Read security access within OpenAPI

[soyuka]

#[Put(security: "is_granted('ROLE_ADMIN') or object.owner == user")]

How to disable the PUT operation if not is_granted('ROLE_ADMIN') on the OpenAPI specification ?

Ideas:

• [ ] Add an openapi security configuration (because object is not available)
• [ ] Hack around the object.owner with a proxy ?

Implementation:

Create a new Normalizer that removes stuff from the open api doc (like https://github.com/api-platform/core/blob/main/src/OpenApi/Serializer/OpenApiNormalizer.php) or decorate the OpenApiFactory in a new factory. Do not add this to the current OpenApiFactory.

[soyuka]

also https://github.com/api-platform/core/issues/2719