feat(symfony): isGranted before provider

soyuka · soyuka · commit db77ad4b68ac · 2025-10-31T15:48:52.000+01:00
diff --git a/src/Metadata/ApiResource.php b/src/Metadata/ApiResource.php
@@ -16,6 +16,7 @@
 use ApiPlatform\Metadata\GraphQl\Operation as GraphQlOperation;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 /**
  * Resource metadata attribute.
@@ -949,7 +950,7 @@ public function __construct(
          * </div>
          */
         protected ?string $paginationType = null,
-        protected string|\Stringable|null $security = null,
+        protected string|\Stringable|IsGranted|array|null $security = null,
         protected ?string $securityMessage = null,
         protected string|\Stringable|null $securityPostDenormalize = null,
         protected ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/Delete.php b/src/Metadata/Delete.php
@@ -16,6 +16,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class Delete extends HttpOperation implements DeleteOperationInterface
@@ -67,7 +68,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/Error.php b/src/Metadata/Error.php
@@ -16,6 +16,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class Error extends HttpOperation
@@ -67,7 +68,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/ErrorResource.php b/src/Metadata/ErrorResource.php
@@ -15,6 +15,7 @@
 
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 class ErrorResource extends ApiResource
@@ -70,7 +71,7 @@ public function __construct(
         ?int $paginationMaximumItemsPerPage = null,
         ?bool $paginationPartial = null,
         ?string $paginationType = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/Get.php b/src/Metadata/Get.php
@@ -16,6 +16,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class Get extends HttpOperation
@@ -67,7 +68,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/GetCollection.php b/src/Metadata/GetCollection.php
@@ -16,6 +16,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class GetCollection extends HttpOperation implements CollectionOperationInterface
@@ -67,7 +68,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/GraphQl/Operation.php b/src/Metadata/GraphQl/Operation.php
@@ -17,6 +17,7 @@
 use ApiPlatform\Metadata\Operation as AbstractOperation;
 use ApiPlatform\Metadata\Parameters;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 class Operation extends AbstractOperation
 {
@@ -61,7 +62,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/GraphQl/Query.php b/src/Metadata/GraphQl/Query.php
@@ -15,6 +15,7 @@
 
 use ApiPlatform\Metadata\Parameters;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 class Query extends Operation
@@ -44,7 +45,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/GraphQl/QueryCollection.php b/src/Metadata/GraphQl/QueryCollection.php
@@ -16,6 +16,7 @@
 use ApiPlatform\Metadata\CollectionOperationInterface;
 use ApiPlatform\Metadata\Parameters;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class QueryCollection extends Query implements CollectionOperationInterface
@@ -45,7 +46,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/GraphQl/Subscription.php b/src/Metadata/GraphQl/Subscription.php
@@ -15,6 +15,7 @@
 
 use ApiPlatform\Metadata\Parameters;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class Subscription extends Operation
@@ -44,7 +45,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/HttpOperation.php b/src/Metadata/HttpOperation.php
@@ -17,6 +17,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\WebLink\Link as WebLink;
 
 class HttpOperation extends Operation
@@ -188,7 +189,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/Metadata.php b/src/Metadata/Metadata.php
@@ -14,6 +14,7 @@
 namespace ApiPlatform\Metadata;
 
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 /**
  * @psalm-inheritors ApiResource|Operation
@@ -64,7 +65,7 @@ public function __construct(
         protected ?bool $paginationClientPartial = null,
         protected ?bool $paginationFetchJoinCollection = null,
         protected ?bool $paginationUseOutputWalkers = null,
-        protected string|\Stringable|null $security = null,
+        protected string|\Stringable|IsGranted|array|null $security = null,
         protected ?string $securityMessage = null,
         protected string|\Stringable|null $securityPostDenormalize = null,
         protected ?string $securityPostDenormalizeMessage = null,
@@ -453,12 +454,12 @@ public function withPaginationUseOutputWalkers(bool $paginationUseOutputWalkers)
         return $self;
     }
 
-    public function getSecurity(): ?string
+    public function getSecurity(): string|\Stringable|IsGranted|array|null
     {
-        return $this->security instanceof \Stringable ? (string) $this->security : $this->security;
+        return $this->security;
     }
 
-    public function withSecurity(string|\Stringable|null $security = null): static
+    public function withSecurity(string|\Stringable|IsGranted|array|null $security = null): static
     {
         $self = clone $this;
         $self->security = $security;
diff --git a/src/Metadata/NotExposed.php b/src/Metadata/NotExposed.php
@@ -16,6 +16,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 /**
  * A NotExposed operation is an operation declared for internal usage,
@@ -80,7 +81,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/Operation.php b/src/Metadata/Operation.php
@@ -14,6 +14,7 @@
 namespace ApiPlatform\Metadata;
 
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 /**
  * ⚠ This class and its children offer no backward compatibility regarding positional parameters.
@@ -612,7 +613,7 @@ public function __construct(
         protected ?array $normalizationContext = null,
         protected ?array $denormalizationContext = null,
         protected ?bool $collectDenormalizationErrors = null,
-        protected string|\Stringable|null $security = null,
+        protected string|\Stringable|IsGranted|array|null $security = null,
         protected ?string $securityMessage = null,
         protected string|\Stringable|null $securityPostDenormalize = null,
         protected ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/Patch.php b/src/Metadata/Patch.php
@@ -16,6 +16,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class Patch extends HttpOperation
@@ -67,11 +68,11 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
-        string|\Stringable|null $securityPostDenormalize = null,
+        string|\Stringable|IsGranted|array|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
-        string|\Stringable|null $securityPostValidation = null,
+        string|\Stringable|IsGranted|array|null $securityPostValidation = null,
         ?string $securityPostValidationMessage = null,
         ?string $deprecationReason = null,
         ?array $filters = null,
diff --git a/src/Metadata/Post.php b/src/Metadata/Post.php
@@ -16,6 +16,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class Post extends HttpOperation
@@ -67,7 +68,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Metadata/Put.php b/src/Metadata/Put.php
@@ -16,6 +16,7 @@
 use ApiPlatform\OpenApi\Attributes\Webhook;
 use ApiPlatform\OpenApi\Model\Operation as OpenApiOperation;
 use ApiPlatform\State\OptionsInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 #[\Attribute(\Attribute::TARGET_CLASS | \Attribute::IS_REPEATABLE)]
 final class Put extends HttpOperation
@@ -67,7 +68,7 @@ public function __construct(
         ?array $normalizationContext = null,
         ?array $denormalizationContext = null,
         ?bool $collectDenormalizationErrors = null,
-        string|\Stringable|null $security = null,
+        string|\Stringable|IsGranted|array|null $security = null,
         ?string $securityMessage = null,
         string|\Stringable|null $securityPostDenormalize = null,
         ?string $securityPostDenormalizeMessage = null,
diff --git a/src/Symfony/Bundle/Resources/config/state/security.php b/src/Symfony/Bundle/Resources/config/state/security.php
@@ -37,4 +37,11 @@
             service('api_platform.state_provider.security_parameter.inner'),
             service('api_platform.security.resource_access_checker'),
         ]);
+
+    $services->set('api_platform.state_provider.is_granted_access_checker', 'ApiPlatform\Symfony\Security\State\IsGrantedAccessCheckerProvider')
+        ->decorate('api_platform.state_provider.read', null, 0)
+        ->args([
+            service('api_platform.state_provider.is_granted_access_checker.inner'),
+            service('security.authorization_checker')->ignoreOnInvalid(),
+        ]);
 };
diff --git a/src/Symfony/Security/State/AccessCheckerProvider.php b/src/Symfony/Security/State/AccessCheckerProvider.php
@@ -22,6 +22,7 @@
 use ApiPlatform\State\ProviderInterface;
 use ApiPlatform\Symfony\Security\Exception\AccessDeniedException;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 /**
  * Allows access based on the ApiPlatform\Metadata\ResourceAccessCheckerInterface.
@@ -69,23 +70,33 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
             return $body;
         }
 
-        if ($operation instanceof HttpOperation) {
-            $request = $context['request'] ?? null;
-
-            $resourceAccessCheckerContext = [
-                'object' => $body,
-                'previous_object' => $request?->attributes->get('previous_data'),
-                'request' => $request,
-            ];
-        } else {
-            $resourceAccessCheckerContext = [
-                'object' => $body,
-                'previous_object' => $context['graphql_context']['previous_object'] ?? null,
-            ];
+        if (!\is_array($isGranted)) {
+            $isGranted = [$isGranted];
         }
 
-        if (!$this->resourceAccessChecker->isGranted($operation->getClass(), $isGranted, $resourceAccessCheckerContext)) {
-            $operation instanceof GraphQlOperation ? throw new AccessDeniedHttpException($message ?? 'Access Denied.') : throw new AccessDeniedException($message ?? 'Access Denied.');
+        foreach ($isGranted as $attribute) {
+            if ($attribute instanceof IsGranted) {
+                continue;
+            }
+
+            if ($operation instanceof HttpOperation) {
+                $request = $context['request'] ?? null;
+
+                $resourceAccessCheckerContext = [
+                    'object' => $body,
+                    'previous_object' => $request?->attributes->get('previous_data'),
+                    'request' => $request,
+                ];
+            } else {
+                $resourceAccessCheckerContext = [
+                    'object' => $body,
+                    'previous_object' => $context['graphql_context']['previous_object'] ?? null,
+                ];
+            }
+
+            if (!$this->resourceAccessChecker->isGranted($operation->getClass(), $attribute, $resourceAccessCheckerContext)) {
+                $operation instanceof GraphQlOperation ? throw new AccessDeniedHttpException($message ?? 'Access Denied.') : throw new AccessDeniedException($message ?? 'Access Denied.');
+            }
         }
 
         return $body;
diff --git a/src/Symfony/Security/State/IsGrantedAccessCheckerProvider.php b/src/Symfony/Security/State/IsGrantedAccessCheckerProvider.php
diff --git a/tests/Fixtures/TestBundle/ApiResource/IsGrantedTest.php b/tests/Fixtures/TestBundle/ApiResource/IsGrantedTest.php
diff --git a/tests/Functional/IsGrantedTest.php b/tests/Functional/IsGrantedTest.php
