Roadmap to version 2

[dunglas]

• Finish New metadata and configuration system. Switched to Symfony 3 and PHP 7. #375
• Rename the namespace Dunglas\ApiBundle to ApiPlatform\Core (or something better?)
• Move Symfony specific classes and config to the Bridge\Symfony namespace (including the bundle)
• Move the Composer dependency to symfony/framework-bundle in the require-dev and suggest section
• Update the doc

[lsmith77]

I agree with your design decision to leave FOSRestBundle out of the the required dependencies but I would recommend to look into integrating it optionally for content negotiation and body decoding etc.

[dunglas]

Hi @lsmith77 the v2 already integrates willdurand/Negotiation (as FOSRest AFAIK) for content negotiation: https://github.com/api-platform/doc/blob/master/api-bundle/content-negotiation.md

The body decoding is currently handled by the Symfony serializer: https://github.com/dunglas/DunglasApiBundle/blob/master/Action/PostCollectionAction.php#L50-L54

This library doesn't use the Symfony form framework (it uses directly the serializer to hydrate entities). Does FOSRest have an interest in such case?

I fully agree with you that we should find ways to make both projects sharing some code and it's why we choose willdurand/Negotiation for that. Do you know some other parts that can be shared?

[sroze]

One very convenient feature of FOSRestBundle is the @View view listener. We should introduce such a feature for custom operations but that's already in mind :)

Else, like @dunglas I'm happy to see what else and how we can share between the both!

[lsmith77]

configuring the priorities is also a key aspect of content negotiation which FOSRestBundle supports.
for body decoding we are not using the serializer due to security concerns.

@sroze FYI the @View annotation is based on SensioFrameworkExtraBundle

[dunglas]

We also support priorities configuration:

• if the requested Content-Type is available it is used (according to requested priorities)
• else the first element in the list of supported formats is used

Do you have more information about these security concerns? Is API Platform vulnerable?

[lsmith77]

In the rest bundle you can also configure the server side priorities to some degree.

The security concerns are mostly related to potentially risking users to be able to make instances of classes you do not want before the security layer can kick in our the controller can determine which classes to support. Or if it's delayed sufficiently, then all earlier listeners relying on request data will not work.

[sroze]

@lsmith77 not sure to see any use case where this server-side priorities that can't be solved by the format order. If you've some, happy to find a solution :)

[lsmith77]

BTW .. FOSRestBundle 2.0 is fairly far in the development but if there is anything do to in order to align things then let me know.

@dunglas BTW for content type negotiation you should use the Accept header

[dunglas]

We use the Accept header.

[lsmith77]

ah ok .. as for priorities .. imho it makes sense for api platform to support content negotiation for its preferred mime types .. but anything more complex I would delegate to FOSRestBundle.

[fbourigault]

Rename the namespace Dunglas\ApiBundle to ApiPlatform\Core (or something better?)

Have you plans for splitting what you want to name Core into more bundles/libraries ? IMHO, naming something core is an architecture smell but it can take lots of time to avoid.

[dunglas]

@fbourigault yes core will be the central repository (like symfony/symfony) and will be split in some bundle/components (like Symfony components and bundles).

[fbourigault]

👍

[sstok]

About the security part, I actually have a use-case where I need to do more checking then the security system alone (package limitations). I recently found this https://github.com/radarphp/Radar.Project/blob/1.x/docs/domain.md Which keeps most of the Domain EntryPoint logic in the ApplicationServices, so you can easily support more complex cases with ease.

[jonny827]

Is there a proposed timeline of production use for version 2 of the DunglasApiBundle and/or ApiPlatform? Just want to know if I should spend the time to build with the current release or if version 2 will be down the pipeline in the coming weeks?