core icon indicating copy to clipboard operation
core copied to clipboard

POST request should ignore "id" in the payload

Open iurciuc opened this issue 2 years ago • 1 comments

API Platform version(s) affected: 3.2

Description
Sending POST request with "id" field returns 400 response with this text "Update is not allowed for this operation.", even if $id in entity does not have any groups.

How to reproduce
Send POST request with "id": "" in payload.

declare(strict_types=1);

namespace App\Entity;

#[ORM\Entity]
#[ApiResource(
    operations: [
        new Get(),
        new Post(),
    ],
    normalizationContext: ['groups' => [TestEntity::GROUP_READ]],
    denormalizationContext: ['groups' => [TestEntity::GROUP_WRITE]]
)]
class TestEntity
{
    public const GROUP_WRITE = 'test_entity:write';
    public const GROUP_READ = 'test_entity:read';

    #[ApiProperty(identifier: true, example: '123e4567-e89b-12d3-a456-426614174000')]
    #[ORM\Id]
    #[ORM\Column(type: 'uuid', unique: true)]
    #[ORM\GeneratedValue(strategy: 'CUSTOM')]
    #[ORM\CustomIdGenerator(class: UuidV7Generator::class)]
    #[Groups([TestEntity::GROUP_READ])]
    private UuidInterface $id;

// some other fields
}

Expected behaviour Field "id" in POST request was ignored.

iurciuc avatar Jan 15 '24 10:01 iurciuc

Not sure about this I guess if there's an id we try to update but as there's nothing to update it fails. Does that occurs during deserialization? You could set read: true and return a dummy object inside a provider. Or maybe just use JSON. Anyways this doesn't look as a bug and there isn't enough information: content-type, stack trace, reproducer etc.

soyuka avatar Jan 15 '24 13:01 soyuka