fix: wrong resource iri

Author: soyuka

features/main/standard_put.feature

@@ -66,6 +66,20 @@ Feature: Spec-compliant PUT support
     """
     Then the response status code should be 400
 
+  Scenario: Fails to create a new resource when the JSON-LD @id doesn't match the URI
+    When I add "Content-Type" header equal to "application/ld+json"
+    And I send a "PUT" request to "/standard_puts/7" with body:
+    """
+    {
+      "@id": "/standard_puts/6",
+      "@context": "/contexts/StandardPut",
+      "@type": "StandardPut",
+      "foo": "a",
+      "bar": "b"
+    }
+    """
+    Then the response status code should be 400
+
   Scenario: Replace an existing resource
     When I add "Content-Type" header equal to "application/ld+json"
     And I send a "PUT" request to "/standard_puts/5" with body:

src/Symfony/Routing/IriConverter.php

@@ -78,6 +78,12 @@ public function getResourceFromIri(string $iri, array $context = [], ?Operation
             throw new InvalidArgumentException(sprintf('No resource associated to "%s".', $iri));
         }
 
+        foreach ($context['uri_variables'] ?? [] as $key => $value) {
+            if (!isset($parameters[$key]) || $parameters[$key] !== (string) $value) {
+                throw new InvalidArgumentException(sprintf('The iri "%s" does not reference the correct resource.', $iri));
+            }
+        }
+
         if ($operation && $operation->getClass() !== $parameters['_api_resource_class']) {
             throw new InvalidArgumentException(sprintf('The iri "%s" does not reference the correct resource.', $iri));
         }