Alternate solution for raising `JSONAPI::Exceptions::InvalidFieldValue` in `replace_fields`? about jsonapi-resources HOT 5 OPEN

I've been running into this question of authorization a bit with some of my own applications as well.

However, I think authorization squarely lies in the responsibilities of the controller and not at the model/resource level. Thus, I subclass the JSONAPI::ResourceController and make sure it does the short-circuiting.

This duplicates the efforts a little bit when policies are model-dependent, i.e. "This model can only be seen if the current user was the author." This results in issuing a find request twice, but I find that's acceptable tradeoff when it comes to code cleanliness.

Here's a little example:

class ModelController < JSONAPI::ResourceController
  def show
    keys = parse_key_array(params[resource_klass._primary_key])

    resources = if keys.length > 1
                  resource_klass.find_by_keys(keys, context: context)
                else
                  resource_klass.find_by_key(keys[0], context: context)
                end

    Array(resources).each do |resource|
      unless resource.user == current_user
        # Raise your 403
      end
    end

    super
  rescue => e
    handle_exceptions(e)
  end 
end

from jsonapi-resources.

I don't see the resource being as coupled to the model as you do, and I also don't think your proposed solution works for the other actions (create, update...).

Am I missing something? How do you handle the authorization of create and update actions using your approach?

from jsonapi-resources.

@barelyknown, I don't fully understand your business case. However I think it sounds like an issue if the after action callbacks aren't being called in the event of an error. So I'd be interested in a change that allows them to be called and have access to the errors collection. I haven't looked into what that would take, and what else will be affected.

from jsonapi-resources.

What about adding an error to the errors collection when ArgumentError is raised because of an invalid enum instead of raising JSONAPI::Exceptions::InvalidFieldValue?

from jsonapi-resources.

@barelyknown, I think that sounds good. It should probably be treated more like a validation error.

from jsonapi-resources.