Symfony #ParamConverter get entity through user relationship - php

Question

I have several routes that start with /experiment/{id}/... and I'm tired of rewriting the same logic to retrieve the signed in user's experiment. I guess I could refactor my code but I'm guessing #ParamConverter would be a better solution.
How would I rewrite the following code to take advantage of Symfony's #ParamConverter functionality?
/**
* Displays details about an Experiment entity, including stats.
*
* #Route("/experiment/{id}/report", requirements={"id" = "\d+"}, name="experiment_report")
* #Method("GET")
* #Template()
* #Security("has_role('ROLE_USER')")
*/
public function reportAction(Request $request, $id)
{
$em = $this->getDoctrine()->getManager();
$experiment = $em->getRepository('AppBundle:Experiment')
->findOneBy(array(
'id' => $id,
'user' => $this->getUser(),
));
if (!$experiment) {
throw $this->createNotFoundException('Unable to find Experiment entity.');
}
// ...
}
Experiment entities have composite primary keys as follows:
class Experiment
{
/**
* #var integer
*
* #ORM\Column(name="id", type="integer")
* #ORM\Id
*/
protected $id;
/**
* #var integer
*
* #ORM\Column(name="user_id", type="integer")
* #ORM\Id
*/
protected $userId;
/**
* #ORM\ManyToOne(targetEntity="UserBundle\Entity\User", inversedBy="experiments", cascade={"persist"})
* #ORM\JoinColumn(name="user_id", referencedColumnName="id")
*/
protected $user;
// ..
}
I want to retrieve a signed in user's experiment using their user id and an experiment id in the route.

Answer 1

You can achieve that by using custom ParamConverter. For example something like that:
namespace AppBundle\Request\ParamConverter;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\ParamConverter;
use Sensio\Bundle\FrameworkExtraBundle\Request\ParamConverter\ParamConverterInterface;
use Doctrine\ORM\EntityManager;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
use AppBundle\Entity\Experiment;
class ExperimentConverter implements ParamConverterInterface
{
protected $em;
protected $user;
public function __construct(EntityManager $em, TokenStorage $tokenStorage)
{
$this->em = $em;
$this->user = $tokenStorage->getToken()->getUser();
}
public function apply(Request $request, ParamConverter $configuration)
{
$object = $this->em->getRepository(Experiment::class)->findOneBy([
'id' => $request->attributes->get('id'),
'user' => $this->user
]);
if (null === $object) {
throw new NotFoundHttpException(
sprintf('%s object not found.', $configuration->getClass())
);
}
$request->attributes->set($configuration->getName(), $object);
return true;
}
public function supports(ParamConverter $configuration)
{
return Experiment::class === $configuration->getClass();
}
}
You need to register your converter service and add a tag to it:
# app/config/config.yml
services:
experiment_converter:
class: AppBundle\Request\ParamConverter\ExperimentConverter
arguments:
- "#doctrine.orm.default_entity_manager"
- "#security.token_storage"
tags:
- { name: request.param_converter, priority: 1, converter: experiment_converter }

Answer 2

Unfortunately, you can't inject the currently logged in users id into the param converter, unless you actually pass it as a parameter in the url.
You could create your own converter, but I think your best bet would be to just create a protected method for fetching the experiment. It will be just as easy to use and maintain as an annotation:
protected function getCurrentUsersExperiment($experimentId)
{
return $this->getDoctrine()->getManager()->getRepository('AppBundle:Experiment')
->findOneBy(array(
'id' => $experimentId,
'user' => $this->getUser()
));
}
public function reportAction(Request $request, $id)
{
$experiment = $this->getCurrentUsersExperiment($id);
...
}
As it's noted in the symfony best practices: use ParamFetcher whenever appropriate, but don't overthink it.

Answer 3

While the question already has an answer, I'd like to add my two cents to it:
It looks like you may be solving a wrong problem: is your objective to prevent access to other user's experiments? If so, just load the Experiment object, and use a Security Voter to determine whether the current user can access the experiment or not.
Using the param converter the way you want will throw a 404 error instead of 401, with the same ultimate result: access to other people's experiments is denied. Unless you're trying to conceal the existence of a particular experiment ID, you might as well return a HTTP response reflecting the actual situation - 401, not 404. I would argue that obscuring the existence of some ID has probably no real benefit.
If nothing else, then using the security voter to deny access sounds like more fit-for-purpose and reusable approach in Symfony context, comparing to a homebrew param converter.
If you don't want to use a security voter, you could also get away with using an expression: if your Experiment's repository class was autowiring the Security object, you would be able to fetch the current user from the repository class. If that repository class has a method findCurrentUserExperiment(int $id), the usage would be close to:
/**
* #Route("/experiment/{experiment}/report", requirements={"experiment" = "\d+"}, name="experiment_report")
* #Entity("experiment", expr="repository.findCurrentUserExperiment(experiment)")
*/
public function reportAction(Request $request, ?Experiment $experiment)
I still think that a security voter is a better fit, but at least with the expression you wouldn't have to manage a narrow-use-case ParamConverter.