fix: security config on UserApiResource

src/ApiResource/User/UserApiResource.php

@@ -114,7 +114,7 @@ class UserApiResource
     #[API\ApiFilter(InArrayFilter::class, strategy: InArrayFilter::STRATEGY_AND)]
     public array $roles;
 
-    #[API\ApiProperty(writable: false)]
+    #[API\ApiProperty(writable: false, security: 'is_granted("USER_VIEW", object)')]
     #[MapFrom(User::class, transformer: UserDisplayNameMapTransformer::class)]
     public string $displayName;
 
@@ -123,15 +123,15 @@ class UserApiResource
      * For `organization` User types: data for the organization representative or person managing the User.\
      * Only available to themselves and platform administrators.
      */
-    #[API\ApiProperty(writable: false, security: 'is_granted("ROLE_ADMIN")')]
-    #[API\ApiFilter(EncryptedSearchFilter::class, properties: ['person.taxId'])]
+    #[API\ApiProperty(writable: false, security: 'is_granted("USER_EDIT", object)')]
+    #[API\ApiFilter(EncryptedSearchFilter::class, properties: ['person.taxId'], strategy: 'is_granted("ROLE_ADMIN")')]
     public PersonApiResource $person;
 
     /**
      * For `organization` User types only. Legal entity data.
      */
-    #[API\ApiProperty(writable: false, security: 'is_granted("ROLE_ADMIN")')]
-    #[API\ApiFilter(EncryptedSearchFilter::class, properties: ['organization.taxId'])]
+    #[API\ApiProperty(writable: false, security: 'is_granted("USER_EDIT", object)')]
+    #[API\ApiFilter(EncryptedSearchFilter::class, properties: ['organization.taxId'], strategy: 'is_granted("ROLE_ADMIN")')]
     public ?OrganizationApiResource $organization = null;
 
     /**

src/Security/Voter/UserVoter.php

@@ -25,10 +25,6 @@ class UserVoter extends Voter
     {
         $user = $token->getUser();
 
-        if (!$user instanceof User) {
-            return false;
-        }
-
         switch ($attribute) {
             case self::EDIT:
                 return $this->canEdit($subject, $user);
@@ -41,6 +37,10 @@ class UserVoter extends Voter
 
     private function canEdit(UserApiResource $subject, ?User $user): bool
     {
+        if (!$user instanceof User) {
+            return false;
+        }
+
         if ($user->hasRoles(['ROLE_ADMIN'])) {
             return true;
         }