How to add new entry in a ManyToMany?

[vincentchalamon]

I have a User entity linked with a bidirectional ManyToMany association to an Event entity: an event have users registered, and it's possible to get a user events through an ApiSubresource.

When a user wants to register to an event, I should update the event to add the user:

PUT /events/{id}
{
    "users": [
        "/users/1",
        "/users/2",
        …
        "/users/8888" <- the user who wants to register
    ]
}

This could also be done by adding the event to the user:

PUT /users/{id}
{
    "events": [
        "/events/1",
        "/events/2",
        …
        "/events/8888" <- the event the user wants to register
    ]
}

In the first example, I'll expose the users id, which could be a security issue. In the second example, I'll have to find all the user events id which is not optimized.
To optimize this process, I've created a custom entry-point PUT /events/{id}/register to register the current user to the event.

It would be awesome to allow to send a write request to my ApiSubresource to add an event without reminding all previous events, for instance:

PUT /users/12345/events
{
    "@id": "/events/67890"
}

And to remove an event from this ApiSubresource: DELETE /users/12345/events/67890

What do you think @api-platform/core-team ?

[soyuka]

Writability on subresource is a wanted/needed/interesting feature indeed, it should not be too hard to implement now. Feel free to work on it if you have the time!

[hassanjuniedi]

@vincentchalamon that's great, am in the middle of similar problem and am trying to create custom api entry but with no success , can you please post an example of how you created custom action for PUT /events/{id}/register
note: the entry am trying to accomplish is like this /products/{id}/add-comment , i have to pass product id and comment object or comment id but inside the _invoke function how to get this data .

[vincentchalamon]

Hi @hassanjuniedi, my case changed a little bit as I need a more complex object to register a user to an event. I've created a Registration entity, and am able to send a POST request to /registrations to register a user to an event.

In your case, I think you confuse the front routing and the api routing: you don't need to restrict the comment creation url under /products. IMO, the easiest way would be to send a POST request to /comments.

If you really need to send a POST request to /products/{id}/comments, you'll need to create a custom route:

products_add_comment:
    path: /products/{id}/comments
    controller: api_platform.action.placeholder
    methods: [POST]

Then, add an itemOperation on your Product entity:

/**
 * @ApiResource(attributes={...}, itemOperations={
 *     ...
 *     "add_comment"={"route_name"="products_add_comment"}
 * })
 */
class Product

Finally, you can manage everything in an EventSubcriber listening to kernel.request & kernel.view events:

services:
    App\EventSubscriber\ProductsAddCommentEventSubscriber:
        autoconfigure: true
        autowire: true

public function ProductsAddCommentEventSubscriber implements EventSubscriber
{
    private $serializer;

    public function __construct(SerializerInterface $serializer)
    {
        $this->serializer = $serializer;
    }

    // ...Register events (be careful with priorities!)

    public function deserializeCommentOnKernelRequest($event)
    {
        $request = $event->getRequest();
        if ('products_add_comment' !== $request->attributes->get('_route')) {
            return;
        }
        // Deserialize Comment from $request->getContent();
        // Validate Comment, then throw an exception (status code 400) if invalid
        $request->attributes->set('data', $comment);
    }

    public function saveCommentOnKernelView($event)
    {
        $request = $event->getRequest();
        if ('products_add_comment' !== $request->attributes->get('_route')) {
            return;
        }
        // Persist/flush Comment from $event->getControllerResult();
    }
}

In order to use API Platform EventSubscribers to serialize your Comment object & prepare Response, you may need to add some parameters in your route, like _api_resource_class & _api_item_operation_name.

I let you do the rest of the code 😉Let me know if you have any question about this example.

[hassanjuniedi]

@vincentchalamon thanks for your quick reply and helpful explanation,but i think i need something little different . /comments is working fine but in may case i use many-to-many relationship between product and comment to use join table to link product with comments
Note: I used this approach because i use same comment entity with multiple other entities.

//Product Entity
/**
     * @ORM\ManyToMany(targetEntity="AppBundle\Entity\Comment")
     * @ORM\JoinTable(
     *     name="product_comments",
     *     joinColumns={@ORM\JoinColumn(name="product_id", referencedColumnName="id")},
     *     inverseJoinColumns={@ORM\JoinColumn(name="comment_id", referencedColumnName="id", unique=true)}
     *     )
     */
    private $comments;

/**
 * Comment
 *
 * @ApiResource
 * @ORM\Table(name="comment")
 * @ORM\Entity(repositoryClass="AppBundle\Repository\CommentRepository")
 */
class Comment
{
    /**
     * @var int
     *
     * @ORM\Column(name="id", type="integer")
     * @ORM\Id
     * @ORM\GeneratedValue(strategy="AUTO")
     */
    private $id;

    /**
     * @var string
     *
     * @ORM\Column(name="author_name", type="string", length=255)
     */
    private $authorName;

    /**
     * @var string|null
     *
     * @ORM\Column(name="author_avatar", type="string", length=255)
     */
    private $authorAvatar;

    /**
     * @var string
     *
     * @ORM\Column(name="author_username", type="string", length=255)
     */
    private $authorUsername;

    /**
     * @var string
     *
     * @ORM\Column(name="text", type="text")
     */
    private $text;

    /**
     * @var \DateTime
     *
     * @ORM\Column(name="create_date", type="datetime")
     */
    private $createDate;

    /**
     * @var string
     *
     * @ORM\Column(name="comment_on", type="string", length=255)
     */
    private $commentOn;

    /**
     * @var string
     *
     * @ORM\Column(name="post_slug", type="string", length=255)
     */
    private $postSlug;


    /**
     * @ORM\ManyToOne(targetEntity="AppBundle\Entity\Comment", inversedBy="replies")
     * @ORM\JoinColumn(name="parent_id", referencedColumnName="id" , nullable=true, onDelete="cascade")
     */
    private $parent;

    /**
     * @ORM\OneToMany(targetEntity="AppBundle\Entity\Comment", mappedBy="parent")
     */
    private $replies;

// product_add_comment Action
class productAddComment
{
    /**
     * @Route(
     *     name="product_add_comment",
     *     path="/products/{id}/add-comment",
     *     defaults={
     *          "_api_resource_class"=Comment::Class,
     *          "_api_item_operation_name"="add_comment",
     *          "_api_receive"="false"
     *     }
     * )
     * @Method("PUT")
     * @param Comment $data
     * @return mixed
     */
    public function _invoke(Comment $data) {
        dump($data);
        // here i need to get comment and product objects and link them together .
        return $data;
    }
}

i just need a way to pass comment @id and product @id so i can add comment to product and persist it to database (in join table). i hope that i delivered my issue clearly, thanks in advance .

[vincentchalamon]

OK so maybe you should use a meta-model like:

class Comment
{
    private $objectId;
    private $objectClass;
    private $author;
    private $createdAt;
    private $updatedAt;
    private $comment;

    public function setObject($object)
    {
        $this->setObjectId($object->getId());
        $this->setObjectClass(get_class($object));
    }
}

Then, you could send a POST request to /products/{id}/comments:

{
    "comment": "Lorem ipsum dolor sit amet"
}

In this example, author can be filled by an EventSubscriber listening to kernel.request event with a high priority (check EventPriorities), and get the current user from the tokenStorage. Product can be retrieve from the request attributes.

public function ProductsAddCommentEventSubscriber implements EventSubscriber
{
    private $serializer;

    public function __construct(SerializerInterface $serializer)
    {
        $this->serializer = $serializer;
    }

    // ...Register events (be careful with priorities!)

    public function deserializeCommentOnKernelRequest($event)
    {
        $request = $event->getRequest();
        if ('products_add_comment' !== $request->attributes->get('_route')) {
            return;
        }
        // Deserialize Comment from $request->getContent();
        // If you set correctly the priorities, you should have a `data` request attribute which correspond to the Product (or related object)
        $comment->setObject($request->attributes->get('data'));
        $request->attributes->set('comment', $comment);
    }
}

class ProductAddComment
{
    /**
     * @Route(
     *     name="product_add_comment",
     *     path="/products/{id}/add-comment",
     *     defaults={
     *          "_api_resource_class"=Comment::Class,
     *          "_api_item_operation_name"="add_comment",
     *          "_api_receive"="false"
     *     }
     * )
     * @Method("PUT")
     */
    public function __invoke(Product $data, Comment $comment): Comment
    {
        return $comment;
    }
}

Note: I didn't have the time & opportunity to test this code, so I hope it'll work. Otherwise, it illustrates the approach :-)

[hassanjuniedi]

Thank you a lot , i will try this approach and let you know .

[hassanjuniedi]

I tried to get the request object using event listener and i succeed with that approach , but then i figure out a better approach as shown in the code below.
now i can get the request data and manipulate it inside action class and that's what i wanted exactly.
@vincentchalamon thanks for your help .

<?php
//AppBundle/Action/PutComments.php

class PutComments
{
    private $request;
    private $serializer;
    private $validator;
    private $em;

    public function __construct(
        RequestStack $requestStack,
        SerializerInterface $serializer,
        ValidatorInterface $validator,
        EntityManagerInterface $em)
    {
        $this->request = $requestStack->getCurrentRequest();
        $this->serializer = $serializer;
        $this->validator = $validator;
        $this->em = $em;
    }

    /**
     * @Route(
     *     name="product_put_comments",
     *     path="/products/{id}/comments.{_format}",
     *     defaults={
     *          "_format"="jsonld",
     *          "_api_resource_class"=Product::Class,
     *          "_api_item_operation_name"="put_comments",
     *     }
     * )
     * @Method("PUT")
     * @param Product $product
     * @return mixed
     */
    public function _invoke(Product $product) {

        $content = $this->request->getContent();
        $format = $this->request->attributes->get('_format');
        if (!empty($content)) {
            $comment = $this->serializer->deserialize($content,Comment::class, $format);
            $errors = $this->validator->validate($comment);
            if (count($errors) > 0 ) {
                $output = array();
                foreach ($errors as $error) {
                    $output[$error->getPropertyPath()][] = $error->getMessage();
                }
                return new JsonResponse($output, 400);
            }else {
                $product->addComment($comment);
                $this->em->flush();
            }
        }
        return $product;
    }
}

[vincentchalamon]

👍 but your code could be optimized ;-)

• Be careful that __invoke magic method starts with 2 underscores.
• You shouldn't call ->getCurrentRequest from the constructor, cause the current request might not be initialized yet (for example using cli).
• You can inject the Request object in the __invoke method as every controller action.
• For an optimized code aux petits oignons, you should respect the Symfony Coding Standards, the PSRs & the Insight rules.
• Do not inject the EntityManager as a dependency (cf. Insight rules), please prefer the ManagerRegistry (@doctrine).
• If you tag your service with controller.service_arguments, you can inject all your dependencies in the __invoke method:

//AppBundle/Action/PutComments.php

final class PutComments
{
    /**
     * @Route(
     *     name="product_put_comments",
     *     path="/products/{id}/comments.{_format}",
     *     defaults={
     *          "_format"="jsonld",
     *          "_api_resource_class"=Product::Class,
     *          "_api_item_operation_name"="put_comments",
     *     }
     * )
     * @Method("PUT")
     */
    public function __invoke(Request $request, $format, SerializerInterface $serializer, ValidatorInterface $validator, ManagerRegistry $registry, Product $product)
    {
        $content = $request->getContent();
        if (empty($content)) {
            // Here you should throw an exception if the content is empty
        }

        $comment = $serializer->deserialize($content, Comment::class, $format);
        $errors = $validator->validate($comment);
        if (0 < count($errors)) {
            $output = array();
            foreach ($errors as $error) {
                $output[$error->getPropertyPath()][] = $error->getMessage();
            }

            return new JsonResponse($output, 400);
        }

        $product->addComment($comment);
        $em = $registry->getManagerForClass(Comment::class);
        $em->persist($comment);
        $em->flush();

        return $product;
    }
}

[teohhanhui]

I love the idea, but let's not further misuse PUT. For new features at least, we should make sure we respect the semantics of the HTTP verbs.

[vincentchalamon]

I'm currently working on a PR to implement POST & DELETE requests on an ApiSubresource. But, as @dunglas said, it's out of the REST concept. What do you think @soyuka @teohhanhui @api-platform/core-team: should I continue working on it, or would we consider to not implement such borderline feature in API Platform?

[vincentchalamon]

Ping @api-platform/core-team @dunglas @soyuka @alanpoulain

[alanpoulain]

IMHO: if there is a real need, then it should be done, even if it's not REST. But we should document this feature as to be avoided if possible.