WIP

databox/api/composer.json

@@ -113,7 +113,7 @@
         "alchemy/test-bundle": "*",
         "alchemy/webhook-bundle": "@dev",
         "alchemy/workflow-bundle": "@dev",
-        "api-platform/core": "3.1.18",
+        "api-platform/core": "^3.2.7",
         "arthem/rabbit-bundle": "dev-master",
         "beberlei/doctrineextensions": "dev-regex-replace-flags",
         "cocur/slugify": "^4.1",

databox/api/config/packages/api_platform.yaml

@@ -21,3 +21,4 @@ api_platform:
         tokenUrl: '%env(KEYCLOAK_URL)%/oauth/v2/token'
         flow: authorizationCode
         authorizationUrl: '%env(KEYCLOAK_URL)%/oauth/v2/auth'
+    event_listeners_backward_compatibility_layer: false

databox/api/src/Api/InputTransformerProvider.php

@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Api;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProviderInterface;
+use App\Api\InputTransformer\InputTransformerInterface;
+use Symfony\Component\DependencyInjection\Attribute\AsDecorator;
+use Symfony\Component\DependencyInjection\Attribute\TaggedIterator;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Serializer\Normalizer\AbstractNormalizer;
+
+#[AsDecorator(decorates: 'api_platform.state_provider.deserialize', priority: 1)]
+final class InputTransformerProvider implements ProviderInterface
+{
+    /**
+     * @var InputTransformerInterface[]
+     */
+    private readonly iterable $transformers;
+
+    public function __construct(
+        private readonly ProviderInterface $decorated,
+        #[TaggedIterator('api.input_transformer')]
+        iterable $transformers,
+    ) {
+        $this->transformers = $transformers;
+    }
+
+    public function provide(Operation $operation, array $uriVariables = [], array $context = []): object|array|null
+    {
+        $data = $this->decorated->provide($operation, $uriVariables, $context);
+        if ($data instanceof Response) {
+            return $data;
+        }
+
+        if (!is_object($data)) {
+            return $data;
+        }
+
+        $resourceClass = $operation->getClass();
+        foreach ($this->transformers as $transformer) {
+            if ($transformer->supports($resourceClass, $data)) {
+                $request = $context['request'];
+                if ($previousData = $request?->attributes->get('data')) {
+                    $context[AbstractNormalizer::OBJECT_TO_POPULATE] = $previousData;
+                }
+
+                return $transformer->transform($data, $resourceClass, $context);
+            }
+        }
+
+        if (null === $operation->getProcessor()) {
+            throw new \InvalidArgumentException(sprintf('No input transformer found for resource "%s"', $data::class));
+        }
+
+        return $data;
+    }
+}

databox/api/src/Api/Processor/AssetAttributeBatchUpdateProcessor.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Api\Processor;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use App\Api\Model\Input\Attribute\AssetAttributeBatchUpdateInput;
+use App\Attribute\BatchAttributeManager;
+use App\Entity\Core\Asset;
+use App\Security\Voter\AssetVoter;
+use App\Util\DoctrineUtil;
+use App\Util\SecurityAwareTrait;
+use Doctrine\ORM\EntityManagerInterface;
+
+final class AssetAttributeBatchUpdateProcessor implements ProcessorInterface
+{
+    use SecurityAwareTrait;
+
+    public function __construct(
+        private readonly BatchAttributeManager $batchAttributeManager,
+        private readonly EntityManagerInterface $em,
+    )
+    {
+    }
+
+    /**
+     * @param AssetAttributeBatchUpdateInput $data
+     */
+    public function process($data, Operation $operation, array $uriVariables = [], array $context = []): Asset
+    {
+        $asset = DoctrineUtil::findStrict($this->em, Asset::class, $uriVariables['id']);
+        $this->denyAccessUnlessGranted(AssetVoter::EDIT_ATTRIBUTES, $asset);
+
+        $this->batchAttributeManager->validate([$asset->getId()], $data);
+
+        $this->batchAttributeManager->handleBatch(
+            $asset->getWorkspaceId(),
+            [$asset->getId()],
+            $data,
+            $this->getStrictUser(),
+            true,
+        );
+
+        return $asset;
+    }
+}

databox/api/src/Entity/Core/Asset.php

@@ -19,11 +19,11 @@
 use App\Api\Model\Input\MultipleAssetInput;
 use App\Api\Model\Output\AssetOutput;
 use App\Api\Model\Output\MultipleAssetOutput;
+use App\Api\Processor\AssetAttributeBatchUpdateProcessor;
 use App\Api\Processor\CopyAssetProcessor;
 use App\Api\Processor\MoveAssetProcessor;
 use App\Api\Processor\TriggerAssetWorkflowProcessor;
 use App\Api\Provider\AssetCollectionProvider;
-use App\Controller\Core\AssetAttributeBatchUpdateAction;
 use App\Controller\Core\DeleteAssetByIdsAction;
 use App\Controller\Core\DeleteAssetByKeysAction;
 use App\Controller\Core\MultipleAssetCreateAction;
@@ -65,12 +65,11 @@
         ),
         new Post(
             uriTemplate: '/assets/{id}/attributes',
-            controller: AssetAttributeBatchUpdateAction::class,
-            securityPostDenormalize: 'is_granted("'.AssetVoter::EDIT_ATTRIBUTES.'", object)',
             input: AssetAttributeBatchUpdateInput::class,
+            processor: AssetAttributeBatchUpdateProcessor::class,
         ),
         new GetCollection(),
-        new Post(securityPostDenormalize: 'is_granted("CREATE", object)'),
+        new Post(securityPostValidation: 'is_granted("CREATE", object)'),
         new Post(
             uriTemplate: '/assets/multiple',
             controller: MultipleAssetCreateAction::class,