fix(symfony): disable Swagger UI and keep openapi.json

src/Symfony/Action/DocumentationAction.php

@@ -28,6 +28,7 @@
 use Negotiation\Negotiator;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
  * Generates the API documentation.
@@ -48,6 +49,7 @@ public function __construct(
         private readonly ?ProcessorInterface $processor = null,
         ?Negotiator $negotiator = null,
         private readonly array $documentationFormats = [OpenApiNormalizer::JSON_FORMAT => ['application/vnd.openapi+json'], OpenApiNormalizer::FORMAT => ['application/json']],
+        private readonly bool $swaggerUiEnabled = true,
     ) {
         $this->negotiator = $negotiator ?? new Negotiator();
     }
@@ -83,6 +85,10 @@ public function __invoke(?Request $request = null)
      */
     private function getOpenApiDocumentation(array $context, string $format, Request $request): OpenApi|Response
     {
+        if ('html' === $format && !$this->swaggerUiEnabled) {
+            throw new NotFoundHttpException('Swagger UI is disabled.');
+        }
+
         if ($this->provider && $this->processor) {
             $context['request'] = $request;
             $operation = new Get(
@@ -93,7 +99,7 @@ class: OpenApi::class,
                 outputFormats: $this->documentationFormats
             );
 
-            if ('html' === $format) {
+            if ('html' === $format && $this->swaggerUiEnabled) {
                 $operation = $operation->withProcessor('api_platform.swagger_ui.processor')->withWrite(true);
             }
 

src/Symfony/Bundle/DependencyInjection/ApiPlatformExtension.php

@@ -586,13 +586,13 @@ private function registerSwaggerConfiguration(ContainerBuilder $container, array
             $loader->load('openapi/yaml.php');
         }
 
-        $loader->load('swagger_ui.php');
+        if ($config['enable_swagger_ui']) {
+            $loader->load('swagger_ui.php');
 
-        if ($config['use_symfony_listeners']) {
-            $loader->load('symfony/swagger_ui.php');
-        }
+            if ($config['use_symfony_listeners']) {
+                $loader->load('symfony/swagger_ui.php');
+            }
 
-        if ($config['enable_swagger_ui']) {
             $loader->load('state/swagger_ui.php');
         }
 

src/Symfony/Bundle/Resources/config/symfony/controller.php

@@ -47,5 +47,6 @@
             service('api_platform.state_processor.main'),
             service('api_platform.negotiator')->nullOnInvalid(),
             '%api_platform.docs_formats%',
+            '%api_platform.enable_swagger_ui%',
         ]);
 };

src/Symfony/Bundle/Resources/config/symfony/events.php

@@ -179,6 +179,7 @@
             service('api_platform.state_processor.documentation'),
             service('api_platform.negotiator')->nullOnInvalid(),
             '%api_platform.docs_formats%',
+            '%api_platform.enable_swagger_ui%',
         ]);
 
     $services->set('api_platform.action.placeholder', 'ApiPlatform\Symfony\Action\PlaceholderAction')

src/Symfony/Tests/Action/DocumentationActionTest.php

@@ -27,6 +27,7 @@
 use Prophecy\Argument;
 use Prophecy\PhpUnit\ProphecyTrait;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 /**
  * @author Amrouche Hamza <hamza.simperfit@gmail.com>
@@ -35,6 +36,50 @@ class DocumentationActionTest extends TestCase
 {
     use ProphecyTrait;
 
+    public function testHtmlFormatWhenSwaggerUiDisabledThrows404(): void
+    {
+        $this->expectException(NotFoundHttpException::class);
+        $this->expectExceptionMessage('Swagger UI is disabled.');
+
+        $request = new Request();
+        $request->attributes->set('_format', 'html');
+
+        $openApiFactory = $this->createMock(OpenApiFactoryInterface::class);
+        $resourceNameCollectionFactory = $this->createMock(ResourceNameCollectionFactoryInterface::class);
+
+        $documentation = new DocumentationAction(
+            $resourceNameCollectionFactory,
+            openApiFactory: $openApiFactory,
+            documentationFormats: [
+                'json' => ['application/json'],
+                'html' => ['text/html'],
+            ],
+            swaggerUiEnabled: false,
+        );
+
+        $documentation($request);
+    }
+
+    public function testJsonFormatWhenSwaggerUiDisabledIsAccessible(): void
+    {
+        $request = new Request();
+        $request->attributes->set('_format', 'json');
+
+        $openApiFactory = $this->createMock(OpenApiFactoryInterface::class);
+        $openApiFactory->expects($this->once())->method('__invoke')->willReturn(new OpenApi(new Info('title', '1.0.0'), [], new Paths()));
+
+        $resourceNameCollectionFactory = $this->createMock(ResourceNameCollectionFactoryInterface::class);
+
+        $documentation = new DocumentationAction(
+            $resourceNameCollectionFactory,
+            openApiFactory: $openApiFactory,
+            swaggerUiEnabled: false
+        );
+
+        $result = $documentation($request);
+        $this->assertInstanceOf(OpenApi::class, $result);
+    }
+
     public function testDocumentationAction(): void
     {
         $openApi = new OpenApi(new Info('my api', '1.0.0'), [], new Paths());
@@ -88,4 +133,25 @@ public function testGetHydraDocumentation(): void
         $entrypoint = new DocumentationAction($resourceNameCollectionFactory, provider: $provider, processor: $processor);
         $entrypoint($request);
     }
+
+    public function testHtmlFormatNotSupportedThrowsException(): void
+    {
+        $this->expectException(NotFoundHttpException::class);
+        $this->expectExceptionMessage('Format "html" is not supported');
+
+        $request = new Request();
+        $request->attributes->set('_format', 'html');
+
+        $openApiFactory = $this->createMock(OpenApiFactoryInterface::class);
+        $resourceNameCollectionFactory = $this->createMock(ResourceNameCollectionFactoryInterface::class);
+
+        $documentation = new DocumentationAction(
+            $resourceNameCollectionFactory,
+            openApiFactory: $openApiFactory,
+            documentationFormats: ['json' => ['application/json']],
+            swaggerUiEnabled: false,
+        );
+
+        $documentation($request);
+    }
 }

src/Symfony/Tests/Bundle/DependencyInjection/ApiPlatformExtensionTest.php

@@ -108,6 +108,8 @@ class ApiPlatformExtensionTest extends TestCase
         'asset_package' => null,
         'enable_entrypoint' => true,
         'enable_docs' => true,
+        'enable_swagger' => true,
+        'enable_swagger_ui' => true,
         'use_symfony_listeners' => false,
     ]];
 
@@ -208,6 +210,10 @@ public function testCommonConfiguration(): void
             'api_platform.state_processor.respond',
             'api_platform.state_processor.add_link_header',
             'api_platform.state_processor.serialize',
+
+            'api_platform.swagger_ui.context',
+            'api_platform.swagger_ui.processor',
+            'api_platform.swagger_ui.provider',
         ];
 
         $aliases = [
@@ -249,13 +255,51 @@ public function testCommonConfiguration(): void
             'api_platform.listener.view.write',
             'api_platform.listener.view.serialize',
             'api_platform.listener.view.respond',
+            'api_platform.swagger_ui.documentation.provider',
         ];
 
         foreach ($services as $service) {
             $this->assertNotContainerHasService($service);
         }
     }
 
+    public function testSwaggerUiDisabledConfiguration(): void
+    {
+        $config = self::DEFAULT_CONFIG;
+        $config['api_platform']['enable_swagger'] = true;
+        $config['api_platform']['enable_swagger_ui'] = false;
+        $config['api_platform']['use_symfony_listeners'] = true;
+
+        (new ApiPlatformExtension())->load($config, $this->container);
+
+        $this->assertNotContainerHasService('api_platform.swagger_ui.processor');
+
+        $this->assertNotContainerHasService('api_platform.swagger_ui.context');
+
+        $this->assertNotContainerHasService('api_platform.swagger_ui.provider');
+
+        $this->assertNotContainerHasService('api_platform.swagger_ui.documentation.provider');
+    }
+
+    public function testSwaggerUiEnabledConfiguration(): void
+    {
+        $config = self::DEFAULT_CONFIG;
+        $config['api_platform']['enable_swagger'] = true;
+        $config['api_platform']['enable_swagger_ui'] = true;
+        $config['api_platform']['use_symfony_listeners'] = true;
+
+        (new ApiPlatformExtension())->load($config, $this->container);
+
+        $services = [
+            'api_platform.swagger_ui.processor',
+            'api_platform.swagger_ui.context',
+            'api_platform.swagger_ui.provider',
+            'api_platform.swagger_ui.documentation.provider',
+        ];
+
+        $this->assertContainerHas($services);
+    }
+
     public function testEventListenersConfiguration(): void
     {
         $config = self::DEFAULT_CONFIG;

tests/Fixtures/app/config/config_common.yml

@@ -36,6 +36,8 @@ api_platform:
     description: |
         This is a test API.
         Made with love
+    enable_swagger: true
+    enable_swagger_ui: true
     formats:
         jsonld:                        ['application/ld+json']
         jsonhal:                       ['application/hal+json']

tests/Functional/DocumentationActionTest.php

@@ -0,0 +1,119 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Tests\Functional;
+
+use ApiPlatform\Symfony\Bundle\Test\ApiTestCase;
+use Symfony\Component\Config\Loader\LoaderInterface;
+use Symfony\Component\DependencyInjection\ContainerBuilder;
+
+/**
+ * @author Maxence Castel <maxence.castel59@gmail.com>
+ */
+class DocumentationActionAppKernel extends \AppKernel
+{
+    public static bool $swaggerUiEnabled = true;
+
+    public function getCacheDir(): string
+    {
+        $suffix = self::$swaggerUiEnabled ? 'ui_enabled' : 'ui_disabled';
+
+        return parent::getCacheDir().'/'.$suffix;
+    }
+
+    public function getLogDir(): string
+    {
+        $suffix = self::$swaggerUiEnabled ? 'ui_enabled' : 'ui_disabled';
+
+        return parent::getLogDir().'/'.$suffix;
+    }
+
+    protected function configureContainer(ContainerBuilder $c, LoaderInterface $loader): void
+    {
+        parent::configureContainer($c, $loader);
+
+        $loader->load(static function (ContainerBuilder $container) {
+            $container->loadFromExtension('api_platform', [
+                'enable_swagger_ui' => DocumentationActionAppKernel::$swaggerUiEnabled,
+            ]);
+        });
+    }
+}
+
+final class DocumentationActionTest extends ApiTestCase
+{
+    protected static ?bool $alwaysBootKernel = true;
+
+    protected static function getKernelClass(): string
+    {
+        return DocumentationActionAppKernel::class;
+    }
+
+    public function testHtmlDocumentationIsNotAccessibleWhenSwaggerUiIsDisabled(): void
+    {
+        DocumentationActionAppKernel::$swaggerUiEnabled = false;
+
+        $client = self::createClient();
+
+        $container = static::getContainer();
+        $this->assertFalse($container->getParameter('api_platform.enable_swagger_ui'));
+
+        $client->request('GET', '/docs', ['headers' => ['Accept' => 'text/html']]);
+        $this->assertResponseStatusCodeSame(404);
+        $this->assertStringContainsString('Swagger UI is disabled.', $client->getResponse()->getContent(false));
+    }
+
+    public function testJsonDocumentationIsAccessibleWhenSwaggerUiIsDisabled(): void
+    {
+        DocumentationActionAppKernel::$swaggerUiEnabled = false;
+
+        $client = self::createClient();
+
+        $container = static::getContainer();
+        $this->assertFalse($container->getParameter('api_platform.enable_swagger_ui'));
+
+        $client->request('GET', '/docs.jsonopenapi', ['headers' => ['Accept' => 'application/vnd.openapi+json']]);
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['openapi' => '3.1.0']);
+        $this->assertJsonContains(['info' => ['title' => 'My Dummy API']]);
+    }
+
+    public function testHtmlDocumentationIsAccessibleWhenSwaggerUiIsEnabled(): void
+    {
+        DocumentationActionAppKernel::$swaggerUiEnabled = true;
+
+        $client = self::createClient();
+
+        $container = static::getContainer();
+        $this->assertTrue($container->getParameter('api_platform.enable_swagger_ui'));
+
+        $client->request('GET', '/docs', ['headers' => ['Accept' => 'text/html']]);
+        $this->assertResponseIsSuccessful();
+        $this->assertStringNotContainsString('Swagger UI is disabled.', $client->getResponse()->getContent(false));
+    }
+
+    public function testJsonDocumentationIsAccessibleWhenSwaggerUiIsEnabled(): void
+    {
+        DocumentationActionAppKernel::$swaggerUiEnabled = true;
+
+        $client = self::createClient();
+
+        $container = static::getContainer();
+        $this->assertTrue($container->getParameter('api_platform.enable_swagger_ui'));
+
+        $client->request('GET', '/docs.jsonopenapi', ['headers' => ['Accept' => 'application/vnd.openapi+json']]);
+        $this->assertResponseIsSuccessful();
+        $this->assertJsonContains(['openapi' => '3.1.0']);
+        $this->assertJsonContains(['info' => ['title' => 'My Dummy API']]);
+    }
+}