Question: collectionOperations / access_control

When trying to control access in Api Platform the documentation states you can do the following in order to limit Item Operations:

/**
 * @ApiResource(
 *     attributes={"access_control"="is_granted('ROLE_USER')"},
 *     collectionOperations={
 *         "get"={"method"="GET"},
 *         "post"={"method"="POST", "access_control"="is_granted('ROLE_ADMIN')"}
 *     },
 *     itemOperations={
 *         "get"={"method"="GET", "access_control"="is_granted('ROLE_USER') and object.owner == user"}
 *     }
 * )
*/

There is however, no mention for how you would limit a collection by the current user. I tried the following but it fails, presumably because the collection is an array, with no direct access to the interior objects, so object.user doesn’t exist.

/**
 * @ApiResource(
 *     collectionOperations={
 *         "get"={"method"="GET",  "access_control"="is_granted('ROLE_USER') and object.getOwner() == user"}
 *     }
 * )
*/

hydra:description: Unable to call method “owner” of object "ApiPlatform\Core\Bridge\Doctrine\Orm\Paginator

I was wondering if there is a built-in way of getting around this?

[antograssiot]

I use extension to automaticaly filter collection results in addition to access filter based on the connected user https://api-platform.com/docs/core/extensions/#extensions

[DougHayward]

Thank you, I think I found a slightly clearer solution (but again I’m unsure if its best practice). In the doc’s example they do a check to see if the $resourceClass == Offers, however this ties it to that class. So instead of this I’ve got the follow which checks if the method exists dynamically:

$client = $this->tokenStorage->getToken()->getUser()->getClient();
if ($client instanceof Client && method_exists(new $resourceClass, 'getClient') && !$this->authorizationChecker->isGranted('ROLE_SUPER_ADMIN')) {
     $rootAlias = $queryBuilder->getRootAliases()[0];
     $queryBuilder->andWhere(sprintf('%s.client = :current_client', $rootAlias));
     $queryBuilder->setParameter('current_client', $client->getId());
}

I hope this helps someone else at some point, and thank you @antograssiot for your help.