json_api_client 1.10.0 → 1.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8dc5a38f2bde33b9912837c82fa1fe5c9ef41c80
-  data.tar.gz: e8a926c76a1198ec9cf720fae46335e12f2c54fc
+  metadata.gz: 6fd62267b74acfe53f89ff0c7ef23db0b69fd294
+  data.tar.gz: 2139b42adda0d08e98de593576ae8701b35e40df
 SHA512:
-  metadata.gz: 5d346d1b746c28b381e77a5842403808377f924feacce7d57f5f8d7ce9df4e9ccff8312a39e2313c0babc31965860e0af3c1b66648df60923af35cd2148467ad
-  data.tar.gz: 1951d5ea9ff1879cebd7f1c1fbafd25f752e2adbbdfd2f636231b23e4d16e8c282def341a5a368f282f64308c596388dc1a2eb58676bec90f3677254100aa006
+  metadata.gz: bc06232298c783d5639df475dad7cdca160df99feb32c57dbba9dbd60132b29f057f8307397fe11053f2559bfe4fb3a3aa3826c3a3b343c76784884d2a87fc2d
+  data.tar.gz: 8bfe1faeb6d342fd9a9269efae3d2cb2ba13ad8615018c1546c0f45ac135e21a23d86dc02e6821135b32b672058087df018b0ddda9b0e654e31e0e62645584b8

data/README.md

@@ -52,14 +52,14 @@ u.update_attributes(
   c: "d"
 )
 
-u.persisted? 
+u.persisted?
 # => true
 
 u.destroy
 
-u.destroyed? 
+u.destroyed?
 # => true
-u.persisted? 
+u.persisted?
 # => false
 
 u = MyApi::Person.create(
@@ -164,7 +164,7 @@ module MyApi
   class Account < JsonApiClient::Resource
     belongs_to :user
   end
-  
+
   class Customer < JsonApiClient::Resource
       belongs_to :user, shallow_path: true
     end
@@ -476,7 +476,7 @@ end
 
 ##### Custom status handler
 
-You can change handling of response status using `connection_options`. For example you can override 400 status handling. 
+You can change handling of response status using `connection_options`. For example you can override 400 status handling.
 By default it raises `JsonApiClient::Errors::ClientError` but you can skip exception if you want to process errors from the server.
 You need to provide a `proc` which should call `throw(:handled)` default handler for this status should be skipped.
 ```ruby
@@ -636,6 +636,37 @@ end
 
 ```
 
+### Safe singular resource fetching
+
+That is a bit curios, but `json_api_client` returns an array from `.find` method, always.
+The history of this fact was discussed [here](https://github.com/JsonApiClient/json_api_client/issues/75)
+
+So, when we searching for a single resource by primary key, we typically write the things like
+
+```ruby
+admin = User.find(id).first
+```
+
+The next thing which we need to notice - `json_api_client` will just interpolate the incoming `.find` param to the end of API URL, just like that:
+
+> http://somehost/api/v1/users/{id}
+
+What will happen if we pass the blank id (nil or empty string) to the `.find` method then?.. Yeah, `json_api_client` will try to call the INDEX API endpoint instead of SHOW one:
+
+> http://somehost/api/v1/users/
+
+Lets sum all together - in case if `id` comes blank (from CGI for instance), we can silently receive the `admin` variable equal to some existing resource, with all the consequences.
+
+Even worse, `admin` variable can equal to *random* resource, depends on ordering applied by INDEX endpoint.
+
+If you prefer to get `JsonApiClient::Errors::NotFound` raised, please define in your base Resource class:
+
+```ruby
+class Resource < JsonApiClient::Resource
+  self.raise_on_blank_find_param = true
+end
+```
+
 ## Contributing
 
 Contributions are welcome! Please fork this repo and send a pull request. Your pull request should have:

data/lib/json_api_client/query/builder.rb

@@ -86,11 +86,15 @@ module JsonApiClient
       end
 
       def to_a
-        @to_a ||= find
+        @to_a ||= _fetch
       end
       alias all to_a
 
       def find(args = {})
+        if klass.raise_on_blank_find_param && args.blank?
+          raise Errors::NotFound, 'blank .find param'
+        end
+
         case args
         when Hash
           scope = where(args)
@@ -98,13 +102,19 @@ module JsonApiClient
           scope = _new_scope( primary_key: args )
         end
 
-        klass.requestor.get(scope.params)
+        scope._fetch
       end
 
       def method_missing(method_name, *args, &block)
         to_a.send(method_name, *args, &block)
       end
 
+      protected
+
+      def _fetch
+        klass.requestor.get(params)
+      end
+
       private
 
       def _new_scope( opts = {} )

data/lib/json_api_client/resource.rb

@@ -36,6 +36,7 @@ module JsonApiClient
                     :keep_request_params,
                     :search_included_in_result_set,
                     :custom_type_to_class,
+                    :raise_on_blank_find_param,
                     instance_accessor: false
     class_attribute :add_defaults_to_changes,
                     instance_writer: false
@@ -54,6 +55,7 @@ module JsonApiClient
     self.add_defaults_to_changes = false
     self.search_included_in_result_set = false
     self.custom_type_to_class = {}
+    self.raise_on_blank_find_param = false
 
     #:underscored_key, :camelized_key, :dasherized_key, or custom
     self.json_key_format = :underscored_key

data/lib/json_api_client/version.rb

@@ -1,3 +1,3 @@
 module JsonApiClient
-  VERSION = "1.10.0"
+  VERSION = "1.11.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: json_api_client
 version: !ruby/object:Gem::Version
-  version: 1.10.0
+  version: 1.11.0
 platform: ruby
 authors:
 - Jeff Ching
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-05-20 00:00:00.000000000 Z
+date: 2019-05-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport