Skip to content

fix(doctrine): fetch_data=false reference for stateOptions resources#8387

Merged
soyuka merged 1 commit into
api-platform:4.3from
bendavies:fix/item-provider-dto-reference
Jul 8, 2026
Merged

fix(doctrine): fetch_data=false reference for stateOptions resources#8387
soyuka merged 1 commit into
api-platform:4.3from
bendavies:fix/item-provider-dto-reference

Conversation

@bendavies

Copy link
Copy Markdown
Contributor
Q A
Branch? 4.3
Bug fix? yes
New feature? no
Deprecations? no
Tickets follow-up to #8295
License MIT
Doc PR n/a

The fetch_data=false reference fast path (#8295) never triggered for a DTO/stateOptions resource: getReferenceIdentifiers() matched the identifier link's fromClass against $entityClass (the entity), but a Link's fromClass is always the resource class. For a DTO resource it therefore fell through to the query and ran the item extensions it should have skipped, which (via getResourceFromIri(fetch_data: false) in SearchFilterTrait::getIdFromValue()) makes a relation SearchFilter silently drop its constraint.

Fix: compare against $operation->getClass(). The entity identifier guard below is unchanged (a uuid API id over an id key still falls through), and non-DTO resources are unaffected since $operation->getClass() === $entityClass.

Covered by unit tests in ItemProviderTest and a functional test that fails before the change.

getReferenceIdentifiers() keeps only the link that points at the resource
itself, selecting it by comparing the link's fromClass to $entityClass, the
stateOptions entity class. A Link's fromClass is always the resource class, so
for a DTO resource the two never coincide: the fetch_data=false fast path
returned null and fell through to the full item query, running the item query
extensions it was meant to skip. A relation SearchFilter then fails open.
getIdFromValue() resolves the IRI via getResourceFromIri, an item query
extension excludes the row, the null is swallowed, and no constraint is emitted
at all.

Compare against $operation->getClass() instead. The entity identifier guard
below is unchanged, so a resource whose API identifier is not a Doctrine
identifier still falls through; for a resource that is not a DTO,
$operation->getClass() === $entityClass and behavior is identical.
@soyuka soyuka merged commit 56de597 into api-platform:4.3 Jul 8, 2026
110 of 112 checks passed
@soyuka

soyuka commented Jul 8, 2026

Copy link
Copy Markdown
Member

thanks @bendavies !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants