fun_with_json_api 0.0.10.2 → 0.0.10.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 866f3cb55b6238f2f94e5ec1f92fb619dc567429
-  data.tar.gz: 380ef33a77466da9776bddfc161d2ca3b5c4d699
+  metadata.gz: 6cbd2e7cd7eb77ab42c01c61b7c0f9cc30d73e85
+  data.tar.gz: 4eb860a2624ff7a914b0551b2bdd4d93d2a075be
 SHA512:
-  metadata.gz: cee40b46955ab1ca26cf7e968e95b4d9e18e7049efba21bbb3faa3eeee5e9bc5a45d7422f00af1586c25ee275cd7675d15f6352d7b83495bbfc77a90a3c0eabb
-  data.tar.gz: 9474f47c9f4d784590f69938b5d748963da6d74f501354c3f157fcc92f38457aa7e63cd256f129b768b45918799ff579921e956b871ad71dc960f8879eeec706
+  metadata.gz: d9a7000c4f77af589383b619af65b15a92e20955f2d8bec2faab500550fb25674f0b90db60b44401d807a9eaa731105ab8c106a4c2aa2d2fcf87e06d9f5b86af
+  data.tar.gz: 67cbade73e38c41c46f06918a0f42fdeae60e56452a266324e2fd0e31e8082037bfb7c23ec8fa8c8f8ed4a7b65296f60af48eb7a7178682ce305508f78623ba2

data/config/locales/fun_with_json_api.en.yml

@@ -11,6 +11,7 @@ en:
       unauthorized_resource: 'Unable to access the requested resource'
       invalid_attribute: 'Request json_api attribute data is invalid'
       unknown_attribute: 'Request json_api attribute is not recognised by the current endpoint'
+      unauthorized_attribute: Request json_api attribute can not be updated by the current endpoint
       invalid_relationship: 'Request json_api relationship data is invalid'
       missing_relationship: 'Unable to find the requested relationship'
       unknown_relationship: 'Request json_api relationship is not recognised by the current endpoint'

data/lib/fun_with_json_api/exceptions/unauthorized_attribute.rb

@@ -0,0 +1,17 @@
+module FunWithJsonApi
+  module Exceptions
+    # Indicates a supplied attribute value is known but unable to be changed by this endpoint
+    class UnauthorizedAttribute < FunWithJsonApi::Exception
+      def initialize(message, payload = ExceptionPayload.new)
+        payload = Array.wrap(payload).each do |unknown|
+          unknown.code ||= 'unauthorized_attribute'
+          unknown.title ||= I18n.t(
+            :unauthorized_attribute, scope: 'fun_with_json_api.exceptions'
+          )
+          unknown.status ||= '403'
+        end
+        super
+      end
+    end
+  end
+end

data/lib/fun_with_json_api/exceptions/unauthorized_relationship.rb

@@ -1,6 +1,6 @@
 module FunWithJsonApi
   module Exceptions
-    # Indicates a supplied relationship value is unknown to the current deserializer
+    # Indicates a supplied relationship value is known but unable to be changed by this endpoint
     class UnauthorizedRelationship < FunWithJsonApi::Exception
       def initialize(message, payload = ExceptionPayload.new)
         payload = Array.wrap(payload).each do |unknown|

data/lib/fun_with_json_api/schema_validator.rb

@@ -21,7 +21,7 @@ module FunWithJsonApi
     def check
       FunWithJsonApi::SchemaValidators::CheckDocumentTypeMatchesResource.call(self)
       FunWithJsonApi::SchemaValidators::CheckDocumentIdMatchesResource.call(self)
-      FunWithJsonApi::SchemaValidators::CheckAttributes.call(document, deserializer)
+      FunWithJsonApi::SchemaValidators::CheckAttributeNames.call(document, deserializer)
       FunWithJsonApi::SchemaValidators::CheckRelationships.call(document, deserializer)
     end
 

data/lib/fun_with_json_api/schema_validators/{check_attributes.rb → check_attribute_names.rb}

@@ -1,6 +1,6 @@
 module FunWithJsonApi
   module SchemaValidators
-    class CheckAttributes
+    class CheckAttributeNames
       def self.call(document, deserializer)
         new(document, deserializer).call
       end
@@ -15,11 +15,11 @@ module FunWithJsonApi
 
       def call
         attributes = document['data'].fetch('attributes', {}).keys
-        unknown = attributes.reject { |attribute| resource_attributes.include?(attribute) }
 
-        return true if unknown.empty?
+        unknown = attributes.reject { |attribute| resource_attributes.include?(attribute) }
+        check_attribute_names(attributes) if unknown.any?
 
-        raise build_unknown_attribute_error(unknown)
+        true
       end
 
       def resource_attributes
@@ -32,14 +32,19 @@ module FunWithJsonApi
 
       private
 
-      def build_unknown_attribute_error(unknown_attributes)
-        payload = unknown_attributes.map do |attribute|
-          if known_attributes.include?(attribute)
-            build_forbidden_attribute_payload(attribute)
-          else
-            build_unknown_attribute_payload(attribute)
-          end
+      def check_attribute_names(unknown)
+        unauthorised_attributes = unknown.select do |attribute|
+          known_attributes.include?(attribute)
         end
+        if unauthorised_attributes.any?
+          raise build_forbidden_attribute_error(unauthorised_attributes)
+        else
+          raise build_unknown_attributes_error(unknown)
+        end
+      end
+
+      def build_unknown_attributes_error(attributes)
+        payload = attributes.map { |attribute| build_unknown_attribute_payload(attribute) }
         message = 'Unknown attributes were provided by endpoint'
         FunWithJsonApi::Exceptions::UnknownAttribute.new(message, payload)
       end
@@ -51,6 +56,12 @@ module FunWithJsonApi
         )
       end
 
+      def build_forbidden_attribute_error(attributes)
+        payload = attributes.map { |attribute| build_forbidden_attribute_payload(attribute) }
+        message = 'Forbidden attributes were provided by endpoint'
+        FunWithJsonApi::Exceptions::UnauthorizedAttribute.new(message, payload)
+      end
+
       def build_forbidden_attribute_payload(attribute)
         ExceptionPayload.new(
           detail: forbidden_attribute_error(attribute),

data/lib/fun_with_json_api/version.rb

@@ -1,3 +1,3 @@
 module FunWithJsonApi
-  VERSION = '0.0.10.2'.freeze
+  VERSION = '0.0.10.3'.freeze
 end