@ApiSubresource `maxDepth` parameter is not working in 2.6.1

[crbanman]

API Platform version(s) affected: 2.6.1

Description

When using the @ApiSubresource annotation, routes are still being generated beyond the defined maxDepth.

This makes it possible for the "Route pattern" LogicException to be thrown by the RouteCompiler if an entity shares a subresource of the same type with one of its subresources (i.e. A Post has a many-to-one relationship with Author and a one-to-many relationship with Comment and Comment also has a many-to-one relationship with Author).

How to reproduce

1. Create Post, Author, and Comment Entities and add the @ApiSubresource(maxDepth=1) annotation to all relationships.
   • Post
     • id
     • content
     • author (many-to-one with Author)
     • comments (one-to-many with Post)
   • Author
     • id
     • posts (one-to-many with Post)
     • comments (one-to-many with Comment)
   • Comment
     • id
     • message
     • post (many-to-one with Comment)
     • author (many-to-one with Author)
2. Clear cache to see the "Route pattern" error.

Additional Context

Result of cache:clear with above entities:

/srv/api # bin/console cache:clear

 // Clearing the cache for the dev environment with debug                       
 // true                                                                        


In RouteCompiler.php line 149:
                                                                               
  Route pattern "/posts/{id}/author/posts/{posts}/comments/{comments}/author/  
  comments/{comments}/post.{_format}" cannot reference variable name "comment  
  s" more than once.                                                           
                                                                               

cache:clear [--no-warmup] [--no-optional-warmers]

Removing the @ApiSubresource annotation from Comment::author will allow cache to clear, but then you get to see a good example of the subresource depth not being limited:

/srv/api # bin/console debug:router | grep "GET"
  api_comments_get_collection                                       GET      ANY      ANY    /comments.{_format}                                                             
  api_comments_get_item                                             GET      ANY      ANY    /comments/{id}.{_format}                                                        
  api_comments_post_get_subresource                                 GET      ANY      ANY    /comments/{id}/post.{_format}                                                   
  api_comments_post_author_get_subresource                          GET      ANY      ANY    /comments/{id}/post/author.{_format}                                            
  api_comments_post_author_posts_get_subresource                    GET      ANY      ANY    /comments/{id}/post/author/posts.{_format}                                      
  api_comments_post_author_posts_comments_get_subresource           GET      ANY      ANY    /comments/{id}/post/author/posts/{posts}/comments.{_format}                     
  api_comments_post_author_comments_get_subresource                 GET      ANY      ANY    /comments/{id}/post/author/comments.{_format}                                   
  api_comments_post_comments_get_subresource                        GET      ANY      ANY    /comments/{id}/post/comments.{_format}                                          
  api_posts_get_collection                                          GET      ANY      ANY    /posts.{_format}                                                                
  api_posts_get_item                                                GET      ANY      ANY    /posts/{id}.{_format}                                                           
  api_posts_author_get_subresource                                  GET      ANY      ANY    /posts/{id}/author.{_format}                                                    
  api_posts_author_posts_get_subresource                            GET      ANY      ANY    /posts/{id}/author/posts.{_format}                                              
  api_posts_author_posts_comments_get_subresource                   GET      ANY      ANY    /posts/{id}/author/posts/{posts}/comments.{_format}                             
  api_posts_author_posts_comments_post_get_subresource              GET      ANY      ANY    /posts/{id}/author/posts/{posts}/comments/{comments}/post.{_format}             
  api_posts_author_comments_get_subresource                         GET      ANY      ANY    /posts/{id}/author/comments.{_format}                                           
  api_posts_author_comments_post_get_subresource                    GET      ANY      ANY    /posts/{id}/author/comments/{comments}/post.{_format}                           
  api_posts_author_comments_post_comments_get_subresource           GET      ANY      ANY    /posts/{id}/author/comments/{comments}/post/comments.{_format}                  
  api_posts_comments_get_subresource                                GET      ANY      ANY    /posts/{id}/comments.{_format}                                                  
  api_posts_comments_post_get_subresource                           GET      ANY      ANY    /posts/{id}/comments/{comments}/post.{_format}                                  
  api_posts_comments_post_author_get_subresource                    GET      ANY      ANY    /posts/{id}/comments/{comments}/post/author.{_format}                           
  api_posts_comments_post_author_posts_get_subresource              GET      ANY      ANY    /posts/{id}/comments/{comments}/post/author/posts.{_format}                     
  api_posts_comments_post_author_comments_get_subresource           GET      ANY      ANY    /posts/{id}/comments/{comments}/post/author/comments.{_format}                  
  api_authors_get_collection                                        GET      ANY      ANY    /authors.{_format}                                                              
  api_authors_get_item                                              GET      ANY      ANY    /authors/{id}.{_format}                                                         
  api_authors_posts_get_subresource                                 GET      ANY      ANY    /authors/{id}/posts.{_format}                                                   
  api_authors_posts_author_get_subresource                          GET      ANY      ANY    /authors/{id}/posts/{posts}/author.{_format}                                    
  api_authors_posts_author_comments_get_subresource                 GET      ANY      ANY    /authors/{id}/posts/{posts}/author/comments.{_format}                           
  api_authors_posts_author_comments_post_get_subresource            GET      ANY      ANY    /authors/{id}/posts/{posts}/author/comments/{comments}/post.{_format}           
  api_authors_posts_author_comments_post_comments_get_subresource   GET      ANY      ANY    /authors/{id}/posts/{posts}/author/comments/{comments}/post/comments.{_format}  
  api_authors_posts_comments_get_subresource                        GET      ANY      ANY    /authors/{id}/posts/{posts}/comments.{_format}                                  
  api_authors_posts_comments_post_get_subresource                   GET      ANY      ANY    /authors/{id}/posts/{posts}/comments/{comments}/post.{_format}                  
  api_authors_posts_comments_post_author_get_subresource            GET      ANY      ANY    /authors/{id}/posts/{posts}/comments/{comments}/post/author.{_format}           
  api_authors_posts_comments_post_author_comments_get_subresource   GET      ANY      ANY    /authors/{id}/posts/{posts}/comments/{comments}/post/author/comments.{_format}  
  api_authors_comments_get_subresource                              GET      ANY      ANY    /authors/{id}/comments.{_format}                                                
  api_authors_comments_post_get_subresource                         GET      ANY      ANY    /authors/{id}/comments/{comments}/post.{_format}                                
  api_authors_comments_post_author_get_subresource                  GET      ANY      ANY    /authors/{id}/comments/{comments}/post/author.{_format}                         
  api_authors_comments_post_author_posts_get_subresource            GET      ANY      ANY    /authors/{id}/comments/{comments}/post/author/posts.{_format}                   
  api_authors_comments_post_author_posts_comments_get_subresource   GET      ANY      ANY    /authors/{id}/comments/{comments}/post/author/posts/{posts}/comments.{_format}  
  api_authors_comments_post_comments_get_subresource                GET      ANY      ANY    /authors/{id}/comments/{comments}/post/comments.{_format}   

[rogierknoester]

Experiencing the same on 2.6.1, updated from 2.5.9.

Looks like the issue exists in the annotation.

In 2.5.9 it did not validate the maxDepth value in any way:

core/src/Annotation/ApiSubresource.php

Lines 24 to 30 in 1a81156

	final class ApiSubresource
	{
	/**
	* @var int
	*/
	public $maxDepth;
	}

However, in 2.6 it does.

core/src/Annotation/ApiSubresource.php

Lines 25 to 41 in fd8fcf4

	final class ApiSubresource
	{
	/**
	* @var int
	*/
	public $maxDepth;
	/**
	* @param int $maxDepth
	*/
	public function __construct($maxDepth = null)
	{
	if (!\is_array($maxDepth)) { // @phpstan-ignore-line
	$this->maxDepth = $maxDepth;
	}
	}
	}

When using annotations it is passed an array:

Changing the annotation's constructor to the following "fixes" it. Which is in line with Doctrine's documenation.

public function __construct($maxDepth = null)
    {
        if (!\is_array($maxDepth)) { // @phpstan-ignore-line
            $this->maxDepth = $maxDepth;
        } else {
            $this->maxDepth = $maxDepth['maxDepth'];
        }
    }

I cannot confirm if using PHP 8 attributes has the same issue, but I expect not.

[soyuka]

The issue must be somewhere in https://github.com/api-platform/core/blob/main/src/Operation/Factory/SubresourceOperationFactory.php I'll tackle this as soon as I have some free time!

[crbanman]

It does look like @rogierknoester is on to something. The other annotations in the ApiPlatform\Core\Annotation namespace use AttributesHydratorTrait and call hydrateAttributes() which appears to handle setting public attribute variables.

https://github.com/api-platform/core/blob/v2.6.1/src/Annotation/ApiProperty.php#L118...L156

[raress96]

Same issue here. Waiting for fix. I wander how this project tests the changes before releasing a new "stable" version and doesn't notice such things...I also had bugs when updating from previous version to next version .0 or .1 releases.