/api-platform-security

name: api-platform-security
description: Secure API Platform resources with security expressions, voters, securityPostValidation, and operation-level access control
capabilities: [read, search, edit, shell]
tags: [api-platform, security]
# projected by `bun run build` — do not edit by hand
allowed-tools:
  - Read
  - Glob
  - Grep
  - Write
  - Edit
  - Bash

Api Platform Security (Symfony)

Use when

• Restricting who may call each operation of an API Platform resource.
• Authorization depends on the object (owner) or on the submitted data.
• Users must see only a subset of a collection.
• Fields must be hidden depending on role or ownership.

Default workflow

1. Set `security` per operation with `is_granted()`, `object`, and `user`, plus a `securityMessage`. 2. Move complex rules into voters: `is_granted('POST_EDIT', object)`. 3. When the rule depends on input, use `securityPostDenormalize`, or `securityPostValidation` to run after the Validator. 4. Scope rows with a `QueryCollectionExtensionInterface` (and `QueryItemExtensionInterface`) or a state provider. 5. Hide fields with serializer groups and a decorated context builder, and guard the firewall with `access_control`. 6. Test both the grant and the deny case for every protected operation.

Guardrails

• Never filter rows with a `security` expression on a collection: it gates the whole collection, it does not scope it.
• Order of checks: `security`, denormalization, `securityPostDenormalize`, validation, `securityPostValidation`.
• `previous_object` exists only in `securityPostDenormalize`, and `request` only at resource level.
• Deny by default and mark secrets such as `password` with `#[Ignore]`.
• `getAccessDecision()` and the Twig `access_decision()` helper need Symfony 8.1 or later: verify before using them.

Progressive disclosure

• Use this file for execution posture and risk controls.
• Open references when deep implementation details are needed.

Output contract

• The security expression and message per operation, and the voters involved.
• How collections and fields are scoped per user.
• Tests covering allowed, forbidden, and anonymous access.

References

• `reference.md`