Api-platform: Can properties be restricted based on access control?

[mikemilano]

I would like to know the most idiomatic way to approach restricting properties based on user role, or other access control. I haven't had luck in the docs or slack so far.

For example: On the User resource, I'd like the roles property to only be accessible to admin users.

The use case would be for building an app where admins can manage other user's roles. Users could also view limited details about each other (their profile), and I'd like to restrict their roles from being exposed here.

Is this possible? and if so, what's the most idiomatic approach?

[soyuka]

This should do it: https://api-platform.com/docs/core/serialization/#changing-the-serialization-context-dynamically

TLDR: use dynamic groups with a context based on access control to restrict properties

[teohhanhui]

Duplicate of #773

[mikemilano]

That looks like it will do, thanks!