fix(serializer): accept union-typed IRI collections on denormalization (#8339)

fixed in #8333) on the collection path.
Closes #8335

Author: soyuka

src/Serializer/AbstractItemNormalizer.php

@@ -764,8 +764,15 @@ private function getResourceFromIri(string $data, array $context, string $resour
         try {
             $item = $this->iriConverter->getResourceFromIri($data, $context + ['fetch_data' => true]);
 
-            // Type-confusion guard: declared relation class must match the IRI's resource.
-            if (!is_a($item, $resourceClass)) {
+            // Type-confusion guard: the IRI's resource must satisfy the declared relation type.
+            // When a union/intersection type is known, validate against it so any member is accepted;
+            // otherwise fall back to the single declared class.
+            $relationType = $context['relation_native_type'] ?? null;
+            $matchesType = $relationType instanceof Type
+                ? $relationType->isSatisfiedBy(static fn (Type $t): bool => $t instanceof ObjectType && is_a($item, $t->getClassName()))
+                : is_a($item, $resourceClass);
+
+            if (!$matchesType) {
                 throw new NotNormalizableValueException(\sprintf('The iri "%s" does not reference the correct resource.', $data));
             }
 
@@ -1227,6 +1234,12 @@ private function createAndValidateAttributeValue(string $attribute, mixed $value
                 $context['resource_class'] = $resourceClass;
                 unset($context['uri_variables']);
 
+                // Validate the IRI target against the declared collection value type so a union
+                // (array<Foo|Bar>) accepts an IRI pointing to any of its members, not just the first.
+                if ($collectionValueType instanceof Type) {
+                    $context['relation_native_type'] = $collectionValueType;
+                }
+
                 try {
                     return $t instanceof Type
                         ? $this->denormalizeObjectCollection($attribute, $propertyMetadata, $t, $resourceClass, $value, $format, $context)
@@ -1249,6 +1262,9 @@ private function createAndValidateAttributeValue(string $attribute, mixed $value
             ) {
                 $resourceClass = $this->resourceClassResolver->getResourceClass(null, $className);
                 $childContext = $this->createChildContext($this->createOperationContext($context, $resourceClass, $propertyMetadata), $attribute, $format);
+                if ($t instanceof Type) {
+                    $childContext['relation_native_type'] = $t;
+                }
 
                 try {
                     return $this->denormalizeRelation($attribute, $propertyMetadata, $resourceClass, $value, $format, $childContext);

src/Serializer/Tests/AbstractItemNormalizerTest.php

@@ -1285,6 +1285,50 @@ public function testUnionTypeDenormalizationFallsThroughAfterTypeConfusionGuardM
         $this->assertInstanceOf(Dummy::class, $actual);
     }
 
+    public function testUnionTypeCollectionDenormalizationAcceptsAnyMember(): void
+    {
+        $data = ['attachments' => ['/related_dummies/1']];
+        $relatedDummy = new RelatedDummy();
+
+        $propertyNameCollectionFactory = $this->createStub(PropertyNameCollectionFactoryInterface::class);
+        $propertyNameCollectionFactory->method('create')->willReturn(new PropertyNameCollection(['attachments']));
+
+        // array<Dummy|RelatedDummy>: the collection value type is a union; the IRI points to the second member.
+        $propertyMetadataFactory = $this->createStub(PropertyMetadataFactoryInterface::class);
+        $propertyMetadataFactory->method('create')->willReturn(
+            (new ApiProperty())
+                ->withNativeType(Type::list(Type::union(Type::object(Dummy::class), Type::object(RelatedDummy::class))))
+                ->withWritable(true)
+        );
+
+        $iriConverter = $this->createStub(IriConverterInterface::class);
+        $iriConverter->method('getResourceFromIri')->willReturn($relatedDummy);
+
+        $resourceClassResolver = $this->createStub(ResourceClassResolverInterface::class);
+        $resourceClassResolver->method('isResourceClass')->willReturnMap([
+            [Dummy::class, true],
+            [RelatedDummy::class, true],
+        ]);
+        $resourceClassResolver->method('getResourceClass')->willReturnMap([
+            [null, Dummy::class, Dummy::class],
+            [null, RelatedDummy::class, RelatedDummy::class],
+        ]);
+
+        $propertyAccessor = $this->createMock(PropertyAccessorInterface::class);
+        $propertyAccessor->expects($this->once())
+            ->method('setValue')
+            ->with($this->isInstanceOf(Dummy::class), 'attachments', [0 => $relatedDummy]);
+
+        $serializer = $this->createStub(SerializerInterface::class);
+
+        $normalizer = new class($propertyNameCollectionFactory, $propertyMetadataFactory, $iriConverter, $resourceClassResolver, $propertyAccessor, null, null, [], null, null) extends AbstractItemNormalizer {};
+        $normalizer->setSerializer($serializer);
+
+        $actual = $normalizer->denormalize($data, Dummy::class);
+
+        $this->assertInstanceOf(Dummy::class, $actual);
+    }
+
     public function testDenormalizeRelationNotFoundReturnsNull(): void
     {
         $data = [

tests/Fixtures/TestBundle/ApiResource/UnionIriCollection/Bar.php

@@ -0,0 +1,37 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Tests\Fixtures\TestBundle\ApiResource\UnionIriCollection;
+
+use ApiPlatform\Metadata\ApiProperty;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\Operation;
+
+#[Get(
+    shortName: 'UnionIriCollectionBar',
+    uriTemplate: '/union_iri_collection_bars/{id}',
+    provider: [self::class, 'provide'],
+)]
+class Bar
+{
+    #[ApiProperty(identifier: true)]
+    public int $id;
+
+    public static function provide(Operation $operation, array $uriVariables = [], array $context = []): self
+    {
+        $bar = new self();
+        $bar->id = (int) ($uriVariables['id'] ?? 1);
+
+        return $bar;
+    }
+}

tests/Fixtures/TestBundle/ApiResource/UnionIriCollection/Container.php

@@ -0,0 +1,38 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Tests\Fixtures\TestBundle\ApiResource\UnionIriCollection;
+
+use ApiPlatform\Metadata\ApiProperty;
+use ApiPlatform\Metadata\Post;
+
+#[Post(
+    shortName: 'UnionIriCollectionContainer',
+    uriTemplate: '/union_iri_collection_containers',
+    processor: [self::class, 'process'],
+)]
+class Container
+{
+    #[ApiProperty(identifier: true)]
+    public int $id = 1;
+
+    /**
+     * @var array<array-key, Foo|Bar>
+     */
+    public array $attachments = [];
+
+    public static function process(mixed $data): self
+    {
+        return $data;
+    }
+}

tests/Fixtures/TestBundle/ApiResource/UnionIriCollection/Foo.php

@@ -0,0 +1,37 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Tests\Fixtures\TestBundle\ApiResource\UnionIriCollection;
+
+use ApiPlatform\Metadata\ApiProperty;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\Operation;
+
+#[Get(
+    shortName: 'UnionIriCollectionFoo',
+    uriTemplate: '/union_iri_collection_foos/{id}',
+    provider: [self::class, 'provide'],
+)]
+class Foo
+{
+    #[ApiProperty(identifier: true)]
+    public int $id;
+
+    public static function provide(Operation $operation, array $uriVariables = [], array $context = []): self
+    {
+        $foo = new self();
+        $foo->id = (int) ($uriVariables['id'] ?? 1);
+
+        return $foo;
+    }
+}

tests/Functional/UnionIriCollectionTest.php

@@ -0,0 +1,51 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Tests\Functional;
+
+use ApiPlatform\Symfony\Bundle\Test\ApiTestCase;
+use ApiPlatform\Tests\Fixtures\TestBundle\ApiResource\UnionIriCollection\Bar;
+use ApiPlatform\Tests\Fixtures\TestBundle\ApiResource\UnionIriCollection\Container;
+use ApiPlatform\Tests\Fixtures\TestBundle\ApiResource\UnionIriCollection\Foo;
+use ApiPlatform\Tests\SetupClassResourcesTrait;
+
+final class UnionIriCollectionTest extends ApiTestCase
+{
+    use SetupClassResourcesTrait;
+
+    protected static ?bool $alwaysBootKernel = false;
+
+    /**
+     * @return class-string[]
+     */
+    public static function getResources(): array
+    {
+        return [Container::class, Foo::class, Bar::class];
+    }
+
+    public function testDenormalizeCollectionAcceptsIriOfEachUnionMember(): void
+    {
+        $response = self::createClient()->request('POST', '/union_iri_collection_containers', [
+            'headers' => ['Content-Type' => 'application/ld+json', 'Accept' => 'application/ld+json'],
+            'json' => ['attachments' => ['/union_iri_collection_foos/1', '/union_iri_collection_bars/2']],
+        ]);
+
+        $this->assertResponseStatusCodeSame(201);
+        $this->assertJsonContains([
+            'attachments' => [
+                '/union_iri_collection_foos/1',
+                '/union_iri_collection_bars/2',
+            ],
+        ]);
+    }
+}