-
-
Notifications
You must be signed in to change notification settings - Fork 932
Closed
Description
API Platform version(s) affected: 3.0.4
Description
As of now, routePrefix
is not included in operation name (which also serves as the symfony route name). This can lead to route name conflict and hence to wrong route matches, if multiple resources are defined on the the same resource class.
How to reproduce
- Specify a resource class with 2 ApiResources, one of them with a
routePrefix
:
#[ApiResource(
operations: [
new Get(
security: 'true'
),
new GetCollection(
security: 'true'
),
)]
#[ApiResource(
operations: [
new Get(
security: 'false'
),
new GetCollection(
security: 'false'
),
],
routePrefix: '/admin'
)]
class User {
}
- Load '/admin/users'
Expected result: 403 Forbidden (matching GetCollection operation of the second ApiResource)
Received result: 200 (matching GetCollection operation of first ApiResource). Confusingly, the individual IRIs are still prefixed with /admin
{
"_links": {
"self": {
"href": "/admin/users"
},
"items": [
{
"href": "/admin/users/1234"
},
{
"href": "/admin/users/5678"
}
]
},
"totalItems": 2
}
Possible Solution
Include routePrefix
in operation name
Additional context
- In SwaggerUI, only the /admin/users endpoint are shown (see screenshot below)
- The routes of the first ApiResource seems to overwritten in Symfony router. Loading
/users
leads to a "404 No route found exception"
Metadata
Metadata
Assignees
Type
Projects
Status
Done