Unable to patch part lot via API

[fabi321]

Describe the bug
I am unable to patch a part lot as an authenticated user using the API.

To Reproduce
Steps to reproduce the behavior:

1. Have a user with the edit part lot permission that does not have the edit part permission
2. try to patch the part lot amount and description using the api
3. it fails with an 403

Log

[2026-06-24T09:25:35.245743+02:00] request.INFO: Matched route "_api_/part_lots/{id}{._format}_patch". {"route":"_api_/part_lots/{id}{._format}_patch","route_parameters":{"_route":"_api_/part_lots/{id}{._format}_patch","_controller":"api_platform.action.placeholder","_stateless":false,"_api_resource_class":"App\\Entity\\Parts\\PartLot","_api_operation_name":"_api_/part_lots/{id}{._format}_patch","_format":null,"id":"461"},"request_uri":"https://example.com/api/part_lots/461","method":"PATCH"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.256898+02:00] security.DEBUG: Checking for authenticator support. {"firewall_name":"main","authenticators":5} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.256931+02:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"main","authenticator":"App\\Security\\ApiTokenAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.256960+02:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"main","authenticator":"Scheb\\TwoFactorBundle\\Security\\Http\\Authenticator\\TwoFactorAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.256979+02:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"main","authenticator":"Scheb\\TwoFactorBundle\\Security\\Http\\Authenticator\\TwoFactorAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.256989+02:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"main","authenticator":"Nbgrp\\OneloginSamlBundle\\Security\\Http\\Authenticator\\SamlAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.256999+02:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"main","authenticator":"Nbgrp\\OneloginSamlBundle\\Security\\Http\\Authenticator\\SamlAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.257008+02:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"main","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.257018+02:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"main","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.257027+02:00] security.DEBUG: Checking support on authenticator. {"firewall_name":"main","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\RememberMeAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.257046+02:00] security.DEBUG: Authenticator does not support the request. {"firewall_name":"main","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\RememberMeAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.268097+02:00] security.INFO: Authenticator successful! {"token":{"App\\Security\\ApiTokenAuthenticatedToken":"ApiTokenAuthenticatedToken(user=\"username\", roles=\"ROLE_USER, ROLE_API_AUTHENTICATED, ROLE_API_READ_ONLY, ROLE_API_EDIT\")"},"authenticator":"App\\Security\\ApiTokenAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":null} [2026-06-24T09:25:35.268353+02:00] security.DEBUG: Remember me skipped: your authenticator does not support it. {"authenticator":"App\\Security\\ApiTokenAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":{"authenticated":true,"roles":["ROLE_USER","ROLE_API_AUTHENTICATED","ROLE_API_READ_ONLY","ROLE_API_EDIT"],"user_identifier":"username"}} [2026-06-24T09:25:35.268394+02:00] security.DEBUG: Authenticator set no success response: request continues. {"authenticator":"App\\Security\\ApiTokenAuthenticator"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":{"authenticated":true,"roles":["ROLE_USER","ROLE_API_AUTHENTICATED","ROLE_API_READ_ONLY","ROLE_API_EDIT"],"user_identifier":"username"}} [2026-06-24T09:25:35.313839+02:00] security.DEBUG: Access denied, the user is neither anonymous, nor remember-me. {"exception":"[object] (ApiPlatform\\Symfony\\Security\\Exception\\AccessDeniedException(code: 403): Access Denied. at /var/www/partdb/vendor/api-platform/symfony/Security/State/AccessCheckerProvider.php:101)"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":{"authenticated":true,"roles":["ROLE_USER","ROLE_API_AUTHENTICATED","ROLE_API_READ_ONLY","ROLE_API_EDIT"],"user_identifier":"username"}} [2026-06-24T09:25:35.319974+02:00] request.ERROR: Uncaught PHP Exception Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: "Access Denied." at ExceptionListener.php line 126 {"exception":"[object] (Symfony\\Component\\HttpKernel\\Exception\\AccessDeniedHttpException(code: 0): Access Denied. at /var/www/partdb/vendor/symfony/security-http/Firewall/ExceptionListener.php:126)\n[previous exception] [object] (ApiPlatform\\Symfony\\Security\\Exception\\AccessDeniedException(code: 403): Access Denied. at /var/www/partdb/vendor/api-platform/symfony/Security/State/AccessCheckerProvider.php:101)"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":{"authenticated":true,"roles":["ROLE_USER","ROLE_API_AUTHENTICATED","ROLE_API_READ_ONLY","ROLE_API_EDIT"],"user_identifier":"username"}} [2026-06-24T09:25:35.338368+02:00] security.DEBUG: Stored the security token in the session. {"key":"_security_main"} {"url":"/api/part_lots/461","ip":"192.168.1.1","http_method":"PATCH","server":"example.com","referrer":null,"token":{"authenticated":true,"roles":["ROLE_USER","ROLE_API_AUTHENTICATED","ROLE_API_READ_ONLY","ROLE_API_EDIT"],"user_identifier":"username"}}

Expected behavior
The part lot is patched.

Server Side

• Part-DB Version: 2.12.3
• PHP Version: 8.2.31
• Database Server 15.1

Additional context
As far as I can tell, it happened after upgrading from 2.12.0 to 2.12.3
It works if the user is allowed to edit parts.

[fabi321]

The reason why the application even wants to edit the description is that there is no way to attach a comment using the api when withdrawing/adding.