Skip to content

Commit 04c30b7

Browse files
soyukaclaude
soyuka
and
claude
committed
fix(jsonapi): prevent double unwrapping of data.attributes with input DTOs
| Q | A | ------------- | --- | Branch? | 4.2 | Tickets | Fixes #7794 | License | MIT | Doc PR | ∅ * When re-entering the serializer for input DTO denormalization, the data has already been unwrapped from the JSON:API `data.attributes` structure. * Without this guard, JsonApi\ItemNormalizer::denormalize() runs a second time on flat data, reads `$data['data']['attributes']` → null, and nulls every DTO property. * Skip JSON:API extraction when `api_platform_input` context flag is set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent c6236f3 commit 04c30b7

9 files changed

Lines changed: 344 additions & 1 deletion

File tree

‎src/JsonApi/Serializer/ItemNormalizer.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,12 @@ public function supportsDenormalization(mixed $data, string $type, ?string $form
169169
*/
170170
public function denormalize(mixed $data, string $class, ?string $format = null, array $context = []): mixed
171171
{
172+
// When re-entering for input DTO denormalization, data has already been
173+
// unwrapped from the JSON:API structure by the first pass. Skip extraction.
174+
if (isset($context['api_platform_input'])) {
175+
return parent::denormalize($data, $class, $format, $context);
176+
}
177+
172178
// Avoid issues with proxies if we populated the object
173179
if (!isset($context[self::OBJECT_TO_POPULATE]) && isset($data['data']['id'])) {
174180
if (true !== ($context['api_allow_update'] ?? true)) {

‎src/JsonApi/Tests/Fixtures/InputDto.php‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the API Platform project.
5+
*
6+
* (c) Kévin Dunglas <dunglas@gmail.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
declare(strict_types=1);
13+
14+
namespace ApiPlatform\JsonApi\Tests\Fixtures;
15+
16+
final class InputDto
17+
{
18+
public string $title = '';
19+
public string $body = '';
20+
}

‎src/JsonApi/Tests/Serializer/ItemNormalizerTest.php‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
use ApiPlatform\JsonApi\Serializer\ReservedAttributeNameConverter;
1818
use ApiPlatform\JsonApi\Tests\Fixtures\CircularReference;
1919
use ApiPlatform\JsonApi\Tests\Fixtures\Dummy;
20+
use ApiPlatform\JsonApi\Tests\Fixtures\InputDto;
2021
use ApiPlatform\JsonApi\Tests\Fixtures\RelatedDummy;
2122
use ApiPlatform\Metadata\ApiProperty;
2223
use ApiPlatform\Metadata\ApiResource;
@@ -38,6 +39,7 @@
3839
use Symfony\Component\PropertyAccess\PropertyAccessorInterface;
3940
use Symfony\Component\Serializer\Exception\NotNormalizableValueException;
4041
use Symfony\Component\Serializer\Exception\UnexpectedValueException;
42+
use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
4143
use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
4244
use Symfony\Component\Serializer\Serializer;
4345
use Symfony\Component\Serializer\SerializerInterface;
@@ -577,4 +579,87 @@ public function testNormalizeWithNullToOneAndEmptyToManyRelationships(): void
577579
$this->assertArrayHasKey('relatedDummies', $result['data']['relationships']);
578580
$this->assertSame(['data' => []], $result['data']['relationships']['relatedDummies']);
579581
}
582+
583+
/**
584+
* Reproducer for https://github.com/api-platform/core/issues/7794.
585+
*
586+
* When a resource uses an input DTO, AbstractItemNormalizer::denormalize() re-enters
587+
* the serializer with the already-unwrapped (flat) data plus an 'api_platform_input'
588+
* context flag. Without the guard, JsonApi\ItemNormalizer::denormalize() runs a second
589+
* time on the flat data, tries to read $data['data']['attributes'] and gets null,
590+
* which nulls every DTO property.
591+
*/
592+
public function testDenormalizeInputDtoDoesNotDoubleUnwrapJsonApiStructure(): void
593+
{
594+
$jsonApiData = [
595+
'data' => [
596+
'type' => 'dummy',
597+
'attributes' => [
598+
'title' => 'Hello',
599+
'body' => 'World',
600+
],
601+
],
602+
];
603+
604+
$propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
605+
$propertyNameCollectionFactoryProphecy->create(Dummy::class, Argument::any())->willReturn(new PropertyNameCollection([]));
606+
$propertyNameCollectionFactoryProphecy->create(InputDto::class, Argument::any())->willReturn(new PropertyNameCollection(['title', 'body']));
607+
608+
$propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
609+
$propertyMetadataFactoryProphecy->create(InputDto::class, 'title', Argument::any())->willReturn((new ApiProperty())->withNativeType(Type::string())->withReadable(true)->withWritable(true));
610+
$propertyMetadataFactoryProphecy->create(InputDto::class, 'body', Argument::any())->willReturn((new ApiProperty())->withNativeType(Type::string())->withReadable(true)->withWritable(true));
611+
612+
$iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
613+
614+
$propertyAccessorProphecy = $this->prophesize(PropertyAccessorInterface::class);
615+
$propertyAccessorProphecy->setValue(Argument::type(InputDto::class), Argument::type('string'), Argument::any())
616+
->will(static function ($args): void {
617+
$args[0]->{$args[1]} = $args[2];
618+
});
619+
620+
$resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
621+
$resourceClassResolverProphecy->getResourceClass(null, Dummy::class)->willReturn(Dummy::class);
622+
$resourceClassResolverProphecy->isResourceClass(Dummy::class)->willReturn(true);
623+
$resourceClassResolverProphecy->isResourceClass(InputDto::class)->willReturn(false);
624+
$resourceClassResolverProphecy->getResourceClass(null, InputDto::class)->willReturn(InputDto::class);
625+
626+
$resourceMetadataCollectionFactory = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
627+
$resourceMetadataCollectionFactory->create(Dummy::class)->willReturn(new ResourceMetadataCollection(Dummy::class, [
628+
(new ApiResource())->withOperations(new Operations([new Get(name: 'get')])),
629+
]));
630+
631+
$normalizer = new ItemNormalizer(
632+
$propertyNameCollectionFactoryProphecy->reveal(),
633+
$propertyMetadataFactoryProphecy->reveal(),
634+
$iriConverterProphecy->reveal(),
635+
$resourceClassResolverProphecy->reveal(),
636+
$propertyAccessorProphecy->reveal(),
637+
new ReservedAttributeNameConverter(),
638+
null,
639+
[],
640+
$resourceMetadataCollectionFactory->reveal(),
641+
);
642+
643+
// Create a mock serializer that simulates the real serializer chain:
644+
// when re-entering for the input DTO, it calls back into the normalizer.
645+
$serializerProphecy = $this->prophesize(SerializerInterface::class);
646+
$serializerProphecy->willImplement(DenormalizerInterface::class);
647+
$serializerProphecy->willImplement(NormalizerInterface::class);
648+
$serializerProphecy->denormalize(Argument::type('array'), InputDto::class, ItemNormalizer::FORMAT, Argument::type('array'))
649+
->will(static function ($args) use ($normalizer) {
650+
// This simulates the serializer re-entering the normalizer chain
651+
return $normalizer->denormalize($args[0], $args[1], $args[2], $args[3]);
652+
});
653+
654+
$normalizer->setSerializer($serializerProphecy->reveal());
655+
656+
$result = $normalizer->denormalize($jsonApiData, Dummy::class, ItemNormalizer::FORMAT, [
657+
'input' => ['class' => InputDto::class],
658+
'resource_class' => Dummy::class,
659+
]);
660+
661+
$this->assertInstanceOf(InputDto::class, $result);
662+
$this->assertSame('Hello', $result->title);
663+
$this->assertSame('World', $result->body);
664+
}
580665
}

‎src/Serializer/Tests/AbstractItemNormalizerTest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,10 @@
3434
use ApiPlatform\Serializer\AbstractItemNormalizer;
3535
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\DtoWithNullValue;
3636
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\Dummy;
37-
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\DummyWithMultipleRequiredConstructorArgs;
3837
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\DummyTableInheritance;
3938
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\DummyTableInheritanceChild;
4039
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\DummyTableInheritanceRelated;
40+
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\DummyWithMultipleRequiredConstructorArgs;
4141
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\NonCloneableDummy;
4242
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\PropertyCollectionIriOnly;
4343
use ApiPlatform\Serializer\Tests\Fixtures\ApiResource\PropertyCollectionIriOnlyRelation;

‎tests/Fixtures/TestBundle/ApiResource/JsonApiInputDto.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the API Platform project.
5+
*
6+
* (c) Kévin Dunglas <dunglas@gmail.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
declare(strict_types=1);
13+
14+
namespace ApiPlatform\Tests\Fixtures\TestBundle\ApiResource;
15+
16+
/**
17+
* Input DTO for JsonApiInputResource.
18+
*/
19+
final class JsonApiInputDto
20+
{
21+
public string $title = '';
22+
public string $body = '';
23+
}

‎tests/Fixtures/TestBundle/ApiResource/JsonApiInputResource.php‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the API Platform project.
5+
*
6+
* (c) Kévin Dunglas <dunglas@gmail.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
declare(strict_types=1);
13+
14+
namespace ApiPlatform\Tests\Fixtures\TestBundle\ApiResource;
15+
16+
use ApiPlatform\Metadata\Operation;
17+
use ApiPlatform\Metadata\Post;
18+
19+
/**
20+
* Reproducer for https://github.com/api-platform/core/issues/7794.
21+
*
22+
* When using input DTOs with JSON:API format, the JsonApi\ItemNormalizer must
23+
* not unwrap the data twice. On re-entry for the input DTO, the data is already
24+
* flat (attributes have been extracted from the JSON:API structure).
25+
*/
26+
#[Post(
27+
uriTemplate: '/jsonapi_input_test',
28+
formats: ['jsonapi' => ['application/vnd.api+json']],
29+
input: JsonApiInputDto::class,
30+
processor: [self::class, 'process'],
31+
)]
32+
class JsonApiInputResource
33+
{
34+
public ?string $id = null;
35+
public string $title = '';
36+
public string $body = '';
37+
38+
public static function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): self
39+
{
40+
\assert($data instanceof JsonApiInputDto);
41+
42+
$resource = new self();
43+
$resource->id = '1';
44+
$resource->title = $data->title;
45+
$resource->body = $data->body;
46+
47+
return $resource;
48+
}
49+
}

‎tests/Fixtures/TestBundle/ApiResource/JsonApiRequiredFieldsInputDto.php‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the API Platform project.
5+
*
6+
* (c) Kévin Dunglas <dunglas@gmail.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
declare(strict_types=1);
13+
14+
namespace ApiPlatform\Tests\Fixtures\TestBundle\ApiResource;
15+
16+
/**
17+
* Input DTO with required constructor args — no defaults, not nullable.
18+
*
19+
* Used to reproduce the Sylius failures where only the first missing
20+
* constructor argument is reported instead of all of them.
21+
*/
22+
final class JsonApiRequiredFieldsInputDto
23+
{
24+
public function __construct(
25+
public string $title,
26+
public int $rating,
27+
public string $comment,
28+
) {
29+
}
30+
}

‎tests/Fixtures/TestBundle/ApiResource/JsonApiRequiredFieldsResource.php‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the API Platform project.
5+
*
6+
* (c) Kévin Dunglas <dunglas@gmail.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
declare(strict_types=1);
13+
14+
namespace ApiPlatform\Tests\Fixtures\TestBundle\ApiResource;
15+
16+
use ApiPlatform\Metadata\Operation;
17+
use ApiPlatform\Metadata\Post;
18+
19+
/**
20+
* Resource using an input DTO with required constructor arguments.
21+
*
22+
* Tests that all missing constructor arguments are reported (not just the first).
23+
*/
24+
#[Post(
25+
uriTemplate: '/jsonapi_required_fields_test',
26+
formats: ['jsonapi' => ['application/vnd.api+json']],
27+
input: JsonApiRequiredFieldsInputDto::class,
28+
processor: [self::class, 'process'],
29+
)]
30+
class JsonApiRequiredFieldsResource
31+
{
32+
public ?string $id = null;
33+
public string $title = '';
34+
public int $rating = 0;
35+
public string $comment = '';
36+
37+
public static function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): self
38+
{
39+
\assert($data instanceof JsonApiRequiredFieldsInputDto);
40+
41+
$resource = new self();
42+
$resource->id = '1';
43+
$resource->title = $data->title;
44+
$resource->rating = $data->rating;
45+
$resource->comment = $data->comment;
46+
47+
return $resource;
48+
}
49+
}

0 commit comments

Comments
 (0)