Is it possible to access the authenticated user in ResourceMetadataCollectionFactory?

[andrepimpao]

I have a project where I have dynamic serialization groups.

These groups are generated based on the current authenticated user role, so I can easily manage, on a property level, what a role can or cannot access.

Something like this:

#[Groups([
    'role-owner:collection:write'
])]
private ?string $propertyOne = null;

#[Groups([
    'role-owner:read', 'role-owner:write',
    'role-manager:read'
])]
private ?string $propertyTwo = null;

#[Groups([
    'role-owner:read', 'role-owner:write',
    'role-manager:read', 'role-manager:write'
])]
private ?string $propertyThree = null;

This has at least two side-effects that I'm aware of:

1. Schemas in the docs page get messed up
2. When testing, assertMatchesResourceItemJsonSchema does not work properly in properties that are writable but not readable. For example, a property that is writable on POST, but not readable, fails because it is expecting that that same property is included in the POST success response (which is not).

So... I wanted to fix that and I tried another approach, that I found in SymfonyCasts, that is to decorate the ResourceMetadataCollectionFactory (link is still for v2, but I'm using v3 here).

Unfortunately, it seems that is not possible to get the authenticated user at this point, because if I do the following, the user is always null:

class RoleGroupResourceMetadataCollectionFactory implements ResourceMetadataCollectionFactoryInterface
{
    public function __construct(
        private readonly ResourceMetadataCollectionFactoryInterface $decorated,
        private readonly Security $security
    ) {}

    public function create(string $resourceClass): ResourceMetadataCollection
    {
        dd($this->security->getUser()); // always null
    }
}

Still, I hardcoded the role to see if it would actually work, and it seems so.
If I do something like the following, both the schemas and the assert seem to work correctly (according to my tests, not sure if it has other side-effects besides having a lots of new schemas per entity/group in the docs):

class RoleGroupResourceMetadataCollectionFactory implements ResourceMetadataCollectionFactoryInterface
{
    public function __construct(
        private readonly ResourceMetadataCollectionFactoryInterface $decorated
    ) {}

    public function create(string $resourceClass): ResourceMetadataCollection
    {
        $resourceMetadataCollection = $this->decorated->create($resourceClass);

        /** @var ApiResource $apiResource */
        foreach ($resourceMetadataCollection as $key => $apiResource) {
            $operations = [];

            /** @var Operation $operation */
            foreach ($apiResource->getOperations() as $operation) {
                $normalizationContext = $operation->getNormalizationContext();
                $denormalizationContext = $operation->getDenormalizationContext();

                $normalizationContext['groups'] ??= [];
                $denormalizationContext['groups'] ??= [];

                $itemOrCollection = ($operation instanceof GetCollection || $operation instanceof Post)
                    ? 'collection'
                    : 'item';

                // Hardcoded role
                $normalizationContext['groups'][] = "role-owner:{$itemOrCollection}:read";
                $normalizationContext['groups'][] = "role-owner:read";

                $denormalizationContext['groups'][] = "role-owner:{$itemOrCollection}:write";
                $denormalizationContext['groups'][] = "role-owner:write";

                $operations[$operation->getName()] = $operation->withNormalizationContext($normalizationContext)
                    ->withDenormalizationContext($denormalizationContext);
            }

            $resourceMetadataCollection[$key] = $apiResource->withOperations(new Operations($operations));
        }

        return $resourceMetadataCollection;
    }
}

All this just to ask: is it possible to get the authenticated user in the ResourceMetadataCollectionFactory or have I reached a dead end?

Thank you!

[soyuka]

I think it's possible but you need to be called after the api_platform.metadata.resource.metadata_collection_factory.cached and I don't think it's a good idea. Decorate the JsonSchemaFactory or the OpenApiFactory instead? Also to override groups based on authentication use the SerializerContextBuilder https://api-platform.com/docs/core/serialization/