Api Platform Extensions Laravel Package

Product Decisions This Supports

• API Security & Role-Based Access Control (RBAC):

  • Enable granular admin-level permissions (e.g., admin:read, admin:write) via AdminGroupsContextBuilder to restrict API responses dynamically. Aligns with roadmaps for internal admin dashboards or B2B portals requiring role-specific data exposure.
  • Build vs. Buy: Avoids reinventing serialization logic for admin contexts, reducing dev effort for security-sensitive APIs.

• API Performance Optimization:

  • Extend API Platform’s core functionality without bloating custom code (e.g., leveraging existing decorators for context builders). Supports scaling APIs with minimal overhead.
  • Use Case: Microservices or headless CMS backends where admin APIs must serve filtered data without full entity exposure.

• Symfony/Ecosystem Integration:

  • Low-risk adoption due to compatibility with Symfony 4/5 and API Platform 2.5+. Ideal for teams already using these stacks, reducing integration friction.
  • Roadmap: Justify inclusion in monorepos where API Platform is the standard for internal tools (e.g., dev portals, analytics APIs).

• Compliance & Auditability:

  • MIT-licensed, open-source solution for teams prioritizing transparency in permission logic. Useful for regulated industries (e.g., fintech, healthcare) where audit trails for data access are critical.

When to Consider This Package

• Avoid if:

  • Your team requires active maintenance or enterprise support (last release: 2022-02-07; low stars/downloads suggest limited community backing).
  • You need advanced RBAC (e.g., nested roles, dynamic group resolution)—consider dedicated packages like api-platform/attribute or custom solutions.
  • Your stack uses PHP <7.1 or Symfony <4.0 (hard dependency).
  • You prioritize documentation or modern tooling (package lacks recent updates, tests, or detailed guides).

• Look elsewhere if:

  • You need GraphQL extensions (API Platform’s core GraphQL support is more mature).
  • Your use case involves real-time APIs (WebSocket/gRPC)—this package focuses on HTTP/REST.
  • You require multi-tenancy or fine-grained field-level permissions (e.g., per-attribute access control).

How to Pitch It (Stakeholders)

For Executives: "This lightweight, MIT-licensed package adds admin-level security controls to our API Platform stack with minimal dev effort. By enabling role-based data filtering (e.g., hiding sensitive fields from non-admin users), we can secure internal tools like the [Admin Dashboard] without custom builds. Low risk—integrates seamlessly with our existing Symfony/API Platform setup, and the MIT license aligns with our open-source policy. Estimated time savings: [X] dev-weeks vs. building from scratch."

For Engineering: *"The AdminGroupsContextBuilder decorator lets us dynamically attach admin:read/admin:write groups to API responses, reducing boilerplate for serialization contexts. Key benefits:

• No core API Platform changes needed (decorates existing context builder).
• Symfony 5 + API Platform 2.5+ compatible—no version conflicts.
• Lightweight (~500 LOC; MIT license). Tradeoff: Limited maintenance (last update 2022), but ideal for short-term gains on admin APIs. Suggest pairing with [package X] for long-term RBAC needs."*

For Developers: *"This gives us a drop-in way to hide admin-only fields from non-privileged users. Example:

# config/services.yaml
AVKluchko\ApiPlatformExtensions\Serializer\AdminGroupsContextBuilder:
    decorates: 'api_platform.serializer.context_builder'

Now, entities with @Groups({"admin:read"}) will only serialize for admin roles. Perfect for:

• Internal APIs where admins need full data but users see sanitized outputs.
• Avoiding custom DTOs for simple permission logic. Caveat: No tests or docs beyond the README—expect to debug edge cases (e.g., group precedence)."*