jpie 3.1.3 → 3.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd99f20db06f6a541724cee1eb5c96adc2045933bc29dfff0ab55e1eaf03753c
-  data.tar.gz: 54b68ed6a85b0091bbafdde4c87fd5bfb18d8d35df1afc9c3233a6c0c6b68976
+  metadata.gz: ac6d32dde9d9be0163f1f3c48a9c65770f4465176a403efdb5f0ba42f18bb4f5
+  data.tar.gz: 4ac43aa7aaf9194497910650cc1180800952806a7cb5ebf1ecf590decda4aaa0
 SHA512:
-  metadata.gz: 4c319de1c2020500399d8ec1fe78392f3b2c36e147edda8405100a38bba428c4aa8229f2da61be1ea109bfd616c563e4907d9be4ad364438070d5c872e340544
-  data.tar.gz: ea1bd9693e915dc19a9b96258d201aba8af05a4ebb9778a2fc6868336bf8cbc32276cd841c85ffedb0a7da8e8e16b21fc8e7798e46db95487c86a036bdcc5173
+  metadata.gz: ec7aff7ee080d6acca4bcf19cd3d72f7084c3bcb492df1d6e5c4b674711575450bd03e558267889d46cc9c436255dbc3013fc1b5bfa3df074503fdb39f342737
+  data.tar.gz: 6a4c2811e9df0bad8bbecc8b6a62ae5a0f9e44912d0035fad7c22a6569b383e24b574dbb35fe2cc3c9402b8157079af4f0addbef91e685e997539200c9b317b5

data/.rubocop.yml

@@ -92,6 +92,20 @@ Style/HashSyntax:
 Lint/UnusedBlockArgument:
   Exclude:
     - "spec/jsonapi/authorization_spec.rb"
+    # Security PoC specs configure authorization handlers via keyword lambdas
+    # that intentionally ignore some of the required keyword arguments.
+    - "spec/requests/regression/*_spec.rb"
+
+# Security PoC regression specs read as a single sequential narrative
+# (sanity check -> attack -> assert), so a handful of expectations per example
+# is clearer than splitting them across examples.
+RSpec/MultipleExpectations:
+  Exclude:
+    - "spec/requests/regression/*_spec.rb"
+
+RSpec/ExampleLength:
+  Exclude:
+    - "spec/requests/regression/*_spec.rb"
 
 # RSpec - file-specific exclusions
 RSpec/DescribedClass:

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    jpie (3.1.2)
+    jpie (3.1.5)
       actionpack (~> 8.1, >= 8.1.0)
       pg_query (>= 4)
       prosopite (>= 1)

data/README.md

@@ -15,7 +15,6 @@ A Rails 8+ gem that provides JSON:API compliant routing DSL and generic JSON:API
 - Content negotiation with Accept and Content-Type headers
 - Support for polymorphic and STI relationships
 - Namespace support for API versioning and modular organization
-- Sideposting: create primary and related resources in one request using `included` and local identifiers (`lid`)
 
 ## Installation
 
@@ -1192,119 +1191,6 @@ The gem validates relationship data:
 - Invalid polymorphic type (class doesn't exist) returns `400 Bad Request`
 - Attempting to unset linkage that cannot be nullified (e.g., foreign key has NOT NULL constraint) returns `400 Bad Request`
 
-## Sideposting
-
-Sideposting lets you create a primary resource and related resources that do not yet exist in a single POST request. The client sends the primary resource in `data` and full resource objects in `included`. Relationships on the primary can reference included resources by **local identifier** (`lid`) instead of `id`. By default the server creates the **primary** first, then creates included resources and updates the primary with resolved relationship ids (**primary-first**). You can optionally use **included-first** (create included resources first, then the primary) via a controller macro.
-
-This follows the JSON:API 1.1 [Local Identity](https://jsonapi.org/format/1.1/#document-resource-object-identification) convention: `lid` is a client-chosen temporary identifier for the request only; it is not stored.
-
-### Sidepost order
-
-Controllers use **primary-first** by default: the primary resource is saved first (without lid-based relationships), then included resources are created, then the primary is updated with the resolved relationship ids. This supports flows such as signup where the user must exist before the account links to them.
-
-To use the legacy **included-first** order (create included resources first, then the primary), set the macro in your controller:
-
-```ruby
-class SomeController < JSONAPI::ResourcesController
-  sidepost_order :included_first
-end
-```
-
-Valid values are `:primary_first` (default) and `:included_first`. Any other value raises `ArgumentError` at class load time.
-
-### Custom create strategy
-
-For included resources, the default creation is `model_class.new(params).save`. You can override this per resource type by defining a class method **`sidepost_create`** on the resource class. It receives `params:` (the deserialized model attributes hash) and `controller:` and must return a persisted record or `nil`. If it returns a record, that record is used and the default create path is skipped; if it returns `nil`, the default create runs.
-
-Example: use a service to create the related resource instead of a bare `new`/`save`:
-
-```ruby
-class AccountResource < JSONAPI::Resource
-  def self.sidepost_create(params:, controller:)
-    CreateAccountService.call(
-      name: params["name"],
-      domain: params["domain"],
-      creator: Current.user
-    ).account
-  end
-end
-```
-
-Use **primary-first** (default) plus `sidepost_create` on the related resource when the primary must exist first and the related resource needs custom creation logic.
-
-### Request format
-
-- **`data`**: The primary resource. In `relationships`, use `type` and `lid` (no `id`) to reference an item in `included`.
-- **`included`**: Array of full resource objects. Each can have `type`, `lid`, and `attributes` (and optionally `relationships` with further `lid` references). Order of creation is the order of `included`; a later item may reference an earlier item’s `lid`.
-
-Example: create a user and a new profile in one request:
-
-```http
-POST /users HTTP/1.1
-Content-Type: application/vnd.api+json
-Accept: application/vnd.api+json
-
-{
-  "data": {
-    "type": "users",
-    "attributes": {
-      "name": "Jane Doe",
-      "email": "jane@example.com"
-    },
-    "relationships": {
-      "profile": {
-        "data": { "type": "customer_profiles", "lid": "temp-profile" }
-      }
-    }
-  },
-  "included": [
-    {
-      "type": "customer_profiles",
-      "lid": "temp-profile",
-      "attributes": {
-        "company_name": "Acme Inc",
-        "industry": "Tech"
-      }
-    }
-  ]
-}
-```
-
-With the default **primary-first** order, the server creates the user first, then creates the `customer_profiles` resource and assigns it an `id`, then updates the user's `profile` relationship to point to that new profile. The `lid` `"temp-profile"` is only used to match the relationship to the included object.
-
-### Response
-
-On success the response is `201 Created` with the primary resource in `data` and the created related resources in `included`, each with a real `id`:
-
-```json
-{
-  "jsonapi": { "version": "1.1" },
-  "data": {
-    "type": "users",
-    "id": "123",
-    "attributes": { "name": "Jane Doe", "email": "jane@example.com" },
-    "relationships": {
-      "profile": { "data": { "type": "customer_profiles", "id": "456" } }
-    }
-  },
-  "included": [
-    {
-      "type": "customer_profiles",
-      "id": "456",
-      "attributes": { "company_name": "Acme Inc", "industry": "Tech" }
-    }
-  ]
-}
-```
-
-### Validation and rollback
-
-Creation runs in a single transaction. If any included resource fails validation, the entire request is rolled back: no primary or included resources are created. The response is `422 Unprocessable Entity` with errors that point to the failing included resource (e.g. `source.pointer` to the relevant `included` index or attribute).
-
-### When sideposting is used
-
-Sideposting is applied when the create request includes a top-level `included` array. If `included` is present, the controller uses the configured **sidepost order** (primary-first by default, or included-first if `sidepost_order :included_first` is set). With primary-first, it creates the primary resource first (without lid-based relationships), creates included resources, resolves `lid` references to new `id`s, updates the primary with those relationships, then returns the primary and `included` in the response. With included-first, it creates included resources first, resolves `lid`s, then creates the primary and returns it with `included`.
-
 ## Relationship Endpoint Details
 
 The gem provides dedicated endpoints for managing relationships independently of the main resource:

data/lib/json_api/controllers/concerns/controller_helpers/error_rendering.rb

@@ -43,24 +43,6 @@ module JSONAPI
         render json: { errors: }, status: :unprocessable_content
       end
 
-      def render_sidepost_validation_errors(sidepost_error)
-        errors = sidepost_validation_errors(sidepost_error)
-        render json: { errors: }, status: :unprocessable_content
-      end
-
-      def sidepost_validation_errors(sidepost_error)
-        index = sidepost_error.included_index
-        sidepost_error.record.errors.map do |error|
-          pointer = "/included/#{index}/attributes/#{error.attribute}"
-          {
-            status: "422",
-            title: "Validation Error",
-            detail: error.full_message,
-            source: { pointer: pointer },
-          }
-        end
-      end
-
       def render_parameter_not_allowed_error(error)
         error_params = error.respond_to?(:params) ? error.params : []
         detail = error_params.present? ? error_params.join(", ") : "Relationship or attribute is read-only"

data/lib/json_api/controllers/concerns/resource_actions/crud_helpers.rb

@@ -8,15 +8,7 @@ module JSONAPI
       private
 
       def prepare_create_params(sti_class)
-        hash = deserialize_params(:create, model_class: sti_class)
-        attachments = extract_active_storage_params_from_hash(hash, sti_class)
-        clean_params(hash, attachments)
-        apply_sti_type(sti_class, hash)
-        [hash, attachments]
-      end
-
-      def prepare_create_params_from_data(sti_class, data)
-        hash = deserialize_params(:create, model_class: sti_class, data:)
+        hash = deserialize_params(:create, model_class: sti_class, definition: determine_sti_resource_class)
         attachments = extract_active_storage_params_from_hash(hash, sti_class)
         clean_params(hash, attachments)
         apply_sti_type(sti_class, hash)
@@ -24,7 +16,7 @@ module JSONAPI
       end
 
       def prepare_update_params
-        hash = deserialize_params(:update)
+        hash = deserialize_params(:update, definition: @resource_class)
         attachments = extract_active_storage_params_from_hash(hash, model_class)
         clean_params(hash, attachments)
         [hash, attachments]
@@ -53,15 +45,6 @@ module JSONAPI
         render json: serialize_resource(resource), status: :created, location: resource_url(resource)
       end
 
-      def save_created_with_sidepost(resource, sideposted_records)
-        raise JSONAPI::Sideposting::PrimaryValidationError, resource unless resource.save
-
-        emit_resource_event(:created, resource)
-        render json: serialize_resource_with_sidepost(resource, sideposted_records),
-               status: :created,
-               location: resource_url(resource)
-      end
-
       def save_updated(params_hash, attachments)
         return render_validation_errors(@resource) unless @resource.update(params_hash)
 

data/lib/json_api/controllers/concerns/resource_actions/resource_loading.rb

@@ -28,7 +28,8 @@ module JSONAPI
       def load_resource_record
         return unless params[:id] && @resource_class
 
-        scope = scope_with_includes(@resource_class.records)
+        authorized = apply_authorization_scope(@resource_class.records, action: action_name.to_sym)
+        scope = scope_with_includes(authorized)
         @resource = scope.find(params[:id])
       end
 
@@ -51,10 +52,10 @@ module JSONAPI
         JSONAPI::ParamHelpers.deep_symbolize_params(data)
       end
 
-      def deserialize_params(action = :update, model_class: nil, data: nil)
+      def deserialize_params(action = :update, model_class: nil, data: nil, definition: nil)
         target = model_class || self.model_class
         payload = data.nil? ? raw_jsonapi_data : symbolize_data(data)
-        JSONAPI::Deserializer.new(payload, model_class: target, action:).to_model_attributes
+        JSONAPI::Deserializer.new(payload, model_class: target, action:, definition:).to_model_attributes
       end
 
       def resource_url(resource)

data/lib/json_api/controllers/concerns/resource_actions/serialization.rb

@@ -14,19 +14,6 @@ module JSONAPI
         )
       end
 
-      def serialize_resource_with_sidepost(resource, sideposted_records)
-        result = serialize_resource(resource)
-        return result if sideposted_records.empty?
-
-        fields = parse_fields_param
-        sideposted_objects = sideposted_records.map do |rec|
-          JSONAPI::Serializer.new(rec).to_hash(include: [], fields:, document_meta: nil)[:data]
-        end
-        all_included = (result[:included] || []) + sideposted_objects
-        result[:included] = deduplicate_included(all_included)
-        result
-      end
-
       def serialize_collection(resources)
         includes = parse_include_param
         fields = parse_fields_param
@@ -72,17 +59,6 @@ module JSONAPI
         processed.add(key)
       end
 
-      def deduplicate_included(included_array)
-        processed = Set.new
-        included_array.each_with_object([]) do |inc, out|
-          key = "#{inc[:type]}-#{inc[:id]}"
-          next if processed.include?(key)
-
-          out << inc
-          processed.add(key)
-        end
-      end
-
       def build_collection_response(data, all_included)
         result = { jsonapi: JSONAPI::Serializer.jsonapi_object, data: }
         result[:included] = all_included if all_included.any?

data/lib/json_api/controllers/concerns/resource_actions.rb

@@ -9,7 +9,6 @@ require_relative "resource_actions/pagination"
 require_relative "resource_actions/type_validation"
 require_relative "resource_actions/crud_helpers"
 require_relative "resource_actions/resource_loading"
-require_relative "resource_actions/sideposting"
 
 module JSONAPI
   module ResourceActions
@@ -23,7 +22,6 @@ module JSONAPI
     include TypeValidation
     include CrudHelpers
     include ResourceLoading
-    include Sideposting
 
     included do
       before_action :load_jsonapi_resource
@@ -49,28 +47,16 @@ module JSONAPI
     end
 
     def create
-      perform_create
+      @resource = build_resource_for_create
+      authorize_resource_action!(@resource, action: :create)
+      attach_active_storage_files(@resource, @create_attachments, resource_class: determine_sti_resource_class)
+      save_created(@resource)
     rescue ArgumentError => e
       render_create_error(e)
-    rescue JSONAPI::Sideposting::ValidationError => e
-      render_sidepost_validation_errors(e)
-    rescue JSONAPI::Sideposting::PrimaryValidationError => e
-      render_validation_errors(e.record)
     rescue JSONAPI::Errors::ParameterNotAllowed, ActiveSupport::MessageVerifier::InvalidSignature => e
       handle_create_exception(e)
     end
 
-    def perform_create
-      if sidepost_request?
-        create_with_sidepost
-      else
-        @resource = build_resource_for_create
-        authorize_resource_action!(@resource, action: :create)
-        attach_active_storage_files(@resource, @create_attachments, resource_class: determine_sti_resource_class)
-        save_created(@resource)
-      end
-    end
-
     def build_resource_for_create
       sti_class = determine_sti_class
       params_hash, @create_attachments = prepare_create_params(sti_class)

data/lib/json_api/controllers/relationships_controller.rb

@@ -78,9 +78,11 @@ module JSONAPI
       raw_data = params[:data]
       return nil if raw_data.nil?
       return [] if raw_data.is_a?(Array) && raw_data.empty?
-      return raw_data.map { |item| ParamHelpers.deep_symbolize_params(item) } if raw_data.is_a?(Array)
+      if raw_data.is_a?(Array)
+        return raw_data.map { |item| ParamHelpers.deep_symbolize_params(ParamHelpers.ensure_object!(item, "data")) }
+      end
 
-      ParamHelpers.deep_symbolize_params(raw_data)
+      ParamHelpers.deep_symbolize_params(ParamHelpers.ensure_object!(raw_data, "data"))
     end
 
     def polymorphic_association?
@@ -90,6 +92,10 @@ module JSONAPI
     def ensure_relationship_writable!(association)
       return if active_storage_writable?(association)
 
+      unless @resource_class.relationship_field_writable?(@relationship_name, :update)
+        raise JSONAPI::AuthorizationError, "Relationship '#{@relationship_name}' is not updatable"
+      end
+
       relationship_def = find_relationship_definition
       readonly = relationship_def && (relationship_def[:options] || {})[:readonly] == true
 

data/lib/json_api/railtie.rb

@@ -57,7 +57,16 @@ module JSONAPI
 
     initializer "json_api.parameter_parsing", after: "action_dispatch.configure" do |_app|
       ActionDispatch::Request.parameter_parsers[:jsonapi] = lambda do |raw_post|
-        ActiveSupport::JSON.decode(raw_post)
+        data = ActiveSupport::JSON.decode(raw_post)
+        # A JSON:API document must be a single object. A top-level non-object body (a bare
+        # array/scalar) would otherwise leave `request.parameters` a non-Hash, and Rails' own
+        # Parameters#parameters then raises NoMethodError (`merge`/`deep_transform_keys!`) -> an
+        # unhandled 500. Reject it as a parse error so Rails renders a clean 400.
+        unless data.is_a?(Hash)
+          raise ActionDispatch::Http::Parameters::ParseError, "JSON:API request body must be an object"
+        end
+
+        data
       rescue JSON::ParserError => e
         raise ActionDispatch::Http::Parameters::ParseError, e.message
       end

data/lib/json_api/resources/concerns/attributes_dsl.rb

@@ -41,6 +41,21 @@ module JSONAPI
           resolve_field_list(:@updatable_fields, :permitted_updatable_fields)
         end
 
+        # Whether a relationship may be written for the given action (:create or :update).
+        # A relationship is gated by the creatable_fields/updatable_fields allow-list only when
+        # the resource opted it in by naming it in one of those lists; relationships named in
+        # neither keep the default (readonly-only) behavior. This lets a resource make a
+        # relationship create-only — name it in creatable_fields, omit it from updatable_fields —
+        # the same way it restricts attributes.
+        def relationship_field_writable?(name, action)
+          name = name.to_sym
+          creatable = permitted_creatable_fields.map(&:to_sym)
+          updatable = permitted_updatable_fields.map(&:to_sym)
+          return true unless creatable.include?(name) || updatable.include?(name)
+
+          (action == :create ? creatable : updatable).include?(name)
+        end
+
         def resolve_field_list(ivar, method)
           return (instance_variable_get(ivar) || []).uniq if instance_variable_defined?(ivar)
           return superclass.public_send(method).uniq if inherits_field?(ivar, method)

data/lib/json_api/resources/resource.rb

@@ -23,10 +23,6 @@ module JSONAPI
         super
         subclass.type_format = type_format
       end
-
-      def sidepost_create(*)
-        nil
-      end
     end
 
     def initialize(record = nil, context = {})

data/lib/json_api/serialization/concerns/attributes_deserialization.rb

@@ -4,10 +4,9 @@ module JSONAPI
   module Serialization
     module AttributesDeserialization
       def attributes
-        attrs = extract_attributes_from_params
-        attrs = attrs.transform_keys(&:to_sym) if attrs.respond_to?(:transform_keys)
+        attrs = ParamHelpers.ensure_object!(extract_attributes_from_params, "data.attributes")
         permitted_attrs = permitted_attributes_for_action
-        attrs.slice(*permitted_attrs)
+        attrs.transform_keys(&:to_sym).slice(*permitted_attrs)
       end
 
       def extract_attributes_from_params

data/lib/json_api/serialization/concerns/deserialization_helpers.rb

@@ -52,11 +52,6 @@ module JSONAPI
 
       def extract_id(resource_identifier)
         id = RelationshipHelpers.extract_id_from_identifier(resource_identifier)
-        if id.nil? && lid?(resource_identifier)
-          raise ArgumentError,
-                "lid references must be resolved before deserialization " \
-                "(include related resources in top-level included)"
-        end
         raise ArgumentError, "Missing id in relationship data" unless id
 
         id
@@ -99,17 +94,13 @@ module JSONAPI
       def valid_resource_identifier?(identifier)
         return false unless identifier.is_a?(Hash)
 
-        has_type?(identifier) && (has_id?(identifier) || lid?(identifier))
+        has_type?(identifier) && has_id?(identifier)
       end
 
       def has_id?(identifier)
         identifier[:id].present?
       end
 
-      def lid?(identifier)
-        identifier[:lid].to_s.present?
-      end
-
       def has_type?(identifier)
         identifier[:type]
       end
@@ -129,7 +120,8 @@ module JSONAPI
 
         association = @model_class.reflect_on_association(association_name.to_sym)
         readonly = relationship_options_for(association_name)[:readonly] == true
-        JSONAPI::RelationshipGuard.ensure_writable!(association, association_name, readonly:) if association
+        field_writable = @definition.relationship_field_writable?(association_name, @action)
+        JSONAPI::RelationshipGuard.ensure_writable!(association, association_name, readonly:, field_writable:)
       end
 
       def relationship_options_for(association_name)

data/lib/json_api/serialization/concerns/relationship_processing.rb

@@ -21,7 +21,7 @@ module JSONAPI
       private
 
       def normalize_relationship_value(value)
-        value.is_a?(Hash) ? value : value.to_h
+        ParamHelpers.ensure_object!(value, "relationship")
       end
 
       def extract_data_from_value(value_hash)
@@ -48,7 +48,7 @@ module JSONAPI
       def validate_relationship_data_format!(data, association_name)
         return if valid_relationship_data?(data)
 
-        raise ArgumentError, "Invalid relationship data for #{association_name}: missing type or (id or lid)"
+        raise ArgumentError, "Invalid relationship data for #{association_name}: missing type or id"
       end
 
       def process_relationship_data(attrs, association_name, param_name, data)

data/lib/json_api/serialization/concerns/relationships_deserialization.rb

@@ -47,10 +47,6 @@ module JSONAPI
         RelationshipHelpers.extract_id_from_identifier(identifier)
       end
 
-      def extract_lid_from_identifier(identifier)
-        RelationshipHelpers.extract_lid_from_identifier(identifier)
-      end
-
       def relationship_id(relationship_name)
         relationship_ids(relationship_name).first
       end

data/lib/json_api/serialization/deserializer.rb

@@ -16,10 +16,14 @@ module JSONAPI
     include Serialization::RelationshipProcessing
     include Serialization::DeserializationHelpers
 
-    def initialize(params, model_class:, action: :create)
+    def initialize(params, model_class:, action: :create, definition: nil)
       @params = ParamHelpers.deep_symbolize_params(params)
       @model_class = model_class
-      @definition = ResourceLoader.find_for_model(model_class)
+      # Prefer the resource the request is addressing (resolved by type/route). Resolving
+      # from the model alone is ambiguous when several resources share one model
+      # (e.g. RestrictedPostResource and PostResource both back Post), which would gate
+      # relationships against the wrong resource's creatable_fields/updatable_fields.
+      @definition = definition || ResourceLoader.find_for_model(model_class)
       @action = action.to_sym
     end
   end

data/lib/json_api/support/param_helpers.rb

@@ -30,6 +30,18 @@ module JSONAPI
       end
     end
 
+    # Every JSON:API document member that carries attributes or resource identifiers must be an
+    # object. A malformed document can send a scalar/array in that slot; without this guard a
+    # later `.to_h`/`.slice`/`.dig` raises NoMethodError/TypeError -> an unhandled 500. Coerce
+    # a Parameters to a Hash, pass a Hash through, and reject anything else with an ArgumentError
+    # (which the create/update/relationship rescues render as a clean 400).
+    def ensure_object!(value, member)
+      return value if value.is_a?(Hash)
+      return value.to_unsafe_h if value.respond_to?(:to_unsafe_h)
+
+      raise ArgumentError, "'#{member}' must be an object"
+    end
+
     def build_query_string(query_params)
       query_parts = []
       query_params.each do |key, value|

data/lib/json_api/support/relationship_guard.rb

@@ -6,7 +6,12 @@ module JSONAPI
   module RelationshipGuard
     module_function
 
-    def ensure_writable!(association, error_target, readonly: false)
+    def ensure_writable!(association, error_target, readonly: false, field_writable: true)
+      # A relationship excluded from the resource's creatable_fields/updatable_fields
+      # allow-list is not writable for this action, on either the main-body path or the
+      # dedicated endpoint. This gate is independent of the AR reflection.
+      raise JSONAPI::AuthorizationError, "Relationship '#{error_target}' is not writable" unless field_writable
+
       return unless association
       return unless readonly
 

data/lib/json_api/support/relationship_helpers.rb

@@ -35,10 +35,6 @@ module JSONAPI
       ResourceIdentifier.extract_id(identifier)
     end
 
-    def extract_lid_from_identifier(identifier)
-      ResourceIdentifier.extract_lid(identifier)
-    end
-
     def extract_type_from_identifier(identifier)
       ResourceIdentifier.extract_type(identifier)
     end

data/lib/json_api/support/resource_identifier.rb

@@ -17,10 +17,6 @@ module JSONAPI
       identifier[:id].to_s.presence
     end
 
-    def extract_lid(identifier)
-      identifier[:lid].to_s.presence
-    end
-
     def extract_type(identifier)
       identifier[:type]
     end

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "3.1.3"
+  VERSION = "3.1.6"
 end

data/lib/json_api.rb

@@ -50,8 +50,6 @@ require "json_api/support/responders"
 require "json_api/support/instrumentation"
 require "json_api/serialization/serializer"
 require "json_api/serialization/deserializer"
-require "json_api/sideposting/lid_resolver"
-require "json_api/sideposting/processor"
 require "json_api/controllers/concerns/controller_helpers"
 require "json_api/controllers/concerns/resource_actions"
 require "json_api/controllers/base_controller"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 3.1.3
+  version: 3.1.6
 platform: ruby
 authors:
 - Emil Kampp
@@ -135,8 +135,6 @@ files:
 - lib/json_api/controllers/concerns/resource_actions/pagination.rb
 - lib/json_api/controllers/concerns/resource_actions/resource_loading.rb
 - lib/json_api/controllers/concerns/resource_actions/serialization.rb
-- lib/json_api/controllers/concerns/resource_actions/sideposting.rb
-- lib/json_api/controllers/concerns/resource_actions/sideposting_primary_first.rb
 - lib/json_api/controllers/concerns/resource_actions/type_validation.rb
 - lib/json_api/controllers/relationships_controller.rb
 - lib/json_api/controllers/resources_controller.rb
@@ -168,9 +166,6 @@ files:
 - lib/json_api/serialization/deserializer.rb
 - lib/json_api/serialization/include_path_helpers.rb
 - lib/json_api/serialization/serializer.rb
-- lib/json_api/sideposting/lid_resolver.rb
-- lib/json_api/sideposting/order.rb
-- lib/json_api/sideposting/processor.rb
 - lib/json_api/support/active_storage_support.rb
 - lib/json_api/support/collection_query.rb
 - lib/json_api/support/concerns/condition_building.rb

data/lib/json_api/controllers/concerns/resource_actions/sideposting.rb

@@ -1,97 +0,0 @@
-# frozen_string_literal: true
-
-require "json_api/sideposting/order"
-require_relative "sideposting_primary_first"
-
-module JSONAPI
-  module ResourceActions
-    module Sideposting
-      extend ActiveSupport::Concern
-      include SidepostingPrimaryFirst
-
-      class_methods do
-        def sidepost_order(value)
-          order = value.to_sym
-          unless JSONAPI::Sideposting::Order::VALID_ORDERS.include?(order)
-            raise ArgumentError, "sidepost_order must be one of #{JSONAPI::Sideposting::Order::VALID_ORDERS.join(", ")}"
-          end
-
-          @sidepost_order = order
-        end
-
-        def sidepost_order_value
-          @sidepost_order || JSONAPI::Sideposting::Order::PRIMARY_FIRST
-        end
-
-        def included_first?
-          sidepost_order_value == JSONAPI::Sideposting::Order::INCLUDED_FIRST
-        end
-      end
-
-      def sidepost_request?
-        params[:included].present?
-      end
-
-      def create_with_sidepost
-        if self.class.included_first?
-          create_with_sidepost_included_first
-        else
-          create_with_sidepost_primary_first
-        end
-      end
-
-      def create_with_sidepost_included_first
-        ActiveRecord::Base.transaction do
-          processor = JSONAPI::Sideposting::Processor.new(included: params[:included], controller: self)
-          processor.create_all!
-          resolved_data = processor.lid_resolver.resolve(raw_jsonapi_data)
-          resource = build_resource_from_resolved_data(resolved_data)
-          authorize_resource_action!(resource, action: :create)
-          attach_active_storage_files(resource, @create_attachments, resource_class: determine_sti_resource_class)
-          save_created_with_sidepost(resource, processor.created_records)
-        end
-      end
-
-      def extract_lid_relationships!(data)
-        extracted = {}
-        rels = data[:relationships] || {}
-        rels.each do |key, val|
-          next unless val.is_a?(Hash)
-
-          d = val[:data] || val["data"]
-          next unless contains_lid?(d)
-
-          extracted[key] = val
-        end
-        extracted.each_key { |k| rels.delete(k) }
-        extracted
-      end
-
-      def contains_lid?(rel_data)
-        return false if rel_data.blank?
-
-        if rel_data.is_a?(Array)
-          rel_data.any? { |item| contains_lid?(item) }
-        else
-          (rel_data[:lid] || rel_data["lid"]).to_s.present?
-        end
-      end
-
-      def apply_resolved_relationships!(resource, resolved_relationships)
-        payload = { relationships: resolved_relationships }
-        params_hash = JSONAPI::Deserializer.new(
-          payload,
-          model_class: resource.class,
-          action: :update,
-        ).to_model_attributes
-        resource.update!(params_hash)
-      end
-
-      def build_resource_from_resolved_data(resolved_data)
-        sti_class = determine_sti_class
-        params_hash, @create_attachments = prepare_create_params_from_data(sti_class, resolved_data)
-        sti_class.new(params_hash)
-      end
-    end
-  end
-end

data/lib/json_api/controllers/concerns/resource_actions/sideposting_primary_first.rb

@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-module JSONAPI
-  module ResourceActions
-    module SidepostingPrimaryFirst
-      extend ActiveSupport::Concern
-
-      def create_with_sidepost_primary_first
-        ActiveRecord::Base.transaction do
-          data = raw_jsonapi_data.dup
-          lid_relationships = extract_lid_relationships!(data)
-          resource, lid_resolver = create_primary_and_lid_resolver(data)
-          processor = run_sidepost_processor(lid_resolver)
-          apply_lid_relationships_if_any(resource, lid_relationships, lid_resolver)
-          render_created_with_sidepost(resource, processor)
-        end
-      end
-
-      def create_primary_and_lid_resolver(data)
-        resource = build_resource_from_resolved_data(data)
-        authorize_resource_action!(resource, action: :create)
-        attach_active_storage_files(resource, @create_attachments, resource_class: determine_sti_resource_class)
-        raise JSONAPI::Sideposting::PrimaryValidationError, resource unless resource.save
-
-        [resource, build_lid_resolver_with_primary(data, resource)]
-      end
-
-      def build_lid_resolver_with_primary(data, resource)
-        lid_resolver = JSONAPI::Sideposting::LidResolver.new
-        primary_lid = (data[:lid] || data["lid"]).to_s.presence
-        if primary_lid
-          type_name = RelationshipHelpers.resource_type_name(determine_sti_resource_class)
-          lid_resolver.add(primary_lid, type: type_name, id: resource.id)
-        end
-        lid_resolver
-      end
-
-      def run_sidepost_processor(lid_resolver)
-        processor = JSONAPI::Sideposting::Processor.new(
-          included: params[:included],
-          controller: self,
-          lid_resolver: lid_resolver,
-        )
-        processor.create_all!
-        processor
-      end
-
-      def apply_lid_relationships_if_any(resource, lid_relationships, lid_resolver)
-        return if lid_relationships.blank?
-
-        resolved = lid_resolver.resolve(lid_relationships)
-        apply_resolved_relationships!(resource, resolved)
-      end
-
-      def render_created_with_sidepost(resource, processor)
-        emit_resource_event(:created, resource)
-        render json: serialize_resource_with_sidepost(resource, processor.created_records),
-               status: :created,
-               location: resource_url(resource)
-      end
-    end
-  end
-end

data/lib/json_api/sideposting/lid_resolver.rb

@@ -1,72 +0,0 @@
-# frozen_string_literal: true
-
-module JSONAPI
-  module Sideposting
-    class LidResolver
-      def initialize
-        @map = {}
-      end
-
-      def add(lid, type:, id:)
-        raise ArgumentError, "lid is required" if lid.blank?
-        raise ArgumentError, "type is required" if type.blank?
-        raise ArgumentError, "id is required" if id.blank?
-
-        @map[lid.to_s] = { type: type.to_s, id: id.to_s }
-        self
-      end
-
-      def resolve(data)
-        return data if data.nil?
-
-        case data
-        when Hash
-          resolve_hash(data)
-        when Array
-          data.map { |item| resolve(item) }
-        else
-          data
-        end
-      end
-
-      def [](lid)
-        @map[lid.to_s]
-      end
-
-      private
-
-      def resolve_hash(hash)
-        result = {}
-        hash.each do |key, value|
-          result[key] = if resource_identifier_with_lid?(value)
-                          resolve_identifier(value)
-                        else
-                          resolve(value)
-                        end
-        end
-        result
-      end
-
-      def resource_identifier_with_lid?(value)
-        return false unless value.is_a?(Hash)
-
-        value = value.symbolize_keys if value.respond_to?(:symbolize_keys)
-        type = value[:type] || value["type"]
-        lid = value[:lid] || value["lid"]
-        type.present? && lid.to_s.present?
-      end
-
-      def resolve_identifier(identifier)
-        identifier = identifier.symbolize_keys if identifier.respond_to?(:symbolize_keys)
-        lid = (identifier[:lid] || identifier["lid"]).to_s
-        resolved = @map[lid]
-        unless resolved
-          raise ArgumentError,
-                "Unknown lid '#{lid}' (ensure the resource is in the top-level included array)"
-        end
-
-        { type: resolved[:type], id: resolved[:id] }
-      end
-    end
-  end
-end

data/lib/json_api/sideposting/order.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-module JSONAPI
-  module Sideposting
-    module Order
-      PRIMARY_FIRST = :primary_first
-      INCLUDED_FIRST = :included_first
-      VALID_ORDERS = [PRIMARY_FIRST, INCLUDED_FIRST].freeze
-    end
-  end
-end

data/lib/json_api/sideposting/processor.rb

@@ -1,118 +0,0 @@
-# frozen_string_literal: true
-
-require "json_api/sideposting/lid_resolver"
-
-module JSONAPI
-  module Sideposting
-    class ValidationError < JSONAPI::Error
-      attr_reader :record, :included_index
-
-      def initialize(record:, included_index:)
-        @record = record
-        @included_index = included_index
-        super("Validation failed for included resource at index #{included_index}")
-      end
-    end
-
-    class PrimaryValidationError < JSONAPI::Error
-      attr_reader :record
-
-      def initialize(record)
-        @record = record
-        super("Validation failed for primary resource")
-      end
-    end
-
-    class Processor
-      def initialize(included:, controller:, lid_resolver: nil)
-        raise ArgumentError, "included is required" if included.blank?
-        raise ArgumentError, "controller is required" if controller.nil?
-
-        @included = Array(included).map { |item| symbolize_item(item) }
-        @controller = controller
-        @lid_resolver = lid_resolver || LidResolver.new
-        @created_records = []
-      end
-
-      def create_all!
-        @included.each_with_index do |item, index|
-          record = create_one(item, index)
-          @created_records << record
-          lid = item[:lid].to_s.presence
-          next unless lid
-
-          resource_class = resource_class_for(item[:type])
-          type_name = RelationshipHelpers.resource_type_name(resource_class)
-          @lid_resolver.add(lid, type: type_name, id: record.id)
-        end
-        @created_records
-      end
-
-      attr_reader :lid_resolver, :created_records
-
-      private
-
-      def symbolize_item(item)
-        item = item.to_unsafe_h if item.respond_to?(:to_unsafe_h)
-        ParamHelpers.deep_symbolize_params(item.to_h)
-      end
-
-      def create_one(item, included_index)
-        type = item[:type].to_s.presence
-        raise ArgumentError, "Included resource is missing type" unless type
-
-        resource_class = resource_class_for(type)
-        model_class = resource_class.model_class
-        params_hash, attachments = prepare_create_params_for_item(item, model_class, resource_class)
-
-        custom = try_sidepost_create(resource_class, params_hash, included_index)
-        return custom if custom
-
-        create_record_default(model_class, params_hash, attachments, resource_class, included_index)
-      end
-
-      def try_sidepost_create(resource_class, params_hash, included_index)
-        custom = resource_class.sidepost_create(params: params_hash, controller: @controller)
-        return nil unless custom
-
-        raise ValidationError.new(record: custom, included_index: included_index) unless custom.persisted?
-
-        custom
-      end
-
-      def create_record_default(model_class, params_hash, attachments, resource_class, included_index)
-        record = model_class.new(params_hash)
-        @controller.send(:authorize_resource_action!, record, action: :create)
-        @controller.send(:attach_active_storage_files, record, attachments, resource_class: resource_class)
-        raise ValidationError.new(record: record, included_index: included_index) unless record.save
-
-        record
-      end
-
-      def resource_class_for(type)
-        namespace = @controller.instance_variable_get(:@jsonapi_namespace)
-        ResourceLoader.find(type, namespace: namespace)
-      end
-
-      def prepare_create_params_for_item(item, model_class, _resource_class)
-        hash = Deserializer.new(item, model_class: model_class, action: :create).to_model_attributes
-        attachments = @controller.send(:extract_active_storage_params_from_hash, hash, model_class)
-        attachments.each_key { |k| hash.delete(k.to_s) }
-        hash.delete("type")
-        hash.delete(:type)
-        apply_sti_type(model_class, hash) if sti_base_with_type_column?(model_class)
-        [hash, attachments]
-      end
-
-      def apply_sti_type(klass, params)
-        return unless sti_base_with_type_column?(klass)
-
-        params["type"] = klass.name
-      end
-
-      def sti_base_with_type_column?(klass)
-        klass.respond_to?(:base_class) && klass.base_class == klass && klass.column_names.include?("type")
-      end
-    end
-  end
-end