I’m using API Platform 3.3 with Symfony 6.4.

My resources are defined in YAML. One resource, Checkin, is a many-to-one sub-resource of another, ActionPlan. Its endpoints follow the format /users/me/action-plans/{actionPlanId}/checkins.

I need to add security so that these endpoints return Unauthorized if attempted by a user who does not own the ActionPlan referenced in the path.

According to the API Platform 3.3 docs, you can do that by adding the security property to your Link class like this:

#[ApiResource(
    uriTemplate: '/users/me/action-plans/{actionPlanId}/checkins',
    uriVariables: [
        'actionPlanId' => new Link(
            fromClass: ActionPlan::class,
            toProperty: 'actionPlan',
            security: "actionPlan.getUser() == user"
        ),
    ]
)]

However, I do not know how to convert this to YAML and the documentation does not provide an example. The following was my best guess, but the security expression is ignored.

ExternalLibraryEntityActionPlanCheckin:
  normalizationContext:
    groups: [ 'action-plan-checkin:read' ]

  denormalizationContext:
    groups: [ 'action-plan-checkin:write' ]

  operations:
    ApiPlatformMetadataPost:
      uriTemplate: users/me/action-plans/{actionPlanId}/checkins
      uriVariables:
        actionPlanId:
          fromClass: ExternalLibraryEntityActionPlanActionPlan
          toProperty: actionPlan
          security: 'actionPlan.getUser() == user'

I have indeed set enable_link_security: true in my api_platform.yaml config.