jpie 3.0.3 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 74099168434a717c88d4fc6ade7c97b6aa049f31fc597cd0db76e2d816a693a7
-  data.tar.gz: 70a2b20227fb36989590b8fd35e9bb4a27b6776569373eea9e6a7c2bf53da606
+  metadata.gz: 67ba9f4553fe73ffa121c436107bb030327211038e4e96130fabb48d585419b4
+  data.tar.gz: 41cd0fa175eb9ddaca6287945aa81b7e2be49349e2db05d1fbfa4bfcf4fc78f1
 SHA512:
-  metadata.gz: f2cd53a342faa153971456b1a5024bb2c61b39d6f0e43345e058993c1c7c8a6f8d71b58726f28786ec6230548c2e232b30c64c06f5aae0323ae58c0b27ac7284
-  data.tar.gz: 35619211ebc1a5455ee003702943b078eba8c3f94a0d11e50a284ae9eab9e9f35da0ca7e5fc464a4cb3923c7ad83075923d36c4b8c2dc86c217bed20f4c6790d
+  metadata.gz: 9ad6c4938d4132a0730ac1f2872f66658ffbf23ae3814f923ede8cd63d57b87dfffaab8843c40c3aee1a38b3d524ab4fca1ce15a805e9d4fddc5db7861b26b73
+  data.tar.gz: ec1fc23309a91b8e38f9720cedf255f908585d01b952e62ae2b78f87398e13119b50cd0b14507e401f2141e2c28c70beae6b060d7734db7d5621365cf6745e9a

data/.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  rubocop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+      - run: bundle exec rubocop
+
+  rspec:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+      - run: bundle exec rspec

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    jpie (3.0.2)
+    jpie (3.0.3)
       actionpack (~> 8.1, >= 8.1.0)
       pg_query (>= 4)
       prosopite (>= 1)

data/lib/json_api/controllers/base_controller.rb

@@ -8,6 +8,7 @@ module JSONAPI
     rescue_from JSONAPI::AuthorizationError, with: :render_jsonapi_authorization_error
     rescue_from Pundit::NotAuthorizedError, with: :render_jsonapi_authorization_error if defined?(Pundit)
     rescue_from JSONAPI::Support::Sort::InvalidFieldError, with: :render_invalid_sort_field_error
+    rescue_from JSONAPI::Errors::ParameterNotAllowed, with: :render_parameter_not_allowed_error
 
     private
 

data/lib/json_api/controllers/concerns/controller_helpers/parsing.rb

@@ -39,9 +39,7 @@ module JSONAPI
       end
 
       def jsonapi_params
-        data = params.require(:data)
-        return data if data.is_a?(Array)
-
+        data = require_query_object(params.require(:data), "data")
         permitted = data.permit(:type, :id, attributes: {})
         permitted[:relationships] = permit_relationships(data) if data[:relationships].present?
         permitted
@@ -64,17 +62,11 @@ module JSONAPI
       end
 
       def jsonapi_type
-        data = jsonapi_params
-        return data.first[:type] if data.is_a?(Array)
-
-        data[:type]
+        jsonapi_params[:type]
       end
 
       def jsonapi_id
-        data = jsonapi_params
-        return data.first[:id].to_s.presence if data.is_a?(Array)
-
-        data[:id].to_s.presence
+        jsonapi_params[:id].to_s.presence
       end
 
       def parse_include_param
@@ -86,7 +78,7 @@ module JSONAPI
       def parse_fields_param
         return {} unless params[:fields]
 
-        params[:fields].permit!.to_h.each_with_object({}) do |(type, fields), hash|
+        require_query_object(params[:fields], "fields").permit!.to_h.each_with_object({}) do |(type, fields), hash|
           hash[type.to_sym] = fields.to_s.split(",").map(&:strip)
         end
       end
@@ -94,7 +86,7 @@ module JSONAPI
       def parse_filter_param
         return {} unless params[:filter]
 
-        raw_filters = params[:filter].permit!.to_h
+        raw_filters = require_query_object(params[:filter], "filter").permit!.to_h
         JSONAPI::ParamHelpers.flatten_filter_hash(raw_filters)
       end
 
@@ -107,7 +99,29 @@ module JSONAPI
       def parse_page_param
         return {} unless params[:page]
 
-        params[:page].permit(:number, :size).to_h
+        page = require_query_object(params[:page], "page").permit(:number, :size).to_h
+        page.each { |key, value| require_positive_integer(value, "page[#{key}]") }
+        page
+      end
+
+      # JSON:API query family params (filter/page/fields) are objects. A client can
+      # instead send a scalar (?filter=x) or array (?filter[]=x), which Rails parses
+      # as a String/Array that does not respond to permit!/permit. Reject those as a
+      # bad request rather than letting the NoMethodError escape as a 500.
+      def require_query_object(value, name)
+        return value if value.is_a?(ActionController::Parameters)
+
+        raise JSONAPI::Errors::ParameterNotAllowed, ["#{name} must be a JSON object"]
+      end
+
+      # page[number]/page[size] are coerced with to_i and used as a divisor and as
+      # LIMIT/OFFSET. A non-positive or non-numeric value (0, -5, "abc") produces a
+      # divide-by-zero (FloatDomainError) or a negative LIMIT/OFFSET. Reject it as a
+      # bad request instead of letting the raise escape as a 500.
+      def require_positive_integer(value, name)
+        return if value.to_s.match?(/\A\d+\z/) && value.to_i.positive?
+
+        raise JSONAPI::Errors::ParameterNotAllowed, ["#{name} must be a positive integer"]
       end
 
       def render_sort_errors(invalid)

data/lib/json_api/serialization/concerns/deserialization_helpers.rb

@@ -69,6 +69,25 @@ module JSONAPI
         type
       end
 
+      # jpie routes a relationship to the to-one or to-many path based on the shape of
+      # the incoming data, not the association definition. A to-one association given an
+      # array (or a to-many given a single identifier) lands on the wrong setter
+      # (e.g. user_ids= for a belongs_to) and raises UnknownAttributeError. Reject the
+      # mismatch as a client error instead of letting it escape as a 500. AS attachments
+      # have no plain reflection and are validated separately, so they are skipped here.
+      def validate_relationship_arity!(association_name, data)
+        association = @model_class&.reflect_on_association(association_name.to_sym)
+        return unless association
+
+        if association.collection? && !data.is_a?(Array)
+          raise ArgumentError,
+                "Relationship #{association_name} is to-many and expects an array of resource identifiers"
+        elsif !association.collection? && data.is_a?(Array)
+          raise ArgumentError,
+                "Relationship #{association_name} is to-one and expects a single resource identifier, not an array"
+        end
+      end
+
       def valid_relationship_data?(data)
         if data.is_a?(Array)
           data.all? { |r| valid_resource_identifier?(r) }

data/lib/json_api/serialization/concerns/relationship_processing.rb

@@ -14,6 +14,7 @@ module JSONAPI
         return handle_empty_array_relationship(attrs, param_name, association_name) if ParamHelpers.empty_array?(data)
 
         validate_relationship_data_format!(data, association_name)
+        validate_relationship_arity!(association_name, data)
         process_relationship_data(attrs, association_name, param_name, data)
       end
 

data/lib/json_api/support/concerns/regular_filters.rb

@@ -27,7 +27,7 @@ module JSONAPI
         return scope unless model_class.respond_to?(filter_name.to_sym)
 
         scope.public_send(filter_name.to_sym, filter_value)
-      rescue ArgumentError, NoMethodError
+      rescue ArgumentError, NoMethodError, TypeError
         scope
       end
     end

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "3.0.3"
+  VERSION = "3.1.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 3.0.3
+  version: 3.1.0
 platform: ruby
 authors:
 - Emil Kampp
@@ -93,10 +93,10 @@ files:
 - ".cursor/agents/nasa-power-of-ten-reviewer.md"
 - ".cursor/agents/systematic-debugging.md"
 - ".cursor/rules/release.mdc"
+- ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
-- ".travis.yml"
 - Gemfile
 - Gemfile.lock
 - PERFORMANCE_BASELINE.md

data/.travis.yml

@@ -1,7 +0,0 @@
----
-sudo: false
-language: ruby
-cache: bundler
-rvm:
-  - 2.6.10
-before_install: gem install bundler -v 1.17.2