jpie 3.1.3 → 3.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd99f20db06f6a541724cee1eb5c96adc2045933bc29dfff0ab55e1eaf03753c
-  data.tar.gz: 54b68ed6a85b0091bbafdde4c87fd5bfb18d8d35df1afc9c3233a6c0c6b68976
+  metadata.gz: a865a73571e8287482862cc1bda700a579b036108f3c9bb2c752e197ed6b2793
+  data.tar.gz: 03b2fe7e47c5712440053ddabe9d131499c34db1a730a2b88b9970900ecda76a
 SHA512:
-  metadata.gz: 4c319de1c2020500399d8ec1fe78392f3b2c36e147edda8405100a38bba428c4aa8229f2da61be1ea109bfd616c563e4907d9be4ad364438070d5c872e340544
-  data.tar.gz: ea1bd9693e915dc19a9b96258d201aba8af05a4ebb9778a2fc6868336bf8cbc32276cd841c85ffedb0a7da8e8e16b21fc8e7798e46db95487c86a036bdcc5173
+  metadata.gz: f397a98e0ef1b4759761f84d271694102f181b805d0619a4efca42f1bc4fc407870019bf179a5bcf93e3c5745f0998e9b665c266da8fad496e9a8bbb7240b6d1
+  data.tar.gz: 4261ae97d8e83de26145b5d85d62da266d933148d154088f57c54066e71b77c7761d1d6e0d6bf64dd8258fdca34c6547c2ba853dbbf85bbedf6bdffa2dac0b76

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    jpie (3.1.2)
+    jpie (3.1.3)
       actionpack (~> 8.1, >= 8.1.0)
       pg_query (>= 4)
       prosopite (>= 1)

data/lib/json_api/controllers/concerns/resource_actions/crud_helpers.rb

@@ -8,7 +8,7 @@ module JSONAPI
       private
 
       def prepare_create_params(sti_class)
-        hash = deserialize_params(:create, model_class: sti_class)
+        hash = deserialize_params(:create, model_class: sti_class, definition: determine_sti_resource_class)
         attachments = extract_active_storage_params_from_hash(hash, sti_class)
         clean_params(hash, attachments)
         apply_sti_type(sti_class, hash)
@@ -16,7 +16,7 @@ module JSONAPI
       end
 
       def prepare_create_params_from_data(sti_class, data)
-        hash = deserialize_params(:create, model_class: sti_class, data:)
+        hash = deserialize_params(:create, model_class: sti_class, data:, definition: determine_sti_resource_class)
         attachments = extract_active_storage_params_from_hash(hash, sti_class)
         clean_params(hash, attachments)
         apply_sti_type(sti_class, hash)
@@ -24,7 +24,7 @@ module JSONAPI
       end
 
       def prepare_update_params
-        hash = deserialize_params(:update)
+        hash = deserialize_params(:update, definition: @resource_class)
         attachments = extract_active_storage_params_from_hash(hash, model_class)
         clean_params(hash, attachments)
         [hash, attachments]

data/lib/json_api/controllers/concerns/resource_actions/resource_loading.rb

@@ -51,10 +51,10 @@ module JSONAPI
         JSONAPI::ParamHelpers.deep_symbolize_params(data)
       end
 
-      def deserialize_params(action = :update, model_class: nil, data: nil)
+      def deserialize_params(action = :update, model_class: nil, data: nil, definition: nil)
         target = model_class || self.model_class
         payload = data.nil? ? raw_jsonapi_data : symbolize_data(data)
-        JSONAPI::Deserializer.new(payload, model_class: target, action:).to_model_attributes
+        JSONAPI::Deserializer.new(payload, model_class: target, action:, definition:).to_model_attributes
       end
 
       def resource_url(resource)

data/lib/json_api/controllers/relationships_controller.rb

@@ -90,6 +90,10 @@ module JSONAPI
     def ensure_relationship_writable!(association)
       return if active_storage_writable?(association)
 
+      unless @resource_class.relationship_field_writable?(@relationship_name, :update)
+        raise JSONAPI::AuthorizationError, "Relationship '#{@relationship_name}' is not updatable"
+      end
+
       relationship_def = find_relationship_definition
       readonly = relationship_def && (relationship_def[:options] || {})[:readonly] == true
 

data/lib/json_api/resources/concerns/attributes_dsl.rb

@@ -41,6 +41,21 @@ module JSONAPI
           resolve_field_list(:@updatable_fields, :permitted_updatable_fields)
         end
 
+        # Whether a relationship may be written for the given action (:create or :update).
+        # A relationship is gated by the creatable_fields/updatable_fields allow-list only when
+        # the resource opted it in by naming it in one of those lists; relationships named in
+        # neither keep the default (readonly-only) behavior. This lets a resource make a
+        # relationship create-only — name it in creatable_fields, omit it from updatable_fields —
+        # the same way it restricts attributes.
+        def relationship_field_writable?(name, action)
+          name = name.to_sym
+          creatable = permitted_creatable_fields.map(&:to_sym)
+          updatable = permitted_updatable_fields.map(&:to_sym)
+          return true unless creatable.include?(name) || updatable.include?(name)
+
+          (action == :create ? creatable : updatable).include?(name)
+        end
+
         def resolve_field_list(ivar, method)
           return (instance_variable_get(ivar) || []).uniq if instance_variable_defined?(ivar)
           return superclass.public_send(method).uniq if inherits_field?(ivar, method)

data/lib/json_api/serialization/concerns/deserialization_helpers.rb

@@ -129,7 +129,8 @@ module JSONAPI
 
         association = @model_class.reflect_on_association(association_name.to_sym)
         readonly = relationship_options_for(association_name)[:readonly] == true
-        JSONAPI::RelationshipGuard.ensure_writable!(association, association_name, readonly:) if association
+        field_writable = @definition.relationship_field_writable?(association_name, @action)
+        JSONAPI::RelationshipGuard.ensure_writable!(association, association_name, readonly:, field_writable:)
       end
 
       def relationship_options_for(association_name)

data/lib/json_api/serialization/deserializer.rb

@@ -16,10 +16,14 @@ module JSONAPI
     include Serialization::RelationshipProcessing
     include Serialization::DeserializationHelpers
 
-    def initialize(params, model_class:, action: :create)
+    def initialize(params, model_class:, action: :create, definition: nil)
       @params = ParamHelpers.deep_symbolize_params(params)
       @model_class = model_class
-      @definition = ResourceLoader.find_for_model(model_class)
+      # Prefer the resource the request is addressing (resolved by type/route). Resolving
+      # from the model alone is ambiguous when several resources share one model
+      # (e.g. RestrictedPostResource and PostResource both back Post), which would gate
+      # relationships against the wrong resource's creatable_fields/updatable_fields.
+      @definition = definition || ResourceLoader.find_for_model(model_class)
       @action = action.to_sym
     end
   end

data/lib/json_api/support/relationship_guard.rb

@@ -6,7 +6,12 @@ module JSONAPI
   module RelationshipGuard
     module_function
 
-    def ensure_writable!(association, error_target, readonly: false)
+    def ensure_writable!(association, error_target, readonly: false, field_writable: true)
+      # A relationship excluded from the resource's creatable_fields/updatable_fields
+      # allow-list is not writable for this action, on either the main-body path or the
+      # dedicated endpoint. This gate is independent of the AR reflection.
+      raise JSONAPI::AuthorizationError, "Relationship '#{error_target}' is not writable" unless field_writable
+
       return unless association
       return unless readonly
 

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "3.1.3"
+  VERSION = "3.1.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 3.1.3
+  version: 3.1.4
 platform: ruby
 authors:
 - Emil Kampp