Entity Hidden Type Bundle Laravel Package

Getting Started

This is a Symfony 2-era micro-bundle that provides a form type for putting a Doctrine entity reference into an HTML hidden input — it wraps a DataTransformer that converts the entity to its identifier on transform and back to a managed entity on reverse transform.

Reality check first: 0 stars, 0 dependents, and Symfony 2 (EOL since Nov 2018) mean this is reference code, not a dependency you should composer require into a live app. Treat the repo as a single-file pattern to copy into src/Form/Type/ rather than something to install.

If you do install it in a legacy Symfony 2 app:

composer require qbbr/entity-hidden-type-bundle

Register the bundle in app/AppKernel.php:

new Qbbr\EntityHiddenTypeBundle\EntityHiddenTypeBundle(),

First use case — an "owner" or "created by" field on a form where the ID is decided server-side, not picked by the user:

$form = $this->createFormBuilder($order)
    ->add('customer', EntityHiddenType::class, [
        'class' => AppBundle:Customer::class,
    ])
    ->getForm();

Where to look first: the bundle's Form/Type/ directory and the DataTransformer it registers. The entire bundle is essentially that one transformer — read it before relying on it. The class name is likely Qbbr\EntityHiddenTypeBundle\Form\Type\EntityHiddenType, but confirm from the source since old Symfony 2 bundles often also expose a legacy alias like entity_hidden.

Implementation Patterns

Inject the value server-side. The value in a hidden field is client-controlled. Always set the entity on the form before rendering (via the bound object, $form->get('customer')->setData($customer), or a PRE_SET_DATA listener), and re-assert it on submit rather than trusting the posted ID.

$form->addEventListener(FormEvents::PRE_SET_DATA, function (FormEvent $event) {
    $event->getData()->setCustomer($this->getUser());
});

Legacy alias registration if the bundle targets Symfony 2.3–2.7 style services:

# app/config/config.yml
services:
    app.form.type.entity_hidden:
        class: Qbbr\EntityHiddenTypeBundle\Form\Type\EntityHiddenType
        tags:
            - { name: form.type, alias: entity_hidden }

Then ->add('customer', 'entity_hidden', ['class' => ...]).

Hide but don't expose. If the entity ID itself is sensitive, use 'property_path' => false plus a form event listener to map the submitted value into the entity — the hidden input will still be visible in markup, so never put a value the user shouldn't see there without a signed/nonce-guarded token.

Reuse for tenant-scoped lookups. The transformer typically calls EntityRepository::find(); subclass the type and override the transformer to constrain the query (findOneBy(['id' => $id, 'tenant' => $tenant])) so a forged ID from another tenant fails cleanly instead of resolving.

Validation belongs on the entity, not the hidden type — use a NotBlank/NotNull constraint on the mapped property and a PRE_SUBMIT listener to overwrite user input with your trusted value.

Gotchas and Tips

• Hidden fields are user-forgeable. The single biggest pitfall: the transformer will happily hydrate any ID posted. Always overwrite from a trusted source on submit, or validate existence and authorization explicitly.
• Reverse transform returns null for unknown IDs in most implementations of this pattern. Decide whether that is a validation error (add a constraint) or acceptable; Symfony form errors from transformers also surface through isSynchronized() — check it during debugging.
• UUID/string IDs break integer assumptions. If your entity uses a UUID or custom identifier, verify the transformer casts correctly; a naive (int) $id will silently zero out.
• dump() after handleRequest ($form->get('customer')->getData()) is the fastest way to confirm the transformer ran; check $form->getErrors(true) for transform-level failures that don't appear at the field level.
• CSRF and HiddenType inheritance work as normal — don't disable protection around this field without a reason; the whole point of the hidden type is that the attacker must not control the value.
• Composer/version drift: confirm the package name and constraint from the repo's composer.json; old bundles often pin symfony/symfony to ~2.3 and won't resolve under newer trees.
• Best extension point is subclassing the type and overriding buildForm()/the transformer, not editing vendor code.
• Modern replacement: on Symfony 3+ you don't need this bundle — use EntityType with a custom HiddenType widget, or a plain HiddenType plus a small DataTransformer, and you get the same behavior with maintained code.