通过自定义路由扩展 ApiResource 以支持不同的输出格式

use Symfony\Component\Serializer\Annotation\Groups;

class Invoice
{
    // ... 其他属性 ...

    #[Groups(["read:invoice"])]
    public function getUrl(): string
    {
        return "/invoices/{$this->id}/document";
    }
}

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use App\Entity\Invoice;
use App\Service\InvoiceDocumentService;

class InvoiceDocumentController extends AbstractController
{
    private InvoiceDocumentService $documentService;

    public function __construct(InvoiceDocumentService $documentService)
    {
        $this->documentService = $documentService;
    }

    #[Route('/invoices/{id}/document', name: 'invoice_document', methods: ['GET'])]
    public function getDocument(Invoice $invoice): Response
    {
        $pdfContent = $this->documentService->createDocumentForInvoice($invoice);

        $response = new Response($pdfContent);
        $response->headers->set('Content-Type', 'application/pdf');
        $response->headers->set('Content-Disposition', 'inline; filename="invoice_' . $invoice->getId() . '.pdf"');

        return $response;
    }
}

use Symfony\Component\Security\Http\Attribute\IsGranted;

#[Route('/invoices/{id}/document', name: 'invoice_document', methods: ['GET'])]
#[IsGranted('ROLE_ADMIN')] // 示例：只有管理员可以访问
public function getDocument(Invoice $invoice): Response
{
    // ...
}

use Symfony\Component\Security\Core\Authorization\Voter\Voter;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use App\Entity\Invoice;
use App\Entity\User;

class InvoiceVoter extends Voter
{
    const VIEW = 'VIEW';

    protected function supports(string $attribute, mixed $subject): bool
    {
        // 如果 attribute 不是我们支持的，则返回 false
        if (!in_array($attribute, [self::VIEW])) {
            return false;
        }

        // 只有 Invoice 对象才能被投票
        if (!$subject instanceof Invoice) {
            return false;
        }

        return true;
    }

    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
    {
        $user = $token->getUser();

        if (!$user instanceof User) {
            // 如果用户未登录，则拒绝访问
            return false;
        }

        /** @var Invoice $invoice */
        $invoice = $subject;

        switch ($attribute) {
            case self::VIEW:
                return $this->canView($invoice, $user);
        }

        throw new \LogicException('This code should not be reached!');
    }

    private function canView(Invoice $invoice, User $user): bool
    {
        // 逻辑判断用户是否有权查看 Invoice
        // 例如，检查用户是否是 Invoice 的创建者
        return $invoice->getOwner() === $user;
    }
}

#[Route('/invoices/{id}/document', name: 'invoice_document', methods: ['GET'])]
public function getDocument(Invoice $invoice, AuthorizationCheckerInterface $authChecker): Response
{
    if (!$authChecker->isGranted(InvoiceVoter::VIEW, $invoice)) {
        throw $this->createAccessDeniedException('您无权查看此发票。');
    }

    // ...
}