• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

api-platform / core / 15779525458

20 Jun 2025 01:00PM UTC coverage: 22.024% (-0.04%) from 22.065%
15779525458

push

github

web-flow
feat(serializer): ability to throw access denied exception when denormalizing secured properties (#7221)

Co-authored-by: Antoine Bluchet <soyuka@users.noreply.github.com>

6 of 126 new or added lines in 3 files covered. (4.76%)

125 existing lines in 11 files now uncovered.

11493 of 52185 relevant lines covered (22.02%)

21.67 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
/src/Serializer/Tests/ItemNormalizerTest.php
1
<?php
2

3
/*
4
 * This file is part of the API Platform project.
5
 *
6
 * (c) Kévin Dunglas <dunglas@gmail.com>
7
 *
8
 * For the full copyright and license information, please view the LICENSE
9
 * file that was distributed with this source code.
10
 */
11

12
declare(strict_types=1);
13

14
namespace ApiPlatform\Serializer\Tests;
15

16
use ApiPlatform\Metadata\ApiProperty;
17
use ApiPlatform\Metadata\ApiResource;
18
use ApiPlatform\Metadata\Exception\InvalidArgumentException;
19
use ApiPlatform\Metadata\Get;
20
use ApiPlatform\Metadata\IriConverterInterface;
21
use ApiPlatform\Metadata\Link;
22
use ApiPlatform\Metadata\Property\Factory\PropertyMetadataFactoryInterface;
23
use ApiPlatform\Metadata\Property\Factory\PropertyNameCollectionFactoryInterface;
24
use ApiPlatform\Metadata\Property\PropertyNameCollection;
25
use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
26
use ApiPlatform\Metadata\Resource\ResourceMetadataCollection;
27
use ApiPlatform\Metadata\ResourceClassResolverInterface;
28
use ApiPlatform\Metadata\UrlGeneratorInterface;
29
use ApiPlatform\Serializer\ItemNormalizer;
30
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\Dummy;
31
use PHPUnit\Framework\TestCase;
32
use Prophecy\Argument;
33
use Prophecy\PhpUnit\ProphecyTrait;
34
use Symfony\Component\Serializer\Exception\NotNormalizableValueException;
35
use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
36
use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
37
use Symfony\Component\Serializer\SerializerInterface;
38

39
/**
40
 * @author Kévin Dunglas <dunglas@gmail.com>
41
 */
42
class ItemNormalizerTest extends TestCase
43
{
44
    use ProphecyTrait;
45

46
    public function testSupportNormalization(): void
47
    {
48
        $std = new \stdClass();
×
49
        $dummy = new Dummy();
×
50
        $dummy->setDescription('hello');
×
51

52
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
53
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
54
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
55

56
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
57
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
58
        $resourceClassResolverProphecy->isResourceClass(\stdClass::class)->willReturn(false);
×
59

60
        $normalizer = new ItemNormalizer(
×
61
            $propertyNameCollectionFactoryProphecy->reveal(),
×
62
            $propertyMetadataFactoryProphecy->reveal(),
×
63
            $iriConverterProphecy->reveal(),
×
64
            $resourceClassResolverProphecy->reveal()
×
65
        );
×
66

67
        $this->assertTrue($normalizer->supportsNormalization($dummy));
×
68
        $this->assertTrue($normalizer->supportsNormalization($dummy));
×
69
        $this->assertFalse($normalizer->supportsNormalization($std));
×
70

71
        $this->assertTrue($normalizer->supportsDenormalization($dummy, Dummy::class));
×
72
        $this->assertTrue($normalizer->supportsDenormalization($dummy, Dummy::class));
×
73
        $this->assertFalse($normalizer->supportsDenormalization($std, \stdClass::class));
×
74
        $this->assertSame(['object' => true], $normalizer->getSupportedTypes('any'));
×
75
    }
76

77
    public function testNormalize(): void
78
    {
79
        $dummy = new Dummy();
×
80
        $dummy->setName('hello');
×
81

82
        $propertyNameCollection = new PropertyNameCollection(['name']);
×
83
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
84
        $propertyNameCollectionFactoryProphecy->create(Dummy::class, [])->willReturn($propertyNameCollection);
×
85

86
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
87
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
88

89
        $propertyMetadata = (new ApiProperty())->withReadable(true);
×
90
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
91
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'name', [])->willReturn($propertyMetadata);
×
92

93
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
94
        $iriConverterProphecy->getIriFromResource($dummy, Argument::cetera())->willReturn('/dummies/1');
×
95

96
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
97
        $resourceClassResolverProphecy->getResourceClass($dummy, null)->willReturn(Dummy::class);
×
98
        $resourceClassResolverProphecy->getResourceClass(null, Dummy::class)->willReturn(Dummy::class);
×
99
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
100

101
        $serializerProphecy = $this->prophesize(SerializerInterface::class);
×
102
        $serializerProphecy->willImplement(NormalizerInterface::class);
×
103
        $serializerProphecy->normalize('hello', null, Argument::type('array'))->willReturn('hello');
×
104

105
        $normalizer = new ItemNormalizer(
×
106
            $propertyNameCollectionFactoryProphecy->reveal(),
×
107
            $propertyMetadataFactoryProphecy->reveal(),
×
108
            $iriConverterProphecy->reveal(),
×
109
            $resourceClassResolverProphecy->reveal()
×
110
        );
×
111
        $normalizer->setSerializer($serializerProphecy->reveal());
×
112

113
        $this->assertEquals(['name' => 'hello'], $normalizer->normalize($dummy, null, ['resources' => []]));
×
114
    }
115

116
    public function testDenormalize(): void
117
    {
118
        $context = ['resource_class' => Dummy::class, 'api_allow_update' => true];
×
119

120
        $propertyNameCollection = new PropertyNameCollection(['name']);
×
121
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
122
        $propertyNameCollectionFactoryProphecy->create(Dummy::class, [])->willReturn($propertyNameCollection)->shouldBeCalled();
×
123

124
        $propertyMetadata = (new ApiProperty())->withReadable(true)->withWritable(true);
×
125
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
126
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'name', [])->willReturn($propertyMetadata)->shouldBeCalled();
×
127

128
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
129

130
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
131
        $resourceClassResolverProphecy->getResourceClass(null, Dummy::class)->willReturn(Dummy::class);
×
132
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
133

134
        $serializerProphecy = $this->prophesize(SerializerInterface::class);
×
135
        $serializerProphecy->willImplement(DenormalizerInterface::class);
×
136
        $normalizer = new ItemNormalizer(
×
137
            $propertyNameCollectionFactoryProphecy->reveal(),
×
138
            $propertyMetadataFactoryProphecy->reveal(),
×
139
            $iriConverterProphecy->reveal(),
×
140
            $resourceClassResolverProphecy->reveal()
×
141
        );
×
142
        $normalizer->setSerializer($serializerProphecy->reveal());
×
143

144
        $this->assertInstanceOf(Dummy::class, $normalizer->denormalize(['name' => 'hello'], Dummy::class, null, $context));
×
145
    }
146

147
    public function testDenormalizeWithIri(): void
148
    {
149
        $context = ['resource_class' => Dummy::class, 'api_allow_update' => true];
×
150

151
        $propertyNameCollection = new PropertyNameCollection(['id', 'name']);
×
152
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
153
        $propertyNameCollectionFactoryProphecy->create(Dummy::class, [])->willReturn($propertyNameCollection)->shouldBeCalled();
×
154

155
        $propertyMetadata = (new ApiProperty())->withReadable(true)->withWritable(true);
×
156
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
157
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'id', [])->willReturn($propertyMetadata)->shouldBeCalled();
×
158
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'name', [])->willReturn($propertyMetadata)->shouldBeCalled();
×
159

160
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
161
        $iriConverterProphecy->getResourceFromIri('/dummies/12', ['resource_class' => Dummy::class, 'api_allow_update' => true, 'fetch_data' => true])->shouldBeCalled();
×
162

163
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
164
        $resourceClassResolverProphecy->getResourceClass(null, Dummy::class)->willReturn(Dummy::class);
×
165
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
166

167
        $serializerProphecy = $this->prophesize(SerializerInterface::class);
×
168
        $serializerProphecy->willImplement(DenormalizerInterface::class);
×
169

170
        $normalizer = new ItemNormalizer(
×
171
            $propertyNameCollectionFactoryProphecy->reveal(),
×
172
            $propertyMetadataFactoryProphecy->reveal(),
×
173
            $iriConverterProphecy->reveal(),
×
174
            $resourceClassResolverProphecy->reveal()
×
175
        );
×
176
        $normalizer->setSerializer($serializerProphecy->reveal());
×
177

178
        $this->assertInstanceOf(Dummy::class, $normalizer->denormalize(['id' => '/dummies/12', 'name' => 'hello'], Dummy::class, null, $context));
×
179
    }
180

181
    public function testDenormalizeWithIdAndUpdateNotAllowed(): void
182
    {
183
        $this->expectException(NotNormalizableValueException::class);
×
184
        $this->expectExceptionMessage('Update is not allowed for this operation.');
×
185

186
        $context = ['resource_class' => Dummy::class, 'api_allow_update' => false];
×
187

188
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
189

190
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
191

192
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
193

194
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
195

196
        $serializerProphecy = $this->prophesize(SerializerInterface::class);
×
197
        $serializerProphecy->willImplement(DenormalizerInterface::class);
×
198

199
        $normalizer = new ItemNormalizer(
×
200
            $propertyNameCollectionFactoryProphecy->reveal(),
×
201
            $propertyMetadataFactoryProphecy->reveal(),
×
202
            $iriConverterProphecy->reveal(),
×
203
            $resourceClassResolverProphecy->reveal()
×
204
        );
×
205
        $normalizer->setSerializer($serializerProphecy->reveal());
×
206
        $normalizer->denormalize(['id' => '12', 'name' => 'hello'], Dummy::class, null, $context);
×
207
    }
208

209
    public function testDenormalizeWithDefinedIri(): void
210
    {
211
        $dummy = new Dummy();
×
212
        $dummy->setName('hello');
×
213

214
        $propertyNameCollection = new PropertyNameCollection(['name']);
×
215
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
216
        $propertyNameCollectionFactoryProphecy->create(Dummy::class, [])->willReturn($propertyNameCollection);
×
217

218
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
219
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
220

221
        $propertyMetadata = (new ApiProperty())->withReadable(true);
×
222
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
223
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'name', [])->willReturn($propertyMetadata);
×
224

225
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
226
        $iriConverterProphecy->getIriFromResource($dummy)->shouldNotBeCalled();
×
227

228
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
229
        $resourceClassResolverProphecy->getResourceClass($dummy, null)->willReturn(Dummy::class);
×
230
        $resourceClassResolverProphecy->getResourceClass(null, Dummy::class)->willReturn(Dummy::class);
×
231
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
232

233
        $serializerProphecy = $this->prophesize(SerializerInterface::class);
×
234
        $serializerProphecy->willImplement(NormalizerInterface::class);
×
235
        $serializerProphecy->normalize('hello', null, Argument::type('array'))->willReturn('hello');
×
236

237
        $normalizer = new ItemNormalizer(
×
238
            $propertyNameCollectionFactoryProphecy->reveal(),
×
239
            $propertyMetadataFactoryProphecy->reveal(),
×
240
            $iriConverterProphecy->reveal(),
×
241
            $resourceClassResolverProphecy->reveal()
×
242
        );
×
243
        $normalizer->setSerializer($serializerProphecy->reveal());
×
244

245
        $this->assertEquals(['name' => 'hello'], $normalizer->normalize($dummy, null, ['resources' => [], 'iri' => '/custom']));
×
246
    }
247

248
    public function testDenormalizeWithIdAndNoResourceClass(): void
249
    {
250
        $context = [];
×
251

252
        $propertyNameCollection = new PropertyNameCollection(['id', 'name']);
×
253
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
254
        $propertyNameCollectionFactoryProphecy->create(Dummy::class, [])->willReturn($propertyNameCollection)->shouldBeCalled();
×
255

256
        $propertyMetadata = (new ApiProperty())->withReadable(true)->withWritable(true);
×
257
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
258
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'id', [])->willReturn($propertyMetadata)->shouldBeCalled();
×
259
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'name', [])->willReturn($propertyMetadata)->shouldBeCalled();
×
260

261
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
262

263
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
264
        $resourceClassResolverProphecy->getResourceClass(null, Dummy::class)->willReturn(Dummy::class);
×
265
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
266

267
        $serializerProphecy = $this->prophesize(SerializerInterface::class);
×
268
        $serializerProphecy->willImplement(DenormalizerInterface::class);
×
269

270
        $normalizer = new ItemNormalizer(
×
271
            $propertyNameCollectionFactoryProphecy->reveal(),
×
272
            $propertyMetadataFactoryProphecy->reveal(),
×
273
            $iriConverterProphecy->reveal(),
×
274
            $resourceClassResolverProphecy->reveal()
×
275
        );
×
276
        $normalizer->setSerializer($serializerProphecy->reveal());
×
277

278
        $object = $normalizer->denormalize(['id' => '42', 'name' => 'hello'], Dummy::class, null, $context);
×
279
        $this->assertInstanceOf(Dummy::class, $object);
×
280
        $this->assertSame('42', $object->getId());
×
281
        $this->assertSame('hello', $object->getName());
×
282
    }
283

284
    public function testDenormalizeWithWrongIdAndNoResourceMetadataFactory(): void
285
    {
286
        $this->expectException(InvalidArgumentException::class);
×
287
        $context = ['resource_class' => Dummy::class, 'api_allow_update' => true];
×
288

289
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
290

291
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
292

293
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
294
        $iriConverterProphecy->getResourceFromIri('fail', $context + ['fetch_data' => true])->willThrow(new InvalidArgumentException());
×
295

296
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
297
        $resourceClassResolverProphecy->getResourceClass(null, Dummy::class)->willReturn(Dummy::class);
×
298
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
299

300
        $serializerProphecy = $this->prophesize(SerializerInterface::class);
×
301
        $serializerProphecy->willImplement(DenormalizerInterface::class);
×
302
        $normalizer = new ItemNormalizer(
×
303
            $propertyNameCollectionFactoryProphecy->reveal(),
×
304
            $propertyMetadataFactoryProphecy->reveal(),
×
305
            $iriConverterProphecy->reveal(),
×
306
            $resourceClassResolverProphecy->reveal()
×
307
        );
×
308
        $normalizer->setSerializer($serializerProphecy->reveal());
×
309

310
        $this->assertInstanceOf(Dummy::class, $normalizer->denormalize(['name' => 'hello', 'id' => 'fail'], Dummy::class, null, $context));
×
311
    }
312

313
    public function testDenormalizeWithWrongId(): void
314
    {
315
        $context = ['resource_class' => Dummy::class, 'api_allow_update' => true];
×
316
        $operation = new Get(uriVariables: ['id' => new Link(identifiers: ['id'], parameterName: 'id')]);
×
317
        $obj = new Dummy();
×
318

319
        $propertyNameCollection = new PropertyNameCollection(['name']);
×
320
        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
×
321
        $propertyNameCollectionFactoryProphecy->create(Dummy::class, [])->willReturn($propertyNameCollection)->shouldBeCalled();
×
322

323
        $propertyMetadata = (new ApiProperty())->withReadable(true)->withWritable(true);
×
324
        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
×
325
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'name', [])->willReturn($propertyMetadata)->shouldBeCalled();
×
NEW
326
        $propertyMetadataFactoryProphecy->create(Dummy::class, 'id', [])->willReturn($propertyMetadata)->shouldBeCalled();
×
327

328
        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
×
329
        $iriConverterProphecy->getResourceFromIri('fail', $context + ['fetch_data' => true])->willThrow(new InvalidArgumentException());
×
330
        $iriConverterProphecy->getIriFromResource(Dummy::class, UrlGeneratorInterface::ABS_PATH, $operation, ['uri_variables' => ['id' => 'fail']])->willReturn('/dummies/fail');
×
331
        $iriConverterProphecy->getResourceFromIri('/dummies/fail', $context + ['fetch_data' => true])->willReturn($obj);
×
332

333
        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
×
334
        $resourceClassResolverProphecy->getResourceClass(null, Dummy::class)->willReturn(Dummy::class);
×
335
        $resourceClassResolverProphecy->getResourceClass($obj, Dummy::class)->willReturn(Dummy::class);
×
336
        $resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
×
337

338
        $resourceMetadataCollectionFactory = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
×
339
        $resourceMetadataCollectionFactory->create(Dummy::class)->willReturn(new ResourceMetadataCollection(Dummy::class, [
×
340
            new ApiResource(operations: [$operation]),
×
341
        ]));
×
342

343
        $serializerProphecy = $this->prophesize(SerializerInterface::class);
×
344
        $serializerProphecy->willImplement(DenormalizerInterface::class);
×
345
        $normalizer = new ItemNormalizer(
×
346
            $propertyNameCollectionFactoryProphecy->reveal(),
×
347
            $propertyMetadataFactoryProphecy->reveal(),
×
348
            $iriConverterProphecy->reveal(),
×
349
            $resourceClassResolverProphecy->reveal(),
×
350
            null,
×
351
            null,
×
352
            null,
×
353
            null,
×
354
            $resourceMetadataCollectionFactory->reveal()
×
355
        );
×
356
        $normalizer->setSerializer($serializerProphecy->reveal());
×
357

358
        $this->assertInstanceOf(Dummy::class, $normalizer->denormalize(['name' => 'hello', 'id' => 'fail'], Dummy::class, null, $context));
×
359
    }
360
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2025 Coveralls, Inc