Skip to content

Wrong route match if routePrefix is defined #5203

@usu

Description

@usu

API Platform version(s) affected: 3.0.4

Description
As of now, routePrefix is not included in operation name (which also serves as the symfony route name). This can lead to route name conflict and hence to wrong route matches, if multiple resources are defined on the the same resource class.

How to reproduce

  1. Specify a resource class with 2 ApiResources, one of them with a routePrefix:
#[ApiResource(
    operations: [
        new Get(
            security: 'true'
        ),
        new GetCollection(
            security: 'true'
        ),
)]
#[ApiResource(
    operations: [
        new Get(
            security: 'false'
        ),
        new GetCollection(
            security: 'false'
        ),
    ],
    routePrefix: '/admin'
)]
class User {
}
  1. Load '/admin/users'

Expected result: 403 Forbidden (matching GetCollection operation of the second ApiResource)

Received result: 200 (matching GetCollection operation of first ApiResource). Confusingly, the individual IRIs are still prefixed with /admin

{
  "_links": {
    "self": {
      "href": "/admin/users"
    },
    "items": [
      {
        "href": "/admin/users/1234"
      },
      {
        "href": "/admin/users/5678"
      }
    ]
  },
  "totalItems": 2
}

Possible Solution
Include routePrefix in operation name

Additional context

  • In SwaggerUI, only the /admin/users endpoint are shown (see screenshot below)
  • The routes of the first ApiResource seems to overwritten in Symfony router. Loading /users leads to a "404 No route found exception"

SwaggerUI:
Screenshot 2022-11-20 073837

Route Match Log:
Screenshot 2022-11-20 074206

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions