Return correct IRI from the /me endpoint if a Get operation exists

Author: silverbackdan

features/user/me.feature

@@ -7,11 +7,20 @@ Feature: Add a /me endpoint
     Given I add "Accept" header equal to "application/ld+json"
     And I add "Content-Type" header equal to "application/ld+json"
 
+  @loginUser
+  Scenario: I can retrieve the current logged in user object
+    When I send a "GET" request to the resource "login_user"
+    Then the response status code should be 200
+    And the JSON should be valid according to the schema file "user.schema.json"
+    And the JSON node "@id" should be equal to the IRI of the resource "login_user"
+    And the JSON node "_metadata.mercureSubscribeTopics[0]" should be equal to "http://example.com/_/component_groups/{id}{._format}"
+
   @loginUser
   Scenario: I can retrieve the current logged in user object
     When I send a "GET" request to "/me"
     Then the response status code should be 200
     And the JSON should be valid according to the schema file "user.schema.json"
+    And the JSON node "@id" should be equal to the IRI of the resource "login_user"
     And the JSON node "_metadata.mercureSubscribeTopics[0]" should be equal to "http://example.com/_/component_groups/{id}{._format}"
 
   Scenario: I can retrieve the current logged in user object

src/ApiPlatform/Api/IriConverter.php

@@ -13,8 +13,13 @@
 
 namespace Silverback\ApiComponentsBundle\ApiPlatform\Api;
 
+use ApiPlatform\Metadata\Exception\OperationNotFoundException;
+use ApiPlatform\Metadata\Exception\ResourceClassNotFoundException;
+use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\IriConverterInterface;
 use ApiPlatform\Metadata\Operation;
+use ApiPlatform\Metadata\Operations;
+use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
 use ApiPlatform\Metadata\UrlGeneratorInterface;
 use Silverback\ApiComponentsBundle\Entity\Core\Route;
 
@@ -23,7 +28,7 @@
  */
 class IriConverter implements IriConverterInterface
 {
-    public function __construct(private IriConverterInterface $decorated)
+    public function __construct(private IriConverterInterface $decorated, private ResourceMetadataCollectionFactoryInterface $resourceMetadataCollectionFactory)
     {
     }
 
@@ -33,8 +38,39 @@ public function getResourceFromIri(string $iri, array $context = [], ?Operation
     }
 
     // We want relations when they are found, to use the IRI with the path
+
+    /**
+     * @throws ResourceClassNotFoundException
+     * @throws \Exception
+     */
     public function getIriFromResource($resource, int $referenceType = UrlGeneratorInterface::ABS_PATH, ?Operation $operation = null, array $context = []): ?string
     {
+        if ($operation?->getName() === 'me') {
+            // we do not want to return the /me IRI if a Get endpoint is configured. The IRI should be canonical to the user's ID etc.
+
+            // get the API metadata of the class
+            // find the Get operation - ApiPlatform\Metadata\Get
+            // use this uriTemplate instead, overwrite $operation and the operation in context
+            $resourceIterator = $this->resourceMetadataCollectionFactory->create($operation->getClass())->getIterator();
+            while($resourceIterator->valid()) {
+                $current = $resourceIterator->current();
+                /**
+                 * @var Operations $resourceOperations
+                 */
+                $resourceOperations = $current->getOperations();
+                $operationIterator = $resourceOperations->getIterator();
+                while($operationIterator->valid()) {
+                    $checkOperation = $operationIterator->current();
+                    if ($checkOperation instanceof Get) {
+                        $operation = $checkOperation;
+                        $context['operation'] = $checkOperation;
+                        break 2;
+                    }
+                    $operationIterator->next();
+                }
+                $resourceIterator->next();
+            }
+        }
         $originalIri = $this->decorated->getIriFromResource($resource, $referenceType, $operation, $context);
 
         if (!$resource instanceof Route || !($path = $resource->getPath())) {

src/Resources/config/services.php

@@ -1421,6 +1421,7 @@
         ->decorate('api_platform.iri_converter')
         ->args([
             new Reference(IriConverter::class . '.inner'),
+            new Reference('api_platform.metadata.resource.metadata_collection_factory'),
         ]);
     $services->alias('silverback.iri_converter', IriConverter::class);
     $services->alias(IriConverterInterface::class, IriConverter::class);

tests/Functional/TestBundle/Entity/User.php

@@ -18,21 +18,22 @@
 use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Patch;
+use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Put;
 use Doctrine\ORM\Mapping as ORM;
 use Silverback\ApiComponentsBundle\Entity\User\AbstractUser;
 
-const USER_SECURITY = "is_granted('ROLE_SUPER_ADMIN') or object == user";
-
 /**
  * @author Daniel West <daniel@silverback.is>
  */
-#[ApiResource]
-#[Get(security: USER_SECURITY)]
-#[Put(security: USER_SECURITY)]
-#[Patch(security: USER_SECURITY)]
-#[Delete(security: USER_SECURITY)]
-#[GetCollection(order: ['createdAt' => 'DESC'], security: "is_granted('ROLE_SUPER_ADMIN')")]
+#[ApiResource(operations: [
+    new GetCollection( order: ['createdAt' => 'DESC'], security: "is_granted('ROLE_SUPER_ADMIN')"),
+    new Post( security: "is_granted('ROLE_SUPER_ADMIN')" ),
+    new Get( security: "is_granted('ROLE_SUPER_ADMIN') or object.getId() == user.getId()" ),
+    new Put( security: "is_granted('ROLE_SUPER_ADMIN') or object.getId() == user.getId()" ),
+    new Patch( security: "is_granted('ROLE_SUPER_ADMIN') or object.getId() == user.getId()" ),
+    new Delete( security: "is_granted('ROLE_SUPER_ADMIN')" )
+])]
 #[ORM\Entity]
 #[ORM\Table(name: '`user`')]
 class User extends AbstractUser