fix(validator): validate entities after ObjectMapper transformation

src/Laravel/ApiPlatformProvider.php

@@ -151,7 +151,8 @@
 use ApiPlatform\State\Pagination\Pagination;
 use ApiPlatform\State\Pagination\PaginationOptions;
 use ApiPlatform\State\Processor\AddLinkHeaderProcessor;
-use ApiPlatform\State\Processor\ObjectMapperProcessor;
+use ApiPlatform\State\Processor\ObjectMapperInputProcessor;
+use ApiPlatform\State\Processor\ObjectMapperOutputProcessor;
 use ApiPlatform\State\Processor\RespondProcessor;
 use ApiPlatform\State\Processor\SerializeProcessor;
 use ApiPlatform\State\Processor\WriteProcessor;
@@ -470,7 +471,13 @@ public function register(): void
         });
 
         $this->app->singleton(WriteProcessor::class, static function (Application $app) {
-            return new WriteProcessor($app->make(SerializeProcessor::class), $app->make(CallableProcessor::class));
+            $inner = $app->make(SerializeProcessor::class);
+
+            if (interface_exists(ObjectMapperInterface::class)) {
+                $inner = new ObjectMapperOutputProcessor($app->make(ObjectMapper::class), $inner);
+            }
+
+            return new WriteProcessor($inner, $app->make(CallableProcessor::class));
         });
 
         $this->app->singleton(SerializerContextBuilder::class, static function (Application $app) {
@@ -504,10 +511,10 @@ public function register(): void
             return $app->make(WriteProcessor::class);
         });
 
-        // ObjectMapperProcessor wraps the base processor if available
+        // ObjectMapperInputProcessor wraps the base processor if available
         if (interface_exists(ObjectMapperInterface::class)) {
             $this->app->extend(ProcessorInterface::class, static function (ProcessorInterface $inner, Application $app) {
-                return new ObjectMapperProcessor($app->make(ObjectMapper::class), $inner);
+                return new ObjectMapperInputProcessor($app->make(ObjectMapper::class), $inner);
             });
         }
 

src/State/Processor/ObjectMapperInputProcessor.php

@@ -0,0 +1,58 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\State\Processor;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\ObjectMapper\ObjectMapperInterface;
+
+/**
+ * Maps the API resource (DTO) to the entity before persistence.
+ *
+ * @implements ProcessorInterface<mixed,mixed>
+ */
+final class ObjectMapperInputProcessor implements ProcessorInterface
+{
+    /**
+     * @param ProcessorInterface<mixed,mixed>|null $decorated
+     */
+    public function __construct(
+        private readonly ?ObjectMapperInterface $objectMapper,
+        private readonly ?ProcessorInterface $decorated = null,
+    ) {
+    }
+
+    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): object|array|null
+    {
+        $class = $operation->getInput()['class'] ?? $operation->getClass();
+
+        if (
+            $data instanceof Response
+            || !$this->objectMapper
+            || !($operation->canWrite() ?? true)
+            || null === $data
+            || null === $class
+            || !is_a($data, $class, true)
+            || !$operation->canMap()
+        ) {
+            return $this->decorated ? $this->decorated->process($data, $operation, $uriVariables, $context) : $data;
+        }
+
+        $request = $context['request'] ?? null;
+        $mapped = $this->objectMapper->map($data, $request?->attributes->get('mapped_data'));
+
+        return $this->decorated ? $this->decorated->process($mapped, $operation, $uriVariables, $context) : $mapped;
+    }
+}

src/State/Processor/ObjectMapperOutputProcessor.php

@@ -0,0 +1,55 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\State\Processor;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\ObjectMapper\ObjectMapperInterface;
+
+/**
+ * Maps the persisted entity back to the API resource (DTO) after persistence.
+ *
+ * @implements ProcessorInterface<mixed,mixed>
+ */
+final class ObjectMapperOutputProcessor implements ProcessorInterface
+{
+    /**
+     * @param ProcessorInterface<mixed,mixed>|null $decorated
+     */
+    public function __construct(
+        private readonly ?ObjectMapperInterface $objectMapper,
+        private readonly ?ProcessorInterface $decorated = null,
+    ) {
+    }
+
+    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): object|array|null
+    {
+        if (
+            $data instanceof Response
+            || !$this->objectMapper
+            || !($operation->canWrite() ?? true)
+            || null === $data
+            || !$operation->canMap()
+        ) {
+            return $this->decorated ? $this->decorated->process($data, $operation, $uriVariables, $context) : $data;
+        }
+
+        $request = $context['request'] ?? null;
+        $request?->attributes->set('persisted_data', $data);
+        $dto = $this->objectMapper->map($data, $operation->getClass());
+
+        return $this->decorated ? $this->decorated->process($dto, $operation, $uriVariables, $context) : $dto;
+    }
+}

src/State/Processor/ObjectMapperProcessor.php

@@ -19,6 +19,8 @@
 use Symfony\Component\ObjectMapper\ObjectMapperInterface;
 
 /**
+ * @deprecated since API Platform 4.2, use {@see ObjectMapperInputProcessor} and {@see ObjectMapperOutputProcessor} instead
+ *
  * @implements ProcessorInterface<mixed,mixed>
  */
 final class ObjectMapperProcessor implements ProcessorInterface
@@ -30,6 +32,7 @@ public function __construct(
         private readonly ?ObjectMapperInterface $objectMapper,
         private readonly ProcessorInterface $decorated,
     ) {
+        trigger_deprecation('api-platform/core', '4.2', 'The "%s" class is deprecated, use "%s" and "%s" instead.', self::class, ObjectMapperInputProcessor::class, ObjectMapperOutputProcessor::class);
     }
 
     public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): object|array|null

src/State/Tests/Processor/ObjectMapperInputProcessorTest.php

@@ -0,0 +1,156 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\State\Tests\Processor;
+
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\Post;
+use ApiPlatform\State\Processor\ObjectMapperInputProcessor;
+use ApiPlatform\State\ProcessorInterface;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\ObjectMapper\ObjectMapperInterface;
+
+class ObjectMapperInputProcessorTest extends TestCase
+{
+    public function testProcessBypassesWhenNoObjectMapper(): void
+    {
+        $data = new \stdClass();
+        $operation = new Post(class: \stdClass::class);
+        $decorated = $this->createMock(ProcessorInterface::class);
+        $decorated->expects($this->once())
+            ->method('process')
+            ->with($data, $operation, [], [])
+            ->willReturn($data);
+
+        $processor = new ObjectMapperInputProcessor(null, $decorated);
+        $this->assertSame($data, $processor->process($data, $operation));
+    }
+
+    public function testProcessBypassesOnNonWriteOperation(): void
+    {
+        $data = new \stdClass();
+        $operation = new Get(class: \stdClass::class);
+        $objectMapper = $this->createMock(ObjectMapperInterface::class);
+        $decorated = $this->createMock(ProcessorInterface::class);
+        $decorated->expects($this->once())
+            ->method('process')
+            ->with($data, $operation, [], [])
+            ->willReturn($data);
+
+        $processor = new ObjectMapperInputProcessor($objectMapper, $decorated);
+        $this->assertSame($data, $processor->process($data, $operation));
+    }
+
+    public function testProcessBypassesWithNullData(): void
+    {
+        $operation = new Post(class: \stdClass::class);
+        $objectMapper = $this->createMock(ObjectMapperInterface::class);
+        $decorated = $this->createMock(ProcessorInterface::class);
+        $decorated->expects($this->once())
+            ->method('process')
+            ->with(null, $operation, [], [])
+            ->willReturn(null);
+
+        $processor = new ObjectMapperInputProcessor($objectMapper, $decorated);
+        $this->assertNull($processor->process(null, $operation));
+    }
+
+    public function testProcessBypassesWithResponseData(): void
+    {
+        $response = new Response();
+        $operation = new Post(class: \stdClass::class);
+        $objectMapper = $this->createMock(ObjectMapperInterface::class);
+        $decorated = $this->createMock(ProcessorInterface::class);
+        $decorated->expects($this->once())
+            ->method('process')
+            ->with($response, $operation, [], [])
+            ->willReturn($response);
+
+        $processor = new ObjectMapperInputProcessor($objectMapper, $decorated);
+        $this->assertSame($response, $processor->process($response, $operation));
+    }
+
+    public function testProcessBypassesWithMismatchedDataType(): void
+    {
+        $data = new \stdClass();
+        $operation = new Post(class: ObjectMapperInputDummy::class);
+        $objectMapper = $this->createMock(ObjectMapperInterface::class);
+        $decorated = $this->createMock(ProcessorInterface::class);
+        $decorated->expects($this->once())
+            ->method('process')
+            ->with($data, $operation, [], [])
+            ->willReturn($data);
+
+        $processor = new ObjectMapperInputProcessor($objectMapper, $decorated);
+        $this->assertSame($data, $processor->process($data, $operation));
+    }
+
+    public function testProcessMapsInputToEntity(): void
+    {
+        $dto = new \stdClass();
+        $entity = new \stdClass();
+        $entity->id = 1;
+        $result = new \stdClass();
+        $operation = new Post(class: \stdClass::class, map: true);
+
+        $objectMapper = $this->createMock(ObjectMapperInterface::class);
+        $objectMapper->expects($this->once())
+            ->method('map')
+            ->with($dto, null)
+            ->willReturn($entity);
+
+        $decorated = $this->createMock(ProcessorInterface::class);
+        $decorated->expects($this->once())
+            ->method('process')
+            ->with($entity, $operation, [], $this->anything())
+            ->willReturn($result);
+
+        $processor = new ObjectMapperInputProcessor($objectMapper, $decorated);
+        $this->assertSame($result, $processor->process($dto, $operation));
+    }
+
+    public function testProcessMapsWithExistingMappedData(): void
+    {
+        $dto = new \stdClass();
+        $existingEntity = new \stdClass();
+        $existingEntity->id = 42;
+        $mappedEntity = new \stdClass();
+        $mappedEntity->id = 42;
+        $result = new \stdClass();
+        $operation = new Post(class: \stdClass::class, map: true);
+
+        $request = new Request();
+        $request->attributes->set('mapped_data', $existingEntity);
+
+        $objectMapper = $this->createMock(ObjectMapperInterface::class);
+        $objectMapper->expects($this->once())
+            ->method('map')
+            ->with($dto, $existingEntity)
+            ->willReturn($mappedEntity);
+
+        $decorated = $this->createMock(ProcessorInterface::class);
+        $decorated->expects($this->once())
+            ->method('process')
+            ->with($mappedEntity, $operation, [], $this->anything())
+            ->willReturn($result);
+
+        $processor = new ObjectMapperInputProcessor($objectMapper, $decorated);
+        $this->assertSame($result, $processor->process($dto, $operation, [], ['request' => $request]));
+    }
+}
+
+class ObjectMapperInputDummy
+{
+}