jpie 0.4.5 → 1.0.0

data/lib/json_api/controllers/relationships_controller.rb

@@ -0,0 +1,504 @@
+# frozen_string_literal: true
+
+require "json_api/support/relationship_guard"
+
+module JSONAPI
+  class RelationshipsController < BaseController
+    skip_before_action :validate_resource_type!, only: %i[update destroy]
+    skip_before_action :validate_resource_id!, only: %i[update destroy]
+
+    before_action :set_resource_name
+    before_action :set_resource_class
+    before_action :set_resource
+    before_action :set_relationship_name
+    before_action :validate_relationship_exists
+    before_action :validate_sort_param, only: [:show]
+    skip_before_action :validate_resource_type!, :validate_resource_id!
+
+    def show
+      authorize_resource_action!(@resource, action: :show, context: { relationship: @relationship_name })
+      relationship_data = serialize_relationship_data
+      links = serialize_relationship_links
+      meta = serialize_relationship_meta
+
+      response_data = { data: relationship_data, links: }
+      response_data[:meta] = meta if meta.present?
+
+      render json: response_data, status: :ok
+    end
+
+    def update
+      authorize_resource_action!(@resource, action: :update, context: { relationship: @relationship_name })
+      relationship_data = parse_relationship_data
+      update_relationship(relationship_data)
+
+      if @resource.save
+        emit_relationship_event(:updated, relationship_data)
+        render json: {
+          data: serialize_relationship_data,
+          links: serialize_relationship_links,
+          meta: serialize_relationship_meta
+        }.compact, status: :ok
+      else
+        render_validation_errors(@resource)
+      end
+    rescue ArgumentError => e
+      render_invalid_relationship_error(e)
+    rescue JSONAPI::Exceptions::ParameterNotAllowed => e
+      render_parameter_not_allowed_error(e)
+    end
+
+    def destroy
+      authorize_resource_action!(@resource, action: :update, context: { relationship: @relationship_name })
+      relationship_data = parse_relationship_data
+      return head :no_content if relationship_data.nil?
+
+      remove_relationship(relationship_data)
+
+      # For to-many relationships, resources are updated directly in remove_from_many_relationship
+      # For to-one relationships, the parent resource needs to be saved
+      association = @resource.class.reflect_on_association(@relationship_name)
+      if association && !association.collection?
+        if @resource.save
+          emit_relationship_event(:removed, relationship_data)
+          head :no_content
+        else
+          render_validation_errors(@resource)
+        end
+      else
+        emit_relationship_event(:removed, relationship_data)
+        head :no_content
+      end
+    rescue ArgumentError => e
+      render_invalid_relationship_error(e)
+    rescue JSONAPI::Exceptions::ParameterNotAllowed => e
+      render_parameter_not_allowed_error(e)
+    end
+
+    private
+
+    def set_relationship_name
+      @relationship_name = params[:relationship_name].to_sym
+    end
+
+    def validate_relationship_exists
+      relationship_def = find_relationship_definition
+      return if relationship_def
+
+      render_jsonapi_error(
+        status: 404,
+        title: "Relationship Not Found",
+        detail: "Relationship '#{@relationship_name}' not found on #{@resource_name}"
+      ) and return
+    end
+
+    def find_relationship_definition
+      RelationshipHelpers.find_relationship_definition(@resource_class, @relationship_name)
+    end
+
+    def serialize_relationship_data
+      association = @resource.class.reflect_on_association(@relationship_name)
+      return nil unless association
+
+      related = @resource.public_send(@relationship_name)
+
+      # Apply sorting for collection relationships
+      if association.collection? && related.respond_to?(:order)
+        related = apply_sorting_to_relationship(related, association)
+      end
+
+      if association.collection?
+        serialize_collection_relationship(related, association)
+      elsif related
+        serialize_single_relationship(related, association)
+      end
+    end
+
+    def serialize_collection_relationship(related, association)
+      return [] if related.nil?
+
+      related.map { |r| serialize_resource_identifier(r, association) }
+    end
+
+    def serialize_single_relationship(related, association)
+      serialize_resource_identifier(related, association)
+    end
+
+    def serialize_resource_identifier(resource_instance, association)
+      RelationshipHelpers.serialize_resource_identifier(
+        resource_instance,
+        association:,
+        resource_class: @resource_class
+      )
+    end
+
+    def serialize_relationship_links
+      {
+        self: relationship_self_url,
+        related: relationship_related_url
+      }
+    end
+
+    def relationship_self_url
+      "/#{params[:resource_type]}/#{params[:id]}/relationships/#{params[:relationship_name]}"
+    end
+
+    def relationship_related_url
+      "/#{params[:resource_type]}/#{params[:id]}/#{params[:relationship_name]}"
+    end
+
+    def serialize_relationship_meta
+      relationship_def = find_relationship_definition
+      return nil unless relationship_def
+
+      relationship_def[:meta]
+    end
+
+    def parse_relationship_data
+      raw_data = params[:data]
+      return nil if raw_data.nil?
+
+      # Handle arrays directly (for to-many relationships)
+      return [] if raw_data.is_a?(Array) && raw_data.empty?
+
+      return raw_data.map { |item| ParamHelpers.deep_symbolize_params(item) } if raw_data.is_a?(Array)
+
+      # Handle hash/object (for to-one relationships or single resource identifiers)
+      ParamHelpers.deep_symbolize_params(raw_data)
+    end
+
+    def update_relationship(relationship_data)
+      association = @resource.class.reflect_on_association(@relationship_name)
+      raise ArgumentError, "Association not found: #{@relationship_name}" unless association
+
+      ensure_relationship_writable!(association)
+
+      if association.collection?
+        update_to_many_relationship(association, relationship_data)
+      else
+        update_to_one_relationship(association, relationship_data)
+      end
+    end
+
+    def update_to_many_relationship(association, relationship_data)
+      if relationship_data.nil? || (relationship_data.is_a?(Array) && relationship_data.empty?)
+        @resource.public_send("#{@relationship_name}=", [])
+        return
+      end
+
+      raise ArgumentError, "Expected array for to-many relationship" unless relationship_data.is_a?(Array)
+
+      related_resources = relationship_data.map do |identifier|
+        find_related_resource(identifier, association)
+      end
+
+      @resource.public_send("#{@relationship_name}=", related_resources)
+    end
+
+    def update_to_one_relationship(association, relationship_data)
+      if relationship_data.nil?
+        @resource.public_send("#{@relationship_name}=", nil)
+        return
+      end
+
+      if relationship_data.is_a?(Array)
+        raise ArgumentError, "Expected single resource identifier for to-one relationship"
+      end
+
+      related_resource = find_related_resource(relationship_data, association)
+      @resource.public_send("#{@relationship_name}=", related_resource)
+    end
+
+    def find_related_resource(identifier, association)
+      RelationshipHelpers.resolve_and_find_related_resource(
+        identifier,
+        association:,
+        resource_class: @resource_class,
+        relationship_name: @relationship_name
+      )
+    end
+
+    def polymorphic_association?
+      RelationshipHelpers.polymorphic_association?(@resource_class, @relationship_name)
+    end
+
+    def remove_relationship(relationship_data)
+      # Check if this is an ActiveStorage attachment first
+      if active_storage_attachment?(@relationship_name, @resource.class)
+        # For ActiveStorage, we need to determine if it's has_many or has_one
+        attachment_reflection = @resource.class.reflect_on_attachment(@relationship_name)
+        if attachment_reflection&.macro == :has_many_attached
+          remove_from_many_relationship(nil, relationship_data)
+        else
+          remove_from_one_relationship(nil, relationship_data)
+        end
+        return
+      end
+
+      association = @resource.class.reflect_on_association(@relationship_name)
+      raise ArgumentError, "Association not found: #{@relationship_name}" unless association
+
+      ensure_relationship_writable!(association)
+
+      if association.collection?
+        remove_from_many_relationship(association, relationship_data)
+      else
+        remove_from_one_relationship(association, relationship_data)
+      end
+    rescue ActiveRecord::NotNullViolation, ActiveRecord::RecordInvalid => e
+      raise ArgumentError, "Cannot remove relationship: #{e.message}"
+    end
+
+    def remove_from_many_relationship(association, relationship_data)
+      raise ArgumentError, "Expected array for to-many relationship removal" unless relationship_data.is_a?(Array)
+
+      return if relationship_data.empty?
+
+      # Check if this is an ActiveStorage attachment
+      if active_storage_attachment?(@relationship_name, @resource.class)
+        remove_active_storage_attachments(relationship_data)
+        return
+      end
+
+      collection = @resource.public_send(@relationship_name)
+      collection_ids = collection.pluck(:id)
+      foreign_key = association.foreign_key
+
+      ActiveRecord::Base.transaction do
+        relationship_data.each do |identifier|
+          resource = RelationshipHelpers.resolve_and_find_related_resource(
+            identifier,
+            association:,
+            resource_class: @resource_class,
+            relationship_name: @relationship_name
+          )
+          resource_id = resource.id
+
+          next unless collection_ids.include?(resource_id)
+
+          resource.update!(foreign_key => nil)
+        end
+      end
+    end
+
+    def remove_active_storage_attachments(relationship_data)
+      attachment_proxy = @resource.public_send(@relationship_name)
+      return unless attachment_proxy.attached?
+
+      blob_ids = relationship_data.map do |identifier|
+        type = RelationshipHelpers.extract_type_from_identifier(identifier)
+        id = RelationshipHelpers.extract_id_from_identifier(identifier)
+
+        unless self.class.active_storage_blob_type?(type)
+          raise ArgumentError, "Expected active_storage_blobs type for ActiveStorage attachment removal, got #{type}"
+        end
+
+        id.to_i
+      end
+
+      # Find attachments that link these blobs to the resource
+      # For has_many_attached, we need to access the underlying attachments
+      attachments_to_remove = attachment_proxy.attachments.where(blob_id: blob_ids)
+
+      # Purge/detach the attachments
+      attachments_to_remove.each(&:purge)
+    end
+
+    def remove_from_one_relationship(association, relationship_data)
+      if relationship_data.is_a?(Array)
+        raise ArgumentError, "Expected single resource identifier for to-one relationship"
+      end
+
+      return if relationship_data.nil?
+
+      # Check if this is an ActiveStorage attachment
+      if active_storage_attachment?(@relationship_name, @resource.class)
+        remove_active_storage_attachment(relationship_data)
+        return
+      end
+
+      related_resource = find_related_resource(relationship_data, association)
+      current_resource = @resource.public_send(@relationship_name)
+
+      return unless current_resource == related_resource
+
+      @resource.public_send("#{@relationship_name}=", nil)
+      @resource.save!
+    end
+
+    def remove_active_storage_attachment(relationship_data)
+      attachment_proxy = @resource.public_send(@relationship_name)
+      return unless attachment_proxy.attached?
+
+      type = RelationshipHelpers.extract_type_from_identifier(relationship_data)
+      id = RelationshipHelpers.extract_id_from_identifier(relationship_data)
+
+      unless self.class.active_storage_blob_type?(type)
+        raise ArgumentError, "Expected active_storage_blobs type for ActiveStorage attachment removal, got #{type}"
+      end
+
+      blob_id = id.to_i
+
+      # Find the attachment that links this blob to the resource
+      attachment = attachment_proxy.attachments.find_by(blob_id:)
+
+      # Purge/detach the attachment
+      attachment&.purge
+    end
+
+    def apply_sorting_to_relationship(related, association)
+      sorts = parse_sort_param
+      return related if sorts.empty?
+
+      related_model = association.klass
+      related_resource_class = ResourceLoader.find_for_model(related_model)
+
+      # Separate database columns from virtual attributes
+      db_sorts = []
+      virtual_sorts = []
+
+      sorts.each do |sort_field|
+        field = RelationshipHelpers.extract_sort_field_name(sort_field)
+        if related_model.column_names.include?(field.to_s)
+          db_sorts << sort_field
+        else
+          virtual_sorts << sort_field
+        end
+      end
+
+      # Apply database sorting first
+      db_sorts.each do |sort_field|
+        direction = RelationshipHelpers.extract_sort_direction(sort_field)
+        field = RelationshipHelpers.extract_sort_field_name(sort_field)
+        related = related.order(field => direction)
+      end
+
+      # Apply virtual attribute sorting in Ruby if needed
+      if virtual_sorts.any?
+        records = related.to_a
+        records = apply_virtual_attribute_sorting_to_relationship(records, virtual_sorts, related_resource_class)
+        related = records
+      end
+
+      related
+    end
+
+    def apply_virtual_attribute_sorting_to_relationship(records, virtual_sorts, resource_class)
+      records.sort do |a, b|
+        compare_records_by_virtual_sorts_for_relationship(a, b, virtual_sorts, resource_class)
+      end
+    end
+
+    def compare_records_by_virtual_sorts_for_relationship(record_a, record_b, virtual_sorts, resource_class)
+      virtual_sorts.each do |sort_field|
+        direction = RelationshipHelpers.extract_sort_direction(sort_field)
+        field = RelationshipHelpers.extract_sort_field_name(sort_field)
+
+        # Get values using resource getter
+        resource_instance_a = resource_class.new(record_a, {})
+        resource_instance_b = resource_class.new(record_b, {})
+
+        value_a = get_virtual_attribute_value_for_relationship(resource_instance_a, field)
+        value_b = get_virtual_attribute_value_for_relationship(resource_instance_b, field)
+
+        # Compare values
+        comparison = compare_values_for_relationship(value_a, value_b)
+        next if comparison.zero? # Equal, check next sort field
+
+        # Apply direction
+        return direction == :desc ? -comparison : comparison
+      end
+
+      0 # All fields equal
+    end
+
+    def get_virtual_attribute_value_for_relationship(resource_instance, field)
+      field_sym = field.to_sym
+      return resource_instance.public_send(field_sym) if resource_instance.respond_to?(field_sym, false)
+
+      nil
+    end
+
+    def compare_values_for_relationship(value_a, value_b)
+      # Handle nil values
+      return 0 if value_a.nil? && value_b.nil?
+      return -1 if value_a.nil?
+      return 1 if value_b.nil?
+
+      # Compare using standard Ruby comparison
+      value_a <=> value_b
+    end
+
+    def validate_sort_param
+      sorts = parse_sort_param
+      return if sorts.empty?
+
+      association = @resource.class.reflect_on_association(@relationship_name)
+      return unless association&.collection?
+
+      # Find resource class for the related model to check virtual attributes
+      related_resource_class = ResourceLoader.find_for_model(association.klass)
+      valid_fields = valid_sort_fields_for_resource(related_resource_class, association.klass)
+      invalid_fields = invalid_sort_fields_for_columns(sorts, valid_fields)
+      return if invalid_fields.empty?
+
+      render_parameter_errors(
+        invalid_fields,
+        title: "Invalid Sort Field",
+        detail_proc: ->(field) { "Invalid sort field requested: #{field}" },
+        source_proc: ->(_field) { { parameter: "sort" } }
+      )
+    end
+
+    def emit_relationship_event(action, relationship_data)
+      resource_type_name = params[:resource_type] || @resource_name.pluralize
+
+      related_ids = extract_related_ids(relationship_data)
+      related_type = extract_related_type(relationship_data)
+
+      JSONAPI::Instrumentation.relationship_event(
+        action:,
+        resource_type: resource_type_name,
+        resource_id: @resource.id,
+        relationship_name: @relationship_name.to_s,
+        related_ids:,
+        related_type:
+      )
+    end
+
+    def extract_related_ids(relationship_data)
+      return nil if relationship_data.nil?
+
+      if relationship_data.is_a?(Array)
+        relationship_data.map { |item| item[:id] }.compact
+      else
+        [relationship_data[:id]].compact
+      end
+    end
+
+    def extract_related_type(relationship_data)
+      return nil if relationship_data.nil?
+
+      if relationship_data.is_a?(Array)
+        first_item = relationship_data.first
+        return nil unless first_item
+
+        first_item[:type]
+      else
+        relationship_data[:type]
+      end
+    end
+
+    def ensure_relationship_writable!(association)
+      if self.class.respond_to?(:active_storage_attachment?) &&
+         active_storage_attachment?(@relationship_name, @resource.class)
+        return
+      end
+
+      relationship_def = find_relationship_definition
+      readonly = relationship_def && (relationship_def[:options] || {})[:readonly] == true
+
+      JSONAPI::RelationshipGuard.ensure_writable!(association, @relationship_name, readonly:)
+    end
+  end
+end

data/lib/json_api/controllers/resources_controller.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module JSONAPI
+  class ResourcesController < BaseController
+  end
+end

data/lib/json_api/errors/parameter_not_allowed.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module JSONAPI
+  module Errors
+    class ParameterNotAllowed < JSONAPI::Error
+      attr_reader :params
+
+      def initialize(params = [])
+        @params = params
+        super("Parameter not allowed: #{Array(params).join(', ')}")
+      end
+    end
+  end
+
+  # Backward compatibility alias
+  module Exceptions
+    ParameterNotAllowed = Errors::ParameterNotAllowed
+  end
+end

data/lib/json_api/railtie.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "rails"
+
+module JSONAPI
+  class Railtie < Rails::Railtie
+    config.before_initialize do
+      ActiveSupport::Inflector.inflections(:en) do |inflect|
+        inflect.acronym "JSON"
+        inflect.acronym "API"
+        # Ensure json_api converts to JSONAPI
+      end
+    end
+
+    initializer "json_api.mime_type" do |_app|
+      Mime::Type.register "application/vnd.api+json", :jsonapi
+    end
+
+    initializer "json_api.routes" do |_app|
+      require "json_api/routing"
+      ActionDispatch::Routing::Mapper.include JSONAPI::Routing
+    end
+
+    # Removed eager_load_namespaces registration - JSONAPI module doesn't implement eager_load!
+    # Controllers and resources are autoloaded via Zeitwerk
+
+    initializer "json_api.parameter_parsing", after: "action_dispatch.configure" do |_app|
+      ActionDispatch::Request.parameter_parsers[:jsonapi] = lambda do |raw_post|
+        ActiveSupport::JSON.decode(raw_post)
+      rescue JSON::ParserError => e
+        raise ActionDispatch::Http::Parameters::ParseError, e.message
+      end
+    end
+
+    initializer "json_api.controllers.include_base", before: :add_routing_paths do |_app|
+      mixin = lambda do |base|
+        next unless JSONAPI.configuration.base_controller_overridden?
+
+        # Use class name comparison instead of object equality to avoid timing issues
+        # when ApplicationController loads before JSONAPIController
+        expected_class_name = JSONAPI.configuration.instance_variable_get(:@base_controller_class)
+        next unless base.name == expected_class_name
+
+        base.include(JSONAPI::ControllerHelpers)
+        base.include(JSONAPI::ResourceActions)
+      end
+
+      ActiveSupport.on_load(:action_controller_base, &mixin)
+      ActiveSupport.on_load(:action_controller_api, &mixin)
+    end
+
+    # Inject JSON:API concerns into the configured base controller class only when it's been overridden
+    # This allows empty controllers inheriting from ApplicationController to work automatically
+    # We don't mix into ActionController::API by default to avoid Rails filtering action methods
+    # (Rails treats public methods on abstract base classes as internal methods)
+    config.to_prepare do
+      next unless JSONAPI.configuration.base_controller_overridden?
+
+      base_controller_class = JSONAPI.configuration.resolved_base_controller_class
+
+      # Ensure BaseController inherits from the configured base controller
+      # This is necessary because BaseController may be defined before the configuration is set
+      if JSONAPI::BaseController.superclass != base_controller_class
+        JSONAPI.send(:remove_const, :BaseController)
+        load "json_api/controllers/base_controller.rb"
+        # Also reload RelationshipsController so it picks up the new BaseController
+        JSONAPI.send(:remove_const, :RelationshipsController)
+        load "json_api/controllers/relationships_controller.rb"
+      end
+
+      base_controller_class.include(JSONAPI::ControllerHelpers)
+      base_controller_class.include(JSONAPI::ResourceActions)
+    end
+  end
+end

data/lib/json_api/resources/active_storage_blob_resource.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module JSONAPI
+  class ActiveStorageBlobResource < Resource
+    attributes :filename, :content_type, :byte_size, :checksum
+
+    def self.model_class
+      ::ActiveStorage::Blob
+    end
+  end
+end