vendor/shopware/core/Framework/Api/Controller/ApiController.php line 439

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\Controller;
  5. use OpenApi\Annotations as OA;
  6. use Shopware\Core\Defaults;
  7. use Shopware\Core\Framework\Api\Acl\AclCriteriaValidator;
  8. use Shopware\Core\Framework\Api\Acl\Role\AclRoleDefinition;
  9. use Shopware\Core\Framework\Api\Converter\ApiVersionConverter;
  10. use Shopware\Core\Framework\Api\Converter\Exceptions\ApiConversionException;
  11. use Shopware\Core\Framework\Api\Exception\InvalidVersionNameException;
  12. use Shopware\Core\Framework\Api\Exception\LiveVersionDeleteException;
  13. use Shopware\Core\Framework\Api\Exception\MissingPrivilegeException;
  14. use Shopware\Core\Framework\Api\Exception\NoEntityClonedException;
  15. use Shopware\Core\Framework\Api\Exception\ResourceNotFoundException;
  16. use Shopware\Core\Framework\Api\Response\ResponseFactoryInterface;
  17. use Shopware\Core\Framework\Context;
  18. use Shopware\Core\Framework\DataAbstractionLayer\DefinitionInstanceRegistry;
  19. use Shopware\Core\Framework\DataAbstractionLayer\Entity;
  20. use Shopware\Core\Framework\DataAbstractionLayer\EntityCollection;
  21. use Shopware\Core\Framework\DataAbstractionLayer\EntityDefinition;
  22. use Shopware\Core\Framework\DataAbstractionLayer\EntityProtection\EntityProtectionValidator;
  23. use Shopware\Core\Framework\DataAbstractionLayer\EntityProtection\ReadProtection;
  24. use Shopware\Core\Framework\DataAbstractionLayer\EntityProtection\WriteProtection;
  25. use Shopware\Core\Framework\DataAbstractionLayer\EntityRepository;
  26. use Shopware\Core\Framework\DataAbstractionLayer\EntityTranslationDefinition;
  27. use Shopware\Core\Framework\DataAbstractionLayer\Event\EntityWrittenContainerEvent;
  28. use Shopware\Core\Framework\DataAbstractionLayer\Exception\DefinitionNotFoundException;
  29. use Shopware\Core\Framework\DataAbstractionLayer\Exception\MissingReverseAssociation;
  30. use Shopware\Core\Framework\DataAbstractionLayer\Field\AssociationField;
  31. use Shopware\Core\Framework\DataAbstractionLayer\Field\Field;
  32. use Shopware\Core\Framework\DataAbstractionLayer\Field\ManyToManyAssociationField;
  33. use Shopware\Core\Framework\DataAbstractionLayer\Field\ManyToOneAssociationField;
  34. use Shopware\Core\Framework\DataAbstractionLayer\Field\OneToManyAssociationField;
  35. use Shopware\Core\Framework\DataAbstractionLayer\Field\OneToOneAssociationField;
  36. use Shopware\Core\Framework\DataAbstractionLayer\Field\TranslationsAssociationField;
  37. use Shopware\Core\Framework\DataAbstractionLayer\FieldCollection;
  38. use Shopware\Core\Framework\DataAbstractionLayer\MappingEntityDefinition;
  39. use Shopware\Core\Framework\DataAbstractionLayer\Search\CompositeEntitySearcher;
  40. use Shopware\Core\Framework\DataAbstractionLayer\Search\Criteria;
  41. use Shopware\Core\Framework\DataAbstractionLayer\Search\EntitySearchResult;
  42. use Shopware\Core\Framework\DataAbstractionLayer\Search\Filter\EqualsFilter;
  43. use Shopware\Core\Framework\DataAbstractionLayer\Search\IdSearchResult;
  44. use Shopware\Core\Framework\DataAbstractionLayer\Search\RequestCriteriaBuilder;
  45. use Shopware\Core\Framework\DataAbstractionLayer\Write\CloneBehavior;
  46. use Shopware\Core\Framework\Feature;
  47. use Shopware\Core\Framework\Routing\Annotation\RouteScope;
  48. use Shopware\Core\Framework\Routing\Annotation\Since;
  49. use Shopware\Core\Framework\Routing\Exception\MissingRequestParameterException;
  50. use Shopware\Core\Framework\Uuid\Exception\InvalidUuidException;
  51. use Shopware\Core\Framework\Uuid\Uuid;
  52. use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
  53. use Symfony\Component\HttpFoundation\JsonResponse;
  54. use Symfony\Component\HttpFoundation\Request;
  55. use Symfony\Component\HttpFoundation\Response;
  56. use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
  57. use Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException;
  58. use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
  59. use Symfony\Component\HttpKernel\Exception\UnsupportedMediaTypeHttpException;
  60. use Symfony\Component\Routing\Annotation\Route;
  61. use Symfony\Component\Serializer\Exception\InvalidArgumentException;
  62. use Symfony\Component\Serializer\Exception\UnexpectedValueException;
  63. use Symfony\Component\Serializer\Serializer;
  65. /**
  66.  * @Route(defaults={"_routeScope"={"api"}})
  67.  */
  68. class ApiController extends AbstractController
  69. {
  70.     public const WRITE_UPDATE = 'update';
  71.     public const WRITE_CREATE = 'create';
  72.     public const WRITE_DELETE = 'delete';
  74.     /**
  75.      * @var DefinitionInstanceRegistry
  76.      */
  77.     private $definitionRegistry;
  79.     /**
  80.      * @var Serializer
  81.      */
  82.     private $serializer;
  84.     /**
  85.      * @var RequestCriteriaBuilder
  86.      */
  87.     private $criteriaBuilder;
  89.     /**
  90.      * @var CompositeEntitySearcher
  91.      */
  92.     private $compositeEntitySearcher;
  94.     /**
  95.      * @var ApiVersionConverter
  96.      */
  97.     private $apiVersionConverter;
  99.     /**
  100.      * @var EntityProtectionValidator
  101.      */
  102.     private $entityProtectionValidator;
  104.     /**
  105.      * @var AclCriteriaValidator
  106.      */
  107.     private $criteriaValidator;
  109.     /**
  110.      * @internal
  111.      */
  112.     public function __construct(
  113.         DefinitionInstanceRegistry $definitionRegistry,
  114.         Serializer $serializer,
  115.         RequestCriteriaBuilder $criteriaBuilder,
  116.         CompositeEntitySearcher $compositeEntitySearcher,
  117.         ApiVersionConverter $apiVersionConverter,
  118.         EntityProtectionValidator $entityProtectionValidator,
  119.         AclCriteriaValidator $criteriaValidator
  120.     ) {
  121.         $this->definitionRegistry = $definitionRegistry;
  122.         $this->serializer = $serializer;
  123.         $this->criteriaBuilder = $criteriaBuilder;
  124.         $this->compositeEntitySearcher = $compositeEntitySearcher;
  125.         $this->apiVersionConverter = $apiVersionConverter;
  126.         $this->entityProtectionValidator = $entityProtectionValidator;
  127.         $this->criteriaValidator = $criteriaValidator;
  128.     }
  130.     /**
  131.      * @Since("6.0.0.0")
  132.      * @OA\Get(
  133.      *      path="/_search",
  134.      *      summary="Search for multiple entites by a given term",
  135.      *      operationId="compositeSearch",
  136.      *      tags={"Admin Api"},
  137.      *      deprecated=true,
  138.      *      @OA\Parameter(
  139.      *          name="limit",
  140.      *          in="query",
  141.      *          description="Max amount of resources per entity",
  142.      *          @OA\Schema(type="integer"),
  143.      *      ),
  144.      *      @OA\Parameter(
  145.      *          name="term",
  146.      *          in="query",
  147.      *          description="The term to search for",
  148.      *          required=true,
  149.      *          @OA\Schema(type="string")
  150.      *      ),
  151.      *      @OA\Response(
  152.      *          response="200",
  153.      *          description="The list of found entities",
  154.      *          @OA\JsonContent(
  155.      *              type="array",
  156.      *              @OA\Items(
  157.      *                  type="object",
  158.      *                  @OA\Property(
  159.      *                      property="entity",
  160.      *                      type="string",
  161.      *                      description="The name of the entity",
  162.      *                  ),
  163.      *                  @OA\Property(
  164.      *                      property="total",
  165.      *                      type="integer",
  166.      *                      description="The total amount of search results for this entity",
  167.      *                  ),
  168.      *                  @OA\Property(
  169.      *                      property="entities",
  170.      *                      type="array",
  171.      *                      description="The found entities",
  172.      *                      @OA\Items(type="object", additionalProperties=true),
  173.      *                  ),
  174.      *              ),
  175.      *          ),
  176.      *      ),
  177.      *      @OA\Response(
  178.      *          response="400",
  179.      *          ref="#/components/responses/400"
  180.      *      ),
  181.      *     @OA\Response(
  182.      *          response="401",
  183.      *          ref="#/components/responses/401"
  184.      *      )
  185.      * )
  186.      * @Route("/api/_search", name="api.composite.search", methods={"GET","POST"})
  187.      *
  188.      * @deprecated tag:v6.5.0 - Will be removed in the next major
  189.      */
  190.     public function compositeSearch(Request $request, Context $context): JsonResponse
  191.     {
  192.         Feature::triggerDeprecationOrThrow(
  193.             'v6.5.0.0',
  194.             Feature::deprecatedMethodMessage(__CLASS__, __METHOD__, 'v6.5.0.0', 'Shopware\Administration\Controller\AdminSearchController::search()')
  195.         );
  197.         $term = (string) $request->query->get('term');
  198.         if ($term === '') {
  199.             throw new MissingRequestParameterException('term');
  200.         }
  201.         $limit = $request->query->getInt('limit', 5);
  203.         $results = $this->compositeEntitySearcher->search($term, $limit, $context);
  205.         foreach ($results as &$result) {
  206.             $definition = $this->definitionRegistry->getByEntityName($result['entity']);
  207.             /** @var EntityCollection $entityCollection */
  208.             $entityCollection = $result['entities'];
  209.             $entities = [];
  210.             foreach ($entityCollection->getElements() as $key => $entity) {
  211.                 $entities[$key] = $this->apiVersionConverter->convertEntity($definition, $entity);
  212.             }
  213.             $result['entities'] = $entities;
  214.         }
  216.         return new JsonResponse(['data' => $results]);
  217.     }
  219.     /**
  220.      * @Since("6.0.0.0")
  221.      * @Route("/api/_action/clone/{entity}/{id}", name="api.clone", methods={"POST"}, requirements={
  222.      *     "version"="\d+", "entity"="[a-zA-Z-]+", "id"="[0-9a-f]{32}"
  223.      * })
  224.      */
  225.     public function clone(Context $context, string $entity, string $id, Request $request): JsonResponse
  226.     {
  227.         $behavior = new CloneBehavior(
  228.             $request->request->all('overwrites'),
  229.             $request->request->getBoolean('cloneChildren', true)
  230.         );
  232.         $entity = $this->urlToSnakeCase($entity);
  234.         $definition = $this->definitionRegistry->getByEntityName($entity);
  235.         $missing = $this->validateAclPermissions($context, $definition, AclRoleDefinition::PRIVILEGE_CREATE);
  236.         if ($missing) {
  237.             throw new MissingPrivilegeException([$missing]);
  238.         }
  240.         $eventContainer = $context->scope(Context::CRUD_API_SCOPE, function (Context $context) use ($definition, $id, $behavior): EntityWrittenContainerEvent {
  241.             /** @var EntityRepository $entityRepo */
  242.             $entityRepo = $this->definitionRegistry->getRepository($definition->getEntityName());
  244.             return $entityRepo->clone($id, $context, null, $behavior);
  245.         });
  247.         $event = $eventContainer->getEventByEntityName($definition->getEntityName());
  248.         if (!$event) {
  249.             throw new NoEntityClonedException($entity, $id);
  250.         }
  252.         $ids = $event->getIds();
  253.         $newId = array_shift($ids);
  255.         return new JsonResponse(['id' => $newId]);
  256.     }
  258.     /**
  259.      * @Since("6.0.0.0")
  260.      * @Route("/api/_action/version/{entity}/{id}", name="api.createVersion", methods={"POST"},
  261.      *     requirements={"version"="\d+", "entity"="[a-zA-Z-]+", "id"="[0-9a-f]{32}"
  262.      * })
  263.      */
  264.     public function createVersion(Request $request, Context $context, string $entity, string $id): Response
  265.     {
  266.         $entity = $this->urlToSnakeCase($entity);
  268.         $versionId = $request->request->has('versionId') ? (string) $request->request->get('versionId') : null;
  269.         $versionName = $request->request->has('versionName') ? (string) $request->request->get('versionName') : null;
  271.         if ($versionId !== null && !Uuid::isValid($versionId)) {
  272.             throw new InvalidUuidException($versionId);
  273.         }
  275.         if ($versionName !== null && !ctype_alnum($versionName)) {
  276.             throw new InvalidVersionNameException();
  277.         }
  279.         try {
  280.             $entityDefinition = $this->definitionRegistry->getByEntityName($entity);
  281.         } catch (DefinitionNotFoundException $e) {
  282.             throw new NotFoundHttpException($e->getMessage(), $e);
  283.         }
  285.         $versionId = $context->scope(Context::CRUD_API_SCOPE, function (Context $context) use ($entityDefinition, $id, $versionName, $versionId): string {
  286.             return $this->definitionRegistry->getRepository($entityDefinition->getEntityName())->createVersion($id, $context, $versionName, $versionId);
  287.         });
  289.         return new JsonResponse([
  290.             'versionId' => $versionId,
  291.             'versionName' => $versionName,
  292.             'id' => $id,
  293.             'entity' => $entity,
  294.         ]);
  295.     }
  297.     /**
  298.      * @Since("6.0.0.0")
  299.      * @Route("/api/_action/version/merge/{entity}/{versionId}", name="api.mergeVersion", methods={"POST"},
  300.      *     requirements={"version"="\d+", "entity"="[a-zA-Z-]+", "versionId"="[0-9a-f]{32}"
  301.      * })
  302.      */
  303.     public function mergeVersion(Context $context, string $entity, string $versionId): JsonResponse
  304.     {
  305.         $entity = $this->urlToSnakeCase($entity);
  307.         if (!Uuid::isValid($versionId)) {
  308.             throw new InvalidUuidException($versionId);
  309.         }
  311.         $entityDefinition = $this->getEntityDefinition($entity);
  312.         $repository = $this->definitionRegistry->getRepository($entityDefinition->getEntityName());
  314.         // change scope to be able to update write protected fields
  315.         $context->scope(Context::SYSTEM_SCOPE, function (Context $context) use ($repository, $versionId): void {
  316.             $repository->merge($versionId, $context);
  317.         });
  319.         return new JsonResponse(null, Response::HTTP_NO_CONTENT);
  320.     }
  322.     /**
  323.      * @Since("6.0.0.0")
  324.      * @Route("/api/_action/version/{versionId}/{entity}/{entityId}", name="api.deleteVersion", methods={"POST"},
  325.      *     requirements={"version"="\d+", "entity"="[a-zA-Z-]+", "id"="[0-9a-f]{32}"
  326.      * })
  327.      */
  328.     public function deleteVersion(Context $context, string $entity, string $entityId, string $versionId): JsonResponse
  329.     {
  330.         if ($versionId !== null && !Uuid::isValid($versionId)) {
  331.             throw new InvalidUuidException($versionId);
  332.         }
  334.         if ($versionId === Defaults::LIVE_VERSION) {
  335.             throw new LiveVersionDeleteException();
  336.         }
  338.         if ($entityId !== null && !Uuid::isValid($entityId)) {
  339.             throw new InvalidUuidException($entityId);
  340.         }
  342.         try {
  343.             $entityDefinition = $this->definitionRegistry->getByEntityName($this->urlToSnakeCase($entity));
  344.         } catch (DefinitionNotFoundException $e) {
  345.             throw new NotFoundHttpException($e->getMessage(), $e);
  346.         }
  348.         $versionContext = $context->createWithVersionId($versionId);
  350.         $entityRepository = $this->definitionRegistry->getRepository($entityDefinition->getEntityName());
  352.         $versionContext->scope(Context::CRUD_API_SCOPE, function (Context $versionContext) use ($entityId, $entityRepository): void {
  353.             $entityRepository->delete([['id' => $entityId]], $versionContext);
  354.         });
  356.         $versionRepository = $this->definitionRegistry->getRepository('version');
  357.         $versionRepository->delete([['id' => $versionId]], $context);
  359.         return new JsonResponse();
  360.     }
  362.     public function detail(Request $request, Context $context, ResponseFactoryInterface $responseFactory, string $entityName, string $path): Response
  363.     {
  364.         $pathSegments = $this->buildEntityPath($entityName, $path, $context);
  365.         $permissions = $this->validatePathSegments($context, $pathSegments, AclRoleDefinition::PRIVILEGE_READ);
  367.         $root = $pathSegments[0]['entity'];
  368.         $id = $pathSegments[\count($pathSegments) - 1]['value'];
  370.         $definition = $this->definitionRegistry->getByEntityName($root);
  372.         $associations = array_column($pathSegments, 'entity');
  373.         array_shift($associations);
  375.         if (empty($associations)) {
  376.             $repository = $this->definitionRegistry->getRepository($definition->getEntityName());
  377.         } else {
  378.             $field = $this->getAssociation($definition->getFields(), $associations);
  380.             $definition = $field->getReferenceDefinition();
  381.             if ($field instanceof ManyToManyAssociationField) {
  382.                 $definition = $field->getToManyReferenceDefinition();
  383.             }
  385.             $repository = $this->definitionRegistry->getRepository($definition->getEntityName());
  386.         }
  388.         $criteria = new Criteria();
  389.         $criteria = $this->criteriaBuilder->handleRequest($request, $criteria, $definition, $context);
  391.         $criteria->setIds([$id]);
  393.         // trigger acl validation
  394.         $missing = $this->criteriaValidator->validate($definition->getEntityName(), $criteria, $context);
  395.         $permissions = array_unique(array_filter(array_merge($permissions, $missing)));
  397.         if (!empty($permissions)) {
  398.             throw new MissingPrivilegeException($permissions);
  399.         }
  401.         $entity = $context->scope(Context::CRUD_API_SCOPE, function (Context $context) use ($repository, $criteria, $id): ?Entity {
  402.             return $repository->search($criteria, $context)->get($id);
  403.         });
  405.         if ($entity === null) {
  406.             throw new ResourceNotFoundException($definition->getEntityName(), ['id' => $id]);
  407.         }
  409.         return $responseFactory->createDetailResponse($criteria, $entity, $definition, $request, $context);
  410.     }
  412.     public function searchIds(Request $request, Context $context, ResponseFactoryInterface $responseFactory, string $entityName, string $path): Response
  413.     {
  414.         [$criteria, $repository] = $this->resolveSearch($request, $context, $entityName, $path);
  416.         $result = $context->scope(Context::CRUD_API_SCOPE, function (Context $context) use ($repository, $criteria): IdSearchResult {
  417.             return $repository->searchIds($criteria, $context);
  418.         });
  420.         return new JsonResponse([
  421.             'total' => $result->getTotal(),
  422.             'data' => array_values($result->getIds()),
  423.         ]);
  424.     }
  426.     public function search(Request $request, Context $context, ResponseFactoryInterface $responseFactory, string $entityName, string $path): Response
  427.     {
  428.         [$criteria, $repository] = $this->resolveSearch($request, $context, $entityName, $path);
  430.         $result = $context->scope(Context::CRUD_API_SCOPE, function (Context $context) use ($repository, $criteria): EntitySearchResult {
  431.             return $repository->search($criteria, $context);
  432.         });
  434.         $definition = $this->getDefinitionOfPath($entityName, $path, $context);
  436.         return $responseFactory->createListingResponse($criteria, $result, $definition, $request, $context);
  437.     }
  439.     public function list(Request $request, Context $context, ResponseFactoryInterface $responseFactory, string $entityName, string $path): Response
  440.     {
  441.         [$criteria, $repository] = $this->resolveSearch($request, $context, $entityName, $path);
  443.         $result = $context->scope(Context::CRUD_API_SCOPE, function (Context $context) use ($repository, $criteria): EntitySearchResult {
  444.             return $repository->search($criteria, $context);
  445.         });
  447.         $definition = $this->getDefinitionOfPath($entityName, $path, $context);
  449.         return $responseFactory->createListingResponse($criteria, $result, $definition, $request, $context);
  450.     }
  452.     public function create(Request $request, Context $context, ResponseFactoryInterface $responseFactory, string $entityName, string $path): Response
  453.     {
  454.         return $this->write($request, $context, $responseFactory, $entityName, $path, self::WRITE_CREATE);
  455.     }
  457.     public function update(Request $request, Context $context, ResponseFactoryInterface $responseFactory, string $entityName, string $path): Response
  458.     {
  459.         return $this->write($request, $context, $responseFactory, $entityName, $path, self::WRITE_UPDATE);
  460.     }
  462.     public function delete(Request $request, Context $context, ResponseFactoryInterface $responseFactory, string $entityName, string $path): Response
  463.     {
  464.         $pathSegments = $this->buildEntityPath($entityName, $path, $context, [WriteProtection::class]);
  466.         $last = $pathSegments[\count($pathSegments) - 1];
  468.         $id = $last['value'];
  470.         $first = array_shift($pathSegments);
  472.         if (\count($pathSegments) === 0) {
  473.             //first api level call /product/{id}
  474.             $definition = $first['definition'];
  476.             $this->executeWriteOperation($definition, ['id' => $id], $context, self::WRITE_DELETE);
  478.             return $responseFactory->createRedirectResponse($definition, $id, $request, $context);
  479.         }
  481.         $child = array_pop($pathSegments);
  482.         $parent = $first;
  483.         if (!empty($pathSegments)) {
  484.             $parent = array_pop($pathSegments);
  485.         }
  487.         $definition = $child['definition'];
  489.         /** @var AssociationField $association */
  490.         $association = $child['field'];
  492.         // DELETE api/product/{id}/manufacturer/{id}
  493.         if ($association instanceof ManyToOneAssociationField || $association instanceof OneToOneAssociationField) {
  494.             $this->executeWriteOperation($definition, ['id' => $id], $context, self::WRITE_DELETE);
  496.             return $responseFactory->createRedirectResponse($definition, $id, $request, $context);
  497.         }
  499.         // DELETE api/product/{id}/category/{id}
  500.         if ($association instanceof ManyToManyAssociationField) {
  501.             $local = $definition->getFields()->getByStorageName(
  502.                 $association->getMappingLocalColumn()
  503.             );
  505.             $reference = $definition->getFields()->getByStorageName(
  506.                 $association->getMappingReferenceColumn()
  507.             );
  509.             $mapping = [
  510.                 $local->getPropertyName() => $parent['value'],
  511.                 $reference->getPropertyName() => $id,
  512.             ];
  513.             /** @var EntityDefinition $parentDefinition */
  514.             $parentDefinition = $parent['definition'];
  516.             if ($parentDefinition->isVersionAware()) {
  517.                 $versionField = $parentDefinition->getEntityName() . 'VersionId';
  518.                 $mapping[$versionField] = $context->getVersionId();
  519.             }
  521.             if ($association->getToManyReferenceDefinition()->isVersionAware()) {
  522.                 $versionField = $association->getToManyReferenceDefinition()->getEntityName() . 'VersionId';
  524.                 $mapping[$versionField] = Defaults::LIVE_VERSION;
  525.             }
  527.             $this->executeWriteOperation($definition, $mapping, $context, self::WRITE_DELETE);
  529.             return $responseFactory->createRedirectResponse($definition, $id, $request, $context);
  530.         }
  532.         if ($association instanceof TranslationsAssociationField) {
  533.             /** @var EntityTranslationDefinition $refClass */
  534.             $refClass = $association->getReferenceDefinition();
  536.             $refPropName = $refClass->getFields()->getByStorageName($association->getReferenceField())->getPropertyName();
  537.             $refLanguagePropName = $refClass->getPrimaryKeys()->getByStorageName($association->getLanguageField())->getPropertyName();
  539.             $mapping = [
  540.                 $refPropName => $parent['value'],
  541.                 $refLanguagePropName => $id,
  542.             ];
  544.             $this->executeWriteOperation($definition, $mapping, $context, self::WRITE_DELETE);
  546.             return $responseFactory->createRedirectResponse($definition, $id, $request, $context);
  547.         }
  549.         if ($association instanceof OneToManyAssociationField) {
  550.             $this->executeWriteOperation($definition, ['id' => $id], $context, self::WRITE_DELETE);
  552.             return $responseFactory->createRedirectResponse($definition, $id, $request, $context);
  553.         }
  555.         throw new \RuntimeException(sprintf('Unsupported association for field %s', $association->getPropertyName()));
  556.     }
  558.     private function resolveSearch(Request $request, Context $context, string $entityName, string $path): array
  559.     {
  560.         $pathSegments = $this->buildEntityPath($entityName, $path, $context);
  561.         $permissions = $this->validatePathSegments($context, $pathSegments, AclRoleDefinition::PRIVILEGE_READ);
  563.         $first = array_shift($pathSegments);
  565.         /** @var EntityDefinition|string $definition */
  566.         $definition = $first['definition'];
  568.         if (!$definition) {
  569.             throw new NotFoundHttpException('The requested entity does not exist.');
  570.         }
  572.         $repository = $this->definitionRegistry->getRepository($definition->getEntityName());
  574.         $criteria = new Criteria();
  575.         if (empty($pathSegments)) {
  576.             $criteria = $this->criteriaBuilder->handleRequest($request, $criteria, $definition, $context);
  578.             // trigger acl validation
  579.             $nested = $this->criteriaValidator->validate($definition->getEntityName(), $criteria, $context);
  580.             $permissions = array_unique(array_filter(array_merge($permissions, $nested)));
  582.             if (!empty($permissions)) {
  583.                 throw new MissingPrivilegeException($permissions);
  584.             }
  586.             return [$criteria, $repository];
  587.         }
  589.         $child = array_pop($pathSegments);
  590.         $parent = $first;
  592.         if (!empty($pathSegments)) {
  593.             $parent = array_pop($pathSegments);
  594.         }
  596.         $association = $child['field'];
  598.         $parentDefinition = $parent['definition'];
  600.         $definition = $child['definition'];
  601.         if ($association instanceof ManyToManyAssociationField) {
  602.             $definition = $association->getToManyReferenceDefinition();
  603.         }
  605.         $criteria = $this->criteriaBuilder->handleRequest($request, $criteria, $definition, $context);
  607.         if ($association instanceof ManyToManyAssociationField) {
  608.             //fetch inverse association definition for filter
  609.             $reverse = $definition->getFields()->filter(
  610.                 function (Field $field) use ($association) {
  611.                     return $field instanceof ManyToManyAssociationField && $association->getMappingDefinition() === $field->getMappingDefinition();
  612.                 }
  613.             );
  615.             //contains now the inverse side association: category.products
  616.             $reverse = $reverse->first();
  617.             if (!$reverse) {
  618.                 throw new MissingReverseAssociation($definition->getEntityName(), $parentDefinition);
  619.             }
  621.             $criteria->addFilter(
  622.                 new EqualsFilter(
  623.                     sprintf('%s.%s.id', $definition->getEntityName(), $reverse->getPropertyName()),
  624.                     $parent['value']
  625.                 )
  626.             );
  628.             /** @var EntityDefinition $parentDefinition */
  629.             if ($parentDefinition->isVersionAware()) {
  630.                 $criteria->addFilter(
  631.                     new EqualsFilter(
  632.                         sprintf('%s.%s.versionId', $definition->getEntityName(), $reverse->getPropertyName()),
  633.                         $context->getVersionId()
  634.                     )
  635.                 );
  636.             }
  637.         } elseif ($association instanceof OneToManyAssociationField) {
  638.             /*
  639.              * Example
  640.              * Route:           /api/product/SW1/prices
  641.              * $definition:     \Shopware\Core\Content\Product\Definition\ProductPriceDefinition
  642.              */
  644.             //get foreign key definition of reference
  645.             $foreignKey = $definition->getFields()->getByStorageName(
  646.                 $association->getReferenceField()
  647.             );
  649.             $criteria->addFilter(
  650.                 new EqualsFilter(
  651.                 //add filter to parent value: prices.productId = SW1
  652.                     $definition->getEntityName() . '.' . $foreignKey->getPropertyName(),
  653.                     $parent['value']
  654.                 )
  655.             );
  656.         } elseif ($association instanceof ManyToOneAssociationField) {
  657.             /*
  658.              * Example
  659.              * Route:           /api/product/SW1/manufacturer
  660.              * $definition:     \Shopware\Core\Content\Product\Aggregate\ProductManufacturer\ProductManufacturerDefinition
  661.              */
  663.             //get inverse association to filter to parent value
  664.             $reverse = $definition->getFields()->filter(
  665.                 function (Field $field) use ($parentDefinition) {
  666.                     return $field instanceof AssociationField && $parentDefinition === $field->getReferenceDefinition();
  667.                 }
  668.             );
  669.             $reverse = $reverse->first();
  670.             if (!$reverse) {
  671.                 throw new MissingReverseAssociation($definition->getEntityName(), $parentDefinition);
  672.             }
  674.             $criteria->addFilter(
  675.                 new EqualsFilter(
  676.                 //filter inverse association to parent value:  manufacturer.products.id = SW1
  677.                     sprintf('%s.%s.id', $definition->getEntityName(), $reverse->getPropertyName()),
  678.                     $parent['value']
  679.                 )
  680.             );
  681.         } elseif ($association instanceof OneToOneAssociationField) {
  682.             /*
  683.              * Example
  684.              * Route:           /api/order/xxxx/orderCustomer
  685.              * $definition:     \Shopware\Core\Checkout\Order\Aggregate\OrderCustomer\OrderCustomerDefinition
  686.              */
  688.             //get inverse association to filter to parent value
  689.             $reverse = $definition->getFields()->filter(
  690.                 function (Field $field) use ($parentDefinition) {
  691.                     return $field instanceof OneToOneAssociationField && $parentDefinition === $field->getReferenceDefinition();
  692.                 }
  693.             );
  694.             $reverse = $reverse->first();
  695.             if (!$reverse) {
  696.                 throw new MissingReverseAssociation($definition->getEntityName(), $parentDefinition);
  697.             }
  699.             $criteria->addFilter(
  700.                 new EqualsFilter(
  701.                 //filter inverse association to parent value:  order_customer.order_id = xxxx
  702.                     sprintf('%s.%s.id', $definition->getEntityName(), $reverse->getPropertyName()),
  703.                     $parent['value']
  704.                 )
  705.             );
  706.         }
  708.         $repository = $this->definitionRegistry->getRepository($definition->getEntityName());
  710.         $nested = $this->criteriaValidator->validate($definition->getEntityName(), $criteria, $context);
  711.         $permissions = array_unique(array_filter(array_merge($permissions, $nested)));
  713.         if (!empty($permissions)) {
  714.             throw new MissingPrivilegeException($permissions);
  715.         }
  717.         return [$criteria, $repository];
  718.     }
  720.     private function getDefinitionOfPath(string $entityName, string $path, Context $context): EntityDefinition
  721.     {
  722.         $pathSegments = $this->buildEntityPath($entityName, $path, $context);
  724.         $first = array_shift($pathSegments);
  726.         /** @var EntityDefinition|string $definition */
  727.         $definition = $first['definition'];
  729.         if (empty($pathSegments)) {
  730.             return $definition;
  731.         }
  733.         $child = array_pop($pathSegments);
  735.         $association = $child['field'];
  737.         if ($association instanceof ManyToManyAssociationField) {
  738.             /*
  739.              * Example:
  740.              * route:           /api/product/SW1/categories
  741.              * $definition:     \Shopware\Core\Content\Category\CategoryDefinition
  742.              */
  743.             return $association->getToManyReferenceDefinition();
  744.         }
  746.         return $child['definition'];
  747.     }
  749.     private function write(Request $request, Context $context, ResponseFactoryInterface $responseFactory, string $entityName, string $path, string $type): Response
  750.     {
  751.         $payload = $this->getRequestBody($request);
  752.         $noContent = !$request->query->has('_response');
  753.         // safari bug prevents us from using the location header
  754.         $appendLocationHeader = false;
  756.         if ($this->isCollection($payload)) {
  757.             throw new BadRequestHttpException('Only single write operations are supported. Please send the entities one by one or use the /sync api endpoint.');
  758.         }
  760.         $pathSegments = $this->buildEntityPath($entityName, $path, $context, [WriteProtection::class]);
  762.         $last = $pathSegments[\count($pathSegments) - 1];
  764.         if ($type === self::WRITE_CREATE && !empty($last['value'])) {
  765.             $methods = ['GET', 'PATCH', 'DELETE'];
  767.             throw new MethodNotAllowedHttpException($methods, sprintf('No route found for "%s %s": Method Not Allowed (Allow: %s)', $request->getMethod(), $request->getPathInfo(), implode(', ', $methods)));
  768.         }
  770.         if ($type === self::WRITE_UPDATE && isset($last['value'])) {
  771.             $payload['id'] = $last['value'];
  772.         }
  774.         $first = array_shift($pathSegments);
  776.         if (\count($pathSegments) === 0) {
  777.             $definition = $first['definition'];
  778.             $events = $this->executeWriteOperation($definition, $payload, $context, $type);
  779.             $event = $events->getEventByEntityName($definition->getEntityName());
  780.             $eventIds = $event->getIds();
  781.             $entityId = array_pop($eventIds);
  783.             if ($definition instanceof MappingEntityDefinition) {
  784.                 return new Response(null, Response::HTTP_NO_CONTENT);
  785.             }
  787.             if ($noContent) {
  788.                 return $responseFactory->createRedirectResponse($definition, $entityId, $request, $context);
  789.             }
  791.             $repository = $this->definitionRegistry->getRepository($definition->getEntityName());
  792.             $criteria = new Criteria($event->getIds());
  793.             $entities = $repository->search($criteria, $context);
  795.             return $responseFactory->createDetailResponse($criteria, $entities->first(), $definition, $request, $context, $appendLocationHeader);
  796.         }
  798.         $child = array_pop($pathSegments);
  800.         $parent = $first;
  801.         if (!empty($pathSegments)) {
  802.             $parent = array_pop($pathSegments);
  803.         }
  805.         /** @var EntityDefinition $definition */
  806.         $definition = $child['definition'];
  808.         $association = $child['field'];
  810.         $parentDefinition = $parent['definition'];
  812.         if ($association instanceof OneToManyAssociationField) {
  813.             $foreignKey = $definition->getFields()
  814.                 ->getByStorageName($association->getReferenceField());
  816.             $payload[$foreignKey->getPropertyName()] = $parent['value'];
  818.             $events = $this->executeWriteOperation($definition, $payload, $context, $type);
  820.             if ($noContent) {
  821.                 return $responseFactory->createRedirectResponse($definition, $parent['value'], $request, $context);
  822.             }
  824.             $event = $events->getEventByEntityName($definition->getEntityName());
  826.             $repository = $this->definitionRegistry->getRepository($definition->getEntityName());
  828.             $criteria = new Criteria($event->getIds());
  829.             $entities = $repository->search($criteria, $context);
  831.             return $responseFactory->createDetailResponse($criteria, $entities->first(), $definition, $request, $context, $appendLocationHeader);
  832.         }
  834.         if ($association instanceof ManyToOneAssociationField || $association instanceof OneToOneAssociationField) {
  835.             $events = $this->executeWriteOperation($definition, $payload, $context, $type);
  836.             $event = $events->getEventByEntityName($definition->getEntityName());
  838.             $entityIds = $event->getIds();
  839.             $entityId = array_pop($entityIds);
  841.             $foreignKey = $parentDefinition->getFields()->getByStorageName($association->getStorageName());
  843.             $payload = [
  844.                 'id' => $parent['value'],
  845.                 $foreignKey->getPropertyName() => $entityId,
  846.             ];
  848.             $repository = $this->definitionRegistry->getRepository($parentDefinition->getEntityName());
  849.             $repository->update([$payload], $context);
  851.             if ($noContent) {
  852.                 return $responseFactory->createRedirectResponse($definition, $entityId, $request, $context);
  853.             }
  855.             $criteria = new Criteria($event->getIds());
  856.             $entities = $repository->search($criteria, $context);
  858.             return $responseFactory->createDetailResponse($criteria, $entities->first(), $definition, $request, $context, $appendLocationHeader);
  859.         }
  861.         /** @var ManyToManyAssociationField $manyToManyAssociation */
  862.         $manyToManyAssociation = $association;
  864.         /** @var EntityDefinition|string $reference */
  865.         $reference = $manyToManyAssociation->getToManyReferenceDefinition();
  867.         // check if we need to create the entity first
  868.         if (\count($payload) > 1 || !\array_key_exists('id', $payload)) {
  869.             $events = $this->executeWriteOperation($reference, $payload, $context, $type);
  870.             $event = $events->getEventByEntityName($reference->getEntityName());
  872.             $ids = $event->getIds();
  873.             $id = array_shift($ids);
  874.         } else {
  875.             // only id provided - add assignment
  876.             $id = $payload['id'];
  877.         }
  879.         $payload = [
  880.             'id' => $parent['value'],
  881.             $manyToManyAssociation->getPropertyName() => [
  882.                 ['id' => $id],
  883.             ],
  884.         ];
  886.         $repository = $this->definitionRegistry->getRepository($parentDefinition->getEntityName());
  887.         $repository->update([$payload], $context);
  889.         $repository = $this->definitionRegistry->getRepository($reference->getEntityName());
  890.         $criteria = new Criteria([$id]);
  892.         $entities = $repository->search($criteria, $context);
  893.         $entity = $entities->first();
  895.         if ($noContent) {
  896.             return $responseFactory->createRedirectResponse($reference, $entity->getId(), $request, $context);
  897.         }
  899.         return $responseFactory->createDetailResponse($criteria, $entity, $definition, $request, $context, $appendLocationHeader);
  900.     }
  902.     private function executeWriteOperation(
  903.         EntityDefinition $entity,
  904.         array $payload,
  905.         Context $context,
  906.         string $type
  907.     ): EntityWrittenContainerEvent {
  908.         $repository = $this->definitionRegistry->getRepository($entity->getEntityName());
  910.         $conversionException = new ApiConversionException();
  911.         $payload = $this->apiVersionConverter->convertPayload($entity, $payload, $conversionException);
  912.         $conversionException->tryToThrow();
  914.         $event = $context->scope(Context::CRUD_API_SCOPE, function (Context $context) use ($repository, $payload, $entity, $type): ?EntityWrittenContainerEvent {
  915.             if ($type === self::WRITE_CREATE) {
  916.                 return $repository->create([$payload], $context);
  917.             }
  919.             if ($type === self::WRITE_UPDATE) {
  920.                 return $repository->update([$payload], $context);
  921.             }
  923.             if ($type === self::WRITE_DELETE) {
  924.                 $event = $repository->delete([$payload], $context);
  926.                 if (!empty($event->getErrors())) {
  927.                     throw new ResourceNotFoundException($entity->getEntityName(), $payload);
  928.                 }
  930.                 return $event;
  931.             }
  933.             return null;
  934.         });
  936.         if (!$event) {
  937.             throw new \RuntimeException('Unsupported write operation.');
  938.         }
  940.         return $event;
  941.     }
  943.     private function getAssociation(FieldCollection $fields, array $keys): AssociationField
  944.     {
  945.         $key = array_shift($keys);
  947.         /** @var AssociationField $field */
  948.         $field = $fields->get($key);
  950.         if (empty($keys)) {
  951.             return $field;
  952.         }
  954.         $reference = $field->getReferenceDefinition();
  955.         $nested = $reference->getFields();
  957.         return $this->getAssociation($nested, $keys);
  958.     }
  960.     private function buildEntityPath(
  961.         string $entityName,
  962.         string $pathInfo,
  963.         Context $context,
  964.         array $protections = [ReadProtection::class]
  965.     ): array {
  966.         $pathInfo = str_replace('/extensions/', '/', $pathInfo);
  967.         $exploded = explode('/', $entityName . '/' . ltrim($pathInfo, '/'));
  969.         $parts = [];
  970.         foreach ($exploded as $index => $part) {
  971.             if ($index % 2) {
  972.                 continue;
  973.             }
  975.             if (empty($part)) {
  976.                 continue;
  977.             }
  979.             $value = $exploded[$index + 1] ?? null;
  981.             if (empty($parts)) {
  982.                 $part = $this->urlToSnakeCase($part);
  983.             } else {
  984.                 $part = $this->urlToCamelCase($part);
  985.             }
  987.             $parts[] = [
  988.                 'entity' => $part,
  989.                 'value' => $value,
  990.             ];
  991.         }
  993.         /** @var array{'entity': string, 'value': string|null} $first */
  994.         $first = array_shift($parts);
  996.         try {
  997.             $root = $this->definitionRegistry->getByEntityName($first['entity']);
  998.         } catch (DefinitionNotFoundException $e) {
  999.             throw new NotFoundHttpException($e->getMessage(), $e);
  1000.         }
  1002.         $entities = [
  1003.             [
  1004.                 'entity' => $first['entity'],
  1005.                 'value' => $first['value'],
  1006.                 'definition' => $root,
  1007.                 'field' => null,
  1008.             ],
  1009.         ];
  1011.         foreach ($parts as $part) {
  1012.             /** @var AssociationField|null $field */
  1013.             $field = $root->getFields()->get($part['entity']);
  1014.             if (!$field) {
  1015.                 $path = implode('.', array_column($entities, 'entity')) . '.' . $part['entity'];
  1017.                 throw new NotFoundHttpException(sprintf('Resource at path "%s" is not an existing relation.', $path));
  1018.             }
  1020.             if ($field instanceof ManyToManyAssociationField) {
  1021.                 $root = $field->getToManyReferenceDefinition();
  1022.             } else {
  1023.                 $root = $field->getReferenceDefinition();
  1024.             }
  1026.             $entities[] = [
  1027.                 'entity' => $part['entity'],
  1028.                 'value' => $part['value'],
  1029.                 'definition' => $field->getReferenceDefinition(),
  1030.                 'field' => $field,
  1031.             ];
  1032.         }
  1034.         $context->scope(Context::CRUD_API_SCOPE, function (Context $context) use ($entities, $protections): void {
  1035.             $this->entityProtectionValidator->validateEntityPath($entities, $protections, $context);
  1036.         });
  1038.         return $entities;
  1039.     }
  1041.     private function urlToSnakeCase(string $name): string
  1042.     {
  1043.         return str_replace('-', '_', $name);
  1044.     }
  1046.     private function urlToCamelCase(string $name): string
  1047.     {
  1048.         $parts = explode('-', $name);
  1049.         $parts = array_map('ucfirst', $parts);
  1051.         return lcfirst(implode('', $parts));
  1052.     }
  1054.     /**
  1055.      * Return a nested array structure of based on the content-type
  1056.      */
  1057.     private function getRequestBody(Request $request): array
  1058.     {
  1059.         $contentType = $request->headers->get('CONTENT_TYPE', '');
  1060.         $semicolonPosition = mb_strpos($contentType, ';');
  1062.         if ($semicolonPosition !== false) {
  1063.             $contentType = mb_substr($contentType, 0, $semicolonPosition);
  1064.         }
  1066.         try {
  1067.             switch ($contentType) {
  1068.                 case 'application/vnd.api+json':
  1069.                     return $this->serializer->decode($request->getContent(), 'jsonapi');
  1070.                 case 'application/json':
  1071.                     return $request->request->all();
  1072.             }
  1073.         } catch (InvalidArgumentException | UnexpectedValueException $exception) {
  1074.             throw new BadRequestHttpException($exception->getMessage());
  1075.         }
  1077.         throw new UnsupportedMediaTypeHttpException(sprintf('The Content-Type "%s" is unsupported.', $contentType));
  1078.     }
  1080.     private function isCollection(array $array): bool
  1081.     {
  1082.         return array_keys($array) === range(0, \count($array) - 1);
  1083.     }
  1085.     private function getEntityDefinition(string $entityName): EntityDefinition
  1086.     {
  1087.         try {
  1088.             $entityDefinition = $this->definitionRegistry->getByEntityName($entityName);
  1089.         } catch (DefinitionNotFoundException $e) {
  1090.             throw new NotFoundHttpException($e->getMessage(), $e);
  1091.         }
  1093.         return $entityDefinition;
  1094.     }
  1096.     private function validateAclPermissions(Context $context, EntityDefinition $entity, string $privilege): ?string
  1097.     {
  1098.         $resource = $entity->getEntityName();
  1100.         if ($entity instanceof EntityTranslationDefinition) {
  1101.             $resource = $entity->getParentDefinition()->getEntityName();
  1102.         }
  1104.         if (!$context->isAllowed($resource . ':' . $privilege)) {
  1105.             return $resource . ':' . $privilege;
  1106.         }
  1108.         return null;
  1109.     }
  1111.     private function validatePathSegments(Context $context, array $pathSegments, string $privilege): array
  1112.     {
  1113.         $child = array_pop($pathSegments);
  1115.         $missing = [];
  1117.         foreach ($pathSegments as $segment) {
  1118.             // you need detail privileges for every parent entity
  1119.             $missing[] = $this->validateAclPermissions(
  1120.                 $context,
  1121.                 $this->getDefinitionForPathSegment($segment),
  1122.                 AclRoleDefinition::PRIVILEGE_READ
  1123.             );
  1124.         }
  1126.         $missing[] = $this->validateAclPermissions($context, $this->getDefinitionForPathSegment($child), $privilege);
  1128.         return array_unique(array_filter($missing));
  1129.     }
  1131.     private function getDefinitionForPathSegment(array $segment): EntityDefinition
  1132.     {
  1133.         $definition = $segment['definition'];
  1135.         if ($segment['field'] instanceof ManyToManyAssociationField) {
  1136.             $definition = $segment['field']->getToManyReferenceDefinition();
  1137.         }
  1139.         return $definition;
  1140.     }
  1141. }