title: How to set normalization groups based on user's role and request method
body: <p>I am creating a sandbox app as Api-platform practice and I have the following problem to address:<br>
  Let's consider following REST endpoint for user entity:<br>
  <strong>DISCLAIMER</strong> in the code examples there are a little more attributes but the whole concept applies regarding that<br><br>
  <strong>Collection-get(aka. /api/users)</strong> - only available for admin users(all attributes available, maybe we exclude hashed password)<br><br>
  <strong>POST</strong> - everyone should have access to following attributes: username, email, plainPassword(not persisted just in case someone asks)<br><br>
  <strong>PATCH/PUT</strong> - here it becomes quite tricky: I want those with ROLE_ADMIN to have access to username, email, plainPassword fields. And those who are the owners to only be able to alter plainPassword<br><br>
  <strong>DELETE</strong> - only ROLE_ADMIN and owners can delete<br><br>
  I will start with the resource config</p>
  
  <pre><code>resources:
      App\Entity\User:
          # attributes:
          #     normalization_context:
          #         groups: ['read', 'put', 'patch', 'post', 'get', 'collection:get']
          #     denormalization_context:
          #         groups: ['read', 'put', 'patch', 'post', 'get', 'collection:get']
          collectionOperations:
              get:
                  security: 'is_granted("ROLE_ADMIN")'
                  normalization_context: { groups: ['collection:get'] }
              post: 
                  normalization_context: { groups: ['admin:post', 'post'] }
          itemOperations:
              get:
                  normalization_context: { groups: ['admin:get', 'get'] }
                  security: 'is_granted("ROLE_ADMIN") or object == user'
              put:
                  normalization_context: { groups: ['admin:put', 'put'] }
                  security: 'is_granted("ROLE_ADMIN") or object == user'
              patch:
                  normalization_context: { groups: ['admin:patch', 'patch'] }
                  security: 'is_granted("ROLE_ADMIN") or object == user'
              delete:
                  security: 'is_granted("ROLE_ADMIN") or object == user'
  </code></pre>
  
  <p>Here is the serializer config</p>
  
  <pre><code>App\Entity\User:
      attributes:
          username:
              groups: ['post', 'admin:put', 'admin:patch', 'collection:get', 'get']
          email:
              groups: ['post', 'admin:put', 'admin:patch', 'collection:get', 'get']
          firstName:
              groups: ['post', 'admin:put', 'admin:patch', 'collection:get', 'get']
          lastName:
              groups: ['post', 'admin:put', 'admin:patch', 'collection:get', 'get']
          plainPassword:
              groups: ['post', patch]
          createdAt:
              groups: ['get', 'collection:get']
          lastLoginDate:
              groups: ['get', 'collection:get']
          updatedAt:
              groups: ['collection:get']
  </code></pre>
  
  <p>Here is the context group builder(Registered as service as it's stated in API-platform doc</p>
  
  <pre><code>&lt;?php
  
  namespace App\Serializer;
  
  use Symfony\Component\HttpFoundation\Request;
  use ApiPlatform\Core\Serializer\SerializerContextBuilderInterface;
  use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  
  final class AdminContextBuilder implements SerializerContextBuilderInterface
  {
      private $decorated;
      private $authorizationChecker;
  
      public function __construct(SerializerContextBuilderInterface $decorated, AuthorizationCheckerInterface $authorizationChecker)
      {
          $this-&gt;decorated = $decorated;
          $this-&gt;authorizationChecker = $authorizationChecker;
      }
  
      public function createFromRequest(Request $request, bool $normalization, ?array $extractedAttributes = null): array
      {
          $context = $this-&gt;decorated-&gt;createFromRequest($request, $normalization, $extractedAttributes);
  
          if ($this-&gt;authorizationChecker-&gt;isGranted('ROLE_ADMIN')) {
              switch($request-&gt;getMethod()) {
                  case 'GET':
                      $context['groups'][] = 'admin:get';
                      break;
                  case 'POST':
                      $context['groups'][] = 'admin:post';
                  case 'PUT':
                      $context['groups'][] = 'admin:put';
                  case 'PATCH':
                      $context['groups'][] = 'admin:patch';
              }
          }
  
          return $context;
      }
  }
  </code></pre>
  
  <p>The issue is that even if I'm logged as a user with only ROLE_USER I am still able to alter username field which should be locked according to the admin:patch normalization group. I am pretty new to the api-platform and I can't quite understand why this does not work but I guess there will be an issue with the context builder. Thanks for your help I'll keep the question updated if I come up with something in the meantime</p>