Airone2000

// Refer to https://gist.github.com/remy/350433
try {
    // Test webstorage existence.
    if (!window.localStorage || !window.sessionStorage) throw "exception";
    // Test webstorage accessibility - Needed for Safari private browsing.
    localStorage.setItem('storage_test', 1);
    localStorage.removeItem('storage_test');
} catch(e) {
    (function () {
        var Storage = function (type) {

Airone2000

// Refer to https://gist.github.com/remy/350433
try {
    // Test webstorage existence.
    if (!window.localStorage || !window.sessionStorage) throw "exception";
    // Test webstorage accessibility - Needed for Safari private browsing.
    localStorage.setItem('storage_test', 1);
    localStorage.removeItem('storage_test');
} catch(e) {
    (function () {
        var Storage = function (type) {

Airone2000

https://stackoverflow.com/questions/47713642/api-platform-how-secure-custom-operation
https://symfony.com/doc/current/security/voters.html

Extending request to fit our needs :
https://api-platform.com/docs/core/data-providers/#data-providers
https://api-platform.com/docs/core/extensions

A priori, I only must write the extension and register it so that APIPlatform internal machanism can automatically extend the request for a route.
Let's test it!

Airone2000

Given I have a User entity and a Profile entity.
A User has a Profile (OneToOne).

When I send a POST request to "/users", with body:
"""
{
  "username": "Erwan29",
  "profile": {
    "firstname": "Erwan",
    "lastname": "Guillou"

Airone2000

<?php

declare(strict_types=1);

namespace ApiPlatform\Workflow\PathResolver;

use ApiPlatform\Core\PathResolver\OperationPathResolverInterface;

final class OperationPathResolver implements OperationPathResolverInterface
{