Extracting the loading of source and related resources in controller actions about jsonapi-resources HOT 4 CLOSED

@barelyknown would it be possible for you to use the records method on the resource to apply the permission check? That's how I'm doing things in my code and it seems to work well. We're taking the approach that if a user doesn't have permission to see a record then they get a 404, even if the record exists. That may not work for you of course. But it does keep the logic more tightly confined to the resource.

If that doesn't work for you I'm not at all opposed to splitting up the controller methods as you proposed. It could DRY it up a bit either way.

from jsonapi-resources.

I'm using the same approach, but that doesn't work for the get_related_resource action because the records method loads the source resource, not the related resource(s).

from jsonapi-resources.

Good catch! In Resource._associate we could add a method similar to records for each association. Then the same approach could be used. I think that could work, but my mind's a bit tired now, so no promises.

from jsonapi-resources.

I was tired last night too!, but I thought about it more this morning and liked your suggestion. The PR implements that approach.

from jsonapi-resources.