GraphQL association field security fixes + @ApiProperty security support by DavidBennettUK · Pull Request #4143 · api-platform/core

Inject `Security\ResourceAccessCheckerInterface` into `GraphQl\Serializer\ItemNormalizer` to be consistent with other `ItemNormalizer`s and allow `@ApiProperty` security to work with GraphQL.

DavidBennettUK

committed

Consider a GraphQL resource field to always be nullable if the `ApiProperty` security attribute is used, as this causes null to be returned if authorization fails.

DavidBennettUK

committed

Only perform security stage on top-level query collection.

DavidBennettUK

committed

Fix `ApiProperty` security not working on collections.

DavidBennettUK

committed

Add tests.

DavidBennettUK

committed

Add Behat tests.

DavidBennettUK

committed

Fix MongoDB tests.

DavidBennettUK

committed

Add more tests to cover related resources that have their own security.

DavidBennettUK

committed

Improved 403 tests to ensure the data is null.

DavidBennettUK

committed

Fix duplicated "when"s in tests.

DavidBennettUK

committed

Type hint `SecuredDummy` collections properly.

DavidBennettUK

committed

Clarify `CollectionResolverFactory` change with a comment.

DavidBennettUK

committed

Reorder `FieldsBuilder` nullable checks to put $forceNullable first, as it's the cheapest operation.

DavidBennettUK

committed

Add `CollectionResolverFactory` test to cover a field not being present in the source.

DavidBennettUK

committed

Improve tests to check for the presence of fields where "should not be null" is used, as this can pass if the field isn't present in the JSON - as technically it's not null.

DavidBennettUK

committed

Fix `ApiProperty` security having a null `object` passed to the expression during denormalization, when trying to update a resource. This meant that only simple role checks etc. could be used. Now …

DavidBennettUK

committed

Add `AbstractItemNormalizerTest` to test denormalization with a secured property.

DavidBennettUK

committed

Update CHANGELOG.

DavidBennettUK

committed

Fix `AbstractItemNormalizerTest::testDenormalizeWithSecuredProperty`.

DavidBennettUK

committed

Revert signature change of `AbstractItemNormalizer::isAllowedAttribute`.

DavidBennettUK

committed

Revert "Fix `ApiProperty` security having a null `object` passed to the expression during denormalization, when trying to update a resource. This meant that only simple role checks etc. could be us…

DavidBennettUK

committed

Revert "Fix `AbstractItemNormalizerTest::testDenormalizeWithSecuredProperty`."

DavidBennettUK

committed

Remove fixing `ApiProperty` security being bassed null object for updates from changelog.

DavidBennettUK

committed

Remove `AbstractItemNormalizerTest`.

DavidBennettUK

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

GraphQL association field security fixes + @ApiProperty security support#4143

GraphQL association field security fixes + @ApiProperty security support#4143
alanpoulain merged 24 commits into
api-platform:mainfrom
Codevate:2.6

Commits on Mar 31, 2021

Inject `Security\ResourceAccessCheckerInterface` into `GraphQl\Serializer\ItemNormalizer` to be consistent with other `ItemNormalizer`s and allow `@ApiProperty` security to work with GraphQL.

Consider a GraphQL resource field to always be nullable if the `ApiProperty` security attribute is used, as this causes null to be returned if authorization fails.

Only perform security stage on top-level query collection.

Fix `ApiProperty` security not working on collections.

Add tests.

Add Behat tests.

Fix MongoDB tests.

Add more tests to cover related resources that have their own security.

Improved 403 tests to ensure the data is null.

Fix duplicated "when"s in tests.

Type hint `SecuredDummy` collections properly.

Clarify `CollectionResolverFactory` change with a comment.

Reorder `FieldsBuilder` nullable checks to put $forceNullable first, as it's the cheapest operation.

Add `CollectionResolverFactory` test to cover a field not being present in the source.

Improve tests to check for the presence of fields where "should not be null" is used, as this can pass if the field isn't present in the JSON - as technically it's not null.

Fix `ApiProperty` security having a null `object` passed to the expression during denormalization, when trying to update a resource. This meant that only simple role checks etc. could be used. Now …

Add `AbstractItemNormalizerTest` to test denormalization with a secured property.

Update CHANGELOG.

Fix `AbstractItemNormalizerTest::testDenormalizeWithSecuredProperty`.

Revert signature change of `AbstractItemNormalizer::isAllowedAttribute`.

Revert "Fix `ApiProperty` security having a null `object` passed to the expression during denormalization, when trying to update a resource. This meant that only simple role checks etc. could be us…

Revert "Fix `AbstractItemNormalizerTest::testDenormalizeWithSecuredProperty`."

Remove fixing `ApiProperty` security being bassed null object for updates from changelog.

Remove `AbstractItemNormalizerTest`.