Relationship routes are created without adding them in the routes.rb

[xdmx]

I've defined the following Resource:

class CommentResource < BaseResource
      has_one :activity
      has_one :user
end

 class ActivityResource < BaseResource
      has_many :comments
end

jsonapi_resources :activities, only: %w(index show)
jsonapi_resources :comments, only: %w(create destroy index show)

And checking with rake routes I see that it also created all the relationship/related routes for both Activity and Comment even if I haven't added jsonapi_links / jsonapi_related_resources in the routes file

[lgebhardt]

By default all the nested routes are created. If you want control of the nested routes that are created you should use a block for jsonapi_resources. See https://github.com/cerebris/jsonapi-resources#nested-routes

[xdmx]

I feel like a noob, even if I read the whole readme twice 😭

I've noticed that even if the relationship routes are not created, the json response still includes them:

{
  "data": {
    "id": "908005740",
    "type": "comments",
    "links": {
      "self": "http://example.org/api/v2/comments/908005740"
    },
    "attributes": {
      "body": "You rock!",
      "created_at": "2015-08-06T15:57:33.401Z"
    },
    "relationships": {
      "activity": {
        "links": {
          "self": "http://example.org/api/v2/comments/908005740/relationships/activity",
          "related": "http://example.org/api/v2/comments/908005740/activity"
        }
      },
      "user": {
        "links": {
          "self": "http://example.org/api/v2/comments/908005740/relationships/user",
          "related": "http://example.org/api/v2/comments/908005740/user"
        }
      }
    }
  }
}

And this causes to have broken links on the relationships /api/v2/comments/908005740/relationships/activity and /api/v2/comments/908005740/activity are broken

[lgebhardt]

@xdmx Yes, the routes are not tied to the serialization and links generation code. That's an oversight we should get fixed. I'll see if I can come up with a decent solution.

[oliverbarnes]

@lgebhardt how about defaulting to flat uris to the relationship resources instead of the nested ones? this would have less of a chance of pointing to inexistent routes.

of course, I'm plugging my own need here - I'm actually about to override the relationship uri building because I prefer the api to be as flat as possible. Less potential headaches, imo

[oliverbarnes]

btw, is it possible to generate these default relationship routes if one isn't using the jsonapi_resources helper? I've been including ActsAsResourceController into my controllers to be able to do things like declaring a before_action before loading JR:

class ResourceController < ApplicationController
  rescue_from Forbidden, with: :forbidden_response

  before_action :authenticate!, except: [:index, :show]

  include JSONAPI::ActsAsResourceController

  def create_operations_processor
    TempMongoidOperationsProcessor.new
  end

  def context
    { current_participant: current_participant }
  end
end

[oliverbarnes]

Nevermind, managed to use the route helpers in the end. I wrongly assumed they wouldn't work unless the controllers extended the resource controller (instead of including the module), but they do. About the flat uris, it sounds like they'd be possible for the related link, but self should point to an endpoint for managing the relationship itself, something I just grasped about te spec. So even if related is flat, self needs to be nested, so not sure if there's any gain in making the former flat.

[oliverbarnes]

Maybe using something like Rails.application.routes.recognize_path in the serializer could help with this integration between serializers and routes? (sorry for the multiple comments, btw. convoluted thought process lol)

[stevenharman]

routes are not tied to the serialization and links generation code. That's an oversight we should get fixed.

@lgebhardt I realized it's been... a while. But has that changed at all? In particular, it seems OK that the self link is there (e.g., "self": "http://example.org/api/v2/comments/908005740/relationships/activity") b/c it's implemented by default. But the related link (e.g., "related": "http://example.org/api/v2/comments/908005740/activity") isn't, and is thus broken.

[eslamodeh]

Destroy relationships URL exposed as well!

This is quite dangerous if not authenticated properly, a user can delate relationships associations through this.

Ex:

rails routes | grep v3 | grep DELETE

DELETE    /api/v3/services/:service_id/relationships/service_forms(.:format)                                                                                                   api/v3/services#destroy_relationship {relationship: "service_forms"}

module Api
  module V3
    class ServiceResource < ApplicationResource
      attributes :name, :slug, :domain

      has_many :service_forms
    end
  end
end