Codestin Search App

dunglas · 2022-09-21T17:57:46Z

Q	A
Branch?	main
Tickets	n/a
License	MIT
Doc PR	todo

Our current implementation of the PUT HTTP method is not standard-compliant: according to the spec, a PUT must create or replace the resource at the requested URL.

However, currently, we don't allow the creation of new resources using PUT, and we update the existing resources instead of replacing them: untouched properties are kept instead of being reset to their default values. Basically, our PUT behaves as PATCH.

The main reason behind that non-conform behavior is a Doctrine ORM limitation.

This patch adds support for spec-compliant PUT and provides a workaround for Doctrine ORM.

Making PUT spec-compliant is opt-in to preserve backward compatibility, but using the non-conform version will be deprecated (use PATCH instead), and removed in API Platform 4.

Allowing resource creation is not enabled by default because it can cause security issues.

TODO:

Use dedicated attribute properties instead of relying on extra_properties
Deprecate not setting standard_put to true
Update the recipe to disable PUT by default (using PATCH is probably a better solution for most common use cases, so we should make PUT opt-in)

soyuka · 2022-09-21T18:10:15Z

+        // This custom logic is needed because EntityManager::merge() has been deprecated and UPSERT isn't supported:
+        // https://github.com/doctrine/orm/issues/8461#issuecomment-1250233555
+        if (isset($context['read_data'], $context['resource_class']) && $operation instanceof HttpOperation && 'PATCH' !== $operation->getMethod()) {
+            $propertyNames = iterator_to_array($this->propertyNameCollectionFactory->create($context['resource_class'])->getIterator());


we can avoid all this, you can retrieve identifiers by looping over foreach $operation->getUriVariables() as $uriVariable then foreach $uriVariable->getIdentifiers() as $property this way we don't use metadata factories here.

My refactoring doesn't handle the case where URI variables don't match the Doctrine properties, but I think that it's good enough for now, mainly because it's in sync with what is currently done here: https://github.com/api-platform/core/blob/main/src/Doctrine/Orm/State/ItemProvider.php#L51

At some point, we'll probably want to introduce a utility to map URI variables with internal Doctrine identifiers.

alanpoulain · 2022-09-22T09:13:30Z

-
-    public function __construct(private readonly ProviderInterface $provider, ?ResourceMetadataCollectionFactoryInterface $resourceMetadataCollectionFactory = null, private readonly ?SerializerContextBuilderInterface $serializerContextBuilder = null, UriVariablesConverterInterface $uriVariablesConverter = null)
-    {
+    public function __construct(


I thought we didn't want to have multiple lines in the constructor?

Now that we have constructor promotion and the ability to add a comma after the last parameter, I think we should use multiple lines for clarity and to reduce merge conflicts.

Good to know, it would be great to add it in the CS fixer.

alanpoulain · 2022-09-22T09:14:00Z

+        if (
+            null === $data &&
+            (
+                HttpOperation::METHOD_PUT !== $operation->getMethod() ||


Why using a constant here and not elsewhere?

soyuka · 2022-09-29T14:06:33Z

+            null !== $data &&
+            (
+                'PATCH' === $method ||
+                ('PUT' === $method && !($operation->getExtraProperties()['standard_put'] ?? false))


use HttpOperation constants for methods

soyuka · 2022-09-29T14:09:48Z

+ * @author Kévin Dunglas <[email protected]>
+ */
+#[ApiResource(extraProperties: [
+    'standard_put' => true,


I find the name confusing

soyuka · 2022-09-29T14:11:30Z

+        // PUT: reset the existing object managed by Doctrine and merge data sent by the user in it
+        // This custom logic is needed because EntityManager::merge() has been deprecated and UPSERT isn't supported:
+        // https://github.com/doctrine/orm/issues/8461#issuecomment-1250233555
+        if ($operation instanceof HttpOperation && 'PUT' === $operation->getMethod()) {


Suggested change

if ($operation instanceof HttpOperation && 'PUT' === $operation->getMethod()) {

if ($operation instanceof HttpOperation && HttpOperation::METHOD_PUT === $operation->getMethod()) {

dunglas · 2023-01-10T10:39:25Z

        $processor = null,
-        array $extraProperties = []
+        array $extraProperties = [],
+        private ?bool $allowCreate = null,


IMHO the order of these parameters shouldn't be part of the BC promise and users must have to use named properties.

note that this allows to use ...func_get_args() to call parent::__construct without having to be concerned about allowCreate.

dunglas requested a review from soyuka September 21, 2022 17:57

soyuka reviewed Sep 21, 2022

View reviewed changes

dunglas force-pushed the feat/standard-put branch 2 times, most recently from de18ece to ce98746 Compare September 21, 2022 21:01

alanpoulain reviewed Sep 22, 2022

View reviewed changes

Comment thread features/main/standard_put.feature Outdated

alanpoulain reviewed Sep 22, 2022

View reviewed changes

soyuka reviewed Sep 29, 2022

View reviewed changes

soyuka mentioned this pull request Nov 5, 2022

PUT to create #4266

Closed

soyuka changed the title ~~feat: spec-compliant PUT method~~ feat: spec-compliant PUT method + #4344 Nov 21, 2022

soyuka changed the title ~~feat: spec-compliant PUT method + #4344~~ feat: spec-compliant PUT method Nov 21, 2022

soyuka added this to the 4.0 milestone Nov 21, 2022

soyuka force-pushed the feat/standard-put branch 4 times, most recently from 6705312 to 83b200b Compare November 28, 2022 21:54

soyuka mentioned this pull request Jan 4, 2023

PUT on /resource/non-existing-id should work according to the HTTP spec #4344

Closed

dunglas commented Jan 10, 2023

View reviewed changes

soyuka added 2 commits January 11, 2023 10:54

feat: spec-compliant PUT method

fad7755

add allowCreate on the put operation and deprecate non standard_put

2256c61

soyuka force-pushed the feat/standard-put branch from d26e501 to 2256c61 Compare January 11, 2023 09:59

soyuka added 7 commits January 11, 2023 11:15

fix deprec

b22fd15

fix tests

0d1dcf3

deprec

d594ed1

phpstan

63603db

fix mongodb

4b7204f

fix mongodb

2fae6a3

t

5167555

soyuka merged commit bde59ba into api-platform:main Jan 11, 2023

soyuka mentioned this pull request Jan 26, 2023

PUT (with extraProperties : ['standard_put' => true]), deserializer & provider #5370

Closed

mrossard mentioned this pull request Jan 27, 2023

PUT tries to create new entity even when it already exists if ORM id is hidden in the API #5372

Closed

jderusse mentioned this pull request Feb 7, 2023

No migration path for partial PUT operation in ApiPlatform 4 #5392

Closed

mrossard mentioned this pull request Feb 16, 2023

fix : (standard-put) correct retrieval of the updated object when the ORM id is not in the URI. #5409

Closed

tyx mentioned this pull request Feb 24, 2023

PUT return 201 without ReadListener enabled #5417

Closed

	if ($operation instanceof HttpOperation && 'PUT' === $operation->getMethod()) {
	if ($operation instanceof HttpOperation && HttpOperation::METHOD_PUT === $operation->getMethod()) {

Uh oh!

Conversation

dunglas commented Sep 21, 2022 • edited by soyuka Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dunglas commented Sep 21, 2022 •

edited by soyuka

Loading