Filtering results for users

[trsteel88]

I have been looking at Extensions and Filters and I am trying to figure out the best way to limit what users see depending on who they are.

I am using Security Voters for Items, so I only need to solve what comes through on Collections as the voter will deny access if someone tries to access something they shouldn't.

I have Projects, Organisations and Users. Projects belong to a user and an organisation, Users can belong to many organisations.

I have an endpoint for /projects which I can limit the results by using an Extension and only revealing projects for that user.

However, I also need an admin endpoint for projects where I want them to be able to see any project. However, an admin may also have their own projects so I need them to be able to control what they see.

Rather than using an Extension, can I use a filter and check if that user has access to the value they are trying to filter by? This would mean that whenever someone requests /projects they can provide a query value (e.g. /projects?organisation=/api/organisation/1 or leave it empty to show all - /projects).

How can I check that user actually has access to that organisation? If the user has a ROLE_ADMIN I want to allow them to use any organisation (or none at all). If they have ROLE_USER they must provide a value for organisation and I need my voter to check they belong to the organisation.

[soyuka]

An extension might be better to alter the query. But maybe you could do some checks in an event listener instead?

What I'd do:

1. Create an event listener and do some security checks (see this example from symfony docs where they check things onKernelController). You can easily return 403 or 400 response statuses according to whether user has no access or forgot the organization parameter.
2. Create an extension that takes the TokenStorage (or whatever suits you, I usually do $token = $tokenStorage->getToken(); $user = $token->getUser(); $user instanceof UserInterface;).
   With that user you can alter the query to get only what the user should see. You could also add your admin requirements.

[trsteel88]

I went with a Filter because it makes it easier to then document within Swagger.

Here is what I have:

<?php

namespace App\Api\Filter;

use ApiPlatform\Core\Bridge\Doctrine\Orm\Filter\FilterInterface;
use ApiPlatform\Core\Bridge\Doctrine\Orm\Util\QueryNameGeneratorInterface;
use App\Entity\User;
use Doctrine\ORM\QueryBuilder;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpFoundation\RequestStack;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;

final class UserFilter implements FilterInterface
{
    private $denormalizer;

    private $authorizationChecker;

    private $tokenStorage;

    private $requestStack;

    public function __construct(
        DenormalizerInterface $denormalizer,
        AuthorizationCheckerInterface $authorizationChecker,
        TokenStorageInterface $tokenStorage,
        RequestStack $requestStack = null,
        LoggerInterface $logger = null
    ) {
        $this->denormalizer = $denormalizer;
        $this->authorizationChecker = $authorizationChecker;
        $this->tokenStorage = $tokenStorage;
        $this->requestStack = $requestStack;
    }

    public function apply(QueryBuilder $queryBuilder, QueryNameGeneratorInterface $queryNameGenerator, string $resourceClass, string $operationName = null)
    {
        $request = $this->requestStack->getCurrentRequest();

        if ($request->query->has('user')) {
            $userId = $request->query->get('user');

            if ($this->authorizationChecker->isGranted('ROLE_ADMIN')) {
                if (!$userId) {
                    // Admin is searching for empty user - do not filter
                    return;
                }
            } else {
                // Only admins can specify a user
                throw new AccessDeniedException();
            }

            $user = $this->denormalizer->denormalize(['id' => $userId], User::class, null, ['resource_class' => User::class]);
        } else {
            $user = $this->getUser();

            if (!$user) {
                // User is not logged in
                throw new AccessDeniedException();
            }
        }

        if ($user) {
            $queryBuilder->andWhere('o.user = :user')
                ->setParameter('user', $user);
        }
    }

    // This function is only used to hook in documentation generators (supported by Swagger and Hydra)
    public function getDescription(string $resourceClass): array
    {
        $description['user'] = [
            'property' => 'user',
            'type' => 'string',
            'required' => false,
            'swagger' => [
                'description' => 'Filter using an user',
                'name' => 'user',
                'type' => 'User',
            ],
        ];

        return $description;
    }

    private function getUser(): ?User
    {
        if (!$token = $this->tokenStorage->getToken()) {
            return null;
        }

        $user = $token->getUser();

        if (!$user instanceof User) {
            return null;
        }

        return $user;
    }
}

I've only done it for filtering by user but it is easily translatable to my organisation scenario as well (would just have the added check for checking access to the organisation).

Is the above good/bad practice?

[soyuka]

This looks just fine to me couldn't have done better :).

[trsteel88]

Thanks @soyuka

[mrtnzagustin]

Hello there! The solution explained by @trsteel88 have one problem. If you you make a request to your endopint not sending any query param (example: GET to https://api.yourdomain.com/your-entity), the filter dont apply and all your resources are exposed. I have this problem so end up using https://api-platform.com/docs/v2.4/core/extensions/#custom-doctrine-orm-extension

[mrtnzagustin]

My mistake, i was using ApiPlatform\Core\Bridge\Doctrine\Orm\Filter\AbstractContextAwareFilter instead of ApiPlatform\Core\Bridge\Doctrine\Orm\Filter\FilterInterface. Can you tell me the differences?