glavweb / api-bundle

v1.2.0 2026-11-09 05:34 UTC

Requires

• php: >=8.4
• doctrine/orm: ^3.3
• glavweb/data-schema-bundle: ^3.0
• glavweb/datagrid-bundle: ^4.0
• glavweb/extra-bundle: ^1.0
• glavweb/framework-bundle: ^1.0
• league/tactician-bundle: ^1.6
• liip/imagine-bundle: ^2.13
• nelmio/api-doc-bundle: ^5.0
• symfony/framework-bundle: ^8.0
• symfony/security-bundle: ^8.0
• symfony/validator: ^8.0

Suggests

• glavweb/uploader-bundle: Needed for make:api-controller media fields and OpenAPI of upload routes
• symfony/maker-bundle: Required for make:api-controller

MIT

• Andrey Nilov
• Glavweb Community

Published on Packagist.org on 2026-11-09 05:39 UTC

README

CQRS/REST: attributes, Populator, ParamFetcher, ScopeFetcher, ResultSet, Nelmio describers (включая upload-роуты UploaderBundle, если он установлен), make:api-controller.

RequestBag — из glavweb/extra-bundle; доменные исключения — из glavweb/framework-bundle.

X-User-Token (access_token firewall)

Вся схема в Glavweb\ApiBundle\Security: UserProviderTokenInterface, AccessToken\XUserTokenExtractor, AccessToken\UserTokenHandler, AccessToken\UserTokenAuthenticationFailureHandler / UserTokenAuthenticationEntryPoint (401 JSON). Хранение токенов — в проекте: UserManager реализует UserProviderTokenInterface::loadUserByToken().

# config/services.yaml
Glavweb\ApiBundle\Security\UserProviderTokenInterface: '@App\Model\User\UserManager'

# config/packages/security.yaml
api:
    stateless: true
    entry_point: Glavweb\ApiBundle\Security\AccessToken\UserTokenAuthenticationEntryPoint
    access_token:
        token_extractors:
            - Glavweb\ApiBundle\Security\AccessToken\XUserTokenExtractor
        token_handler: Glavweb\ApiBundle\Security\AccessToken\UserTokenHandler
        failure_handler: Glavweb\ApiBundle\Security\AccessToken\UserTokenAuthenticationFailureHandler

Невалидный/протухший токен экстрактор приравнивает к отсутствию: запрос идёт анонимно, 401 отдаёт entry point только на защищённых эндпоинтах. Другая авторизация (JWT, сессия) — свои extractor/handler в security.yaml.