jpie 3.8.3 → 3.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5fee8d7ae2ce0016c8c6b1d0740cf9448d7b932c9d71fc0f74a553ae5bd15d17
-  data.tar.gz: 8d8151d6323ad4c3538abb0bb95f23347162d047006af7c9e7d03da638d4f955
+  metadata.gz: 637098cfaf33f60d61c1669573a007686467f5218a1b20aff8701886b3fa79d5
+  data.tar.gz: 95e995bb47caddc5f3ae867b0e4d3aa2b5fb2de9f40225bba36a7edb527b62b0
 SHA512:
-  metadata.gz: e8e86875e6b6c582640e9f7c03355a8dd271ecab3c1e96186a304f0927b28cccda7fb5009f013b37bf0bd5c778c280e29a03b765033c2e7fe1babba2bd24576a
-  data.tar.gz: 44feac1f5b20d4cb6c95f05773e06fefedb7cea9b254fb55a98af26a0b58f5dec60dae425f55bda8c10185f57099c7bd2450729a940c7a31eab8636acbdc1348
+  metadata.gz: ccbdca591a2dcd1a6745f72beb4f477777ac96bfbbf0f3973c56bb4d2f7e63ebecc4bd20feab45d345e887a4d2903aa97c2bce3efa30a36f26403d771311d3fb
+  data.tar.gz: 3a6f363d40e998ce65c9805ed06fcf7a2fea1b5e2aac13fd14360f0b8250937b9a00302b230e2a2931d32b8991e55ffdfd93c779cc3534f54f7ed06a1e0755bf

data/.claude/skills/root-cause-analysis/SKILL.md

@@ -42,6 +42,12 @@ Gather facts before concluding. Prefer:
 
 Do not rely on assumptions. Evidence supports or refutes hypotheses.
 
+**Bind the error to the incident by identity, not by proximity.** An error in the same account, the same minute, the same job class, or the same feature area is NOT evidence that it caused the reported failure. Busy systems fire several unrelated errors in one window. Prove the link with a record identity that both sides share — the job arguments, the record GID, the message id, the request id. Sentry event details carry `job_arguments` and `extra`; open them and read the ids. If no shared id ties the error to the records the user named, you have a co-occurring error, not the cause.
+
+Search the failure's exact time window for EVERY error, not just the ones that match your first idea. Then pick the one whose arguments name the user's records. A narrow search that starts from a suspected culprit returns that culprit and hides the real one.
+
+**When the user's evidence contradicts your diagnosis, re-run the search.** Do not restate the theory in better words. Their report of what actually happened outranks your reading of the code. Treat the contradiction as a failed hypothesis and go back to evidence gathering.
+
 ## Methodology and verification
 
 - **5 Whys:** State the problem; ask "why?" repeatedly until you reach a cause you can fix. **Verify:** Would fixing this prevent the issue? If not, keep investigating.
@@ -55,6 +61,10 @@ Do not rely on assumptions. Evidence supports or refutes hypotheses.
 | "Let me try this quick fix" | You do not understand the cause |
 | "Maybe if I add a guard here" | Guessing, not debugging |
 | "Let me try a few things" | Random changes waste time |
+| "This error is in the same account and the same minute, so it is the one" | Co-occurrence is not causation; match a record id before you believe it |
+| "The related error is in the same job class / feature, close enough" | Same area is not same incident; open the event's arguments and match the ids |
+| "The user says it still fails, let me explain why my fix is right" | Their evidence beat your theory; re-run the search instead of defending |
+| "I found an error that fits my theory, stop searching" | Search the whole time window; a narrow search only confirms what you assumed |
 
 When you notice these, stop and run through problem definition, evidence, and one hypothesis at a time.
 

data/.cursor/agents/systematic-debugging.md

@@ -20,6 +20,7 @@ Do not recommend changing code just to pass specs, or changing specs just to mak
 - Review recent changes (git log, options, caller expectations).
 - Gather evidence (params, include, serializer path, input data).
 - Trace backwards from the failure to where correct behaviour diverges.
+- Bind each error you find to the reported incident by a shared record id (job arguments, record GID, message id, request id) — same account, same minute, or same feature is proximity, not proof. Search the whole failure window, not only what matches your first idea.
 
 ### Phase 2: Pattern analysis
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    jpie (3.8.3)
+    jpie (3.10.0)
       actionpack (~> 8.1, >= 8.1.0)
       pg_query (>= 4)
       prosopite (>= 1)

data/lib/json_api/controllers/concerns/resource_actions/crud_helpers.rb

@@ -70,13 +70,16 @@ module JSONAPI
       end
 
       def determine_sti_class
-        JSONAPI::ResourceLoader.find(jsonapi_type || resource_type).model_class
+        JSONAPI::ResourceLoader.find(jsonapi_type || resource_type, namespace: jsonapi_namespace).model_class
       rescue JSONAPI::ResourceLoader::MissingResourceClass
         model_class
       end
 
+      # The namespace decides which resource defines the writable fields. Resolving the
+      # type alone returns the flat resource, so a namespaced endpoint over a flat model
+      # would accept every field the flat resource allows.
       def determine_sti_resource_class
-        JSONAPI::ResourceLoader.find(jsonapi_type || resource_type)
+        JSONAPI::ResourceLoader.find(jsonapi_type || resource_type, namespace: jsonapi_namespace)
       rescue JSONAPI::ResourceLoader::MissingResourceClass
         @resource_class
       end

data/lib/json_api/controllers/concerns/resource_actions/serialization.rb

@@ -8,6 +8,11 @@ module JSONAPI
 
       def serialize_resource(resource)
         includes = parse_include_param
+        # On show and update the record arrives through `load_resource_record`, which loaded
+        # the include tree via `scope_with_includes`. Each included resource's own `records`
+        # preloads still have to be applied, or every included record pays them one query at
+        # a time. On create the tree is unloaded, so this finds no targets and does nothing.
+        preload_included_resource_associations([resource], includes)
         cache = build_include_filter_cache([resource], includes)
         serializer = JSONAPI::Serializer.new(resource, authorization_context: self, include_filter_cache: cache,
                                                        namespace: jsonapi_namespace,)

data/lib/json_api/serialization/concerns/includes_serialization.rb

@@ -111,8 +111,14 @@ module JSONAPI
         handler.call(controller: authorization_context, scope:, action: :index, model_class:)
       end
 
+      # An attachment reaches the serializer as loaded blobs, never as a relation, so it
+      # takes the same route as any other loaded association: the filter cache applies the
+      # configured authorization_scope for ActiveStorage::Blob. Without it an attachment
+      # sideload carried no authorization of its own.
       def get_active_storage_records(current_record, association_name)
-        JSONAPI::ActiveStorage::Serialization.blobs_for(association_name, current_record)
+        blobs = JSONAPI::ActiveStorage::Serialization.blobs_for(association_name, current_record)
+
+        include_filter_cache.filter(blobs, ::ActiveStorage::Blob)
       end
 
       def serialize_and_process_record(related_record, path_to_record, ctx, parent_record: nil, association_name: nil)

data/lib/json_api/serialization/concerns/relationship_processing.rb

@@ -20,6 +20,23 @@ module JSONAPI
 
       private
 
+      # A belongs_to may name a key that does not match the association
+      # (belongs_to :author, foreign_key: "user_id"), so ask the reflection.
+      def association_foreign_key(association_name, param_name)
+        belongs_to_reflection(association_name)&.foreign_key&.to_s || "#{param_name}_id"
+      end
+
+      def association_foreign_type(association_name, param_name)
+        belongs_to_reflection(association_name)&.foreign_type&.to_s || "#{param_name}_type"
+      end
+
+      def belongs_to_reflection(association_name)
+        return nil unless @model_class
+
+        association = @model_class.reflect_on_association(association_name.to_sym)
+        association if association&.belongs_to?
+      end
+
       def normalize_relationship_value(value)
         ParamHelpers.ensure_object!(value, "relationship")
       end
@@ -32,8 +49,10 @@ module JSONAPI
         if active_storage_attachment?(association_name)
           attrs[association_name.to_s] = nil
         else
-          attrs["#{param_name}_id"] = nil
-          attrs["#{param_name}_type"] = nil if polymorphic_association?(association_name)
+          attrs[association_foreign_key(association_name, param_name)] = nil
+          if polymorphic_association?(association_name)
+            attrs[association_foreign_type(association_name, param_name)] = nil
+          end
         end
       end
 
@@ -61,26 +80,29 @@ module JSONAPI
 
       def process_to_many_relationship(attrs, association_name, param_name, data)
         ids = data.map { |r| extract_id(r) }
-        types = data.map { |r| extract_type(r) }
 
-        if types.any? && self.class.active_storage_blob_type?(types.first)
+        # An attachment must take the attachment path whether or not the client sends a
+        # `type`. JSON:API requires a resource identifier to carry `type` and `id`, so
+        # routing on the association itself keeps the spec-compliant payload working
+        # instead of falling through to the `<rel>_ids=` setter, which an attachment lacks.
+        if active_storage_attachment?(association_name)
           process_active_storage_attachment(attrs, association_name, ids, singular: false)
           return
         end
 
+        types = data.map { |r| extract_type(r) }
         validate_relationship_type(association_name, types.first) unless polymorphic_association?(association_name)
         attrs["#{param_name.singularize}_ids"] = ids
       end
 
       def process_to_one_relationship(attrs, association_name, param_name, data)
         id = extract_id(data)
-        type = extract_type(data)
 
-        if self.class.active_storage_blob_type?(type)
+        if active_storage_attachment?(association_name)
           return process_active_storage_attachment(attrs, association_name, id, singular: true)
         end
 
-        process_regular_to_one_relationship(attrs, association_name, param_name, id, type)
+        process_regular_to_one_relationship(attrs, association_name, param_name, id, extract_type(data))
       end
 
       def process_regular_to_one_relationship(attrs, association_name, param_name, id, type)
@@ -93,8 +115,8 @@ module JSONAPI
 
       def process_polymorphic_relationship(attrs, association_name, param_name, id, type)
         class_name = validate_and_get_class_name(type, association_name)
-        attrs["#{param_name}_id"] = id
-        attrs["#{param_name}_type"] = class_name
+        attrs[association_foreign_key(association_name, param_name)] = id
+        attrs[association_foreign_type(association_name, param_name)] = class_name
       end
 
       def validate_and_get_class_name(type, association_name)
@@ -109,7 +131,7 @@ module JSONAPI
 
       def process_non_polymorphic_relationship(attrs, association_name, param_name, id, type)
         validate_relationship_type(association_name, type)
-        attrs["#{param_name}_id"] = id
+        attrs[association_foreign_key(association_name, param_name)] = id
       end
     end
   end

data/lib/json_api/serialization/concerns/relationships_serialization.rb

@@ -45,14 +45,19 @@ module JSONAPI
         relationships[association_name] = result
       end
 
+      # Linkage carries a type and an id, so reading the association directly
+      # leaks the identity of a record the related endpoint denies — the same
+      # bypass the `included` section closes, with a narrower payload. Both
+      # sections resolve through one authorized read, so they always describe
+      # the same set, and the request-scoped filter cache means the second
+      # reader vets nothing the first already vetted.
       def serialize_relationship_data(association)
-        related = record.public_send(association.name)
+        related = get_association_records(record, association.name)
 
-        if association.collection?
-          serialize_collection_relationship(related, association)
-        elsif related
-          serialize_single_relationship(related, association)
-        end
+        return serialize_collection_relationship(related, association) if association.collection?
+
+        first = related.first
+        serialize_single_relationship(first, association) if first
       end
 
       def serialize_collection_relationship(related, association)

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "3.8.3"
+  VERSION = "3.10.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 3.8.3
+  version: 3.10.0
 platform: ruby
 authors:
 - Emil Kampp
@@ -222,7 +222,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.7.2
 specification_version: 4
 summary: JSON:API compliant Rails gem for producing and consuming JSON:API resources
 test_files: []