allow_extra_attributes and update nested entity @id

[ili101]

Description
As mentioned in documentation https://api-platform.com/docs/core/serialization/#denormalization

The following rules apply when denormalizing embedded relations:

    If an @id key is present in the embedded resource, then the object corresponding to the given URI will be retrieved through the state provider. Any changes in the embedded relation will also be applied to that object.
    If no @id key exists, a new object will be created containing state provided in the embedded JSON document.

When setting allow_extra_attributes: false this results in Extra attributes are not allowed ("@id" is unknown). If using json and not ld+json and sending id instead you get the same error on id. P.S. not sure if intentional but for the update to actually work even if extra attributes allowed @id needs to also be provided on the parent entity.

How to reproduce
Test example https://github.com/ili101/api-platform/blob/subTest/Test.ps1 (uncomment allow_extra_attributes in api_platform.yaml)

Possible Solution
Allow @id (or maybe also @type @context) with allow_extra_attributes: false and ld+json. Allow id with allow_extra_attributes: false and json.

Alternatively for more flexible solution, in the Entry ApiProperty or somewhere else add and option to set the base $allowedAttributes with default values here: https://github.com/api-platform/core/blob/5523bf5df93783582bed5591ff35c71e0942a978/src/Serializer/AbstractItemNormalizer.php#L423 Something like:

    #[ApiProperty(
        ExtraAllowedExtraAttributes: ['@id', '@type'],
    )]

Additional Context
https://github.com/api-platform/api-platform/issues/2096 https://github.com/api-platform/api-platform/issues/2620 https://stackoverflow.com/questions/70379382/how-to-update-nested-entity-with-api-platform

[soyuka]

specify this inside the normalizerContext?

[ili101]

specify this inside the normalizerContext?

Yes, https://github.com/ili101/api-platform-core/commit/7b84701c055f7c2cb972defea220682fdb17a913 then you can:

#[ApiResource(
    denormalizationContext: [
        AbstractNormalizer::GROUPS => ['Main:write'],
        'additional_allowed_attributes' => ['@id', '@type', 'id', '@context'],
    ],
)]

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[soyuka]

can you let me know if my patch works

[ili101]

Looks good