ash-project / ash_json_api

The JSON:API extension for the Ash Framework
https://hexdocs.pm/ash_json_api
MIT License
55 stars 41 forks source link

JSON:API spec compliance when creating resources - The resource object MUST contain at least a type member. #164

Open sevenseacat opened 1 month ago

sevenseacat commented 1 month ago

Describe the bug

From: https://jsonapi.org/format/#crud-creating

A resource can be created by sending a POST request to a URL that represents a collection of resources. The request MUST include a single resource object as primary data. The resource object MUST contain at least a type member.

Something small I noticed - we don't require that the type member is present in the request.

We do validate it if it is present (empty/invalid values return an error) but if it's omitted, records can still be created.

Screenshot 2024-06-12 at 6 19 11 PM

To Reproduce

A json_api config and :

  json_api do
    type "artist"

    routes do
      base "/artists"

      post :create
    end
  end

  actions do
    create :create do
      accept [:name, :biography]
      change relate_actor(:created_by, allow_nil?: true)
      change relate_actor(:updated_by, allow_nil?: true)
    end
  end

Expected behavior

For full compliance with the spec, an error should also be returned if the type is not provided as part of the data hash. This would probably be a breaking change even though it's to add compliance 🤔

Runtime

zachdaniel commented 1 month ago

Yeah, realistically it's not something we can change now unless we put it behind some kind of strict flag. I wouldn't be opposed to that. In general we always know the type of something at all times, so it would only be for spec compliance not for anything that we need.