magdev
5498c3c91e
Closes the input-validation gap that was the audit's headline finding.
The legacy generated controller's `if (isset($data['title']))…` body
accepted any JSON: empty title slipped through, malformed JSON got
swallowed by `?? []`, wrong types were silently coerced via casts.
The --with-dto flag generates:
- src/Dto/Create<Name>Dto.php — readonly DTO with #[Assert\NotBlank]
on title and #[Assert\Length(max: 255)]
- src/Dto/Update<Name>Dto.php — same DTO with all fields nullable
so PATCH callers send only what changed
- src/Controller/<Name>Controller.php — same shape as the legacy
controller but actions dispatch via #[MapRequestPayload]
Validation failures (missing required field, wrong type, malformed
JSON, oversize string) become RFC 7807 application/problem+json
automatically — Symfony's RequestPayloadValueResolver does the work.
No `if-isset` boilerplate, no silent coercion.
Behaviour:
- --with-dto is opt-in; legacy template still ships unchanged
- audit suggests flipping to default-on once stable; that's a
follow-up
- maker fails loud (composer require hint) if symfony/validator
isn't autoloadable
- skeleton + example/todo composer.json pull symfony/validator so
scaffolded apps work out of the box
Snapshot test exercises both modes (legacy + --with-dto). New
baselines TodoControllerWithDto.php / CreateTodoDto.php /
UpdateTodoDto.php under tests/snapshot/.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
96 lines
3.1 KiB
PHP
96 lines
3.1 KiB
PHP
<?= "<?php\n" ?>
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Controller;
|
|
|
|
use App\Dto\Create<?= $entity_short ?>Dto;
|
|
use App\Dto\Update<?= $entity_short ?>Dto;
|
|
use <?= $entity_fqcn ?>;
|
|
use Doctrine\ORM\EntityManagerInterface;
|
|
use Symfony\Component\HttpFoundation\JsonResponse;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\HttpKernel\Attribute\MapRequestPayload;
|
|
use Symfony\Component\Routing\Attribute\Route;
|
|
use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
|
|
|
|
/**
|
|
* Auto-generated CRUD controller for the <?= $singular ?> bridge resource (DTO-shaped).
|
|
* Edit freely — re-running make:bridge:resource won't overwrite this file.
|
|
*
|
|
* Validated input via #[MapRequestPayload]: malformed JSON, missing
|
|
* required fields, or constraint violations produce RFC 7807
|
|
* problem+json automatically (Symfony's RequestPayloadValueResolver).
|
|
*/
|
|
#[Route('<?= $route ?>')]
|
|
final class <?= $entity_short ?>Controller
|
|
{
|
|
public function __construct(
|
|
private readonly EntityManagerInterface $em,
|
|
private readonly NormalizerInterface $normalizer,
|
|
) {
|
|
}
|
|
|
|
#[Route('', name: '<?= $resource ?>_list', methods: ['GET'])]
|
|
public function list(): JsonResponse
|
|
{
|
|
$items = $this->em->getRepository(<?= $entity_short ?>::class)->findAll();
|
|
|
|
return new JsonResponse($this->normalizer->normalize($items, 'json'));
|
|
}
|
|
|
|
#[Route('', name: '<?= $resource ?>_create', methods: ['POST'])]
|
|
public function create(#[MapRequestPayload] Create<?= $entity_short ?>Dto $dto): JsonResponse
|
|
{
|
|
$entity = new <?= $entity_short ?>();
|
|
$entity->setTitle($dto->title);
|
|
$entity->setDone($dto->done);
|
|
|
|
$this->em->persist($entity);
|
|
$this->em->flush();
|
|
|
|
return new JsonResponse(
|
|
$this->normalizer->normalize($entity, 'json'),
|
|
Response::HTTP_CREATED,
|
|
);
|
|
}
|
|
|
|
#[Route('/{id}', name: '<?= $resource ?>_update', methods: ['PATCH'])]
|
|
public function update(string $id, #[MapRequestPayload] Update<?= $entity_short ?>Dto $dto): JsonResponse
|
|
{
|
|
$entity = $this->em->getRepository(<?= $entity_short ?>::class)->find($id);
|
|
if (null === $entity) {
|
|
return new JsonResponse(
|
|
['title' => 'Not Found', 'status' => 404],
|
|
Response::HTTP_NOT_FOUND,
|
|
['Content-Type' => 'application/problem+json'],
|
|
);
|
|
}
|
|
|
|
if (null !== $dto->title) {
|
|
$entity->setTitle($dto->title);
|
|
}
|
|
if (null !== $dto->done) {
|
|
$entity->setDone($dto->done);
|
|
}
|
|
|
|
$this->em->flush();
|
|
|
|
return new JsonResponse($this->normalizer->normalize($entity, 'json'));
|
|
}
|
|
|
|
#[Route('/{id}', name: '<?= $resource ?>_delete', methods: ['DELETE'])]
|
|
public function delete(string $id): JsonResponse
|
|
{
|
|
$entity = $this->em->getRepository(<?= $entity_short ?>::class)->find($id);
|
|
if (null === $entity) {
|
|
return new JsonResponse(null, Response::HTTP_NO_CONTENT);
|
|
}
|
|
|
|
$this->em->remove($entity);
|
|
$this->em->flush();
|
|
|
|
return new JsonResponse(null, Response::HTTP_NO_CONTENT);
|
|
}
|
|
}
|