Core: Different denormalization context for operations

[polc]

I'm creating my API and building my user system (I don't use FosUser).

For registering, I have my endpoint POST /api/users with 2 parameters: email *_and *_plainPassword

Now I want the user to be able to edit his email. But the endpoint PUT /api/users/{id} is not valid because he have the same denormalization context than POST. I only want this endpoint to have one argument (email). And I don't want to replace the user, just to update it.

Any piste is welcomed !

[teohhanhui]

With v2 you are able to have per-operation normalization / denormalization context.

But in your case, perhaps you could add a Symfony Validator constraint to check that plainPassword must be accompanied by the correct current password (assuming that's what you're trying to achieve).

[polc]

Good idea, but then I will be unable to edit a user without knowing his password (it's a problem if I'm editing as an admin for example).

Do you think it's worth switching to v2 now ? it's for a little project not very important.

[teohhanhui]

You could check roles (by injecting security.authorization_checker) if you create a custom validation constraint. There are many ways to skin the cat...

As for v2, I think it's almost there... I've been using it for a while now. It'll certainly be welcome if more people would experiment with it and hopefully contribute patches :smile:

[soyuka]

There are many ways to skin the cat...

Well said!

FYI, we talked about voters and authorization in #395.

[polc]

:+1: thanks guys, i will go for v2 :)