test: #7061

Author: soyuka

src/Metadata/Resource/Factory/UriTemplateResourceMetadataCollectionFactory.php

@@ -235,7 +235,7 @@ private function normalizeUriVariables(ApiResource|HttpOperation $operation): Ap
             }
 
             $normalizedUriVariable = $normalizedUriVariable->withParameterName($normalizedParameterName);
-            $normalizedUriVariables[$normalizedParameterName] = $normalizedUriVariable;
+            $normalizedUriVariables[$normalizedParameterName] = $normalizedUriVariable->withKey($normalizedParameterName);
         }
 
         return $operation->withUriVariables($normalizedUriVariables);

src/State/ParameterProvider/ReadLinkParameterProvider.php

@@ -69,7 +69,7 @@ public function provide(Parameter $parameter, array $parameters = [], array $con
 
             foreach ($value as $v) {
                 try {
-                    $r = $relation[] = $this->locator->provide($linkOperation, $this->getUriVariables($v, $parameter, $linkOperation), $context);
+                    $relation[] = $this->locator->provide($linkOperation, $this->getUriVariables($v, $parameter, $linkOperation), $context);
                 } catch (ProviderNotFoundException) {
                 }
             }

tests/Fixtures/TestBundle/Entity/Company.php

@@ -17,10 +17,17 @@
 use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\GetCollection;
 use ApiPlatform\Metadata\Link;
+use ApiPlatform\Metadata\NotExposed;
+use ApiPlatform\Metadata\Operation;
 use ApiPlatform\Metadata\Post;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Serializer\Annotation\Groups;
 
+#[NotExposed(
+    uriTemplate: '/company-by-name/{name}',
+    provider: [self::class, 'provideCompanyByName'],
+    uriVariables: ['name']
+)]
 #[ApiResource]
 #[GetCollection]
 #[Get]
@@ -34,6 +41,14 @@
 #[ORM\Entity]
 class Company
 {
+    public static function provideCompanyByName(Operation $operation, array $uriVariables): object
+    {
+        $c = new self();
+        $c->setName($uriVariables['name']);
+
+        return $c;
+    }
+
     /**
      * @var int|null The id
      */

tests/Fixtures/TestBundle/Entity/Employee.php

@@ -16,6 +16,7 @@
 use ApiPlatform\Metadata\ApiResource;
 use ApiPlatform\Metadata\Get;
 use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Link;
 use ApiPlatform\Metadata\Post;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Serializer\Annotation\Groups;
@@ -38,6 +39,18 @@
     normalizationContext: ['groups' => ['company_employees_read']]
 )]
 #[GetCollection]
+#[GetCollection(
+    uriTemplate: '/companies-by-name/{name}/employees',
+    uriVariables: [
+        'name' => new Link(
+            identifiers: ['name'],
+            fromClass: Company::class,
+            toProperty: 'company',
+            security: 'company.name == "Test"',
+            extraProperties: ['uri_template' => '/company-by-name/{name}']
+        ),
+    ],
+)]
 #[ORM\Entity]
 class Employee
 {

tests/Functional/Parameters/LinkProviderParameterTest.php

@@ -15,7 +15,9 @@
 
 use ApiPlatform\Symfony\Bundle\Test\ApiTestCase;
 use ApiPlatform\Tests\Fixtures\TestBundle\ApiResource\WithParameter;
+use ApiPlatform\Tests\Fixtures\TestBundle\Entity\Company;
 use ApiPlatform\Tests\Fixtures\TestBundle\Entity\Dummy;
+use ApiPlatform\Tests\Fixtures\TestBundle\Entity\Employee;
 use ApiPlatform\Tests\Fixtures\TestBundle\Entity\RelatedDummy;
 use ApiPlatform\Tests\Fixtures\TestBundle\Entity\RelatedOwnedDummy;
 use ApiPlatform\Tests\RecreateSchemaTrait;
@@ -33,15 +35,15 @@ final class LinkProviderParameterTest extends ApiTestCase
      */
     public static function getResources(): array
     {
-        return [WithParameter::class, Dummy::class];
+        return [WithParameter::class, Dummy::class, Employee::class, Company::class];
     }
 
     /**
      * @throws \Throwable
      */
     protected function setUp(): void
     {
-        $this->recreateSchema([Dummy::class, RelatedOwnedDummy::class, RelatedDummy::class]);
+        $this->recreateSchema([Dummy::class, RelatedOwnedDummy::class, RelatedDummy::class, Employee::class, Company::class]);
     }
 
     public function testReadDummyProviderFromQueryParameter(): void
@@ -107,4 +109,29 @@ public function testReadDummyProviderFromQueryParameterNoNotFound(): void
         $response = self::createClient()->request('GET', '/with_parameters_links_no_not_found?dummy=1');
         self::assertEquals(200, $response->getStatusCode());
     }
+
+    /**
+     * See https://github.com/api-platform/core/issues/7061.
+     */
+    public function testLinkSecurityWithSlug(): void
+    {
+        $manager = $this->getManager();
+        $employee = new Employee();
+        $employee->setName('me');
+        $dummy = new Company();
+        $dummy->setName('Test');
+        $employee->setCompany($dummy);
+        $manager->persist($employee);
+        $manager->persist($dummy);
+        $manager->flush();
+
+        $container = static::getContainer();
+        if ('mongodb' === $container->getParameter('kernel.environment')) {
+            $this->markTestSkipped();
+        }
+
+        $response = self::createClient()->request('GET', '/companies-by-name/Test/employees');
+        dd($response->toArray(false));
+        self::assertEquals(200, $response->getStatusCode());
+    }
 }