API-PLATFORM User Update Password Or user profile - php

Question

I need help :-D, I'm a beginner on Symfony and Api Platform. I have an entity User, I want create an items Operation for update my user with an object { email: string; firstname: string; lastname: string } without password, and a second itemsOperation just for my password.
I have testing, but I can't do it.
this is my entity user and annotation api.
/**
* #ApiResource(
* itemOperations={
* "get",
* "update_password"={"method"="PUT", "path"="user/{id}/update-password",
* "validation_groups"={"updatePassword"}},
* "update_user"={"method"="PUT", "path"="user/{id}/update-user",
* "validation_groups"={"updateUser"}}
* }
* )
* #ORM\Table(name="users")
* #ORM\Entity
*/
class User implements UserInterface
{
/**
* #ORM\Column(type="integer")
* #ORM\Id
* #ORM\GeneratedValue(strategy="AUTO")
*/
private $id;
/**
* #ORM\Column(type="string", length=25, unique=true)
*/
private $username;
/**
* #ORM\Column(type="string", length=255)
* #Assert\Length(min="8", max="22")
* #Assert\NotNull(groups={"updatePassword"})
* #Assert\IsNull(groups={"updateUser"})
*/
private $password;
/**
* #ORM\Column(type="string", length=45)
* #Groups({"updateUser"})
*/
private $email;
/**
* #ORM\Column(type="array")
*/
private $roles = [];
/**
* #ORM\Column(type="string", length=255, nullable=true)
* #Groups({"updateUser"})
*/
private $firstname;
/**
* #ORM\Column(type="string", length=255, nullable=true)
* #Groups({"updateUser"})
*/
private $lastname;
public function getId(): ?int
{
return $this->id;
}
public function getUsername(): ?string
{
return $this->username;
}
public function setUsername(string $username): self
{
$this->username = $username;
return $this;
}
public function getSalt()
{
return null;
}
public function getPassword(): string
{
return (string) $this->password;
}
public function setPassword(string $password): self
{
$this->password = $password;
return $this;
}
public function getEmail(): ?string
{
return $this->email;
}
public function setEmail(string $email): self
{
$this->email = $email;
return $this;
}
public function getRoles(): array
{
$roles = $this->roles;
return $roles;
}
public function setRoles(array $roles): self
{
$this->roles = $roles;
return $this;
}
/**
* #see UserInterface
*/
public function eraseCredentials()
{
// If you store any temporary, sensitive data on the user, clear it here
$this->password = null;
}
public function getFirstname(): ?string
{
return $this->firstname;
}
public function setFirstname(?string $firstname): self
{
$this->firstname = $firstname;
return $this;
}
public function getLastname(): ?string
{
return $this->lastname;
}
public function setLastname(?string $lastname): self
{
$this->lastname = $lastname;
return $this;
}
}
If I used update-user endpoint, failed error because i not send my password.
Can you help me?
Thanx all.

Answer 1

The "Symfony way" to handle this, is using 2 fields: password and plainPassword. This is Symfony best practice in general.
<?php
use Symfony\Component\Serializer\Annotation\Groups;
/**
* #ApiResource(
* normalizationContext={"groups"={"user"}},
* denormalizationContext={"groups"={"user"}}
* )
* #ORM\EntityListeners({"App\Listener\Entity\UserEntityListener"})
*/
class User
{
/**
* #ORM\Column(type="string", length=255)
*/
private $password; // This field should NEVER be exposed.
/**
* #Assert\Length(min="8", max="22") // Apply validation here, not on $password
* #Groups({"user"}) // Expose using groups
*/
private $plainPassword;
Next, create an entity listener (or any api platform event listener) to change password if plainPassword is not empty.
<?php
namespace App\Listener\Entity;
use App\Entity\User;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface
class UserEntityListener
{
private UserPasswordEncoderInterface $passwordEncoder;
public function __construct(
UserPasswordEncoderInterface $passwordEncoder
) {
$this->passwordEncoder = $passwordEncoder;
}
/**
* #ORM\PrePersist()
* #ORM\PreUpdate()
*/
public function preUpdateHandler(User $user): void
{
if ($user->getPlainPassword() !== null) {
$password = $this->passwordEncoder->encodePassword($user, $user->getPlainPassword());
$user->setPassword($password);
}
}
}
If you want different itemOperations to change password, you can still do so by changing the groups.