feat: add `security_post_denormalize` in `ApiProperty`#4184

Merged

alanpoulain merged 8 commits into

api-platform:mainfrom

DavidBennettUK:api-property-security-objects

May 6, 2021

Commits on May 6, 2021

Fix `ApiProperty` `security` unexpectedly having a class string `object` passed to the expression during denormalization when trying to update or create a resource. This meant that only simple role…

DavidBennettUK
authored and
alanpoulain
committed
Update change log with PR #.

DavidBennettUK
authored and
alanpoulain
committed
Fix `ApiPropertyTest`.

DavidBennettUK
authored and
alanpoulain
committed
Update `AbstractItemNormalizer` changes to use property accessor + metadata instead of reflection directly.

DavidBennettUK
authored and
alanpoulain
committed
Add more `AbstractItemNormalizerTest` tests for coverage.

DavidBennettUK
authored and
alanpoulain
committed
Fix `ApiPropertyTest`.

DavidBennettUK
authored and
alanpoulain
committed
Move new `ApiProperty` attribute parameter to last, to ensure no BC.

DavidBennettUK
authored and
alanpoulain
committed
Remove the additional pre-denormalize `ApiProperty` security check to reduce code complexity. `security_post_normalize` should be used if an object is required.

DavidBennettUK
authored and
alanpoulain
committed