mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-06-23 18:28:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Restrict access to users API endpoint

Browse source
This commit is contained in:
Jan Böhmer 2023-10-02 00:35:11 +02:00
parent 7bd44484be
commit b796ae36db
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/Entity/UserSystem/User.php
View file

@ -83,8 +83,10 @@ use Jbtronics\TFAWebauthn\Model\TwoFactorInterface as WebauthnTwoFactorInterface
#[ApiResource( #[ApiResource(
shortName: 'User', shortName: 'User',
operations: [ operations: [
new Get(openapiContext: ['summary' => 'Get a specific user.']), new Get(openapiContext: ['summary' => 'Get a specific user.'],
new GetCollection(openapiContext: ['summary' => 'Get all users defined in the system.']), security: 'is_granted("read", object)'),
new GetCollection(openapiContext: ['summary' => 'Get all users defined in the system.'],
security: 'is_granted("@users.read")'),
], ],
normalizationContext: ['groups' => ['user:read'], 'openapi_definition_name' => 'Read'], normalizationContext: ['groups' => ['user:read'], 'openapi_definition_name' => 'Read'],
)] )]
@ -108,7 +110,7 @@ class User extends AttachmentContainingDBElement implements UserInterface, HasPe
protected ?\DateTimeInterface $lastModified = null; protected ?\DateTimeInterface $lastModified = null;
#[Groups(['user:read'])] #[Groups(['user:read'])]
protected ?\DateTimeInterface $createdAt = null; protected ?\DateTimeInterface $addedDate = null;
/** /**
* @var bool Determines if the user is disabled (user can not log in) * @var bool Determines if the user is disabled (user can not log in)
@ -258,7 +260,7 @@ class User extends AttachmentContainingDBElement implements UserInterface, HasPe
#[ORM\ManyToOne(targetEntity: UserAttachment::class)] #[ORM\ManyToOne(targetEntity: UserAttachment::class)]
#[ORM\JoinColumn(name: 'id_preview_attachment', onDelete: 'SET NULL')] #[ORM\JoinColumn(name: 'id_preview_attachment', onDelete: 'SET NULL')]
#[Groups(['user:read', 'usser:write'])] #[Groups(['user:read', 'user:write'])]
protected ?Attachment $master_picture_attachment = null; protected ?Attachment $master_picture_attachment = null;
/** @var \DateTimeInterface|null The time when the backup codes were generated /** @var \DateTimeInterface|null The time when the backup codes were generated