graphiti 2.0.2 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d65d4265eb6a753309e1348e135296d3c114b0497ceadd09ccc0f626d0fcaad
-  data.tar.gz: c8e52211ff147a9607360ce19e2351fe10e5a670481e1d20cf2625034f761ed8
+  metadata.gz: dd25841a045956cda400bc9fd72f0eaac514cd7b0c393145607383bdfb4f9628
+  data.tar.gz: bb457041c8ed31b7f527614cf241fb43e626f8abc465d2ee5fca851081be94c1
 SHA512:
-  metadata.gz: b8c3fcadbaba93c23bdf505937443432abc2e0b120a2baadd76279c20f7ba0382798a416dd83832e4ad0e9697e5cb20570df93c0747eea5c832782a1cf442865
-  data.tar.gz: c3f790bed7b1cba2802e5a10b9c9f51c53ccc44e9da9823956266361f80a4af0df790d59ebe951f97768b4ba80da7a002ae919cc739225ed22cec8084e4292ce
+  metadata.gz: cedef768a22bd9a6058a1d0c527c60c34478b6aa3091c31c8524a1feb7dad33bd5912c4beddf5d8b6f49f964a1ff32b1eff8c778cc12a55a3e420c8914127923
+  data.tar.gz: 8638ac3f7ea8702df0ac0f475cfd5c820d477921e5a4af85b6dd5b845a507d3a81914ffde73ecfeaa86fc4a4cf992044399ae8482d0339f0dc403fef0f301122

data/.github/workflows/docs.yml

@@ -12,6 +12,8 @@ on:
       - 'docs/**'
       - 'website/**'
       - '.github/workflows/docs.yml'
+  release:
+    types: [published]
   workflow_dispatch: {}
 
 # One static group: deploys from different branches force-push the same
@@ -39,6 +41,11 @@ jobs:
         working-directory: website
         run: npm ci
 
+      - name: Find the latest release
+        run: |
+          git fetch --tags --quiet
+          echo "GRAPHITI_RELEASE=$(git tag --list 'v2*' --sort=-v:refname | head -1 | sed 's/^v//')" >> "$GITHUB_ENV"
+
       - name: Build
         working-directory: website
         run: npm run build

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 graphiti changelog
 
+# [2.1.0](https://github.com/graphiti-api/graphiti/compare/v2.0.2...v2.1.0) (2026-09-04)
+
+
+### Bug Fixes
+
+* attribute :id declared on an abstract resource is inherited instead of failing on the missing serializer ([8faf217](https://github.com/graphiti-api/graphiti/commit/8faf217bcf0d560ff81a067a8f3ef1473724b933)), closes [#151](https://github.com/graphiti-api/graphiti/issues/151)
+
+
+### Features
+
+* declare resource settings in the DSL form (adapter :active_record, model Employee), matching `attribute :name` ([14f1722](https://github.com/graphiti-api/graphiti/commit/14f17222770ba8577048775a45c893e85aef7e94))
+* hide your database ids from clients by specifying an alternate public_id, or an obfuscation transform ([81b97f9](https://github.com/graphiti-api/graphiti/commit/81b97f979bf35c3fa8c2eda8651a40a3f989e0ea)), closes [#409](https://github.com/graphiti-api/graphiti/issues/409)
+
 ## [2.0.2](https://github.com/graphiti-api/graphiti/compare/v2.0.1...v2.0.2) (2026-09-04)
 
 

data/bin/cut-docs-version

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'TEXT'
+Usage: bin/cut-docs-version <version>      e.g. bin/cut-docs-version 2.1
+
+Freezes docs/ as website/versioned_docs/version-<version>, served at /<version>/.
+docs/ itself keeps serving at the root as "Latest". Run it before merging docs
+whose syntax the current release lacks, naming the release being left behind.
+Review the new files and commit them.
+TEXT
+}
+
+case "${1:-}" in
+  ""|-h|--help) usage; exit 0 ;;
+esac
+
+cd "$(dirname "$0")/../website"
+[ -d node_modules ] || npm ci
+npm run docusaurus docs:version "$1"
+
+echo
+echo "Cut $1. Review website/versioned_docs/version-$1 and commit it."

data/lib/generators/graphiti/generator_mixin.rb

@@ -37,7 +37,7 @@ module Graphiti
       name_width = Graphiti::Resource::SETTINGS.keys.map(&:length).max
       assignments = Graphiti::Resource::SETTINGS.to_h do |name, setting|
         value = setting[:format] || setting[:default].inspect
-        [name, "self.#{name.to_s.ljust(name_width)} = #{value}"]
+        [name, "#{name.to_s.ljust(name_width)} #{value}"]
       end
       hint_column = assignments.values.map(&:length).max + 2
 

data/lib/generators/graphiti/templates/application_resource.rb.erb

@@ -2,14 +2,14 @@
 # All Resources should inherit from ApplicationResource.
 <%- end -%>
 class ApplicationResource < Graphiti::Resource
-  self.abstract_class = true
-  self.adapter = Graphiti::Adapters::ActiveRecord
+  abstract_class
+  adapter :active_record
   <%- unless omit_comments? -%>
   # Or follow config/environments:
-  #   self.base_url = ActionDispatch::Http::URL.url_for(Rails.application.routes.default_url_options)
+  #   base_url ActionDispatch::Http::URL.url_for(Rails.application.routes.default_url_options)
   <%- end -%>
-  self.base_url = ENV.fetch('BASE_URL', 'http://localhost:3000')
-  self.endpoint_namespace = '<%= api_namespace %>'
+  base_url ENV.fetch('BASE_URL', 'http://localhost:3000')
+  endpoint_namespace '<%= api_namespace %>'
   <%- unless omit_comments? -%>
 
   # Defaults every Resource inherits. See https://graphiti.dev/concepts/resources

data/lib/graphiti/adapters/abstract.rb

@@ -68,6 +68,14 @@ module Graphiti
         raise Errors::AdapterNotImplemented.new(self, attribute, :filter_string_not_eql)
       end
 
+      def filter_public_id_eq(scope, attribute, value)
+        filter_string_eq(scope, attribute, value)
+      end
+
+      def filter_public_id_not_eq(scope, attribute, value)
+        filter_string_not_eq(scope, attribute, value)
+      end
+
       def filter_string_prefix(scope, attribute, value)
         raise Errors::AdapterNotImplemented.new(self, attribute, :filter_string_prefix)
       end

data/lib/graphiti/adapters/active_record.rb

@@ -61,6 +61,14 @@ module Graphiti
         filter_string_eql(scope, attribute, value.presence, is_not: true)
       end
 
+      def filter_public_id_eq(scope, attribute, value)
+        filter_string_eql(scope, attribute, value)
+      end
+
+      def filter_public_id_not_eq(scope, attribute, value)
+        filter_string_not_eql(scope, attribute, value)
+      end
+
       # Arel has different match escaping behavior before rails 5.
       # Since rails 4.x does not expose methods to escape LIKE statements
       # anyway, we just don't support proper LIKE escaping in those versions.

data/lib/graphiti/adapters/persistence/associations.rb

@@ -63,11 +63,16 @@ module Graphiti
             if x[:sideload].polymorphic_has_one? || x[:sideload].polymorphic_has_many?
               attrs[:"#{x[:sideload].polymorphic_as}_type"] = polymorphic_type_value(parent_object)
             end
-            attrs[x[:foreign_key]] = parent_object.send(x[:primary_key])
+            attrs[x[:foreign_key]] = internal_foreign_key(parent_object.send(x[:primary_key]))
             update_foreign_type(attrs, x) if x[:is_polymorphic]
           end
         end
 
+        # Resource#assign decodes public ids out of foreign keys, and must leave a key Graphiti resolved itself alone.
+        def internal_foreign_key(value)
+          Graphiti.public_ids_declared? ? Graphiti::Util::InternalParam.new(value) : value
+        end
+
         def polymorphic_type_value(parent_object)
           parent_object.class.name
         end

data/lib/graphiti/audit/report.rb

@@ -7,7 +7,8 @@ module Graphiti
         broken_relationship: "raised while being inspected",
         missing_association_method: "will raise when the relationship is included: the model has no association method",
         missing_guard_method: "will raise whenever the resource renders: the readable guard is not defined",
-        missing_sideload_filter: "will raise when the relationship is included: the related resource is missing the filter"
+        missing_sideload_filter: "will raise when the relationship is included: the related resource is missing the filter",
+        link_hidden: "renders no related link: it would expose a primary key the related resource hides"
       }.freeze
 
       CHECKLIST = {
@@ -15,6 +16,7 @@ module Graphiti
         missing_association_method: ["all association methods defined", "association method", "missing"],
         missing_guard_method: ["all readable guards defined", "readable guard", "missing"],
         missing_sideload_filter: ["all sideload filters declared", "sideload filter", "missing"],
+        link_hidden: ["all relationship links renderable", "relationship link", "hidden"],
         loads_on_every_render: ["all id-rendering loads preloaded", "relationship", "loading ids without preloading"]
       }.freeze
 

data/lib/graphiti/audit.rb

@@ -79,7 +79,8 @@ module Graphiti
         findings: [
           missing_association_method(sideload, model),
           missing_guard_method(resource_class, sideload),
-          missing_sideload_filter(sideload)
+          missing_sideload_filter(sideload),
+          link_hidden(sideload)
         ].compact
       )
     rescue => error
@@ -195,6 +196,18 @@ module Graphiti
       )
     end
 
+    def link_hidden(sideload)
+      return if sideload.link_proc || sideload.link_hides_primary_key?
+      return unless sideload.requested_link_mode
+
+      Finding.new(
+        severity: :warning,
+        check: :link_hidden,
+        message: "#{target_name(sideload)} publishes a public id the relationship cannot translate to",
+        remedy: "declare the filter the relationship links through on the related resource, have its block take `primary_keys:`, or give the relationship a `link` block"
+      )
+    end
+
     def builds_its_own_query?(sideload)
       sideload.class.params_proc || sideload.class.scope_proc
     end

data/lib/graphiti/errors.rb

@@ -740,6 +740,42 @@ module Graphiti
       end
     end
 
+    class ConflictingPublicIdSource < Base
+      def initialize(resource_class, filter_name, registered, claimant)
+        @resource_class = resource_class
+        @filter_name = filter_name
+        @registered = registered
+        @claimant = claimant
+      end
+
+      def message
+        "#{@resource_class.name}: filter #{@filter_name.inspect} already resolves public ids through #{@registered.name}, so #{@claimant.name} cannot claim it too. Give one of the relationships a different `inverse_filter`."
+      end
+    end
+
+    class InvalidPublicId < Base
+      def initialize(resource_class, reason)
+        @resource_class = resource_class
+        @reason = reason
+      end
+
+      def message
+        "#{@resource_class.name}: public_id #{@reason}."
+      end
+    end
+
+    class PublicIdLeak < Base
+      def initialize(resource_class, attribute_name, source_resource_class)
+        @resource_class = resource_class
+        @attribute_name = attribute_name
+        @source_resource_class = source_resource_class
+      end
+
+      def message
+        "#{@resource_class.name}: attribute #{@attribute_name.inspect} is readable, but it holds the primary key #{@source_resource_class.name} hides behind its public id. Declare it `only: [:filterable]` or drop it."
+      end
+    end
+
     class UnselectedForeignKey < Base
       def initialize(resource_class, sideload, model)
         @resource_class = resource_class

data/lib/graphiti/query.rb

@@ -26,6 +26,7 @@ module Graphiti
       @action = parse_action(action)
       @entity_map = Concurrent::Map.new if parents.empty?
       @association_owners = Concurrent::Map.new if parents.empty?
+      @public_id_maps = Concurrent::Map.new if parents.empty?
     end
 
     def association?
@@ -45,6 +46,12 @@ module Graphiti
       @association_owners
     end
 
+    def public_id_maps
+      return root.public_id_maps unless root == self
+
+      @public_id_maps
+    end
+
     # Deduplication exists for a row two include paths both resolve, so a
     # resource class sitting at one node has nothing to collide with.
     def repeated_resource_classes

data/lib/graphiti/request_validators/validator.rb

@@ -108,7 +108,7 @@ module Graphiti
               resource.class.config[:attributes][:id][:writable] == false
 
             begin
-              attributes[key] = resource.typecast(key, value, :writable)
+              attributes[key] = typecast_attribute(resource, key, value)
             rescue Graphiti::Errors::UnknownAttribute
               @errors.add(fully_qualified_key(key, payload_path), :unknown_attribute)
             rescue Graphiti::Errors::InvalidAttributeAccess
@@ -120,6 +120,15 @@ module Graphiti
         end
       end
 
+      # A writable foreign key arrives as the public id of the record it names, and is decoded when assigned.
+      def typecast_attribute(resource, key, value)
+        source = (key == :id) ? nil : resource.class.public_id_source_for(key)
+        return resource.typecast(key, value, :writable) unless source
+
+        resource.get_attr!(key, :writable, request: true)
+        source.new.typecast(:id, value, :filterable)
+      end
+
       def normalized_params(raw_params)
         normalized = raw_params
         if normalized.respond_to?(:to_unsafe_h)

data/lib/graphiti/resource/configuration.rb

@@ -63,7 +63,27 @@ module Graphiti
 
       SETTINGS = SETTING_GROUPS.values.reduce(:merge).freeze # :nodoc:
 
+      DSL_SETTINGS = [:adapter, :base_url, :endpoint_namespace, :model, :remote, :remote_base_url, :type, :polymorphic, :polymorphic_child, :serializer, :graphql_entrypoint, *SETTINGS.keys].freeze # :nodoc:
+
+      UNSET = Object.new.freeze # :nodoc:
+
+      module DslReaders # :nodoc:
+        # Real methods with a default, not define_method with a splat: these readers run per attribute per record.
+        DSL_SETTINGS.each do |name|
+          class_eval <<~RUBY, __FILE__, __LINE__ + 1
+            def #{name}(value = UNSET)
+              value.equal?(UNSET) ? super() : (self.#{name} = value)
+            end
+          RUBY
+        end
+      end
+
+      # Rails 7 class_attribute writers redefine the reader on the receiving class itself, ahead of anything prepended on Resource.
+      READERS_REDEFINED_PER_CLASS = ActiveSupport::VERSION::MAJOR < 8 # :nodoc:
+
       module Overrides
+        include DslReaders
+
         SETTINGS.each_pair do |name, setting|
           next unless setting[:values]
 
@@ -113,6 +133,7 @@ module Graphiti
         # The .stat call stores a proc based on adapter
         # So if we assign a new adapter, reconfigure
         def adapter=(val)
+          val = Adapters.const_get(Adapters.constants.find { |name| name.to_s.underscore == val.to_s }) if val.is_a?(Symbol)
           super
           stat total: [:count]
         end
@@ -129,8 +150,16 @@ module Graphiti
           }
         end
 
-        def model
-          klass = super
+        def model=(val)
+          super
+          apply_public_id if publishes_public_id?
+          config[:sideloads].each_value { |sideload| sideload.register_public_id_source if eagerly_apply_sideload?(sideload) }
+        end
+
+        def model(value = UNSET)
+          return public_send(:model=, value) unless value.equal?(UNSET)
+
+          klass = super()
           unless klass || abstract_class?
             if (klass = infer_model)
               self.model = klass
@@ -168,6 +197,7 @@ module Graphiti
 
         def self.inherited(klass)
           super
+          klass.singleton_class.prepend(DslReaders) if READERS_REDEFINED_PER_CLASS
           klass.config = Util::Hash.deep_dup(config)
           klass.adapter ||= Adapters::Abstract
           # re-assigning causes a new Class.new
@@ -241,6 +271,96 @@ module Graphiti
           !!page_cursors
         end
 
+        def publishes_public_id?
+          !!(config[:public_id] || config[:public_id_encode])
+        end
+
+        def public_id_attribute?(name)
+          !!config[:public_id] && [:id, :_public_id].include?(name.to_sym)
+        end
+
+        def model_declared?
+          !!model
+        rescue Errors::ModelNotFound
+          false
+        end
+
+        def public_id_for(model)
+          if (encode = config[:public_id_encode])
+            encode.call(model.send(model_primary_key))
+          else
+            model.send(config[:public_id])
+          end
+        end
+
+        def model_attribute_for(name)
+          return name unless publishes_public_id?
+
+          case name
+          when :id then config[:public_id] || model_primary_key
+          when :_primary_key then model_primary_key
+          when :_public_id then config[:public_id]
+          else name
+          end
+        end
+
+        def model_primary_key
+          if model.respond_to?(:primary_key)
+            model.primary_key.to_sym
+          else
+            :id
+          end
+        end
+
+        def inferred_public_id_type
+          column = config[:public_id]
+          return :string unless column && model_loaded? && model.respond_to?(:type_for_attribute)
+
+          case model.type_for_attribute(column.to_s).type
+          when :integer then :integer
+          when :uuid then :uuid
+          else :string
+          end
+        end
+
+        def model_loaded?
+          model
+          true
+        rescue Errors::ModelNotFound
+          false
+        end
+
+        def guard_public_id_leak!(attribute_name)
+          return if attribute_name.to_sym == :id
+
+          attribute = attributes[attribute_name.to_sym]
+          return unless attribute && attribute[:readable] && !attribute[:proc]
+
+          source = public_id_source_for(attribute_name)
+          raise Errors::PublicIdLeak.new(self, attribute_name, source) if source
+        end
+
+        # A custom block owns its value, so the generated link can only carry a public id if the block asked to decode it.
+        def filter_accepts_public_ids?(filter_name)
+          filter = filters[filter_name.to_sym]
+          return false unless filter
+
+          filter[:operators][:eq].nil? || Array(filter[:operators_taking_primary_keys]).include?(:eq)
+        end
+
+        def public_id_source_for(filter_name)
+          return unless Graphiti.public_ids_declared?
+
+          name = filter_name.to_sym
+          return self if name == :id && config[:public_id_decode]
+
+          source = Graphiti.public_id_sources[self, name]
+          return source if source
+
+          sideload = sideloads.values.find { |candidate| candidate.type == :belongs_to && candidate.foreign_key == name }
+          sideload.resource_class if sideload&.primary_key_filter == :_primary_key
+        end
+
         def get_attr!(name, flag, opts = {})
           opts[:raise_error] = true
           get_attr(name, flag, opts)
@@ -253,11 +373,11 @@ module Graphiti
         end
 
         def abstract_class?
-          !!abstract_class
+          !!@abstract_class
         end
 
         def abstract_class
-          @abstract_class
+          self.abstract_class = true
         end
 
         def abstract_class=(val)

data/lib/graphiti/resource/dsl.rb

@@ -39,7 +39,9 @@ module Graphiti
               dependencies: opts[:dependent],
               required: required,
               schema: schema,
+              internal: !!opts[:internal],
               operators: operators.to_hash,
+              operators_taking_primary_keys: operators_taking_primary_keys(operators.to_hash),
               blanks: blanks_for(name, opts)
             }
           elsif (type = args[0])
@@ -131,7 +133,9 @@ module Graphiti
           attribute_option(options, :schema, true)
           options[:type] = type
           options[:proc] = blk
+          options[:proc] ||= public_id_proc if name == :id && publishes_public_id?
           config[:attributes][name] = options
+          guard_public_id_leak!(name)
           apply_attributes_to_serializer
           options[:sortable] ? sort(name) : config[:sorts].delete(name)
 
@@ -142,6 +146,44 @@ module Graphiti
           end
         end
 
+        def public_id(name = nil, type = nil, &blk)
+          raise Errors::InvalidPublicId.new(self, "takes a column name or a block, not both") if name && blk
+          raise Errors::InvalidPublicId.new(self, "needs a column name or a block") unless name || blk
+
+          if blk
+            block = Util::PublicIdBlock.new
+            block.instance_eval(&blk)
+            raise Errors::InvalidPublicId.new(self, "block must define both encode and decode") unless block.encoder && block.decoder
+            config[:public_id_encode] = block.encoder
+            config[:public_id_decode] = block.decoder
+          end
+          config[:public_id] = name
+          config[:public_id_type] = type
+          Graphiti.public_ids_declared = true
+          apply_public_id
+        end
+
+        def operators_taking_primary_keys(operators)
+          operators.select { |_, block| block && takes_primary_keys?(block) }.keys
+        end
+
+        def takes_primary_keys?(block)
+          block.parameters.any? { |kind, name| kind == :keyrest || (name == :primary_keys && %i[key keyreq].include?(kind)) }
+        end
+
+        # The hidden filter only ever sees keys Graphiti read off models, so its type is never used to cast anything.
+        def public_id_proc
+          proc { @resource.class.public_id_for(@object) }
+        end
+
+        def apply_public_id
+          attribute :id, config[:public_id_type] || inferred_public_id_type, &public_id_proc
+          attribute :_primary_key, :integer_id, only: [:filterable], schema: false
+          filter :_primary_key, schema: false, internal: true
+          attribute :_public_id, config[:public_id_type] || inferred_public_id_type, only: [:filterable], schema: false
+          filter :_public_id, schema: false, internal: true
+        end
+
         def extra_attribute(name, type, options = {}, &blk)
           raise Errors::TypeNotFound.new(self, name, type) unless Types[type]
           defaults = {
@@ -175,13 +217,18 @@ module Graphiti
           attributes.merge(extra_attributes)
         end
 
+        # An abstract resource has no serializer until a concrete subclass is given one.
         def apply_attributes_to_serializer
+          return unless serializer
+
           serializer.type(type)
           Util::SerializerAttributes.new(self, attributes).apply
         end
         private :apply_attributes_to_serializer
 
         def apply_extra_attributes_to_serializer
+          return unless serializer
+
           Util::SerializerAttributes.new(self, extra_attributes, true).apply
         end
 

data/lib/graphiti/resource/interface.rb

@@ -27,6 +27,40 @@ module Graphiti
           _find(params, base_scope)
         end
 
+        # @api private
+        def public_ids_by(filter_name, keys)
+          encode = config[:public_id_encode]
+          return keys.to_h { |key| [key, encode.call(key)] } if encode && filter_name == :_primary_key
+
+          attribute = model_attribute_for(filter_name)
+          value = (filter_name == :_primary_key) ? Util::InternalParam.new(keys) : keys.join(",")
+          translate_ids(filter_name => value).each_with_object({}) do |record, map|
+            map[record.send(attribute)] = public_id_for(record)
+          end
+        end
+
+        # @api private
+        # Sqids decodes any string in its alphabet, so "42" yields some unrelated record.
+        # A decode only counts if encoding the result gives back the string that was sent.
+        def decode_encoded_id(public_id)
+          primary_key = config[:public_id_decode].call(public_id)
+          return if primary_key.nil?
+
+          primary_key if config[:public_id_encode].call(primary_key) == public_id
+        end
+
+        def decode_public_id(public_id)
+          decode_public_ids([public_id]).first
+        end
+
+        def decode_public_ids(public_ids)
+          if config[:public_id_decode]
+            return public_ids.map { |public_id| decode_encoded_id(public_id) }.compact
+          end
+
+          translate_ids(_public_id: Util::InternalParam.new(public_ids)).map { |record| record.send(model_primary_key) }
+        end
+
         # @api private
         def _find(params = {}, base_scope = nil)
           guard_nil_id!(params[:data])
@@ -79,6 +113,11 @@ module Graphiti
           {cache: @cache_resource, cache_expires_in: @cache_expires_in, cache_tag: @cache_tag}
         end
 
+        def translate_ids(filter)
+          opts = {default_paginate: false, bypass_required_filters: true, bypass_default_filters: true, translating_public_ids: true}
+          _all({filter: filter}, opts, nil).data
+        end
+
         def validate_request!(params)
           return if Graphiti.context[:graphql] || !validate_requests?
 

data/lib/graphiti/resource/persistence.rb

@@ -78,8 +78,16 @@ module Graphiti
         if action_name == :update
           id = assign_params[:id]
           assign_params = assign_params.except(:id)
+        elsif assign_params.key?(:id) && (public_id = self.class.config[:public_id])
+          assign_params = assign_params.except(:id).merge(public_id => assign_params[:id])
+        elsif assign_params.key?(:id) && self.class.config[:public_id_decode]
+          primary_key = self.class.decode_public_id(assign_params[:id])
+          raise Errors::ConflictRequest, unresolvable_id_errors(assign_params) if primary_key.nil?
+          assign_params = assign_params.except(:id).merge(self.class.model_primary_key => primary_key)
         end
 
+        assign_params = decode_foreign_keys(assign_params)
+
         run_callbacks :attributes, action_name, assign_params, meta do |params|
           model_instance ||= if action_name == :update
             self.class._find(id: id).data
@@ -123,6 +131,27 @@ module Graphiti
         model_instance
       end
 
+      def decode_foreign_keys(assign_params)
+        return assign_params unless Graphiti.public_ids_declared?
+
+        assign_params.each_with_object({}) do |(name, value), decoded|
+          source = (name == :id || value.nil?) ? nil : self.class.public_id_source_for(name)
+          decoded[name] = if value.is_a?(Util::InternalParam)
+            value.value
+          elsif source
+            source.decode_public_id(value.to_s) or raise Errors::RecordNotFound.new(source.type, value, name)
+          else
+            value
+          end
+        end
+      end
+
+      def unresolvable_id_errors(assign_params)
+        Util::SimpleErrors.new(assign_params).tap do |errors|
+          errors.add("data.id", :unresolvable, message: "does not name a record of this resource")
+        end
+      end
+
       def update(update_params, meta = nil)
         model_instance = assigned_model || assign(update_params, meta, :update)
 

data/lib/graphiti/resource/sideloading.rb

@@ -23,10 +23,12 @@ module Graphiti
         end
 
         def apply_sideload_to_serializer(name)
+          config[:sideloads][name].register_public_id_source
           Util::SerializerRelationships.new(self, config[:sideloads].slice(name)).apply
         end
 
         def apply_sideloads_to_serializer
+          config[:sideloads].each_value(&:register_public_id_source)
           Util::SerializerRelationships.new(self, config[:sideloads]).apply
         end