
throw new NotFoundHttpException('Not Found');
118117
}
119118

120-
if ($operation->getUriVariables()) {
121-
foreach ($operation->getUriVariables() as $key => $uriVariable) {
122-
if (!$uriVariable instanceof Link || !$uriVariable->getSecurity()) {
123-
continue;
124-
}
125-
126-
$relationClass = $uriVariable->getFromClass() ?? $uriVariable->getToClass();
127-
128-
if (!$relationClass) {
129-
continue;
130-
}
131-
132-
$parentOperation = $this->resourceMetadataCollectionFactory
133-
->create($relationClass)
134-
->getOperation($operation->getExtraProperties()['parent_uri_template'] ?? null);
135-
try {
136-
$relation = $this->provider->provide($parentOperation, [$uriVariable->getIdentifiers()[0] => $request->attributes->all()[$key]], $context);
137-
} catch (ProviderNotFoundException) {
138-
$relation = null;
139-
}
140-
if (!$relation) {
141-
throw new NotFoundHttpException('Not Found');
142-
}
143-
144-
try {
145-
$securityObjectName = $uriVariable->getSecurityObjectName();
146-
147-
if (!$securityObjectName) {
148-
$securityObjectName = $uriVariable->getToProperty() ?? $uriVariable->getFromProperty();
149-
}
150-
151-
if (!$securityObjectName) {
152-
continue;
153-
}
154-
$request->attributes->set($securityObjectName, $relation);
155-
} catch (InvalidIdentifierException|InvalidUriVariableException $e) {
156-
throw new NotFoundHttpException('Invalid identifier value or configuration.', $e);
157-
}
158-
}
159-
}
160-
161119
$request->attributes->set('data', $data);
162120
$request->attributes->set('previous_data', $this->clone($data));
163121
}

‎tests/Symfony/EventListener/DenyAccessListenerTest.php

Lines changed: 0 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@
1515

1616
use ApiPlatform\Metadata\ApiResource;
1717
use ApiPlatform\Metadata\Get;
18-
use ApiPlatform\Metadata\GetCollection;
19-
use ApiPlatform\Metadata\Link;
2018
use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
2119
use ApiPlatform\Metadata\Resource\ResourceMetadataCollection;
2220
use ApiPlatform\Symfony\EventListener\DenyAccessListener;
@@ -157,92 +155,6 @@ public function testSecurityComponentNotAvailable(): void
157155
$listener->onSecurity($event);
158156
}
159157

160-
public function testIsGrantedLink(): void
161-
{
162-
$request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get_collection']);
163-
164-
$eventProphecy = $this->prophesize(RequestEvent::class);
165-
$eventProphecy->getRequest()->willReturn($request)->shouldBeCalled();
166-
$event = $eventProphecy->reveal();
167-
168-
$resourceMetadataFactoryProphecy = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
169-
$resourceMetadataFactoryProphecy->create('Foo')->shouldBeCalled()->willReturn(new ResourceMetadataCollection('Foo', [
170-
new ApiResource(
171-
uriTemplate: '/bars/{barId}/foos',
172-
operations: [
173-
'get_collection' => new GetCollection(uriVariables: [
174-
'barId' => new Link(toProperty: 'bar', fromClass: 'Bar', security: 'is_granted("some_voter", "bar")'),
175-
], ),
176-
],
177-
),
178-
]));
179-
180-
$resourceAccessCheckerProphecy = $this->prophesize(ResourceAccessCheckerInterface::class);
181-
$resourceAccessCheckerProphecy->isGranted('Bar', 'is_granted("some_voter", "bar")', Argument::type('array'))->willReturn(true)->shouldBeCalled();
182-
183-
$listener = $this->getListener($resourceMetadataFactoryProphecy->reveal(), $resourceAccessCheckerProphecy->reveal());
184-
$listener->onSecurity($event);
185-
}
186-
187-
public function testIsNotGrantedLink(): void
188-
{
189-
$this->expectException(AccessDeniedException::class);
190-
191-
$request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get_collection']);
192-
193-
$eventProphecy = $this->prophesize(RequestEvent::class);
194-
$eventProphecy->getRequest()->willReturn($request)->shouldBeCalled();
195-
$event = $eventProphecy->reveal();
196-
197-
$resourceMetadataFactoryProphecy = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
198-
$resourceMetadataFactoryProphecy->create('Foo')->shouldBeCalled()->willReturn(new ResourceMetadataCollection('Foo', [
199-
new ApiResource(
200-
uriTemplate: '/bars/{barId}/foos',
201-
operations: [
202-
'get_collection' => new GetCollection(uriVariables: [
203-
'barId' => new Link(toProperty: 'bar', fromClass: 'Bar', security: 'is_granted("some_voter", "bar")'),
204-
], ),
205-
],
206-
),
207-
]));
208-
209-
$resourceAccessCheckerProphecy = $this->prophesize(ResourceAccessCheckerInterface::class);
210-
$resourceAccessCheckerProphecy->isGranted('Bar', 'is_granted("some_voter", "bar")', Argument::type('array'))->willReturn(false)->shouldBeCalled();
211-
212-
$listener = $this->getListener($resourceMetadataFactoryProphecy->reveal(), $resourceAccessCheckerProphecy->reveal());
213-
$listener->onSecurity($event);
214-
}
215-
216-
public function testSecurityMessageLink(): void
217-
{
218-
$this->expectException(AccessDeniedException::class);
219-
$this->expectExceptionMessage('You are not admin.');
220-
221-
$request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get_collection']);
222-
223-
$eventProphecy = $this->prophesize(RequestEvent::class);
224-
$eventProphecy->getRequest()->willReturn($request)->shouldBeCalled();
225-
$event = $eventProphecy->reveal();
226-
227-
$resourceMetadataFactoryProphecy = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
228-
$resourceMetadataFactoryProphecy->create('Foo')->shouldBeCalled()->willReturn(new ResourceMetadataCollection('Foo', [
229-
new ApiResource(
230-
uriTemplate: '/bars/{barId}/foos',
231-
operations: [
232-
'get_collection' => new GetCollection(uriVariables: [
233-
'barId' => new Link(toProperty: 'bar', fromClass: 'Bar', security: 'is_granted("some_voter", "bar")', securityMessage: 'You are not admin.'),
234-
], ),
235-
],
236-
),
237-
]));
238-
239-
$resourceAccessCheckerProphecy = $this->prophesize(ResourceAccessCheckerInterface::class);
240-
$resourceAccessCheckerProphecy->isGranted('Bar', 'is_granted("some_voter", "bar")', Argument::type('array'))->willReturn(false)->shouldBeCalled();
241-
242-
$listener = $this->getListener($resourceMetadataFactoryProphecy->reveal(), $resourceAccessCheckerProphecy->reveal());
243-
$listener->onSecurity($event);
244-
}
245-
246158
private function getListener(ResourceMetadataCollectionFactoryInterface $resourceMetadataCollectionFactory, ResourceAccessCheckerInterface $resourceAccessChecker = null): DenyAccessListener
247159
{
248160
if (null === $resourceAccessChecker) {

0 commit comments

Comments
 (0)