Api Platform Toolkit Bundle Laravel Package

Getting Started

Minimal Setup

1. Installation

   composer require cyberspectrum/api-platform-toolkit-bundle
   

   Add the bundle to config/bundles.php:

   return [
       // ...
       Cyberspectrum\ApiPlatformToolkitBundle\ApiPlatformToolkitBundle::class => ['all' => true],
   ];
   

2. Basic Configuration Enable the bundle in config/packages/api_platform_toolkit.yaml:

   api_platform_toolkit:
       enable_expression_language: true
       lexik_jwt:
           add_documentation: true
           default_ttl: 3600
           login_url: '/api/login_check'
   

3. First Use Case: Custom Expression Language Implement a custom provider for API Platform’s expression language:

   // src/ExpressionLanguage/CustomProvider.php
   namespace App\ExpressionLanguage;
   
   use ApiPlatform\Core\ExpressionLanguage\ExpressionFunctionProviderInterface;
   
   class CustomProvider implements ExpressionFunctionProviderInterface
   {
       public function getFunctions(): array
       {
           return [
               'custom_func' => [$this, 'customFunc'],
           ];
       }
   
       public function customFunc($arg1, $arg2)
       {
           return $arg1 . ' ' . $arg2;
       }
   }
   

   Register it as a tagged service in config/services.yaml:

   services:
       App\ExpressionLanguage\CustomProvider:
           tags:
               - { name: csap_toolkit.security.expression_language }
   

Implementation Patterns

Expression Language Integration

• Dynamic Security Rules Use the expression language to dynamically enforce security rules in API resources:

  // src/Entity/Book.php
  use ApiPlatform\Core\Annotation\Security;
  
  #[Security("is_granted('ROLE_ADMIN') or custom_func('user', 'can_edit')")]
  

• Custom Filtering Extend API Platform’s filtering with custom logic:

  #[ApiFilter(CustomFilter::class, properties: ['customField'])]
  

JWT Handling

• Token TTL Configuration Override default TTL per request via headers or query params:

  # config/packages/lexik_jwt_authentication.yaml
  lexik_jwt_authentication:
      token_extractors:
          - authorization_header
          - query_parameter
  

  Use in API calls:

  GET /api/login_check?ttl=900
  

• Documentation Integration Automatically include JWT login endpoint in Swagger/OpenAPI docs by enabling add_documentation.

Workflow Tips

1. Tagging Services Always tag custom expression providers with csap_toolkit.security.expression_language for automatic registration.

2. JWT Customization Extend LexikJWT’s configuration to support TTL overrides:

   api_platform_toolkit:
       lexik_jwt:
           min_ttl: 60    # Optional: Add min/max TTL constraints
           max_ttl: 86400
   

3. Testing Mock expression providers in tests:

   $container->set('custom_provider', $this->createMock(CustomProvider::class));
   

Gotchas and Tips

Pitfalls

1. Expression Language Scope

   • Custom providers only work with API Platform’s expression language (e.g., @Security annotations).
   • Avoid mixing with Symfony’s native expression language unless explicitly supported.

2. JWT Configuration Conflicts

   • Disabling lexik_jwt in api_platform_toolkit does not remove LexikJWT’s core functionality—only the bundle’s extensions.
   • Ensure lexik_jwt_authentication is properly configured in config/packages/lexik_jwt_authentication.yaml.

3. Tagging Errors

   • Forgetting the exact tag name (csap_toolkit.security.expression_language) will silently ignore your provider.
   • Verify tags with:

     bin/console debug:container csap_toolkit.security.expression_language
     

Debugging

• Expression Language Issues Enable debug mode and check logs for:

  bin/console debug:container --tag=csap_toolkit.security.expression_language
  

  If a provider isn’t loaded, confirm it’s autowired and tagged correctly.

• JWT TTL Overrides Debug TTL values in the JWTCreatedEvent listener:

  public function onJWTCreated(JWTCreatedEvent $event)
  {
      $data = $event->getData();
      var_dump($data['ttl']); // Check if custom TTL is applied
  }
  

Extension Points

1. Custom Expression Functions Extend the provider interface to add complex logic:

   public function getFunctions(): array
   {
       return [
           'user_has_role' => [$this, 'checkUserRole'],
           'date_between'  => [$this, 'checkDateRange'],
       ];
   }
   

2. JWT Metadata Add custom claims to tokens via a JWTCreatedEvent subscriber:

   public function onJWTCreated(JWTCreatedEvent $event)
   {
       $event->setData([
           ...$event->getData(),
           'custom_claim' => 'value',
       ]);
   }
   

3. Documentation Enhancements Override the Swagger generator to include additional JWT details:

   # config/packages/api_platform.yaml
   api_platform:
       formats:
           jsonld:
               mime_types: ['application/ld+json']
       swagger:
           versions: [3]