chore: deprecate link_security and set it default to true

Author: Maxcastel

filters.md

@@ -587,13 +587,17 @@ The `IriConverterParameterProvider` supports the following options in `extraProp
 
 ### `ReadLinkParameterProvider`
 
-This provider must be enabled before it can be used.
+This provider is now enabled by default (since API Platform 4.2).
+
+Previously, this provider required the following configuration:
 
 ```yaml
 api_platform:
     enable_link_security: true
 ```
 
+> [!NOTE] The `enable_link_security` option is deprecated since API Platform 4.2 and will be removed in 5.0.
+
 This provider fetches a linked resource from a given identifier. This is useful when you need to
 load a related entity to use later, for example in your own state provider. When you have an API
 resource with a custom `uriTemplate` that includes parameters, the `ReadLinkParameterProvider` can

src/Symfony/Bundle/DependencyInjection/ApiPlatformExtension.php

@@ -1018,9 +1018,7 @@ private function registerArgumentResolverConfiguration(PhpFileLoader $loader): v
 
     private function registerLinkSecurityConfiguration(PhpFileLoader $loader, array $config): void
     {
-        if ($config['enable_link_security']) {
-            $loader->load('link_security.php');
-        }
+        $loader->load('link_security.php');
     }
 
     private function registerJsonStreamerConfiguration(ContainerBuilder $container, PhpFileLoader $loader, array $formats, array $config): void

src/Symfony/Bundle/DependencyInjection/Configuration.php

@@ -117,7 +117,11 @@ public function getConfigTreeBuilder(): TreeBuilder
                 ->booleanNode('enable_docs')->defaultTrue()->info('Enable the docs')->end()
                 ->booleanNode('enable_profiler')->defaultTrue()->info('Enable the data collector and the WebProfilerBundle integration.')->end()
                 ->booleanNode('enable_phpdoc_parser')->defaultTrue()->info('Enable resource metadata collector using PHPStan PhpDocParser.')->end()
-                ->booleanNode('enable_link_security')->defaultFalse()->info('Enable security for Links (sub resources)')->end()
+                ->booleanNode('enable_link_security')
+                    ->defaultTrue()
+                    ->info('Enable security for Links (sub resources).')
+                    ->setDeprecated('api-platform/symfony', '4.2', 'This option is always enabled and will be removed in API Platform 5.0.')
+                ->end()
                 ->arrayNode('collection')
                     ->addDefaultsIfNotSet()
                     ->children()

tests/Fixtures/app/config/config_common.yml

@@ -82,6 +82,7 @@ api_platform:
     http_cache:
         invalidation:
             enabled: true
+    # TODO: remove in 5.0
     enable_link_security: true
     # see also defaults in AppKernel
     doctrine_mongodb_odm: false

tests/Symfony/Bundle/DependencyInjection/ConfigurationTest.php

@@ -230,7 +230,8 @@ private function runDefaultConfigTests(array $doctrineIntegrationsToLoad = ['orm
             ],
             'use_symfony_listeners' => false,
             'handle_symfony_errors' => false,
-            'enable_link_security' => false,
+            // TODO: remove in 5.0
+            'enable_link_security' => true,
             'serializer' => [
                 'hydra_prefix' => null,
             ],