eZ\Publish\Core\REST\Server\Controller\Role

Complexity

Total Complexity

85

Size/Duplication

Total Lines	843
Duplicated Lines	6.64 %

Coupling/Cohesion

Components	1
Dependencies	29

Importance

Changes	2
Bugs	2	Features	0

31 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	9	1
C	createRole()	0	46	8
B	createRoleDraft()	0	18	5
C	listRoles()	0	23	7
A	loadRole()	0	4	1
A	loadRoleDraft()	0	11	2
A	updateRole()	0	14	1
A	updateRoleDraft()	0	20	2
A	publishRoleDraft()	0	16	2
A	deleteRole()	0	8	1
A	deleteRoleDraft()	0	8	1
A	loadPolicies()	0	6	1
A	loadPolicy()	0	11	3
A	deletePolicies()	0	10	2
B	addPolicy()	0	31	3
B	addPolicyByRoleDraft()	0	24	2
A	getLastAddedPolicy()	0	13	3
C	updatePolicy()	24	43	8
B	updatePolicyByRoleDraft()	12	25	4
C	deletePolicy()	0	40	8
A	removePolicyByRoleDraft()	20	20	4
A	assignRoleToUser()	0	22	2
B	assignRoleToUserGroup()	0	25	2
A	unassignRoleFromUser()	0	11	1
A	unassignRoleFromUserGroup()	0	13	1
A	loadRoleAssignmentsForUser()	0	8	1
A	loadRoleAssignmentsForUserGroup()	0	10	1
A	loadRoleAssignmentForUser()	0	13	3
A	loadRoleAssignmentForUserGroup()	0	15	3
A	listPoliciesForUser()	0	9	1
A	mapToUpdateStruct()	0	8	1

<?php

/**
 * File containing the Role controller class.
 *
 * @copyright Copyright (C) eZ Systems AS. All rights reserved.
 * @license For full copyright and license information view LICENSE file distributed with this source code.
 *
 * @version //autogentag//
 */
namespace eZ\Publish\Core\REST\Server\Controller;

use eZ\Publish\API\Repository\Exceptions\LimitationValidationException;
use eZ\Publish\API\Repository\Exceptions\NotFoundException;
use eZ\Publish\Core\Base\Exceptions\ForbiddenException;
use eZ\Publish\Core\Base\Exceptions\InvalidArgumentException;
use eZ\Publish\Core\Base\Exceptions\UnauthorizedException;
use eZ\Publish\Core\REST\Common\Message;
use eZ\Publish\Core\REST\Common\Exceptions;
use eZ\Publish\Core\REST\Server\Exceptions\BadRequestException;
use eZ\Publish\Core\REST\Server\Values;
use eZ\Publish\Core\REST\Server\Controller as RestController;
use eZ\Publish\API\Repository\RoleService;
use eZ\Publish\API\Repository\UserService;
use eZ\Publish\API\Repository\LocationService;
use eZ\Publish\API\Repository\Values\User\RoleCreateStruct;
use eZ\Publish\API\Repository\Values\User\RoleUpdateStruct;
use eZ\Publish\API\Repository\Exceptions\NotFoundException as APINotFoundException;
use Symfony\Component\HttpFoundation\Request;

/**
 * Role controller.
 */
class Role extends RestController
{
    /**
     * Role service.
     *
     * @var \eZ\Publish\API\Repository\RoleService
     */
    protected $roleService;

    /**
     * User service.
     *
     * @var \eZ\Publish\API\Repository\UserService
     */
    protected $userService;

    /**
     * Location service.
     *
     * @var \eZ\Publish\API\Repository\LocationService
     */
    protected $locationService;

    /**
     * Construct controller.
     *
     * @param \eZ\Publish\API\Repository\RoleService $roleService
     * @param \eZ\Publish\API\Repository\UserService $userService
     * @param \eZ\Publish\API\Repository\LocationService $locationService
     */
    public function __construct(
        RoleService $roleService,
        UserService $userService,
        LocationService $locationService
    ) {
        $this->roleService = $roleService;
        $this->userService = $userService;
        $this->locationService = $locationService;
    }

    /**
     * Create new role.
     *
     * Defaults to publishing the role, but you can create a draft instead by setting the POST parameter publish=false
     *
     * @return \eZ\Publish\Core\REST\Server\Values\CreatedRole
     */
    public function createRole(Request $request)
    {
        $publish = (
            !$request->query->has('publish') ||
            ($request->query->has('publish') && $request->query->get('publish') === 'true')
        );

        try {
            $roleDraft = $this->roleService->createRole(
                $this->inputDispatcher->parse(

$this->inputDispatcher->parse(new \eZ\Publish\Core\REST\Common\Message(array('Content-Type' => $request->headers->get('Content-Type'), '__publish' => $publish), $request->getContent())) of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\RoleCreateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

                    new Message(
                        [
                            'Content-Type' => $request->headers->get('Content-Type'),
                            // @todo Needs refactoring! Temporary solution so parser has access to get parameters
                            '__publish' => $publish,
                        ],
                        $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

                    )
                )
            );
        } catch (InvalidArgumentException $e) {
            throw new ForbiddenException($e->getMessage());
        } catch (UnauthorizedException $e) {
            throw new ForbiddenException($e->getMessage());
        } catch (LimitationValidationException $e) {
            throw new BadRequestException($e->getMessage());
        } catch (Exceptions\Parser $e) {
            throw new BadRequestException($e->getMessage());
        }

        if ($publish) {
            @trigger_error(

It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

                "Create and publish role in the same operation is deprecated, and will be removed in the future.\n" .
                'Instead, publish the role draft using Role::publishRoleDraft().',
                E_USER_DEPRECATED
            );

            $this->roleService->publishRoleDraft($roleDraft);

            $role = $this->roleService->loadRole($roleDraft->id);

The property $id is declared protected in eZ\Publish\API\Repository\Values\User\Role. Since you implemented __get(), maybe consider adding a @property or @property-read annotation. This makes it easier for IDEs to provide auto-completion.

            return new Values\CreatedRole(['role' => new Values\RestRole($role)]);
        }

        return new Values\CreatedRole(['role' => new Values\RestRole($roleDraft)]);
    }

    /**
     * Creates a new RoleDraft for an existing Role.
     *
     * @since 6.2
     *
     * @throws \eZ\Publish\API\Repository\Exceptions\ForbiddenException if the Role already has a Role Draft that will need to be removed first,
     *                                                                  or if the authenticated user is not allowed to create a role
     * @throws \eZ\Publish\Core\REST\Server\Exceptions\BadRequestException if a policy limitation in the $roleCreateStruct is not valid
     *
     * @return \eZ\Publish\Core\REST\Server\Values\CreatedRole
     */
    public function createRoleDraft($roleId, Request $request)

The parameter $request is not used and could be removed.

    {
        try {
            $roleDraft = $this->roleService->createRoleDraft(
                $this->roleService->loadRole($roleId)
            );
        } catch (InvalidArgumentException $e) {
            throw new ForbiddenException($e->getMessage());
        } catch (UnauthorizedException $e) {
            throw new ForbiddenException($e->getMessage());
        } catch (LimitationValidationException $e) {
            throw new BadRequestException($e->getMessage());
        } catch (Exceptions\Parser $e) {
            throw new BadRequestException($e->getMessage());
        }

        return new Values\CreatedRole(['role' => new Values\RestRole($roleDraft)]);
    }

    /**
     * Loads list of roles.
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RoleList
     */
    public function listRoles(Request $request)
    {
        $roles = array();
        if ($request->query->has('identifier')) {
            try {
                $role = $this->roleService->loadRoleByIdentifier($request->query->get('identifier'));
                $roles[] = $role;
            } catch (APINotFoundException $e) {
                // Do nothing
            }
        } else {
            $offset = $request->query->has('offset') ? (int)$request->query->get('offset') : 0;
            $limit = $request->query->has('limit') ? (int)$request->query->get('limit') : -1;

            $roles = array_slice(
                $this->roleService->loadRoles(),
                $offset >= 0 ? $offset : 0,
                $limit >= 0 ? $limit : null
            );
        }

        return new Values\RoleList($roles, $request->getPathInfo());
    }

    /**
     * Loads role.
     *
     * @param $roleId
     *
     * @return \eZ\Publish\API\Repository\Values\User\Role
     */
    public function loadRole($roleId)
    {
        return $this->roleService->loadRole($roleId);
    }

    /**
     * Loads a role draft.
     *
     * @param mixed $roleId Original role ID, or ID of the role draft itself
     *
     * @return \eZ\Publish\API\Repository\Values\User\RoleDraft
     */
    public function loadRoleDraft($roleId)
    {
        try {
            // First try to load the draft for given role.
            return $this->roleService->loadRoleDraftByRoleId($roleId);
        } catch (NotFoundException $e) {
            // We might want a newly created role, so try to load it by its ID.
            // loadRoleDraft() might throw a NotFoundException (wrong $roleId). If so, let it bubble up.
            return $this->roleService->loadRoleDraft($roleId);
        }
    }

    /**
     * Updates a role.
     *
     * @param $roleId
     *
     * @return \eZ\Publish\API\Repository\Values\User\Role
     */
    public function updateRole($roleId, Request $request)
    {
        $createStruct = $this->inputDispatcher->parse(
            new Message(
                array('Content-Type' => $request->headers->get('Content-Type')),
                $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

            )
        );

        return $this->roleService->updateRole(

The method eZ\Publish\API\Repository\RoleService::updateRole() has been deprecated with message: since 6.0, use {@see updateRoleDraft}

            $this->roleService->loadRole($roleId),
            $this->mapToUpdateStruct($createStruct)

$createStruct of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\RoleCreateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

        );
    }

    /**
     * Updates a role draft.
     *
     * @param mixed $roleId Original role ID, or ID of the role draft itself
     *
     * @return \eZ\Publish\API\Repository\Values\User\RoleDraft
     */
    public function updateRoleDraft($roleId, Request $request)
    {
        $createStruct = $this->inputDispatcher->parse(
            new Message(
                array('Content-Type' => $request->headers->get('Content-Type')),
                $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

            )
        );

        try {
            // First try to load the draft for given role.
            $roleDraft = $this->roleService->loadRoleDraftByRoleId($roleId);
        } catch (NotFoundException $e) {
            // We might want a newly created role, so try to load it by its ID.
            // loadRoleDraft() might throw a NotFoundException (wrong $roleId). If so, let it bubble up.
            $roleDraft = $this->roleService->loadRoleDraft($roleId);
        }

        return $this->roleService->updateRoleDraft($roleDraft, $this->mapToUpdateStruct($createStruct));

$createStruct of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\RoleCreateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

    }

    /**
     * Publishes a role draft.
     *
     * @param mixed $roleId Original role ID, or ID of the role draft itself
     * @return Values\RestRole
     */
    public function publishRoleDraft($roleId)
    {
        try {
            // First try to load the draft for given role.
            $roleDraft = $this->roleService->loadRoleDraftByRoleId($roleId);
        } catch (NotFoundException $e) {
            // We might want a newly created role, so try to load it by its ID.
            // loadRoleDraft() might throw a NotFoundException (wrong $roleId). If so, let it bubble up.
            $roleDraft = $this->roleService->loadRoleDraft($roleId);
        }

        $this->roleService->publishRoleDraft($roleDraft);
        $publishedRole = $this->roleService->loadRole($roleDraft->id);

The property $id is declared protected in eZ\Publish\API\Repository\Values\User\Role. Since you implemented __get(), maybe consider adding a @property or @property-read annotation. This makes it easier for IDEs to provide auto-completion.

        return new Values\CreatedRole(['role' => new Values\RestRole($publishedRole)]);
    }

    /**
     * Delete a role by ID.
     *
     * @param $roleId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\NoContent
     */
    public function deleteRole($roleId)
    {
        $this->roleService->deleteRole(
            $this->roleService->loadRole($roleId)
        );

        return new Values\NoContent();
    }

    /**
     * Delete a role draft by ID.
     *
     * @since 6.2
     *
     * @param $roleId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\NoContent
     */
    public function deleteRoleDraft($roleId)
    {
        $this->roleService->deleteRoleDraft(
            $this->roleService->loadRoleDraft($roleId)
        );

        return new Values\NoContent();
    }

    /**
     * Loads the policies for the role.
     *
     * @param $roleId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\PolicyList
     */
    public function loadPolicies($roleId, Request $request)
    {
        $loadedRole = $this->roleService->loadRole($roleId);

        return new Values\PolicyList($loadedRole->getPolicies(), $request->getPathInfo());
    }

    /**
     * Deletes all policies from a role.
     *
     * @param $roleId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\NoContent
     */
    public function deletePolicies($roleId)
    {
        $loadedRole = $this->roleService->loadRole($roleId);

        foreach ($loadedRole->getPolicies() as $policy) {
            $this->roleService->deletePolicy($policy);

The method eZ\Publish\API\Repository\RoleService::deletePolicy() has been deprecated with message: since 6.0, use {@link removePolicyByRoleDraft()} instead.

        }

        return new Values\NoContent();
    }

    /**
     * Loads a policy.
     *
     * @param $roleId
     * @param $policyId
     *
     * @throws \eZ\Publish\Core\REST\Common\Exceptions\NotFoundException
     *
     * @return \eZ\Publish\API\Repository\Values\User\Policy
     */
    public function loadPolicy($roleId, $policyId, Request $request)
    {
        $loadedRole = $this->roleService->loadRole($roleId);
        foreach ($loadedRole->getPolicies() as $policy) {
            if ($policy->id == $policyId) {
                return $policy;
            }
        }

        throw new Exceptions\NotFoundException("Policy not found: '{$request->getPathInfo()}'.");
    }

    /**
     * Adds a policy to role.
     *
     * @param $roleId int ID of a role or a role draft
     *
     * @return \eZ\Publish\Core\REST\Server\Values\CreatedPolicy
     */
    public function addPolicy($roleId, Request $request)
    {
        $createStruct = $this->inputDispatcher->parse(
            new Message(
                array('Content-Type' => $request->headers->get('Content-Type')),
                $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

            )
        );

        try {
            // First try to treat $roleId as a role draft ID.
            $role = $this->roleService->addPolicyByRoleDraft(
                $this->roleService->loadRoleDraft($roleId),
                $createStruct

$createStruct of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\PolicyCreateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

            );
        } catch (NotFoundException $e) {
            // Then try to treat $roleId as a role ID.
            $role = $this->roleService->addPolicy(

The method eZ\Publish\API\Repository\RoleService::addPolicy() has been deprecated with message: since 6.0, use {@see addPolicyByRoleDraft}

                $this->roleService->loadRole($roleId),
                $createStruct

$createStruct of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\PolicyCreateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

            );
        } catch (LimitationValidationException $e) {
            throw new BadRequestException($e->getMessage());
        }

        return new Values\CreatedPolicy(
            array(
                'policy' => $this->getLastAddedPolicy($role),
            )
        );
    }

    /**
     * Adds a policy to a role draft.
     *
     * @since 6.2
     * @deprecated since 6.3, use {@see addPolicy}
     *
     * @param $roleId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\CreatedPolicy
     */
    public function addPolicyByRoleDraft($roleId, Request $request)
    {
        $createStruct = $this->inputDispatcher->parse(
            new Message(
                array('Content-Type' => $request->headers->get('Content-Type')),
                $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

            )
        );

        try {
            $role = $this->roleService->addPolicyByRoleDraft(
                $this->roleService->loadRoleDraft($roleId),
                $createStruct

$createStruct of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\PolicyCreateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

            );
        } catch (LimitationValidationException $e) {
            throw new BadRequestException($e->getMessage());
        }

        return new Values\CreatedPolicy(
            array(
                'policy' => $this->getLastAddedPolicy($role),
            )
        );
    }

    /**
     * Get the last added policy for $role.
     *
     * This is needed because the RoleService addPolicy() and addPolicyByRoleDraft() methods return the role,
     * not the policy.
     *
     * @param $role \eZ\Publish\API\Repository\Values\User\Role
     *
     * @return \eZ\Publish\API\Repository\Values\User\Policy
     */
    private function getLastAddedPolicy($role)
    {
        $policies = $role->getPolicies();

        $policyToReturn = $policies[0];
        for ($i = 1, $count = count($policies); $i < $count; ++$i) {
            if ($policies[$i]->id > $policyToReturn->id) {
                $policyToReturn = $policies[$i];
            }
        }

        return $policyToReturn;
    }

    /**
     * Updates a policy.
     *
     * @param $roleId int ID of a role or a role draft
     * @param $policyId int ID of a policy
     *
     * @throws \eZ\Publish\Core\REST\Common\Exceptions\NotFoundException
     *
     * @return \eZ\Publish\API\Repository\Values\User\Policy
     */
    public function updatePolicy($roleId, $policyId, Request $request)
    {
        $updateStruct = $this->inputDispatcher->parse(
            new Message(
                array('Content-Type' => $request->headers->get('Content-Type')),
                $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

            )
        );

        try {
            // First try to treat $roleId as a role draft ID.
            $role = $this->roleService->loadRoleDraft($roleId);
            foreach ($role->getPolicies() as $policy) {

This code seems to be duplicated across your project.

                if ($policy->id == $policyId) {
                    try {
                        return $this->roleService->updatePolicy(

The method eZ\Publish\API\Repository\RoleService::updatePolicy() has been deprecated with message: since 6.0, use {@link updatePolicyByRoleDraft()} instead.

                            $policy,
                            $updateStruct

$updateStruct of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\PolicyUpdateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

                        );
                    } catch (LimitationValidationException $e) {
                        throw new BadRequestException($e->getMessage());
                    }
                }
            }
        } catch (NotFoundException $e) {
            // Then try to treat $roleId as a role ID.
            $role = $this->roleService->loadRole($roleId);
            foreach ($role->getPolicies() as $policy) {

This code seems to be duplicated across your project.

                if ($policy->id == $policyId) {
                    try {
                        return $this->roleService->updatePolicy(

The method eZ\Publish\API\Repository\RoleService::updatePolicy() has been deprecated with message: since 6.0, use {@link updatePolicyByRoleDraft()} instead.

                            $policy,
                            $updateStruct

$updateStruct of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\PolicyUpdateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

                        );
                    } catch (LimitationValidationException $e) {
                        throw new BadRequestException($e->getMessage());
                    }
                }
            }
        }

        throw new Exceptions\NotFoundException("Policy not found: '{$request->getPathInfo()}'.");
    }

    /**
     * Updates a policy.
     *
     * @since 6.2
     * @deprecated since 6.3, use {@see updatePolicy}
     *
     * @param $roleId
     * @param $policyId
     *
     * @throws \eZ\Publish\Core\REST\Common\Exceptions\NotFoundException
     *
     * @return \eZ\Publish\API\Repository\Values\User\Policy
     */
    public function updatePolicyByRoleDraft($roleId, $policyId, Request $request)
    {
        $updateStruct = $this->inputDispatcher->parse(
            new Message(
                array('Content-Type' => $request->headers->get('Content-Type')),
                $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

            )
        );

        $role = $this->roleService->loadRoleDraft($roleId);
        foreach ($role->getPolicies() as $policy) {

This code seems to be duplicated across your project.

            if ($policy->id == $policyId) {
                try {
                    return $this->roleService->updatePolicy(

The method eZ\Publish\API\Repository\RoleService::updatePolicy() has been deprecated with message: since 6.0, use {@link updatePolicyByRoleDraft()} instead.

                        $policy,
                        $updateStruct

$updateStruct of type object<eZ\Publish\API\Repository\Values\ValueObject> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\PolicyUpdateStruct>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\ValueObject to be always present.

                    );
                } catch (LimitationValidationException $e) {
                    throw new BadRequestException($e->getMessage());
                }
            }
        }

        throw new Exceptions\NotFoundException("Policy not found: '{$request->getPathInfo()}'.");
    }

    /**
     * Delete a policy from role.
     *
     * @param $roleId int ID of a role or a role draft
     * @param $policyId int ID of a policy
     *
     * @throws \eZ\Publish\Core\REST\Common\Exceptions\NotFoundException
     *
     * @return \eZ\Publish\Core\REST\Server\Values\NoContent
     */
    public function deletePolicy($roleId, $policyId, Request $request)
    {
        try {
            // First try to treat $roleId as a role draft ID.
            $roleDraft = $this->roleService->loadRoleDraft($roleId);

            $policy = null;
            foreach ($roleDraft->getPolicies() as $rolePolicy) {
                if ($rolePolicy->id == $policyId) {
                    $policy = $rolePolicy;
                    break;
                }
            }

            if ($policy !== null) {
                $this->roleService->removePolicyByRoleDraft($roleDraft, $policy);

$policy of type object<eZ\Publish\API\Repository\Values\User\Policy> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\PolicyDraft>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\User\Policy to be always present.

                return new Values\NoContent();
            }
        } catch (NotFoundException $e) {
            // Then try to treat $roleId as a role ID.
            $role = $this->roleService->loadRole($roleId);

            $policy = null;
            foreach ($role->getPolicies() as $rolePolicy) {
                if ($rolePolicy->id == $policyId) {
                    $policy = $rolePolicy;
                    break;
                }
            }

            if ($policy !== null) {
                $this->roleService->deletePolicy($policy);

The method eZ\Publish\API\Repository\RoleService::deletePolicy() has been deprecated with message: since 6.0, use {@link removePolicyByRoleDraft()} instead.

                return new Values\NoContent();
            }
        }

        throw new Exceptions\NotFoundException("Policy not found: '{$request->getPathInfo()}'.");
    }

    /**
     * Remove a policy from a role draft.
     *
     * @since 6.2
     * @deprecated since 6.3, use {@see deletePolicy}
     *
     * @param $roleId
     * @param $policyId
     *
     * @throws \eZ\Publish\Core\REST\Common\Exceptions\NotFoundException
     *
     * @return \eZ\Publish\Core\REST\Server\Values\NoContent
     */
    public function removePolicyByRoleDraft($roleId, $policyId, Request $request)
    {
        $roleDraft = $this->roleService->loadRoleDraft($roleId);

        $policy = null;
        foreach ($roleDraft->getPolicies() as $rolePolicy) {
            if ($rolePolicy->id == $policyId) {
                $policy = $rolePolicy;
                break;
            }
        }

        if ($policy !== null) {
            $this->roleService->removePolicyByRoleDraft($roleDraft, $policy);

$policy of type object<eZ\Publish\API\Repository\Values\User\Policy> is not a sub-type of object<eZ\Publish\API\Repository\Values\User\PolicyDraft>. It seems like you assume a child class of the class eZ\Publish\API\Repository\Values\User\Policy to be always present.

            return new Values\NoContent();
        }

        throw new Exceptions\NotFoundException("Policy not found: '{$request->getPathInfo()}'.");
    }

    /**
     * Assigns role to user.
     *
     * @param $userId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RoleAssignmentList
     */
    public function assignRoleToUser($userId, Request $request)
    {
        $roleAssignment = $this->inputDispatcher->parse(
            new Message(
                array('Content-Type' => $request->headers->get('Content-Type')),
                $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

            )
        );

        $user = $this->userService->loadUser($userId);
        $role = $this->roleService->loadRole($roleAssignment->roleId);

The property roleId does not exist on object<eZ\Publish\API\Repository\Values\ValueObject>. Since you implemented __get, maybe consider adding a @property annotation.

        try {
            $this->roleService->assignRoleToUser($role, $user, $roleAssignment->limitation);

The property limitation does not exist on object<eZ\Publish\API\Repository\Values\ValueObject>. Since you implemented __get, maybe consider adding a @property annotation.

        } catch (LimitationValidationException $e) {
            throw new BadRequestException($e->getMessage());
        }

        $roleAssignments = $this->roleService->getRoleAssignmentsForUser($user);

        return new Values\RoleAssignmentList($roleAssignments, $user->id);
    }

    /**
     * Assigns role to user group.
     *
     * @param $groupPath
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RoleAssignmentList
     */
    public function assignRoleToUserGroup($groupPath, Request $request)
    {
        $roleAssignment = $this->inputDispatcher->parse(
            new Message(
                array('Content-Type' => $request->headers->get('Content-Type')),
                $request->getContent()

It seems like $request->getContent() targeting Symfony\Component\HttpFoundation\Request::getContent() can also be of type resource; however, eZ\Publish\Core\REST\Common\Message::__construct() does only seem to accept string, maybe add an additional type check?

            )
        );

        $groupLocationParts = explode('/', $groupPath);
        $groupLocation = $this->locationService->loadLocation(array_pop($groupLocationParts));
        $userGroup = $this->userService->loadUserGroup($groupLocation->contentId);

        $role = $this->roleService->loadRole($roleAssignment->roleId);

The property roleId does not exist on object<eZ\Publish\API\Repository\Values\ValueObject>. Since you implemented __get, maybe consider adding a @property annotation.

        try {
            $this->roleService->assignRoleToUserGroup($role, $userGroup, $roleAssignment->limitation);

The property limitation does not exist on object<eZ\Publish\API\Repository\Values\ValueObject>. Since you implemented __get, maybe consider adding a @property annotation.

        } catch (LimitationValidationException $e) {
            throw new BadRequestException($e->getMessage());
        }

        $roleAssignments = $this->roleService->getRoleAssignmentsForUserGroup($userGroup);

        return new Values\RoleAssignmentList($roleAssignments, $groupPath, true);
    }

    /**
     * Un-assigns role from user.
     *
     * @param $userId
     * @param $roleId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RoleAssignmentList
     */
    public function unassignRoleFromUser($userId, $roleId)
    {
        $user = $this->userService->loadUser($userId);
        $role = $this->roleService->loadRole($roleId);

        $this->roleService->unassignRoleFromUser($role, $user);

The method eZ\Publish\API\Repository\RoleService::unassignRoleFromUser() has been deprecated with message: since 6.0, use {@see removeRoleAssignment} instead.

        $roleAssignments = $this->roleService->getRoleAssignmentsForUser($user);

        return new Values\RoleAssignmentList($roleAssignments, $user->id);
    }

    /**
     * Un-assigns role from user group.
     *
     * @param $groupPath
     * @param $roleId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RoleAssignmentList
     */
    public function unassignRoleFromUserGroup($groupPath, $roleId)
    {
        $groupLocationParts = explode('/', $groupPath);
        $groupLocation = $this->locationService->loadLocation(array_pop($groupLocationParts));
        $userGroup = $this->userService->loadUserGroup($groupLocation->contentId);

        $role = $this->roleService->loadRole($roleId);
        $this->roleService->unassignRoleFromUserGroup($role, $userGroup);

The method eZ\Publish\API\Repository\RoleService::unassignRoleFromUserGroup() has been deprecated with message: since 6.0, use {@see removeRoleAssignment} instead.

        $roleAssignments = $this->roleService->getRoleAssignmentsForUserGroup($userGroup);

        return new Values\RoleAssignmentList($roleAssignments, $groupPath, true);
    }

    /**
     * Loads role assignments for user.
     *
     * @param $userId
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RoleAssignmentList
     */
    public function loadRoleAssignmentsForUser($userId)
    {
        $user = $this->userService->loadUser($userId);

        $roleAssignments = $this->roleService->getRoleAssignmentsForUser($user);

        return new Values\RoleAssignmentList($roleAssignments, $user->id);
    }

    /**
     * Loads role assignments for user group.
     *
     * @param $groupPath
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RoleAssignmentList
     */
    public function loadRoleAssignmentsForUserGroup($groupPath)
    {
        $groupLocationParts = explode('/', $groupPath);
        $groupLocation = $this->locationService->loadLocation(array_pop($groupLocationParts));
        $userGroup = $this->userService->loadUserGroup($groupLocation->contentId);

        $roleAssignments = $this->roleService->getRoleAssignmentsForUserGroup($userGroup);

        return new Values\RoleAssignmentList($roleAssignments, $groupPath, true);
    }

    /**
     * Returns a role assignment to the given user.
     *
     * @param $userId
     * @param $roleId
     *
     * @throws \eZ\Publish\Core\REST\Common\Exceptions\NotFoundException
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RestUserRoleAssignment
     */
    public function loadRoleAssignmentForUser($userId, $roleId, Request $request)
    {
        $user = $this->userService->loadUser($userId);
        $roleAssignments = $this->roleService->getRoleAssignmentsForUser($user);

        foreach ($roleAssignments as $roleAssignment) {
            if ($roleAssignment->getRole()->id == $roleId) {
                return new Values\RestUserRoleAssignment($roleAssignment, $userId);

It seems like $roleAssignment defined by $roleAssignment on line 809 can also be of type object<eZ\Publish\API\Repository\Values\User\UserGroupRoleAssignment>; however, eZ\Publish\Core\REST\Server\Values\RestUserRoleAssignment::__construct() does only seem to accept object<eZ\Publish\API\Repository\Values\User\UserRoleAssignment>, maybe add an additional type check?

            }
        }

        throw new Exceptions\NotFoundException("Role assignment not found: '{$request->getPathInfo()}'.");
    }

    /**
     * Returns a role assignment to the given user group.
     *
     * @param $groupPath
     * @param $roleId
     *
     * @throws \eZ\Publish\Core\REST\Common\Exceptions\NotFoundException
     *
     * @return \eZ\Publish\Core\REST\Server\Values\RestUserGroupRoleAssignment
     */
    public function loadRoleAssignmentForUserGroup($groupPath, $roleId, Request $request)
    {
        $groupLocationParts = explode('/', $groupPath);
        $groupLocation = $this->locationService->loadLocation(array_pop($groupLocationParts));
        $userGroup = $this->userService->loadUserGroup($groupLocation->contentId);

        $roleAssignments = $this->roleService->getRoleAssignmentsForUserGroup($userGroup);
        foreach ($roleAssignments as $roleAssignment) {
            if ($roleAssignment->getRole()->id == $roleId) {
                return new Values\RestUserGroupRoleAssignment($roleAssignment, $groupPath);
            }
        }

        throw new Exceptions\NotFoundException("Role assignment not found: '{$request->getPathInfo()}'.");
    }

    /**
     * Search all policies which are applied to a given user.
     *
     * @return \eZ\Publish\Core\REST\Server\Values\PolicyList
     */
    public function listPoliciesForUser(Request $request)
    {
        return new Values\PolicyList(
            $this->roleService->loadPoliciesByUserId(
                $request->query->get('userId')
            ),
            $request->getPathInfo()
        );
    }

    /**
     * Maps a RoleCreateStruct to a RoleUpdateStruct.
     *
     * Needed since both structs are encoded into the same media type on input.
     *
     * @param \eZ\Publish\API\Repository\Values\User\RoleCreateStruct $createStruct
     *
     * @return \eZ\Publish\API\Repository\Values\User\RoleUpdateStruct
     */
    protected function mapToUpdateStruct(RoleCreateStruct $createStruct)
    {
        return new RoleUpdateStruct(
            array(
                'identifier' => $createStruct->identifier,
            )
        );
    }
}