Added possibility to access PartAssociations via API

src/Entity/Parts/PartAssociation.php

@@ -23,12 +23,27 @@ declare(strict_types=1);
 
 namespace App\Entity\Parts;
 
+use ApiPlatform\Doctrine\Orm\Filter\BooleanFilter;
+use ApiPlatform\Doctrine\Orm\Filter\DateFilter;
+use ApiPlatform\Doctrine\Orm\Filter\OrderFilter;
+use ApiPlatform\Doctrine\Orm\Filter\RangeFilter;
+use ApiPlatform\Metadata\ApiFilter;
+use ApiPlatform\Metadata\ApiProperty;
+use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\Delete;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Patch;
+use ApiPlatform\Metadata\Post;
+use ApiPlatform\Serializer\Filter\PropertyFilter;
+use App\ApiPlatform\Filter\LikeFilter;
 use App\Repository\DBElementRepository;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use App\Entity\Base\AbstractDBElement;
 use App\Entity\Base\TimestampTrait;
 use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
+use Symfony\Component\Serializer\Annotation\Groups;
 use Symfony\Component\Validator\Constraints as Assert;
 
 /**
@@ -38,6 +53,21 @@ use Symfony\Component\Validator\Constraints as Assert;
 #[ORM\Entity(repositoryClass: DBElementRepository::class)]
 #[ORM\HasLifecycleCallbacks]
 #[UniqueEntity(fields: ['other', 'owner', 'type'], message: 'validator.part_association.already_exists')]
+#[ApiResource(
+    operations: [
+        new Get(security: 'is_granted("read", object)'),
+        new GetCollection(security: 'is_granted("@parts.read")'),
+        new Post(securityPostDenormalize: 'is_granted("create", object)'),
+        new Patch(security: 'is_granted("edit", object)'),
+        new Delete(security: 'is_granted("delete", object)'),
+    ],
+    normalizationContext: ['groups' => ['part_assoc:read', 'part_assoc:read:standalone',  'api:basic:read'], 'openapi_definition_name' => 'Read'],
+    denormalizationContext: ['groups' => ['part_assoc:write', 'api:basic:write'], 'openapi_definition_name' => 'Write'],
+)]
+#[ApiFilter(PropertyFilter::class)]
+#[ApiFilter(LikeFilter::class, properties: ["other_type", "comment"])]
+#[ApiFilter(DateFilter::class, strategy: DateFilter::EXCLUDE_NULL)]
+#[ApiFilter(OrderFilter::class, properties: ['comment', 'addedDate', 'lastModified'])]
 class PartAssociation extends AbstractDBElement
 {
     use TimestampTrait;
@@ -46,6 +76,7 @@ class PartAssociation extends AbstractDBElement
      * @var AssociationType The type of this association (how the two parts are related)
      */
     #[ORM\Column(type: Types::SMALLINT, enumType: AssociationType::class)]
+    #[Groups('part_assoc:read', 'part_assoc:write')]
     protected AssociationType $type = AssociationType::OTHER;
 
     /**
@@ -55,12 +86,14 @@ class PartAssociation extends AbstractDBElement
     #[ORM\Column(type: Types::STRING, length: 255, nullable: true)]
     #[Assert\Expression("this.getType().value !== 0 or this.getOtherType() !== null",
         message: 'validator.part_association.must_set_an_value_if_type_is_other')]
+    #[Groups('part_assoc:read', 'part_assoc:write')]
     protected ?string $other_type = null;
 
     /**
      * @var string|null A comment describing this association further.
      */
     #[ORM\Column(type: Types::TEXT, nullable: true)]
+    #[Groups('part_assoc:read', 'part_assoc:write')]
     protected ?string $comment = null;
 
     /**
@@ -69,6 +102,7 @@ class PartAssociation extends AbstractDBElement
     #[ORM\ManyToOne(targetEntity: Part::class, inversedBy: 'associated_parts_as_owner')]
     #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
     #[Assert\NotNull]
+    #[Groups('part_assoc:read', 'part_assoc:write', 'part_assoc:read:standalone')]
     protected ?Part $owner = null;
 
     /**
@@ -79,6 +113,7 @@ class PartAssociation extends AbstractDBElement
     #[Assert\NotNull]
     #[Assert\Expression("this.getOwner() !== this.getOther()",
         message: 'validator.part_association.part_cannot_be_associated_with_itself')]
+    #[Groups('part_assoc:read', 'part_assoc:write')]
     protected ?Part $other = null;
 
     /**

src/Entity/Parts/PartTraits/AssociationTrait.php

@@ -27,6 +27,7 @@ use App\Entity\Parts\Part;
 use App\Entity\Parts\PartAssociation;
 use Doctrine\Common\Collections\ArrayCollection;
 use Doctrine\Common\Collections\Collection;
+use Symfony\Component\Serializer\Annotation\Groups;
 use Symfony\Component\Validator\Constraints\Valid;
 use Doctrine\ORM\Mapping as ORM;
 
@@ -38,6 +39,7 @@ trait AssociationTrait
     #[Valid]
     #[ORM\OneToMany(mappedBy: 'owner', targetEntity: PartAssociation::class,
         cascade: ['persist', 'remove'], orphanRemoval: true)]
+    #[Groups(['part:read', 'part:write'])]
     protected Collection $associated_parts_as_owner;
 
     /**
@@ -46,6 +48,7 @@ trait AssociationTrait
     #[Valid]
     #[ORM\OneToMany(mappedBy: 'other', targetEntity: PartAssociation::class,
         cascade: ['persist', 'remove'], orphanRemoval: true)]
+    #[Groups(['part:read'])]
     protected Collection $associated_parts_as_other;
 
     /**

src/Security/Voter/PartAssociationVoter.php

@@ -0,0 +1,104 @@
+<?php
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2022 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+declare(strict_types=1);
+
+/**
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ * Copyright (C) 2019 - 2022 Jan Böhmer (https://github.com/jbtronics)
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+namespace App\Security\Voter;
+
+use App\Entity\Parts\PartAssociation;
+use App\Services\UserSystem\VoterHelper;
+use Symfony\Bundle\SecurityBundle\Security;
+use App\Entity\Parts\Part;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+
+/**
+ * This voter handles permissions for part associations.
+ * The permissions are inherited from the part.
+ */
+final class PartAssociationVoter extends Voter
+{
+    public function __construct(private readonly Security $security, private readonly VoterHelper $helper)
+    {
+    }
+
+    protected const ALLOWED_PERMS = ['read', 'edit', 'create', 'delete', 'show_history', 'revert_element'];
+
+    protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
+    {
+        if (!is_string($subject) && !$subject instanceof PartAssociation) {
+            throw new \RuntimeException('Invalid subject type!');
+        }
+
+        $operation = match ($attribute) {
+            'read' => 'read',
+            'edit', 'create', 'delete' => 'edit',
+            'show_history' => 'show_history',
+            'revert_element' => 'revert_element',
+            default => throw new \RuntimeException('Encountered unknown operation "'.$attribute.'"!'),
+        };
+
+        //If we have no part associated use the generic part permission
+        if (is_string($subject) ||  !$subject->getOwner() instanceof Part) {
+            return $this->helper->isGranted($token, 'parts', $operation);
+        }
+
+        //Otherwise vote on the part
+        return $this->security->isGranted($attribute, $subject->getOwner());
+    }
+
+    protected function supports($attribute, $subject): bool
+    {
+        if (is_a($subject, PartAssociation::class, true)) {
+            return in_array($attribute, self::ALLOWED_PERMS, true);
+        }
+
+        return false;
+    }
+
+    public function supportsType(string $subjectType): bool
+    {
+        return $subjectType === 'string' || is_a($subjectType, PartAssociation::class, true);
+    }
+
+    public function supportsAttribute(string $attribute): bool
+    {
+        return in_array($attribute, self::ALLOWED_PERMS, true);
+    }
+}