ApiPlatform
Table of Contents
Classes
- Maho_ApiPlatform_IndexController
- Legacy SOAP/XML-RPC/JSON-RPC dispatcher.
- Maho_ApiPlatform_Model_Observer
- API Platform Observer.
- AdminGraphQlController
- Admin GraphQL Controller.
- OAuthController
- CrudProcessor
- Convention-based processor for CrudResource subclasses.
- CrudProvider
- Convention-based provider for CrudResource subclasses.
- CrudResource
- Base class for convention-based CRUD API resources.
- CrudMetadata
- Cached metadata for a CrudResource class.
- FieldMapping
- Describes how a single DTO property maps to a model field.
- ModuleApiDiscovery
- Discovers Maho modules that expose API resources via the Api/ convention.
- AdminAclListener
- Enforces Maho admin ACL on every API Platform request made with an admin
token.
- AdminBridgeListener
- Bridges Maho's cookie-based admin session into the Symfony security context
for /api/admin/* endpoints by populating $_SERVER vars that
AdminSessionAuthenticator reads.
- ApiExceptionListener
- API Exception Listener.
- CurrencyContextListener
- Honors the `X-Currency-Code` header, letting a caller pick among the display
currencies a store view allows, the way the storefront's currency switcher
does.
- DefaultDenyListener
- Pre-provider authentication enforcement for API Platform operations.
- HttpCacheListener
- HTTP Cache Listener - Adds ETag, Cache-Control, and 304 Not Modified support.
- IdempotencyListener
- Idempotency Key Listener.
- McpAuthChallengeListener
- The MCP server catches a tool's exception in its own loop and answers with a
JSON-RPC error at HTTP 200. For an ordinary failure that is right. For "you
are not authenticated" it is a dead end: the reply says to send a bearer
token, in prose, with nothing a client can act on.
- McpErrorSanitizerListener
- An exception thrown while a tool runs never reaches `kernel.exception`: the MCP
server catches it in its own request loop and answers with
`Error::forInternalError($e->getMessage())`, so {@see ApiExceptionListener},
which is what keeps REST from returning raw messages, never sees it. Left alone
a public read tool would hand an anonymous caller whatever a TypeError or a
DBAL failure says. Only the messages REST would also pass through survive.
- ProtocolToggleListener
- Gate the new API entry points behind per-protocol admin toggles.
- StoreContextAuthorizationListener
- Validates the user's right to operate in the store switched in by
StoreContextListener. Runs at priority 6, after the firewall (8), so the
security token is populated.
- StoreContextListener
- Honors the `store` query parameter or `X-Store-Code` header by pointing
Maho's app at the matching store before any controller or authenticator runs.
- ApiException
- Base API Exception.
- AuthenticationException
- Authentication Exception - 401 Unauthorized.
- NotFoundException
- Not Found Exception - 404 Not Found.
- ValidationException
- Validation Exception - 400 Bad Request.
- CustomQueryResolver
- Custom GraphQL Query Resolver.
- IriToleranceProvider
- Decorates the GraphQL ReadProvider to translate unparseable-IRI errors into
the same shape as item-not-found.
- OwnershipDenialProvider
- Decorates the GraphQL ReadProvider chain to convert row-level ownership
denials on item queries into null results.
- Kernel
- OperationRequestFactory
- Providers and processors read plain path parameters off `$request->getPathInfo()`,
because API Platform only populates `uriVariables` declared as `Link` objects. Under
MCP every request is a POST to `/api/mcp`, so those reads come back empty: a product
link loses which of related/cross-sell/up-sell it meant, a guest cart loses its
masked id.
- PermissionFilteredListHandler
- Drops from `tools/list` every tool the current token would be refused, so an agent
doesn't burn turns discovering that. Not the security boundary,
{@see \Maho\ApiPlatform\State\McpDispatchProvider} is.
- SourceOperationResolver
- API Platform dispatches the `McpTool` itself, which works for a standalone tool
with its own `input:` and `processor:`. Derived tools reuse REST processors, and
those read the operation's identity: `instanceof Post` / `DeleteOperationInterface`
to tell create from update, `getName()` to route named operations. So dispatch
swaps the mirrored operation back in and the pipeline below is unchanged REST.
- ToolSchemaFactory
- Synthesises the schema a hand-declared tool would carry in `input:`. Derived tools
have no DTO to point at, and the fallback (the resource class) is the response
shape: it advertises sixty writable fields on a `*_get` tool that takes one id,
and an array on a `*_list` tool, which the MCP `Tool` constructor rejects.
- McpToolResourceMetadataCollectionFactory
- API Platform exposes nothing to MCP unless a resource declares `mcp: [...]`, so
this derives that list from the operations already declared. Third-party resources
are covered without their authors doing anything.
- SelfResolvingWriteResourceMetadataCollectionFactory
- A resource declaring `mahoSelfResolvingWrites: true` promises that its write
processors resolve and verify their own state, so the provider read pass
before them is discarded work. This factory turns that promise into
`read: false` on every item-scoped HTTP write operation and every GraphQL
mutation, instead of each operation repeating the flag.
- Processor
- Base class for all API state processors.
- Provider
- Base class for all API state providers.
- Resource
- Base class for all API resource DTOs.
- AdminAcl
- Static helper for inline admin-ACL checks.
- AdminSessionAuthenticator
- Admin Session Authenticator
Authenticates admin users via Maho's admin session (cookie-based)
- AdminUserProvider
- Admin User Provider
Loads admin users from Maho's admin/user model
- ApiPermissionRegistry
- Central registry of API resource permissions.
- ApiUser
- API User - Represents an authenticated API user (customer, admin, or API user).
- ApiUserVoter
- Voter that answers `is_granted('resource/operation')` permission checks for API users.
- BackendAccess
- A backend caller is an admin token (gated separately by the Maho admin ACL
through AdminAclListener) or a service token that actually holds a grant on the
resource. Write counts as well as read, so an integration can read back the
draft it just created.
- CustomerOwnership
- Publishes `is_owner(object, '<property>')` to every security expression, the
row-level counterpart of `has_backend_access()`. Used on item read operations of
`mahoCustomerScoped` resources as
`security: "has_backend_access('<resource>') or is_owner(object, 'customerId')"`,
evaluated by API Platform's AccessCheckerProvider after the provider has
loaded the row (the literal `object` token in the expression is what defers
evaluation to post-read, so never wrap or alias it).
- CustomerUserProvider
- Customer User Provider
Loads customer users from Maho's customer model
- OAuth2Authenticator
- OAuth2 JWT Token Authenticator
Validates Bearer tokens from Authorization header
- OperationAccessChecker
- The two checks `security:` expressions don't cover: whether anybody is
authenticated, and whether an admin's Maho role grants the resource's
ADMIN_RESOURCE.
- TolerantIriConverter
- Many Maho API responses are computed DTOs returned from action operations
(media upload, cart gift-message / gift-card mutations, order placement) whose
URI carries path variables — {itemId}, {code}, {path} — that don't correspond
to a DTO property, or that have no retrievable item GET at all. During
serialization the core AbstractItemNormalizer unconditionally asks the
IriConverter for the resource's self-IRI (to populate the cache-tag/resource
tracking context and, for JSON-LD, the `@id`). When the identifier can't be
extracted the converter throws, surfacing as an HTTP 500 on an otherwise
successful mutation.
- JwtService
- Centralized JWT token management.
- StoreContext
- Store Context Service.
- StoreDefaults
- Store-aware defaults for country, currency, region, and POS address.
- TokenBlacklist
- JWT token blacklist for logout/revocation, backed by a durable DB table.
- McpDispatchProcessor
- Outermost decorator of `api_platform.mcp.state_processor`, which serializes the
result and wraps the write stage. Both read the request out of the context, and
the MCP handler hands them the JSON-RPC one: serialization would then build every
hydra IRI from `/api/mcp`, and the write stage would see the wrong path and body.
- McpDispatchProvider
- Outermost decorator of `api_platform.state_provider.main`, so the read, the
deserialization and the `security:` expression all see a vetted caller and the
real operation. Three translations from MCP's one-POST-many-operations shape:
- McpWriteProcessor
- The write half of {@see McpDispatchProvider}'s operation swap.
- PermittedForAny
- Lcobucci's PermittedFor takes exactly one audience, but an install serves
several resource identifiers: a root per host, plus the MCP endpoint under
each. This check only proves the audience is one this install issues. Whether
it covers the path being requested is decided further up, by
OAuth2Authenticator.
Traits
- ActivityLogTrait
- AdminQuoteTrait
- Loads a quote by id without store filtering, for admin/POS GraphQL handlers
that operate across stores. Throws a not-found exception when the quote is
missing, so handlers don't each repeat the load-and-check.
- AuthenticationTrait
- Shared authentication and authorization logic for API providers and processors.
- CacheTrait
- Cache-aside helper for API providers.
- DateRangeFilterTrait
- Date-range filtering for collections, in one place because the two provider base
classes don't share one and the boundary handling is easy to get wrong.
- ModelPersistenceTrait
- Wraps model save, delete, and load operations with consistent HTTP error handling.
- PaginationTrait
- Extracts pagination parameters (page, pageSize) from API Platform context.
- ProductLoaderTrait
- Loads a catalog product by ID within the current store context.
- RateLimitTrait
- Request throttling helpers shared by API providers and processors.
- RawResponseTrait
- Return a bare JSON body from a provider/processor instead of the resource's
JSON-LD serialization.
- StockWriterTrait
- Shared stock-write helpers for direct (model-bypassing) inventory updates.
- StoreAccessTrait
- Store access helpers shared by content processors (CMS pages, blocks, blog posts).
- StoreRestrictionTrait
- Enforces an API token's store allowlist at the data layer.