fix(serializer): improve api-platform#7270 by reducing inconsistencies

Author: soyuka

src/Serializer/ItemNormalizer.php

@@ -32,6 +32,8 @@
 /**
  * Generic item normalizer.
  *
+ * TODO: do not hardcode "id"
+ *
  * @author Kévin Dunglas <[email protected]>
  */
 class ItemNormalizer extends AbstractItemNormalizer
@@ -68,17 +70,6 @@ public function denormalize(mixed $data, string $class, ?string $format = null,
             }
         }
 
-        // See https://github.com/api-platform/core/pull/7270 - id may be an allowed attribute due to being added in the
-        // overridden getAllowedAttributes below, in order to allow updating a nested item via ID. But in this case it
-        // may not "really" be an allowed attribute, ie we don't want to actually use it in denormalization. In this
-        // scenario it will not be present in parent::getAllowedAttributes
-        if (isset($data['id'], $context['resource_class'])) {
-            $parentAllowedAttributes = parent::getAllowedAttributes($class, $context, true);
-            if (\is_array($parentAllowedAttributes) && !\in_array('id', $parentAllowedAttributes, true)) {
-                unset($data['id']);
-            }
-        }
-
         return parent::denormalize($data, $class, $format, $context);
     }
 
@@ -122,8 +113,9 @@ private function getContextUriVariables(array $data, $operation, array $context)
     protected function getAllowedAttributes(string|object $classOrObject, array $context, bool $attributesAsString = false): array|bool
     {
         $allowedAttributes = parent::getAllowedAttributes($classOrObject, $context, $attributesAsString);
-        if (\is_array($allowedAttributes) && ($context['api_denormalize'] ?? false)) {
-            $allowedAttributes = array_merge($allowedAttributes, ['id']);
+        // id is a special case handled above it causes issues not allowing it
+        if (\is_array($allowedAttributes) && ($context['api_denormalize'] ?? false) && !in_array('id', $allowedAttributes)) {
+            $allowedAttributes[] = 'id';
         }
 
         return $allowedAttributes;

src/Serializer/Tests/ItemNormalizerTest.php

@@ -316,13 +316,14 @@ public function testDenormalizeWithWrongId(): void
         $operation = new Get(uriVariables: ['id' => new Link(identifiers: ['id'], parameterName: 'id')]);
         $obj = new Dummy();
 
-        $propertyNameCollection = new PropertyNameCollection(['name']);
+        $propertyNameCollection = new PropertyNameCollection(['id', 'name']);
         $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
         $propertyNameCollectionFactoryProphecy->create(Dummy::class, [])->willReturn($propertyNameCollection)->shouldBeCalled();
 
         $propertyMetadata = (new ApiProperty())->withReadable(true)->withWritable(true);
         $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
         $propertyMetadataFactoryProphecy->create(Dummy::class, 'name', [])->willReturn($propertyMetadata)->shouldBeCalled();
+        $propertyMetadataFactoryProphecy->create(Dummy::class, 'id', [])->willReturn((new ApiProperty)->withIdentifier(true))->shouldBeCalled();
 
         $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
         $iriConverterProphecy->getResourceFromIri('fail', $context + ['fetch_data' => true])->willThrow(new InvalidArgumentException());