[api-platform/core] prevent a deprecation warning and sync with upstream

[dunglas]

Q	A
License	MIT
Doc issue/PR	n/a

Enabling the standard behavior for PUT requests is necessary to prevent a deprecation warning.
I also imported the defaults we set in the API Platform distribution.

[github-actions]

Thanks for the PR 😍

How to test these changes in your application

1. Define the SYMFONY_ENDPOINT environment variable:

   # On Unix-like (BSD, Linux and macOS)
   export SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes/flex/pull-1227/index.json
   # On Windows
   SET SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes/flex/pull-1227/index.json

2. Install the package(s) related to this recipe:

   composer req 'symfony/flex:^1.16'
   composer req 'api-platform/core:^3.1'

3. Don't forget to unset the SYMFONY_ENDPOINT environment variable when done:

   # On Unix-like (BSD, Linux and macOS)
   unset SYMFONY_ENDPOINT
   # On Windows
   SET SYMFONY_ENDPOINT=

Diff between recipe versions

In order to help with the review stage, I'm in charge of computing the diff between the various versions of patched recipes.
I'm going keep this comment up to date with any updates of the attached patch.

api-platform/core

2.1 vs 2.5

diff --git a/api-platform/core/2.1/config/packages/api_platform.yaml b/api-platform/core/2.5/config/packages/api_platform.yaml
index e453d1d..2eb7b4c 100644
--- a/api-platform/core/2.1/config/packages/api_platform.yaml
+++ b/api-platform/core/2.5/config/packages/api_platform.yaml
@@ -1,3 +1,7 @@
 api_platform:
     mapping:
         paths: ['%kernel.project_dir%/src/Entity']
+    patch_formats:
+        json: ['application/merge-patch+json']
+    swagger:
+        versions: [3]

2.5 vs 3.0

diff --git a/api-platform/core/2.5/config/packages/api_platform.yaml b/api-platform/core/2.5/config/packages/api_platform.yaml
deleted file mode 100644
index 2eb7b4c..0000000
--- a/api-platform/core/2.5/config/packages/api_platform.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-api_platform:
-    mapping:
-        paths: ['%kernel.project_dir%/src/Entity']
-    patch_formats:
-        json: ['application/merge-patch+json']
-    swagger:
-        versions: [3]
diff --git a/api-platform/core/2.5/manifest.json b/api-platform/core/3.0/manifest.json
index a886a48..af16452 100644
--- a/api-platform/core/2.5/manifest.json
+++ b/api-platform/core/3.0/manifest.json
@@ -1,6 +1,6 @@
 {
     "bundles": {
-        "ApiPlatform\\Core\\Bridge\\Symfony\\Bundle\\ApiPlatformBundle": ["all"]
+        "ApiPlatform\\Symfony\\Bundle\\ApiPlatformBundle": ["all"]
     },
     "copy-from-recipe": {
         "config/": "%CONFIG_DIR%/",
diff --git a/api-platform/core/2.5/src/Entity/.gitignore b/api-platform/core/3.0/src/ApiResource/.gitignore
similarity index 100%
rename from api-platform/core/2.5/src/Entity/.gitignore
rename to api-platform/core/3.0/src/ApiResource/.gitignore

3.0 vs 3.1

diff --git a/api-platform/core/3.1/config/packages/api_platform.yaml b/api-platform/core/3.1/config/packages/api_platform.yaml
new file mode 100644
index 0000000..41c7993
--- /dev/null
+++ b/api-platform/core/3.1/config/packages/api_platform.yaml
@@ -0,0 +1,10 @@
+api_platform:
+    title: Hello API Platform
+    version: 1.0.0
+    # Good defaults for REST APIs
+    defaults:
+        stateless: true
+        cache_headers:
+            vary: ['Content-Type', 'Authorization', 'Origin']
+        extra_properties:
+            standard_put: true

[weaverryan]

This might be too opinionated? If you create a frontend on the same domain that logs in via cookies, then authentication wouldn't work, correct?

[dunglas]

Cookies can be used, but the session cannot. It's one of the mandatory constraints of the REST architecture.

IMHO it's not opinionated, it's just encouraging the correct way of creating REST APIs (and web applications in general).

Better let the user remove this line only if they know what they are doing (and by doing that they are probably doing a mistake) than having them creating non-stateless "REST" APIs.

[dunglas]

By the way since 6.3 stateless routes automatically enable stateless firewalls, so enabling this feature shouldn't be an issue even when using the default config of firewalls: https://symfony.com/doc/current/reference/configuration/security.html#stateless

[stof]

but if this is the good thing to do, why isn't it the default in ApiPlatform then ?

[dunglas]

@stof it is: https://github.com/api-platform/api-platform/blob/main/api/config/packages/api_platform.yaml

[stof]

I'm talking about the default in the Configuration class of the bundle (i.e. the actual default value of the setting), not the config provided in the API platform distribution.

[dunglas]

Because this would be a BC break. We'll maybe do that for API Platform 4 next year.