jpie 3.9.0 → 3.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f3af561d7afa748d2a1095a6b3c83fe8ab42b12a6fb88655f67c023e72779ba
-  data.tar.gz: ea3c315885d7b2ae18f328bb6659c796e64e82b62b87ae479fd7d3faa0ef4f09
+  metadata.gz: 637098cfaf33f60d61c1669573a007686467f5218a1b20aff8701886b3fa79d5
+  data.tar.gz: 95e995bb47caddc5f3ae867b0e4d3aa2b5fb2de9f40225bba36a7edb527b62b0
 SHA512:
-  metadata.gz: edd52e432cec91efbd1487ebb8ad340fbe560879415ae6af400290b68e5c5bfa3db6f7afd967077bbf6a5509992329b412f865af88db19f80accadb8903f44e5
-  data.tar.gz: 1f9854c359c421410f19645ae03659137059e92f8bc88a1b52b3e79ac2906abe5747c859a46ed02a312ba8ab37e7f661fbce1c16e42a2a29e73e5446122889b1
+  metadata.gz: ccbdca591a2dcd1a6745f72beb4f477777ac96bfbbf0f3973c56bb4d2f7e63ebecc4bd20feab45d345e887a4d2903aa97c2bce3efa30a36f26403d771311d3fb
+  data.tar.gz: 3a6f363d40e998ce65c9805ed06fcf7a2fea1b5e2aac13fd14360f0b8250937b9a00302b230e2a2931d32b8991e55ffdfd93c779cc3534f54f7ed06a1e0755bf

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    jpie (3.9.0)
+    jpie (3.10.0)
       actionpack (~> 8.1, >= 8.1.0)
       pg_query (>= 4)
       prosopite (>= 1)

data/lib/json_api/controllers/concerns/resource_actions/crud_helpers.rb

@@ -70,13 +70,16 @@ module JSONAPI
       end
 
       def determine_sti_class
-        JSONAPI::ResourceLoader.find(jsonapi_type || resource_type).model_class
+        JSONAPI::ResourceLoader.find(jsonapi_type || resource_type, namespace: jsonapi_namespace).model_class
       rescue JSONAPI::ResourceLoader::MissingResourceClass
         model_class
       end
 
+      # The namespace decides which resource defines the writable fields. Resolving the
+      # type alone returns the flat resource, so a namespaced endpoint over a flat model
+      # would accept every field the flat resource allows.
       def determine_sti_resource_class
-        JSONAPI::ResourceLoader.find(jsonapi_type || resource_type)
+        JSONAPI::ResourceLoader.find(jsonapi_type || resource_type, namespace: jsonapi_namespace)
       rescue JSONAPI::ResourceLoader::MissingResourceClass
         @resource_class
       end

data/lib/json_api/controllers/concerns/resource_actions/serialization.rb

@@ -8,6 +8,11 @@ module JSONAPI
 
       def serialize_resource(resource)
         includes = parse_include_param
+        # On show and update the record arrives through `load_resource_record`, which loaded
+        # the include tree via `scope_with_includes`. Each included resource's own `records`
+        # preloads still have to be applied, or every included record pays them one query at
+        # a time. On create the tree is unloaded, so this finds no targets and does nothing.
+        preload_included_resource_associations([resource], includes)
         cache = build_include_filter_cache([resource], includes)
         serializer = JSONAPI::Serializer.new(resource, authorization_context: self, include_filter_cache: cache,
                                                        namespace: jsonapi_namespace,)

data/lib/json_api/serialization/concerns/includes_serialization.rb

@@ -111,8 +111,14 @@ module JSONAPI
         handler.call(controller: authorization_context, scope:, action: :index, model_class:)
       end
 
+      # An attachment reaches the serializer as loaded blobs, never as a relation, so it
+      # takes the same route as any other loaded association: the filter cache applies the
+      # configured authorization_scope for ActiveStorage::Blob. Without it an attachment
+      # sideload carried no authorization of its own.
       def get_active_storage_records(current_record, association_name)
-        JSONAPI::ActiveStorage::Serialization.blobs_for(association_name, current_record)
+        blobs = JSONAPI::ActiveStorage::Serialization.blobs_for(association_name, current_record)
+
+        include_filter_cache.filter(blobs, ::ActiveStorage::Blob)
       end
 
       def serialize_and_process_record(related_record, path_to_record, ctx, parent_record: nil, association_name: nil)

data/lib/json_api/serialization/concerns/relationship_processing.rb

@@ -20,6 +20,23 @@ module JSONAPI
 
       private
 
+      # A belongs_to may name a key that does not match the association
+      # (belongs_to :author, foreign_key: "user_id"), so ask the reflection.
+      def association_foreign_key(association_name, param_name)
+        belongs_to_reflection(association_name)&.foreign_key&.to_s || "#{param_name}_id"
+      end
+
+      def association_foreign_type(association_name, param_name)
+        belongs_to_reflection(association_name)&.foreign_type&.to_s || "#{param_name}_type"
+      end
+
+      def belongs_to_reflection(association_name)
+        return nil unless @model_class
+
+        association = @model_class.reflect_on_association(association_name.to_sym)
+        association if association&.belongs_to?
+      end
+
       def normalize_relationship_value(value)
         ParamHelpers.ensure_object!(value, "relationship")
       end
@@ -32,8 +49,10 @@ module JSONAPI
         if active_storage_attachment?(association_name)
           attrs[association_name.to_s] = nil
         else
-          attrs["#{param_name}_id"] = nil
-          attrs["#{param_name}_type"] = nil if polymorphic_association?(association_name)
+          attrs[association_foreign_key(association_name, param_name)] = nil
+          if polymorphic_association?(association_name)
+            attrs[association_foreign_type(association_name, param_name)] = nil
+          end
         end
       end
 
@@ -96,8 +115,8 @@ module JSONAPI
 
       def process_polymorphic_relationship(attrs, association_name, param_name, id, type)
         class_name = validate_and_get_class_name(type, association_name)
-        attrs["#{param_name}_id"] = id
-        attrs["#{param_name}_type"] = class_name
+        attrs[association_foreign_key(association_name, param_name)] = id
+        attrs[association_foreign_type(association_name, param_name)] = class_name
       end
 
       def validate_and_get_class_name(type, association_name)
@@ -112,7 +131,7 @@ module JSONAPI
 
       def process_non_polymorphic_relationship(attrs, association_name, param_name, id, type)
         validate_relationship_type(association_name, type)
-        attrs["#{param_name}_id"] = id
+        attrs[association_foreign_key(association_name, param_name)] = id
       end
     end
   end

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "3.9.0"
+  VERSION = "3.10.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 3.9.0
+  version: 3.10.0
 platform: ruby
 authors:
 - Emil Kampp