diff --git a/api/src/Doctrine/FilterByCurrentUserExtension.php b/api/src/Doctrine/FilterByCurrentUserExtension.php index 4a1cf62edb..a2b1f65b39 100644 --- a/api/src/Doctrine/FilterByCurrentUserExtension.php +++ b/api/src/Doctrine/FilterByCurrentUserExtension.php @@ -22,6 +22,11 @@ public function __construct(Security $security, EntityManagerInterface $entityMa } public function applyToCollection(QueryBuilder $queryBuilder, QueryNameGeneratorInterface $queryNameGenerator, ?string $resourceClass = null, ?Operation $operation = null, array $context = []): void { + $extraProperties = $operation->getExtraProperties(); + if (array_key_exists('filter_by_current_user', $extraProperties) && false === $extraProperties['filter_by_current_user']) { + return; + } + $this->addWhere($queryBuilder, $queryNameGenerator, $resourceClass); } diff --git a/api/src/Entity/Activity.php b/api/src/Entity/Activity.php index 6fb0f0d874..69519e711b 100644 --- a/api/src/Entity/Activity.php +++ b/api/src/Entity/Activity.php @@ -58,6 +58,9 @@ ], normalizationContext: self::COLLECTION_NORMALIZATION_CONTEXT, security: 'is_fully_authenticated()', + extraProperties: [ + 'filter_by_current_user' => false, + ] ), new Post( processor: ActivityCreateProcessor::class, diff --git a/api/src/Entity/ActivityProgressLabel.php b/api/src/Entity/ActivityProgressLabel.php index 429ef8f0a2..0f687f381b 100644 --- a/api/src/Entity/ActivityProgressLabel.php +++ b/api/src/Entity/ActivityProgressLabel.php @@ -54,6 +54,9 @@ ), ], security: 'is_fully_authenticated()', + extraProperties: [ + 'filter_by_current_user' => false, + ] ), new Post( validationContext: ['groups' => ['Default', 'create']], diff --git a/api/src/Entity/Category.php b/api/src/Entity/Category.php index 6298d315a8..af5d616886 100644 --- a/api/src/Entity/Category.php +++ b/api/src/Entity/Category.php @@ -66,6 +66,9 @@ security: 'is_granted("CAMP_COLLABORATOR", camp) or is_granted("CAMP_IS_PROTOTYPE", camp)' ), ], + extraProperties: [ + 'filter_by_current_user' => false, + ] ), ], denormalizationContext: ['groups' => ['write']], diff --git a/api/src/Entity/Checklist.php b/api/src/Entity/Checklist.php index 14038b16e4..bca408e6e0 100644 --- a/api/src/Entity/Checklist.php +++ b/api/src/Entity/Checklist.php @@ -65,6 +65,9 @@ security: 'is_granted("CAMP_COLLABORATOR", camp) or is_granted("CAMP_IS_PROTOTYPE", camp)' ), ], + extraProperties: [ + 'filter_by_current_user' => false, + ] ), ], denormalizationContext: ['groups' => ['write']], diff --git a/api/src/Entity/ChecklistItem.php b/api/src/Entity/ChecklistItem.php index a08a45e681..df737b9bc3 100644 --- a/api/src/Entity/ChecklistItem.php +++ b/api/src/Entity/ChecklistItem.php @@ -68,6 +68,9 @@ is_granted("CAMP_COLLABORATOR", checklist)' ), ], + extraProperties: [ + 'filter_by_current_user' => false, + ] ), ], denormalizationContext: ['groups' => ['write']], diff --git a/api/src/Entity/Day.php b/api/src/Entity/Day.php index 51e75a7114..0d36eb85a3 100644 --- a/api/src/Entity/Day.php +++ b/api/src/Entity/Day.php @@ -45,6 +45,9 @@ ], normalizationContext: self::COLLECTION_NORMALIZATION_CONTEXT, security: 'is_fully_authenticated()', + extraProperties: [ + 'filter_by_current_user' => false, + ] ), ], denormalizationContext: ['groups' => ['write']], diff --git a/api/src/Entity/DayResponsible.php b/api/src/Entity/DayResponsible.php index 3d575f359c..1ad82f21b6 100644 --- a/api/src/Entity/DayResponsible.php +++ b/api/src/Entity/DayResponsible.php @@ -41,6 +41,9 @@ security: 'is_granted("CAMP_COLLABORATOR", day) or is_granted("CAMP_IS_PROTOTYPE", day)' ), ], + extraProperties: [ + 'filter_by_current_user' => false, + ] ), new Post( securityPostDenormalize: 'is_granted("CAMP_MEMBER", object) or is_granted("CAMP_MANAGER", object) or object.day === null' diff --git a/api/src/Entity/ScheduleEntry.php b/api/src/Entity/ScheduleEntry.php index de78271400..c3b8a6e808 100644 --- a/api/src/Entity/ScheduleEntry.php +++ b/api/src/Entity/ScheduleEntry.php @@ -54,6 +54,9 @@ ), ], security: 'is_fully_authenticated()', + extraProperties: [ + 'filter_by_current_user' => false, + ] ), new Post( denormalizationContext: ['groups' => ['write', 'create']], diff --git a/api/tests/Api/Activities/ListActivitiesTest.php b/api/tests/Api/Activities/ListActivitiesTest.php index b6133e6188..47f2c2be6c 100644 --- a/api/tests/Api/Activities/ListActivitiesTest.php +++ b/api/tests/Api/Activities/ListActivitiesTest.php @@ -59,7 +59,7 @@ public function testListActivitiesFilteredByCampIsAllowedForCollaborator() { ], $response->toArray()['_links']['items']); } - public function testListActivitiesByCampSubresourceIsAllowedForCollaborator() { + public function testListActivitiesAsCampSubresourceIsAllowedForCollaborator() { $camp = static::getFixture('camp1'); $response = static::createClientWithCredentials()->request('GET', "/camps/{$camp->getId()}/activities"); $this->assertResponseStatusCodeSame(200); @@ -78,6 +78,12 @@ public function testListActivitiesByCampSubresourceIsAllowedForCollaborator() { ], $response->toArray()['_links']['items']); } + public function testListActivitiesAsCampSubresourceIsDeniedForUnrelatedUser() { + $camp = static::getFixture('camp1'); + $response = static::createClientWithCredentials(['email' => static::$fixtures['user4unrelated']->getEmail()])->request('GET', "/camps/{$camp->getId()}/activities"); + $this->assertResponseStatusCodeSame(404); + } + public function testListActivitiesFilteredByCampIsDeniedForUnrelatedUser() { $camp = static::getFixture('camp1'); $response = static::createClientWithCredentials(['email' => static::$fixtures['user4unrelated']->getEmail()]) diff --git a/api/tests/Api/ActivityProgressLabel/ListActivityProgressLabelTest.php b/api/tests/Api/ActivityProgressLabel/ListActivityProgressLabelTest.php index 369e5c3559..7f5ad578ac 100644 --- a/api/tests/Api/ActivityProgressLabel/ListActivityProgressLabelTest.php +++ b/api/tests/Api/ActivityProgressLabel/ListActivityProgressLabelTest.php @@ -86,6 +86,14 @@ public function testListActivityProgressLabelsAsSubresourceOfCampIsAllowedForCol ], $response->toArray()['_links']['items']); } + public function testListActivityProgressLabelsAsSubresourceOfCampIsDeniedForUnrelatedUser() { + $camp = static::getFixture('camp1'); + $response = static::createClientWithCredentials(['email' => static::$fixtures['user4unrelated']->getEmail()]) + ->request('GET', "/camps/{$camp->getId()}/activity_progress_labels") + ; + $this->assertResponseStatusCodeSame(404); + } + public function testListActivityProgressLabelsFilteredByCampIsDeniedForUnrelatedUser() { $camp = static::getFixture('camp1'); $response = static::createClientWithCredentials(['email' => static::$fixtures['user4unrelated']->getEmail()])