{"action":"created","issue":{"url":"https://api.github.com/repos/dunglas/DunglasApiBundle/issues/395","labels_url":"https://api.github.com/repos/dunglas/DunglasApiBundle/issues/395/labels{/name}","comments_url":"https://api.github.com/repos/dunglas/DunglasApiBundle/issues/395/comments","events_url":"https://api.github.com/repos/dunglas/DunglasApiBundle/issues/395/events","html_url":"https://github.com/dunglas/DunglasApiBundle/issues/395","id":129513850,"number":395,"title":"How to add user security through custom UserDataProvider","user":{"login":"vincentchalamon","id":407859,"avatar_url":"https://avatars.githubusercontent.com/u/407859?v=3","gravatar_id":"","url":"https://api.github.com/users/vincentchalamon","html_url":"https://github.com/vincentchalamon","followers_url":"https://api.github.com/users/vincentchalamon/followers","following_url":"https://api.github.com/users/vincentchalamon/following{/other_user}","gists_url":"https://api.github.com/users/vincentchalamon/gists{/gist_id}","starred_url":"https://api.github.com/users/vincentchalamon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vincentchalamon/subscriptions","organizations_url":"https://api.github.com/users/vincentchalamon/orgs","repos_url":"https://api.github.com/users/vincentchalamon/repos","events_url":"https://api.github.com/users/vincentchalamon/events{/privacy}","received_events_url":"https://api.github.com/users/vincentchalamon/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2016-01-28T17:08:26Z","updated_at":"2016-01-29T09:31:48Z","closed_at":"2016-01-29T08:46:32Z","body":"The following story: _as a user, I shouldn't be able to update another user_.\r\n\r\nSo, I think I should add a custom `UserDataProvider` which extends default `DataProvider`, and supports my user class. On this one, I override `getItem` method and compare requested user with authenticated user: if they're identical, I should return the requested user, otherwise I should return `null`.\r\n\r\nBut because of `DataProviderChain::getItem` method, if `UserDataProvider` returns null, it will continue to the default `DataProvider` which will return the requested user (but it shouldn't).\r\n\r\nShouldn't `DataProviderChain::getItem` method be like following ?:\r\n```php\r\npublic function getItem(ResourceInterface $resource, $id, $fetchData = false)\r\n{\r\n    foreach ($this->dataProviders as $dataProvider) {\r\n        if ($dataProvider->supports($resource)) {\r\n            return $dataProvider->getItem($resource, $id, $fetchData);\r\n        }\r\n    }\r\n}\r\n```\r\n\r\nOr is there a better way to manage this story (for example) ?"},"comment":{"url":"https://api.github.com/repos/dunglas/DunglasApiBundle/issues/comments/176662335","html_url":"https://github.com/dunglas/DunglasApiBundle/issues/395#issuecomment-176662335","issue_url":"https://api.github.com/repos/dunglas/DunglasApiBundle/issues/395","id":176662335,"user":{"login":"jordanaubert","id":16880485,"avatar_url":"https://avatars.githubusercontent.com/u/16880485?v=3","gravatar_id":"","url":"https://api.github.com/users/jordanaubert","html_url":"https://github.com/jordanaubert","followers_url":"https://api.github.com/users/jordanaubert/followers","following_url":"https://api.github.com/users/jordanaubert/following{/other_user}","gists_url":"https://api.github.com/users/jordanaubert/gists{/gist_id}","starred_url":"https://api.github.com/users/jordanaubert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jordanaubert/subscriptions","organizations_url":"https://api.github.com/users/jordanaubert/orgs","repos_url":"https://api.github.com/users/jordanaubert/repos","events_url":"https://api.github.com/users/jordanaubert/events{/privacy}","received_events_url":"https://api.github.com/users/jordanaubert/received_events","type":"User","site_admin":false},"created_at":"2016-01-29T09:31:48Z","updated_at":"2016-01-29T09:31:48Z","body":"@dunglas but what about `putAction` & `postAction` in ResourceController ? API events will be Events::PRE_UPDATE (for `putAction` for example), but at this event resource is already modified (but not persisted). Is there any retrieve event for put & post to denied access only for those methods ?\r\n\r\nIn my case, I want to restrict access get & put actions on my current user (get will be managed using `api.retrieve` event, but what about put ?)"}}