mrevutskyi / flask-restless-ng

A Flask extension for creating simple ReSTful JSON APIs from SQLAlchemy models.
https://flask-restless-ng.readthedocs.io
Other
64 stars 11 forks source link

Attributes with the name 'type' are not allowed #31

Closed velosomarcus closed 2 years ago

velosomarcus commented 2 years ago

Let's say we have this table:

class Person(db.Model): id = db.Column(db.Integer, primary_key=True) type = db.Column(db.Unicode, nullable=False) name = db.Column(db.Unicode)

And then we try to insert a new row using this payload:

payload = {'data': {'type': 'person', 'attributes': {'type': 'This value will be replaced by null by the Restless api during the post', 'name': 'Testing'}}} url = 'http://locahost/api/person' req = requests.post(url, data=json.dumps(payload), headers=HEADERS)

Then we got the error below: {"errors": [{"code": null, "detail": "(psycopg2.errors.NotNullViolation) null value in column \"type\" of relation \"person\" violates not-null constraint\nDETAIL: Failing row contains (1, null, Testing) ...

mrevutskyi commented 2 years ago

They are not allowed by JSON API specification

https://jsonapi.org/format/#document-resource-object-fields

Fields for a resource object MUST share a common namespace with each other and with type and id. 
In other `words,` a resource can not have an attribute and relationship with the same name,
nor can it have an attribute or relationship named type or id

What we can do, is to throw 400 when such payload is received

velosomarcus commented 2 years ago

Thanks for the clarification

mrevutskyi commented 2 years ago

I've changed the code so it does not erase type from attributes (even though technically it is not allowed by JSON API). Please try version 2.2.9 I the next major release this will probably return a 400