Alow to use "object" var in expressions when deserializing

[goetas]

Q	A
Bug fix?	yes
New feature?	no
Doc updated	no
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	#826
License	Apache-2.0

[mpoiriert]

@goetas Why does the object is not available and must be set to null in a Deserialization context ?

Looking at the DeserializationGraphNavigator the object is available.

This cause some issue because if we want to do some security to allow edition of some attribute base on the currently connected user we can't.

Since the visitor is accessible from the context and that the current object could bet access from getCurrentObject we can have a work arround but the getCurrentObject is not part of the DeserializationVisitorInterface or VisitorInterface, both XMl and Json deserialization implements the method maybe it should be part of it ?

[goetas]

Actually the object sometimes is available.

• When doing the per-class exclusion, the object is not available as it has not yet been created (see

  serializer/src/GraphNavigator/DeserializationGraphNavigator.php

  Line 176 in 8727285

  if (null !== $this->exclusionStrategy && $this->exclusionStrategy->shouldSkipClass($metadata, $this->context)) {

  , the object gets created few lines later)
• When doing the per-property exclusion the object is available, but is in a non consistent state, some props are deserialized and some not.

Given this contradictory situations, was much simpler to not make it available.
Can you please describe better your usecase?

[mpoiriert]

I understand for the shouldSkip class, it make sens since it's about the class...

For the state of the object I thought about it and there is 2 way that I came up with:

• Not great Clone the object and work on the clone itself for the test
• Best way Loop trough all the property first just to check which property should be updated and then loop again to do the visit.

The use case itself is to have ACL on a object property level and not on a class property level.

I could submit a PR of the second solution if you want.

[mpoiriert]

We will also need to come up with a none BC way to make sure that if some developer have done a check if object is null to apply some logic it will still work.

I thought of a few way but I don't want to make configuration too much complicated either...

[mpoiriert]

Any interest in me making a PR of the second solution ? (I still need to implement it)