From dcbd4fd2e4d406973073c5bc563c2c35a8ed595e Mon Sep 17 00:00:00 2001
From: Daniel Subiabre <daniel.subiabre@platoniq.net>
Date: Fri, 7 Aug 2026 16:04:53 +0200
Subject: [PATCH] fix: security config on UserApiResource

---
 src/ApiResource/User/UserApiResource.php | 10 +++++-----
 src/Security/Voter/UserVoter.php         |  8 ++++----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/ApiResource/User/UserApiResource.php b/src/ApiResource/User/UserApiResource.php
index 4be9443..656e3b5 100644
--- a/src/ApiResource/User/UserApiResource.php
+++ b/src/ApiResource/User/UserApiResource.php
@@ -114,7 +114,7 @@ class UserApiResource
     #[API\ApiFilter(InArrayFilter::class, strategy: InArrayFilter::STRATEGY_AND)]
     public array $roles;
 
-    #[API\ApiProperty(writable: false)]
+    #[API\ApiProperty(writable: false, security: 'is_granted("USER_VIEW", object)')]
     #[MapFrom(User::class, transformer: UserDisplayNameMapTransformer::class)]
     public string $displayName;
 
@@ -123,15 +123,15 @@ class UserApiResource
      * For `organization` User types: data for the organization representative or person managing the User.\
      * Only available to themselves and platform administrators.
      */
-    #[API\ApiProperty(writable: false, security: 'is_granted("ROLE_ADMIN")')]
-    #[API\ApiFilter(EncryptedSearchFilter::class, properties: ['person.taxId'])]
+    #[API\ApiProperty(writable: false, security: 'is_granted("USER_EDIT", object)')]
+    #[API\ApiFilter(EncryptedSearchFilter::class, properties: ['person.taxId'], strategy: 'is_granted("ROLE_ADMIN")')]
     public PersonApiResource $person;
 
     /**
      * For `organization` User types only. Legal entity data.
      */
-    #[API\ApiProperty(writable: false, security: 'is_granted("ROLE_ADMIN")')]
-    #[API\ApiFilter(EncryptedSearchFilter::class, properties: ['organization.taxId'])]
+    #[API\ApiProperty(writable: false, security: 'is_granted("USER_EDIT", object)')]
+    #[API\ApiFilter(EncryptedSearchFilter::class, properties: ['organization.taxId'], strategy: 'is_granted("ROLE_ADMIN")')]
     public ?OrganizationApiResource $organization = null;
 
     /**
diff --git a/src/Security/Voter/UserVoter.php b/src/Security/Voter/UserVoter.php
index fa7f132..563d078 100644
--- a/src/Security/Voter/UserVoter.php
+++ b/src/Security/Voter/UserVoter.php
@@ -25,10 +25,6 @@ class UserVoter extends Voter
     {
         $user = $token->getUser();
 
-        if (!$user instanceof User) {
-            return false;
-        }
-
         switch ($attribute) {
             case self::EDIT:
                 return $this->canEdit($subject, $user);
@@ -41,6 +37,10 @@ class UserVoter extends Voter
 
     private function canEdit(UserApiResource $subject, ?User $user): bool
     {
+        if (!$user instanceof User) {
+            return false;
+        }
+
         if ($user->hasRoles(['ROLE_ADMIN'])) {
             return true;
         }