Add validation for GraphQL mutations

features/graphql/mutation.feature

@@ -114,7 +114,6 @@ Feature: GraphQL mutation support
     And the JSON node "data.updateFoo.clientMutationId" should be equal to "myId"
 
   @createSchema
-  @dropSchema
   Scenario: Modify an item with composite identifiers through a mutation
     Given there are Composite identifier objects
     When I send the following GraphQL request:
@@ -133,3 +132,18 @@ Feature: GraphQL mutation support
     And the JSON node "data.updateCompositeRelation.id" should be equal to "/composite_relations/compositeItem=1;compositeLabel=2"
     And the JSON node "data.updateCompositeRelation.value" should be equal to "Modified value."
     And the JSON node "data.updateCompositeRelation.clientMutationId" should be equal to "myId"
+
+  @dropSchema
+  Scenario: Trigger a validation error
+    When I send the following GraphQL request:
+    """
+    mutation {
+      createDummy(input: {_id: 12, name: "", clientMutationId: "myId"}) {
+        clientMutationId
+      }
+    }
+    """
+    Then the response status code should be 400
+    And the response should be in JSON
+    And the header "Content-Type" should be equal to "application/json"
+    And the JSON node "errors[0].message" should be equal to "name: This value should not be blank."

src/Bridge/Symfony/Bundle/Resources/config/graphql.xml

@@ -25,7 +25,8 @@
             <argument type="service" id="api_platform.data_persister" />
             <argument type="service" id="serializer" />
             <argument type="service" id="api_platform.metadata.resource.metadata_factory" />
-            <argument type="service" id="api_platform.security.resource_access_checker" on-invalid="ignore" />
+            <argument type="service" id="api_platform.security.resource_access_checker" on-invalid="null" />
+            <argument type="service" id="api_platform.validator" on-invalid="null" />
         </service>
 
         <service id="api_platform.graphql.resolver.item" class="ApiPlatform\Core\GraphQl\Resolver\ItemResolver" public="false">

src/Bridge/Symfony/Bundle/Resources/config/validator.xml

@@ -5,15 +5,20 @@
            xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
 
     <services>
+        <service id="api_platform.validator" class="ApiPlatform\Core\Bridge\Symfony\Validator\Validator">
+            <argument type="service" id="validator" />
+            <argument type="service" id="service_container" />
+        </service>
+        <service id="ApiPlatform\Core\Validator\ValidatorInterface" alias="api_platform.validator" />
+
         <service id="api_platform.metadata.property.metadata_factory.validator" class="ApiPlatform\Core\Bridge\Symfony\Validator\Metadata\Property\ValidatorPropertyMetadataFactory" decorates="api_platform.metadata.property.metadata_factory" decoration-priority="20" public="false">
             <argument type="service" id="validator" />
             <argument type="service" id="api_platform.metadata.property.metadata_factory.validator.inner" />
         </service>
 
-        <service id="api_platform.listener.view.validate" class="ApiPlatform\Core\Bridge\Symfony\Validator\EventListener\ValidateListener">
-            <argument type="service" id="validator" />
+        <service id="api_platform.listener.view.validate" class="ApiPlatform\Core\Validator\EventListener\ValidateListener">
+            <argument type="service" id="api_platform.validator" />
             <argument type="service" id="api_platform.metadata.resource.metadata_factory" />
-            <argument type="service" id="service_container" />
 
             <tag name="kernel.event_listener" event="kernel.view" method="onKernelView" priority="64" />
         </service>

src/Bridge/Symfony/Validator/EventListener/ValidateListener.php

@@ -16,6 +16,7 @@
 use ApiPlatform\Core\Bridge\Symfony\Validator\Exception\ValidationException;
 use ApiPlatform\Core\Metadata\Resource\Factory\ResourceMetadataFactoryInterface;
 use ApiPlatform\Core\Util\RequestAttributesExtractor;
+use ApiPlatform\Core\Validator\EventListener\ValidateListener as MainValidateListener;
 use Psr\Container\ContainerInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Event\GetResponseForControllerResultEvent;
@@ -24,6 +25,8 @@
 /**
  * Validates data.
  *
+ * @deprecated
+ *
  * @author Kévin Dunglas <dunglas@gmail.com>
  */
 final class ValidateListener
@@ -34,6 +37,8 @@ final class ValidateListener
 
     public function __construct(ValidatorInterface $validator, ResourceMetadataFactoryInterface $resourceMetadataFactory, ContainerInterface $container = null)
     {
+        @trigger_error(sprintf('Using "%s" is deprecated since API Platform 2.2 and will not be possible anymore in API Platform 3. Use "%s" instead.', __CLASS__, MainValidateListener::class), E_USER_DEPRECATED);
+
         $this->validator = $validator;
         $this->resourceMetadataFactory = $resourceMetadataFactory;
         $this->container = $container;

src/Bridge/Symfony/Validator/Exception/ValidationException.php

@@ -13,22 +13,23 @@
 
 namespace ApiPlatform\Core\Bridge\Symfony\Validator\Exception;
 
+use ApiPlatform\Core\Validator\Exception\ValidationException as BaseValidationException;
 use Symfony\Component\Validator\ConstraintViolationListInterface;
 
 /**
  * Thrown when a validation error occurs.
  *
  * @author Kévin Dunglas <dunglas@gmail.com>
  */
-final class ValidationException extends \RuntimeException
+final class ValidationException extends BaseValidationException
 {
     private $constraintViolationList;
 
-    public function __construct(ConstraintViolationListInterface $constraintViolationList, $message = '', $code = 0, \Exception $previous = null)
+    public function __construct(ConstraintViolationListInterface $constraintViolationList, string $message = '', int $code = 0, \Exception $previous = null)
     {
-        parent::__construct($message, $code, $previous);
-
         $this->constraintViolationList = $constraintViolationList;
+
+        parent::__construct($message ?: $this->__toString(), $code, $previous);
     }
 
     /**
@@ -40,4 +41,21 @@ public function getConstraintViolationList()
     {
         return $this->constraintViolationList;
     }
+
+    public function __toString(): string
+    {
+        $message = '';
+        foreach ($this->constraintViolationList as $violation) {
+            if ('' !== $message) {
+                $message .= "\n";
+            }
+            if ($propertyPath = $violation->getPropertyPath()) {
+                $message .= "$propertyPath: ";
+            }
+
+            $message .= $violation->getMessage();
+        }
+
+        return $message;
+    }
 }

src/Bridge/Symfony/Validator/Validator.php

@@ -0,0 +1,63 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Core\Bridge\Symfony\Validator;
+
+use ApiPlatform\Core\Bridge\Symfony\Validator\Exception\ValidationException;
+use ApiPlatform\Core\Validator\ValidatorInterface;
+use Psr\Container\ContainerInterface;
+use Symfony\Component\Validator\Validator\ValidatorInterface as SymfonyValidatorInterface;
+
+/**
+ * Validates an item using the Symfony validator component.
+ *
+ * @author Kévin Dunglas <dunglas@gmail.com>
+ */
+class Validator implements ValidatorInterface
+{
+    private $validator;
+    private $container;
+
+    public function __construct(SymfonyValidatorInterface $validator, ContainerInterface $container = null)
+    {
+        $this->validator = $validator;
+        $this->container = $container;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function validate($data, array $context = [])
+    {
+        if (null !== $validationGroups = $context['groups'] ?? null) {
+            if (
+                $this->container &&
+                \is_string($validationGroups) &&
+                $this->container->has($validationGroups) &&
+                ($service = $this->container->get($validationGroups)) &&
+                \is_callable($service)
+            ) {
+                $validationGroups = $service($data);
+            } elseif (\is_callable($validationGroups)) {
+                $validationGroups = $validationGroups($data);
+            }
+
+            $validationGroups = (array) $validationGroups;
+        }
+
+        $violations = $this->validator->validate($data, null, $validationGroups);
+        if (0 !== \count($violations)) {
+            throw new ValidationException($violations);
+        }
+    }
+}

src/GraphQl/Resolver/Factory/ItemMutationResolverFactory.php

@@ -20,7 +20,10 @@
 use ApiPlatform\Core\GraphQl\Resolver\ResourceAccessCheckerTrait;
 use ApiPlatform\Core\GraphQl\Serializer\ItemNormalizer;
 use ApiPlatform\Core\Metadata\Resource\Factory\ResourceMetadataFactoryInterface;
+use ApiPlatform\Core\Metadata\Resource\ResourceMetadata;
 use ApiPlatform\Core\Security\ResourceAccessCheckerInterface;
+use ApiPlatform\Core\Validator\Exception\ValidationException;
+use ApiPlatform\Core\Validator\ValidatorInterface;
 use GraphQL\Error\Error;
 use GraphQL\Type\Definition\ResolveInfo;
 use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
@@ -42,8 +45,9 @@ final class ItemMutationResolverFactory implements ResolverFactoryInterface
     private $normalizer;
     private $resourceMetadataFactory;
     private $resourceAccessChecker;
+    private $validator;
 
-    public function __construct(IriConverterInterface $iriConverter, DataPersisterInterface $dataPersister, NormalizerInterface $normalizer, ResourceMetadataFactoryInterface $resourceMetadataFactory, ResourceAccessCheckerInterface $resourceAccessChecker = null)
+    public function __construct(IriConverterInterface $iriConverter, DataPersisterInterface $dataPersister, NormalizerInterface $normalizer, ResourceMetadataFactoryInterface $resourceMetadataFactory, ResourceAccessCheckerInterface $resourceAccessChecker = null, ValidatorInterface $validator = null)
     {
         if (!$normalizer instanceof DenormalizerInterface) {
             throw new InvalidArgumentException(sprintf('The normalizer must implements the "%s" interface', DenormalizerInterface::class));
@@ -54,6 +58,7 @@ public function __construct(IriConverterInterface $iriConverter, DataPersisterIn
         $this->normalizer = $normalizer;
         $this->resourceMetadataFactory = $resourceMetadataFactory;
         $this->resourceAccessChecker = $resourceAccessChecker;
+        $this->validator = $validator;
     }
 
     public function __invoke(string $resourceClass = null, string $rootClass = null, string $operationName = null): callable
@@ -78,6 +83,7 @@ public function __invoke(string $resourceClass = null, string $rootClass = null,
                 case 'update':
                     $context = null === $item ? ['resource_class' => $resourceClass] : ['resource_class' => $resourceClass, 'object_to_populate' => $item];
                     $item = $this->normalizer->denormalize($args['input'], $resourceClass, ItemNormalizer::FORMAT, $context);
+                    $this->validate($item, $info, $resourceMetadata, $operationName);
                     $this->dataPersister->persist($item);
 
                     return $this->normalizer->normalize(
@@ -98,4 +104,24 @@ public function __invoke(string $resourceClass = null, string $rootClass = null,
             return $data;
         };
     }
+
+    /**
+     * @param object $item
+     *
+     * @throws Error
+     */
+    private function validate($item, ResolveInfo $info, ResourceMetadata $resourceMetadata, string $operationName = null)
+    {
+        if (null === $this->validator) {
+            return;
+        }
+
+        $validationGroups = $resourceMetadata->getGraphqlAttribute($operationName, 'validation_groups', null, true);
+
+        try {
+            $this->validator->validate($item, ['groups' => $validationGroups]);
+        } catch (ValidationException $e) {
+            throw Error::createLocatedError($e->getMessage(), $info->fieldNodes, $info->path);
+        }
+    }
 }

src/Serializer/AbstractConstraintViolationListNormalizer.php

@@ -57,10 +57,7 @@ protected function getMessagesAndViolations(ConstraintViolationListInterface $co
             }
 
             $violations[] = $violationData;
-
-            $propertyPath = $violation->getPropertyPath();
-            $prefix = $propertyPath ? sprintf('%s: ', $propertyPath) : '';
-            $messages[] = "$prefix{$violation->getMessage()}";
+            $messages[] = ($violationData['propertyPath'] ? "{$violationData['propertyPath']}: " : '').$violationData['message'];
         }
 
         return [$messages, $violations];

src/Validator/EventListener/ValidateListener.php

@@ -0,0 +1,67 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Core\Validator\EventListener;
+
+use ApiPlatform\Core\Bridge\Symfony\Validator\Exception\ValidationException;
+use ApiPlatform\Core\Metadata\Resource\Factory\ResourceMetadataFactoryInterface;
+use ApiPlatform\Core\Util\RequestAttributesExtractor;
+use ApiPlatform\Core\Validator\ValidatorInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\GetResponseForControllerResultEvent;
+
+/**
+ * Validates data.
+ *
+ * @author Kévin Dunglas <dunglas@gmail.com>
+ */
+final class ValidateListener
+{
+    private $validator;
+    private $resourceMetadataFactory;
+
+    public function __construct(ValidatorInterface $validator, ResourceMetadataFactoryInterface $resourceMetadataFactory)
+    {
+        $this->validator = $validator;
+        $this->resourceMetadataFactory = $resourceMetadataFactory;
+    }
+
+    /**
+     * Validates data returned by the controller if applicable.
+     *
+     * @throws ValidationException
+     */
+    public function onKernelView(GetResponseForControllerResultEvent $event)
+    {
+        $request = $event->getRequest();
+        if (
+            $request->isMethodSafe(false)
+            || $request->isMethod(Request::METHOD_DELETE)
+            || !($attributes = RequestAttributesExtractor::extractAttributes($request))
+            || !$attributes['receive']
+        ) {
+            return;
+        }
+
+        $data = $event->getControllerResult();
+        $resourceMetadata = $this->resourceMetadataFactory->create($attributes['resource_class']);
+
+        if (isset($attributes['collection_operation_name'])) {
+            $validationGroups = $resourceMetadata->getCollectionOperationAttribute($attributes['collection_operation_name'], 'validation_groups', null, true);
+        } else {
+            $validationGroups = $resourceMetadata->getItemOperationAttribute($attributes['item_operation_name'], 'validation_groups', null, true);
+        }
+
+        $this->validator->validate($data, ['groups' => $validationGroups]);
+    }
+}

src/Validator/Exception/ValidationException.php

@@ -0,0 +1,25 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Core\Validator\Exception;
+
+use ApiPlatform\Core\Exception\RuntimeException;
+
+/**
+ * Thrown when a validation error occurs.
+ *
+ * @author Kévin Dunglas <dunglas@gmail.com>
+ */
+class ValidationException extends RuntimeException
+{
+}