66
77use Doctrine \ORM \EntityManagerInterface ;
88use OpenApi \Attributes as OA ;
9- use PhpList \Core \Domain \Common \Model \Filter \ PaginatedFilter ;
9+ use PhpList \Core \Domain \Identity \Model \Administrator ;
1010use PhpList \Core \Domain \Messaging \Model \Filter \SubscriberListFilter ;
1111use PhpList \Core \Domain \Subscription \Model \SubscriberList ;
1212use PhpList \Core \Domain \Subscription \Service \Manager \SubscriberListManager ;
3232#[Route('/lists ' , name: 'subscriber_list_ ' )]
3333class SubscriberListController extends BaseController
3434{
35- private SubscriberListNormalizer $ normalizer ;
36- private SubscriberListManager $ subscriberListManager ;
37- private PaginatedDataProvider $ paginatedDataProvider ;
38- private EntityManagerInterface $ entityManager ;
39-
4035 public function __construct (
4136 Authentication $ authentication ,
4237 RequestValidator $ validator ,
43- SubscriberListNormalizer $ normalizer ,
44- SubscriberListManager $ subscriberListManager ,
45- PaginatedDataProvider $ paginatedDataProvider ,
46- EntityManagerInterface $ entityManager ,
38+ private readonly SubscriberListNormalizer $ normalizer ,
39+ private readonly SubscriberListManager $ subscriberListManager ,
40+ private readonly PaginatedDataProvider $ paginatedDataProvider ,
41+ private readonly EntityManagerInterface $ entityManager ,
4742 ) {
4843 parent ::__construct ($ authentication , $ validator );
49- $ this ->normalizer = $ normalizer ;
50- $ this ->subscriberListManager = $ subscriberListManager ;
51- $ this ->paginatedDataProvider = $ paginatedDataProvider ;
52- $ this ->entityManager = $ entityManager ;
5344 }
5445
5546 #[Route('' , name: 'get_list ' , methods: ['GET ' ])]
@@ -167,19 +158,26 @@ className: SubscriberList::class,
167158 ],
168159 type: 'object '
169160 )
170- )
161+ ),
162+ new OA \Response (
163+ response: 405 ,
164+ description: 'Failure ' ,
165+ content: new OA \JsonContent (ref: '#/components/schemas/UnauthorizedResponse ' )
166+ ),
171167 ]
172168 )]
173169 public function getList (
174170 Request $ request ,
175171 #[MapEntity(mapping: ['listId ' => 'id ' ])] ?SubscriberList $ list = null
176172 ): JsonResponse {
177- $ this ->requireAuthentication ($ request );
173+ $ authUser = $ this ->requireAuthentication ($ request );
178174
179175 if (!$ list ) {
180176 throw $ this ->createNotFoundException ('Subscriber list not found. ' );
181177 }
182178
179+ $ this ->denyAccessUnlessOwnerOrPublic ($ list , $ authUser );
180+
183181 return $ this ->json ($ this ->normalizer ->normalize ($ list ), Response::HTTP_OK );
184182 }
185183
@@ -220,19 +218,26 @@ public function getList(
220218 response: 404 ,
221219 description: 'Failure ' ,
222220 content: new OA \JsonContent (ref: '#/components/schemas/NotFoundErrorResponse ' )
223- )
221+ ),
222+ new OA \Response (
223+ response: 405 ,
224+ description: 'Failure ' ,
225+ content: new OA \JsonContent (ref: '#/components/schemas/UnauthorizedResponse ' )
226+ ),
224227 ]
225228 )]
226229 public function deleteList (
227230 Request $ request ,
228231 #[MapEntity(mapping: ['listId ' => 'id ' ])] ?SubscriberList $ list = null
229232 ): JsonResponse {
230- $ this ->requireAuthentication ($ request );
233+ $ authUser = $ this ->requireAuthentication ($ request );
231234
232235 if (!$ list ) {
233236 throw $ this ->createNotFoundException ('Subscriber list not found. ' );
234237 }
235238
239+ $ this ->denyAccessUnlessOwnerOrPublic ($ list , $ authUser );
240+
236241 $ this ->subscriberListManager ->delete ($ list );
237242 $ this ->entityManager ->flush ();
238243
@@ -278,7 +283,7 @@ public function deleteList(
278283 ),
279284 ]
280285 )]
281- public function createList (Request $ request, SubscriberListNormalizer $ normalizer ): JsonResponse
286+ public function createList (Request $ request ): JsonResponse
282287 {
283288 $ authUser = $ this ->requireAuthentication ($ request );
284289
@@ -287,6 +292,94 @@ public function createList(Request $request, SubscriberListNormalizer $normalize
287292 $ data = $ this ->subscriberListManager ->createSubscriberList ($ subscriberListRequest ->getDto (), $ authUser );
288293 $ this ->entityManager ->flush ();
289294
290- return $ this ->json ($ normalizer ->normalize ($ data ), Response::HTTP_CREATED );
295+ return $ this ->json ($ this ->normalizer ->normalize ($ data ), Response::HTTP_CREATED );
296+ }
297+
298+ #[Route('/{listId} ' , name: 'update ' , requirements: ['listId ' => '\d+ ' ], methods: ['PUT ' ])]
299+ #[OA \Post(
300+ path: '/api/v2/lists/{listId} ' ,
301+ description: '🚧 **Status: Beta** – This method is under development. Avoid using in production. ' .
302+ 'Returns updated list. ' ,
303+ summary: 'Update a subscriber list. ' ,
304+ requestBody: new OA \RequestBody (
305+ description: 'Pass parameters to create a new subscriber list. ' ,
306+ required: true ,
307+ content: new OA \JsonContent (ref: '#/components/schemas/CreateSubscriberListRequest ' )
308+ ),
309+ tags: ['lists ' ],
310+ parameters: [
311+ new OA \Parameter (
312+ name: 'php-auth-pw ' ,
313+ description: 'Session key obtained from login ' ,
314+ in: 'header ' ,
315+ required: true ,
316+ schema: new OA \Schema (type: 'string ' )
317+ ),
318+ new OA \Parameter (
319+ name: 'listId ' ,
320+ description: 'List ID ' ,
321+ in: 'path ' ,
322+ required: true ,
323+ schema: new OA \Schema (type: 'string ' )
324+ ),
325+ ],
326+ responses: [
327+ new OA \Response (
328+ response: 200 ,
329+ description: 'Success ' ,
330+ content: new OA \JsonContent (ref: '#/components/schemas/SubscriberList ' )
331+ ),
332+ new OA \Response (
333+ response: 403 ,
334+ description: 'Failure ' ,
335+ content: new OA \JsonContent (ref: '#/components/schemas/UnauthorizedResponse ' )
336+ ),
337+ new OA \Response (
338+ response: 405 ,
339+ description: 'Failure ' ,
340+ content: new OA \JsonContent (ref: '#/components/schemas/UnauthorizedResponse ' )
341+ ),
342+ new OA \Response (
343+ response: 422 ,
344+ description: 'Failure ' ,
345+ content: new OA \JsonContent (ref: '#/components/schemas/ValidationErrorResponse ' )
346+ ),
347+ ]
348+ )]
349+ public function updateList (
350+ Request $ request ,
351+ #[MapEntity(mapping: ['listId ' => 'id ' ])] ?SubscriberList $ list = null ,
352+ ): JsonResponse {
353+ $ authUser = $ this ->requireAuthentication ($ request );
354+
355+ if (!$ list ) {
356+ throw $ this ->createNotFoundException ('Subscriber list not found. ' );
357+ }
358+
359+ $ this ->denyAccessUnlessOwnerOrPublic ($ list , $ authUser );
360+
361+ /** @var CreateSubscriberListRequest $subscriberListRequest */
362+ $ subscriberListRequest = $ this ->validator ->validate ($ request , CreateSubscriberListRequest::class);
363+ $ data = $ this ->subscriberListManager ->updateSubscriberList (
364+ $ list ,
365+ $ subscriberListRequest ->getDto (),
366+ $ authUser ,
367+ );
368+ $ this ->entityManager ->flush ();
369+
370+ return $ this ->json ($ this ->normalizer ->normalize ($ data ), Response::HTTP_OK );
371+ }
372+
373+ private function denyAccessUnlessOwnerOrPublic (SubscriberList $ list , Administrator $ user ): void
374+ {
375+ if ($ list ->getOwner () === null ) {
376+ return ;
377+ }
378+
379+ if ($ list ->getOwner ()->getId () === $ user ->getId ()) {
380+ return ;
381+ }
382+
383+ throw $ this ->createAccessDeniedException ('Access denied. ' );
291384 }
292385}
0 commit comments