CS fix

Author: silverbackdan

src/ApiPlatform/Metadata/Resource/RoutableResourceMetadataCollectionFactory.php

@@ -28,7 +28,7 @@ class RoutableResourceMetadataCollectionFactory implements ResourceMetadataColle
 {
     private ResourceMetadataCollectionFactoryInterface $decorated;
 
-    public function __construct(ResourceMetadataCollectionFactoryInterface $decorated)
+    public function __construct(ResourceMetadataCollectionFactoryInterface $decorated, private readonly ?string $securityStr = null)
     {
         $this->decorated = $decorated;
     }
@@ -50,12 +50,23 @@ public function create(string $resourceClass): ResourceMetadataCollection
             if ($operations) {
                 /** @var Operation $operation */
                 foreach ($operations as $i => $operation) {
-                    if (
-                        HttpOperation::METHOD_POST !== $operation->getMethod()
-                        && !$operation instanceof CollectionOperationInterface
-                        && !$operation->getSecurity()) {
+                    if ($operation->getSecurity()) {
+                        $newOperations[$i] = $operation;
+                        continue;
+                    }
+
+                    if (HttpOperation::METHOD_POST === $operation->getMethod()) {
+                        // POST (creation) — apply securityStr directly since the voter cannot
+                        // check the subject pre-denormalize. No restriction if securityStr is null.
+                        if ($this->securityStr) {
+                            $operation = $operation->withSecurity($this->securityStr);
+                        }
+                    } elseif (!$operation instanceof CollectionOperationInterface) {
+                        // Item operations (GET, PATCH, DELETE, PUT) — delegate to the routable voter
+                        // which checks the route or falls back to securityStr.
                         $operation = $operation->withSecurity(\sprintf("is_granted('%s', object)", AbstractRoutableVoter::READ_ROUTABLE));
                     }
+
                     $newOperations[$i] = $operation;
                 }
             }

src/DependencyInjection/SilverbackApiComponentsExtension.php

@@ -12,6 +12,7 @@
 namespace Silverback\ApiComponentsBundle\DependencyInjection;
 
 use Ramsey\Uuid\Doctrine\UuidType;
+use Silverback\ApiComponentsBundle\ApiPlatform\Metadata\Resource\RoutableResourceMetadataCollectionFactory;
 use Silverback\ApiComponentsBundle\AttributeReader\UploadableAttributeReader;
 use Silverback\ApiComponentsBundle\Doctrine\Extension\ORM\RoutableExtension;
 use Silverback\ApiComponentsBundle\Doctrine\Extension\ORM\RouteExtension;
@@ -155,6 +156,9 @@ public function load(array $configs, ContainerBuilder $container): void
         $definition = $container->getDefinition(RoutableVoter::class);
         $definition->setArgument('$securityStr', $config['routable_security']);
 
+        $definition = $container->getDefinition(RoutableResourceMetadataCollectionFactory::class);
+        $definition->setArgument('$securityStr', $config['routable_security']);
+
         $definition = $container->getDefinition(MercureAuthorization::class);
         $definition->setArgument('$cookieSameSite', $config['mercure']['cookie']['samesite']);
         $definition->setArgument('$hubName', $config['mercure']['hub_name']);

src/Serializer/Normalizer/ComponentGroupNormalizer.php

@@ -35,8 +35,8 @@
  */
 class ComponentGroupNormalizer implements NormalizerInterface, NormalizerAwareInterface, DenormalizerInterface, DenormalizerAwareInterface
 {
-    use NormalizerAwareTrait;
     use DenormalizerAwareTrait;
+    use NormalizerAwareTrait;
 
     private const ALREADY_CALLED = 'COMPONENT_GROUP_NORMALIZER_ALREADY_CALLED';
 
@@ -99,6 +99,7 @@ function (string $value): string {
                     if (!str_contains($value, '\\')) {
                         return $value;
                     }
+
                     return $this->iriConverter->getIriFromResource(
                         $value,
                         UrlGeneratorInterface::ABS_PATH,