Upgrade to API Platform (#174)

silverbackdan · web-flow · commit 0a1fb4bcc24e · 2025-09-19T14:17:48.000+01:00
* Upgraded to APIP4 - except upload put

* Finish upgrade, remove PUT request support by default

* CS Fixes

* Remove 8.3 support

* Fix text for info.version regex allow hyphens

* Fix route voter

* Fix for next release of voters in symfony

* Fix updates to security contracts of voter and UserChecker
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -51,7 +51,6 @@ jobs:
     strategy:
       matrix:
         php:
-          - '8.3'
           - '8.4'
         symfony:
           - '7.3'
@@ -150,7 +149,6 @@ jobs:
     strategy:
       matrix:
         php:
-          - '8.3'
           - '8.4'
         symfony:
           - '7.3'
diff --git a/composer.json b/composer.json
@@ -18,13 +18,13 @@
         }
     ],
     "require": {
-        "php": ">=8.3",
+        "php": ">=8.4",
         "ext-exif": "*",
         "ext-fileinfo": "*",
         "ext-json": "*",
         "ext-pdo": "*",
         "ext-simplexml": "*",
-        "api-platform/core": "^3.3.1 || 3.3.x-dev",
+        "api-platform/core": "^4.2",
         "cocur/slugify": "^4.1",
         "doctrine/annotations": "^1.7.0",
         "doctrine/dbal": "^3.4",
@@ -136,7 +136,6 @@
         }
     },
     "conflict": {
-        "api-platform/core": "dev-main",
         "willdurand/negotiation": "^2",
         "symfony/serializer": "<=6.1.2",
         "symfony/var-exporter": "<6.1",
diff --git a/features/bootstrap/DoctrineContext.php b/features/bootstrap/DoctrineContext.php
@@ -13,7 +13,7 @@
 
 namespace Silverback\ApiComponentsBundle\Features\Bootstrap;
 
-use ApiPlatform\Exception\ItemNotFoundException;
+use ApiPlatform\Metadata\Exception\ItemNotFoundException;
 use ApiPlatform\Metadata\IriConverterInterface;
 use Behat\Behat\Context\Context;
 use Behat\Behat\Hook\Scope\BeforeScenarioScope;
@@ -618,7 +618,7 @@ public function iPatchPageDataWithThePropertyAndResource(string $property, strin
     {
         $iri = $this->restContext->resources[$resource];
         $this->restContext->iSendARequestToTheResourceWithBody(
-            'PUT',
+            'PATCH',
             'page_data',
             null,
             new PyStringNode([\sprintf('{ "%s": "%s" }', $property, $iri)], 0)
diff --git a/features/bootstrap/RestContext.php b/features/bootstrap/RestContext.php
@@ -142,6 +142,7 @@ public function castFromJson(string $value)
      */
     public function iSendARequestToWithData($method, $url, TableNode $tableNode): void
     {
+        $this->setContentTypeForMethod($method);
         $this->restContext->iSendARequestToWithBody($method, $url, new PyStringNode([json_encode($this->castTableNodeToArray($tableNode))], 0));
     }
 
@@ -166,10 +167,16 @@ public function iSendARequestToTheResourceWithBody(string $method, string $resou
             throw new ExpectationException(\sprintf("The resource with name $resource has not been defined. (Components that exist are `%s`)", implode('`, `', array_keys($this->resources))), $this->minkContext->getSession()->getDriver());
         }
         $endpoint = $this->resources[$resource] . ($postfix ?: '');
+        $this->setContentTypeForMethod($method);
 
         return $this->restContext->iSendARequestToWithBody($method, $endpoint, $body ?? new PyStringNode([], 0));
     }
 
+    private function setContentTypeForMethod(string $method)
+    {
+        $this->restContext->iAddHeaderEqualTo('Content-Type', 'PATCH' === $method ? 'application/merge-patch+json' : 'application/ld+json');
+    }
+
     /**
      * @When /^I send a "([^"]*)" request to the resource "([^"]*)"(?: and the postfix "([^"]*)"|)? with data:$/i
      */
diff --git a/features/bootstrap/UploadsContext.php b/features/bootstrap/UploadsContext.php
@@ -13,7 +13,7 @@
 
 namespace Silverback\ApiComponentsBundle\Features\Bootstrap;
 
-use ApiPlatform\Exception\ItemNotFoundException;
+use ApiPlatform\Metadata\Exception\ItemNotFoundException;
 use ApiPlatform\Metadata\IriConverterInterface;
 use Behat\Behat\Context\Context;
 use Behat\Behat\Hook\Scope\BeforeScenarioScope;
diff --git a/features/main/current_version.feature b/features/main/current_version.feature
@@ -8,7 +8,7 @@ Feature: In order to detect the current API Components Bundle Version
     And I add "Content-Type" header equal to "<header>"
     When I send a "GET" request to "/docs"
     Then the response status code should be 200
-    And the JSON node "info.version" should match the regex '/^1\.0\.0 \((?:dev-[a-zA-Z0-9]+|1\.0\.0\+no\-version\-set)@(?:[a-zA-Z0-9]+)?\)$/'
+    And the JSON node "info.version" should match the regex '/^1\.0\.0 \((?:dev-[a-zA-Z0-9\-]+|1\.0\.0\+no\-version\-set)@(?:[a-zA-Z0-9]+)?\)$/'
     Examples:
       | header              |
       | application/json    |
diff --git a/features/main/route.feature b/features/main/route.feature
@@ -83,7 +83,7 @@ Feature: Route resources
   @loginUser
   Scenario: I update a route path. A new redirect will be created.
     Given there is a PageData resource with the route path "/original"
-    When I send a "PUT" request to "/_/routes//original" with data:
+    When I send a "PATCH" request to "/_/routes//original" with data:
       | path            |
       | /new            |
     Then the response status code should be 200
diff --git a/features/publishable/publishable.feature b/features/publishable/publishable.feature
@@ -203,7 +203,7 @@ Feature: Access to unpublished/draft resources should be configurable
   Scenario: As a user with draft access, when I update a published resource, it should create and return a draft resource. Draft resource should not have the component position.
     Given there is a publishable resource set to publish at "1970-12-31T23:59:59+00:00"
     And there is a ComponentPosition with the resource "publishable_published"
-    When I send a "PUT" request to the resource "publishable_published" with body:
+    When I send a "PATCH" request to the resource "publishable_published" with body:
     """
     {
         "reference": "updated"
@@ -247,7 +247,7 @@ Feature: Access to unpublished/draft resources should be configurable
   @loginAdmin
   Scenario Outline: As a user with draft access, when I update a published resource with a publication date in the past (or now), it should be ignored.
     Given there is a publishable resource set to publish at "1970-12-31T23:59:59+00:00"
-    When I send a "PUT" request to the resource "publishable_published" with data:
+    When I send a "PATCH" request to the resource "publishable_published" with data:
       | publishedAt   |
       | <publishedAt> |
     Then the response status code should be 200
@@ -260,7 +260,7 @@ Feature: Access to unpublished/draft resources should be configurable
   @loginAdmin
   Scenario Outline: As a user with draft access, when I update a published/draft resource with a draft resource available, and set a publication date in the past (or now), it should update the draft resource, merge it with the public resource, and remove the draft resource.
     Given there is a published resource with a draft set to publish at "2999-12-31T23:59:59+00:00"
-    When I send a "PUT" request to the resource "<component>" with data:
+    When I send a "PATCH" request to the resource "<component>" with data:
       | publishedAt   | reference |
       | <publishedAt> | updated   |
     Then the response status code should be 200
@@ -278,7 +278,7 @@ Feature: Access to unpublished/draft resources should be configurable
   @loginAdmin
   Scenario: As a user with draft access, when I update a published resource with a draft resource available, and set a publication date in the future, it should update and return the draft resource.
     Given there is a published resource with a draft set to publish at "2999-12-31T23:59:59+00:00"
-    When I send a "PUT" request to the resource "publishable_published" with body:
+    When I send a "PATCH" request to the resource "publishable_published" with body:
     """
     {
         "publishedAt": "2991-11-11T23:59:59+00:00"
@@ -291,7 +291,7 @@ Feature: Access to unpublished/draft resources should be configurable
   @loginUser
   Scenario: As a user with no draft access, when I update a published resource, it should update and return the published resource.
     Given there is a publishable resource set to publish at "1970-12-31T23:59:59+00:00"
-    When I send a "PUT" request to the resource "publishable_published" with body:
+    When I send a "PATCH" request to the resource "publishable_published" with body:
     """
     {
         "reference": "updated"
@@ -304,7 +304,7 @@ Feature: Access to unpublished/draft resources should be configurable
   @loginUser
   Scenario: As a user with no draft access, I cannot update a draft resource.
     Given there is a publishable resource set to publish at "2999-12-31T23:59:59+00:00"
-    When I send a "PUT" request to the resource "publishable_draft" with body:
+    When I send a "PATCH" request to the resource "publishable_draft" with body:
     """
     {
         "reference": "updated"
@@ -315,7 +315,7 @@ Feature: Access to unpublished/draft resources should be configurable
   @loginAdmin
   Scenario: I cannot modify the publishedResource property via the API
     Given there is a publishable resource set to publish at "2999-12-31T23:59:59+00:00"
-    When I send a "PUT" request to the resource "publishable_draft" with body:
+    When I send a "PATCH" request to the resource "publishable_draft" with body:
     """
     {
         "reference": "updated",
@@ -410,7 +410,7 @@ Feature: Access to unpublished/draft resources should be configurable
   Scenario: When I publish a draft component where there is an existing published component, the newly published draft should inherit the old published component positions
     Given there is a published resource with a draft set to publish at "2999-12-31T23:59:59+00:00"
     And there is a ComponentPosition with the resource "publishable_published"
-    When I send a "PUT" request to the resource "publishable_draft" with body:
+    When I send a "PATCH" request to the resource "publishable_draft" with body:
     """
     {
         "publishedAt": "1970-11-11T23:59:59+00:00"
diff --git a/features/publishable/publishable_soft_validation.feature b/features/publishable/publishable_soft_validation.feature
@@ -39,7 +39,7 @@ Feature: Soft validation on draft resources
   @loginAdmin
   Scenario Outline: When I update a draft resource, there should be a header to indicate whether validation is passing if I were to try and publish it
     Given there is a DummyPublishableWithValidation resource
-    When I send a "PUT" request to the resource "publishable_draft" with data:
+    When I send a "PATCH" request to the resource "publishable_draft" with data:
       | resourceData |
       | <data>       |
     Then the response status code should be 200
@@ -53,7 +53,7 @@ Feature: Soft validation on draft resources
   @loginAdmin
   Scenario Outline: I update a draft resource with data that is OK for a draft, but not for published
     Given there is a DummyPublishableWithValidation resource
-    When I send a "PUT" request to the resource "publishable_draft" and the postfix "?<postfix>" with data:
+    When I send a "PATCH" request to the resource "publishable_draft" and the postfix "?<postfix>" with data:
       | publishedAt   | resourceData |
       | <publishedAt> | <data>       |
     Then the response status code should be <httpStatus>
@@ -66,7 +66,7 @@ Feature: Soft validation on draft resources
   @loginAdmin
   Scenario Outline: I update a draft resource with data that is valid to make it published when ready
     Given there is a DummyPublishableWithValidation resource
-    When I send a "PUT" request to the resource "publishable_draft" and the postfix "?<postfix>" with data:
+    When I send a "PATCH" request to the resource "publishable_draft" and the postfix "?<postfix>" with data:
       | publishedAt   | resourceData |
       | <publishedAt> | <data>       |
     Then the response status code should be <httpStatus>
@@ -80,7 +80,7 @@ Feature: Soft validation on draft resources
   @loginAdmin
   Scenario Outline: I update a draft resource and expect to see a hard fail with validation errors and no need to populate metadata as the output is the violations
     Given there is a DummyPublishableWithValidation resource
-    When I send a "PUT" request to the resource "publishable_draft" and the postfix "?<postfix>" with data:
+    When I send a "PATCH" request to the resource "publishable_draft" and the postfix "?<postfix>" with data:
       | publishedAt   | resourceData |
       | <publishedAt> | <data>       |
     Then the response status code should be <httpStatus>
@@ -100,7 +100,7 @@ Feature: Soft validation on draft resources
   @loginAdmin
   Scenario Outline: Updating a resource to published. The querystring should make no difference and the response is published so no header should exist
     Given there is a DummyPublishableWithValidation resource
-    When I send a "PUT" request to the resource "publishable_draft" and the postfix "?<postfix>" with data:
+    When I send a "PATCH" request to the resource "publishable_draft" and the postfix "?<postfix>" with data:
       | publishedAt   | resourceData |
       | <publishedAt> | <data>       |
     Then the response status code should be <httpStatus>
@@ -114,7 +114,7 @@ Feature: Soft validation on draft resources
   @loginAdmin
   Scenario: I update a published resource with the querystring "validate_published=false" and "published=true" should have no effect and published resource validation should still apply
     Given there is a DummyPublishableWithValidation resource set to publish at "1970-12-31T23:59:59+00:00"
-    When I send a "PUT" request to the resource "publishable_published" and the postfix "?validate_published=false&published=true" with body:
+    When I send a "PATCH" request to the resource "publishable_published" and the postfix "?validate_published=false&published=true" with body:
      """
      {
        "description": ""
diff --git a/features/uploads/uploads.feature b/features/uploads/uploads.feature
@@ -105,7 +105,7 @@ Feature: API Resources which can have files uploaded
   @loginUser
   Scenario Outline: I can update a media resource
     Given there is a DummyUploadableWithImagineFilters
-    When I send a "PUT" request to the resource "dummy_uploadable" with data:
+    When I send a "PATCH" request to the resource "dummy_uploadable" with data:
       | file           |
       | base64(<file>) |
     Then the response status code should be 200
@@ -154,7 +154,7 @@ Feature: API Resources which can have files uploaded
   @loginAdmin
   Scenario: I can set the file to null to delete it
     And there is a DummyUploadableWithImagineFilters
-    When I send a "PUT" request to the resource "dummy_uploadable" with data:
+    When I send a "PATCH" request to the resource "dummy_uploadable" with data:
       | file   |
       | null   |
     Then the response status code should be 200
@@ -183,7 +183,7 @@ Feature: API Resources which can have files uploaded
     Given there is a DummyUploadableAndPublishable
     And the resource "dummy_uploadable" has a file "<existing_file>"
     And there is a ComponentPosition with the resource "dummy_uploadable"
-    When I send a "PUT" request to the resource "dummy_uploadable" with data:
+    When I send a "PATCH" request to the resource "dummy_uploadable" with data:
       | file               |
       | base64(<new_file>) |
     Then the response status code should be 200
diff --git a/features/user/new_email_address.feature b/features/user/new_email_address.feature
@@ -98,7 +98,7 @@ Feature: Register process via a form
     Given there is a "new_email" form
     And there is a user with the username "another_user" password "password" and role "ROLE_USER"
     And I add "referer" header equal to "http://www.website.com"
-    When I send a "PUT" request to the resource "user" with body:
+    When I send a "PATCH" request to the resource "user" with body:
     """
     {
       "newEmailAddress": ""
@@ -115,7 +115,7 @@ Feature: Register process via a form
     Given there is a "new_email" form
     And there is a user with the username "another_user" password "password" and role "ROLE_USER"
     And I add "referer" header equal to "http://www.website.com"
-    When I send a "PUT" request to the resource "user" with body:
+    When I send a "PATCH" request to the resource "user" with body:
     """
     {
       "newEmailAddress": null
diff --git a/features/user/verify_email_address.feature b/features/user/verify_email_address.feature
@@ -31,7 +31,7 @@ Feature: Email address verification
   Scenario: Email becomes unverified when the email address is changed by the API
     Given there is a user with the username "my_username" password "password" and role "ROLE_USER"
     And I add "referer" header equal to "http://www.website.com"
-    When I send a "PUT" request to the resource "user" with body:
+    When I send a "PATCH" request to the resource "user" with body:
     """
     {
       "emailAddress": "new@email.com"
diff --git a/src/ApiPlatform/Metadata/Resource/UploadableResourceMetadataCollectionFactory.php b/src/ApiPlatform/Metadata/Resource/UploadableResourceMetadataCollectionFactory.php
@@ -110,19 +110,20 @@ private static function configurePostOperation(Operation $postOperation, array $
         return $postOperation
             ->withController(UploadAction::class)
             ->withDeserialize(false)
-            ->withStateless(null)
-            ->withOpenapiContext([
-                'requestBody' => [
-                    'content' => [
-                        'multipart/form-data' => [
-                            'schema' => [
-                                'type' => 'object',
-                                'properties' => $openApiRequestMultipartProperties,
-                            ],
-                        ],
-                    ],
-                ],
-            ]);
+            ->withStateless(null);
+        // todo: re-instatate..
+        //            ->withOpenapiContext([
+        //                'requestBody' => [
+        //                    'content' => [
+        //                        'multipart/form-data' => [
+        //                            'schema' => [
+        //                                'type' => 'object',
+        //                                'properties' => $openApiRequestMultipartProperties,
+        //                            ],
+        //                        ],
+        //                    ],
+        //                ],
+        //            ]);
     }
 
     #[Pure]
diff --git a/src/Doctrine/Extension/ORM/RoutableExtension.php b/src/Doctrine/Extension/ORM/RoutableExtension.php
@@ -16,7 +16,7 @@
 use ApiPlatform\Doctrine\Orm\Extension\QueryCollectionExtensionInterface;
 use ApiPlatform\Doctrine\Orm\Util\QueryNameGeneratorInterface;
 use ApiPlatform\Metadata\Operation;
-use ApiPlatform\Symfony\Security\ResourceAccessCheckerInterface;
+use ApiPlatform\Metadata\ResourceAccessCheckerInterface;
 use Doctrine\ORM\QueryBuilder;
 use Silverback\ApiComponentsBundle\Entity\Core\RoutableInterface;
 
diff --git a/src/EventListener/Api/CollectionApiEventListener.php b/src/EventListener/Api/CollectionApiEventListener.php
@@ -13,18 +13,17 @@
 
 namespace Silverback\ApiComponentsBundle\EventListener\Api;
 
-use ApiPlatform\Exception\InvalidIdentifierException as LegacyInvalidIdentifierException;
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\CollectionOperationInterface;
 use ApiPlatform\Metadata\Exception\InvalidIdentifierException;
 use ApiPlatform\Metadata\HttpOperation;
 use ApiPlatform\Metadata\Operation;
 use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
+use ApiPlatform\Metadata\Util\AttributesExtractor;
 use ApiPlatform\State\ProviderInterface;
 use ApiPlatform\State\SerializerContextBuilderInterface;
 use ApiPlatform\State\UriVariablesResolverTrait;
 use ApiPlatform\State\Util\RequestParser;
-use ApiPlatform\Util\AttributesExtractor;
 use Silverback\ApiComponentsBundle\Entity\Component\Collection;
 use Silverback\ApiComponentsBundle\Exception\OutOfBoundsException;
 use Silverback\ApiComponentsBundle\Serializer\SerializeFormatResolver;
@@ -133,7 +132,7 @@ private function transform(Collection $object): Collection
             $uriVariables = $this->getOperationUriVariables($getCollectionOperation, $parameters, $resourceClass);
             // Operation $operation, array $uriVariables = [], array $context = []
             $collectionData = $this->provider->provide($getCollectionOperation, $uriVariables, $collectionContext);
-        } catch (InvalidIdentifierException|LegacyInvalidIdentifierException $e) {
+        } catch (InvalidIdentifierException $e) {
             throw new NotFoundHttpException('Invalid identifier value or configuration.', $e);
         }
 
diff --git a/src/EventListener/Api/PublishableEventListener.php b/src/EventListener/Api/PublishableEventListener.php
@@ -14,7 +14,7 @@
 namespace Silverback\ApiComponentsBundle\EventListener\Api;
 
 use ApiPlatform\Metadata\CollectionOperationInterface;
-use ApiPlatform\Symfony\Validator\Exception\ValidationException;
+use ApiPlatform\Validator\Exception\ValidationException;
 use ApiPlatform\Validator\ValidatorInterface;
 use Doctrine\Persistence\ManagerRegistry;
 use Silverback\ApiComponentsBundle\AttributeReader\PublishableAttributeReader;
@@ -155,10 +155,9 @@ public function onPostRespond(ResponseEvent $event): void
             $response->headers->set(self::VALID_TO_PUBLISH_HEADER, '1');
         } catch (ValidationException $exception) {
             $response->headers->set(self::VALID_TO_PUBLISH_HEADER, '0');
-
             if (
                 true === $request->query->getBoolean(self::VALID_PUBLISHED_QUERY, false)
-                && \in_array($request->getMethod(), [Request::METHOD_POST, Request::METHOD_PUT], true)
+                && \in_array($request->getMethod(), [Request::METHOD_POST, Request::METHOD_PUT, Request::METHOD_PATCH], true)
             ) {
                 throw $exception;
             }
diff --git a/src/Security/UserChecker.php b/src/Security/UserChecker.php
diff --git a/src/Security/Voter/ComponentVoter.php b/src/Security/Voter/ComponentVoter.php
diff --git a/src/Security/Voter/RoutableVoter.php b/src/Security/Voter/RoutableVoter.php
diff --git a/src/Security/Voter/RouteVoter.php b/src/Security/Voter/RouteVoter.php
diff --git a/src/Security/Voter/SiteConfigParameterVoter.php b/src/Security/Voter/SiteConfigParameterVoter.php
diff --git a/src/Serializer/Normalizer/PublishableNormalizer.php b/src/Serializer/Normalizer/PublishableNormalizer.php
diff --git a/tests/Functional/app/config/packages/api_platform.yaml b/tests/Functional/app/config/packages/api_platform.yaml
diff --git a/tests/Serializer/UserContextBuilderTest.php b/tests/Serializer/UserContextBuilderTest.php

Original file line number	Diff line number	Diff line change
`@@ -142,6 +142,7 @@ public function castFromJson(string $value)`
`142`	`142`	`*/`
`143`	`143`	`public function iSendARequestToWithData($method, $url, TableNode $tableNode): void`
`144`	`144`	`{`
	`145`	`+ $this->setContentTypeForMethod($method);`
`145`	`146`	`$this->restContext->iSendARequestToWithBody($method, $url, new PyStringNode([json_encode($this->castTableNodeToArray($tableNode))], 0));`
`146`	`147`	`}`
`147`	`148`
`@@ -166,10 +167,16 @@ public function iSendARequestToTheResourceWithBody(string $method, string $resou`
`166`	`167`	throw new ExpectationException(\sprintf("The resource with name $resource has not been defined. (Components that exist are `%s`)", implode('`, `', array_keys($this->resources))), $this->minkContext->getSession()->getDriver());
`167`	`168`	`}`
`168`	`169`	`$endpoint = $this->resources[$resource] . ($postfix ?: '');`
	`170`	`+ $this->setContentTypeForMethod($method);`
`169`	`171`
`170`	`172`	`return $this->restContext->iSendARequestToWithBody($method, $endpoint, $body ?? new PyStringNode([], 0));`
`171`	`173`	`}`
`172`	`174`
	`175`	`+ private function setContentTypeForMethod(string $method)`
	`176`	`+ {`
	`177`	`+ $this->restContext->iAddHeaderEqualTo('Content-Type', 'PATCH' === $method ? 'application/merge-patch+json' : 'application/ld+json');`
	`178`	`+ }`
	`179`	`+`
`173`	`180`	`/**`
`174`	`181`	`* @When /^I send a "([^"])" request to the resource "([^"])"(?: and the postfix "([^"]*)"\|)? with data:$/i`
`175`	`182`	`*/`