Fix ComponentGroup.allowedComponents: add Layout:read/Page:read groups and FQCN normalisation

Primary fix: add Layout:read and Page:read to allowedComponents Groups so the field is
present when a ComponentGroup is serialised in Layout or Page context, preventing the
Nuxt ComponentGroupUtilSynchronizer from firing spurious PATCHes that blank the nav.

Secondary fix: ComponentGroupNormalizer now implements DenormalizerInterface. Any PHP FQCN
sent in allowedComponents (e.g. from a misconfigured client) is converted to a collection
IRI before being stored, matching the format ComponentGroupNormalizer reads on the
normalization side.

Behat: new scenario verifies FQCN is converted to IRI in the PATCH response.

Author: silverbackdan

features/main/component_groups.feature

@@ -125,3 +125,14 @@ Feature: ComponentGroup resource
       | json_decode([ "resource[layout]" ]) |
     Then the response status code should be 200
     And the resource "layout" should be purged from the cache
+
+  @loginAdmin
+  Scenario: Sending a PHP class name as allowedComponents is normalised to a collection IRI
+    Given there is a ComponentGroup with 0 components
+    When I send a "PATCH" request to the resource "component_group" with body:
+      """
+      {"allowedComponents": ["Silverback\\ApiComponentsBundle\\Tests\\Functional\\TestBundle\\Entity\\DummyComponent"]}
+      """
+    Then the response status code should be 200
+    And the JSON node "allowedComponents[0]" should be equal to "/component/dummy_components"
+

src/Entity/Core/ComponentGroup.php

@@ -74,7 +74,7 @@ class ComponentGroup
     public Collection $componentPositions;
 
     #[ORM\Column(name: 'allowed_components', type: 'json', nullable: true)]
-    #[Groups(['ComponentGroup:read', 'ComponentGroup:write'])]
+    #[Groups(['ComponentGroup:read', 'ComponentGroup:write', 'Layout:read', 'Page:read'])]
     public ?array $allowedComponents = null;
 
     public function __construct()

src/Serializer/Normalizer/ComponentGroupNormalizer.php

@@ -16,6 +16,9 @@
 use ApiPlatform\Metadata\UrlGeneratorInterface;
 use Silverback\ApiComponentsBundle\Entity\Core\ComponentGroup;
 use Silverback\ApiComponentsBundle\Entity\Core\ComponentPosition;
+use Symfony\Component\Serializer\Normalizer\DenormalizerAwareInterface;
+use Symfony\Component\Serializer\Normalizer\DenormalizerAwareTrait;
+use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
 use Symfony\Component\Serializer\Normalizer\NormalizerAwareInterface;
 use Symfony\Component\Serializer\Normalizer\NormalizerAwareTrait;
 use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
@@ -25,11 +28,15 @@
  * pageDataProperty positions (no component) are always kept.
  * Components that violate the restriction remain in the database — they are only hidden from the response.
  *
+ * On write, converts any PHP FQCN in allowedComponents to a collection IRI so the stored value is
+ * always an IRI (e.g. /component/navigation_links) regardless of what the client sends.
+ *
  * @author Daniel West <daniel@silverback.is>
  */
-class ComponentGroupNormalizer implements NormalizerInterface, NormalizerAwareInterface
+class ComponentGroupNormalizer implements NormalizerInterface, NormalizerAwareInterface, DenormalizerInterface, DenormalizerAwareInterface
 {
     use NormalizerAwareTrait;
+    use DenormalizerAwareTrait;
 
     private const ALREADY_CALLED = 'COMPONENT_GROUP_NORMALIZER_ALREADY_CALLED';
 
@@ -74,6 +81,37 @@ function (ComponentPosition $position) use ($allowed): bool {
         return $result;
     }
 
+    public function supportsDenormalization($data, $type, $format = null, array $context = []): bool
+    {
+        return ComponentGroup::class === $type && !isset($context[self::ALREADY_CALLED]);
+    }
+
+    public function denormalize($data, $type, $format = null, array $context = []): ComponentGroup
+    {
+        $context[self::ALREADY_CALLED] = true;
+
+        /** @var ComponentGroup $object */
+        $object = $this->denormalizer->denormalize($data, $type, $format, $context);
+
+        if (null !== $object->allowedComponents) {
+            $object->allowedComponents = array_values(array_map(
+                function (string $value): string {
+                    if (!str_contains($value, '\\')) {
+                        return $value;
+                    }
+                    return $this->iriConverter->getIriFromResource(
+                        $value,
+                        UrlGeneratorInterface::ABS_PATH,
+                        (new GetCollection())->withClass($value),
+                    );
+                },
+                $object->allowedComponents,
+            ));
+        }
+
+        return $object;
+    }
+
     public function getSupportedTypes(?string $format): array
     {
         return [ComponentGroup::class => false];