(Automatically) Convert empty association properties for SAVE_REPLACE compatibility?

[ndm2]

This is a (multiple allowed):

• bug
• enhancement
• feature-discussion (RFC)

---

Let's say we have a form that supports adding/removing hasMany/belongsToMany associated records that are using the SAVE_REPLACE save strategy.

$this->Form->input('parent_field');
$this->Form->input('association.0.field');
$this->Form->input('association.1.field');
$this->Form->input('association.2.field');
// ...

When removing for example association.2.field, the saving process would delete the record accordingly. When however removing all of them, so that we'd be left with only

$this->Form->input('parent_field');

then the association property wouldn't be affected anymore at all, and nothing would change, ie the records wouldn't be deleted.

To workaround that one have to do something like adding a hidden field with the name of the association property, and check that before marshalling and replace it with an empty array accordingly, like for example

$this->Form->input('parent_field');
$this->Form->hidden('association', ['value' => '']);
$this->Form->input('association.0.field');
$this->Form->input('association.1.field');
$this->Form->input('association.2.field');
// ...

public function beforeMarshal(Event $event, \ArrayObject $data, \ArrayObject $options)
{
    if (isset($data['association']) && $data['association'] === '') {
        $data['association'] = [];
    }
}

That way all records would be deleted properly when none of the association.*.field inputs would be submitted.

I'm wondering if this is something that may fit in the core? Maybe as an optional behavior that can be enabled via the associated option?

[markstory]

Making an empty string replace the association with an empty list sounds like a reasonable default behavior to me.

[lorenzo]

Could this be used in a malicious way? Or could it be a surprise for users to discover that there is a way to delete all associated records from a form?

[markstory]

@lorenzo Good point. It could be used for bad purposes.

[ndm2]

I was a little worried too at first, hence the suggestion to make this optional, but the more I think about it, the less concerned I am. By default users are currently able to delete all but one record, so I'd say that one record more doesn't really make a difference.

I'd think that if developers use the replace save strategy, then they usually want exactly that to be possible. If they don't want users to be able to remove associated records via a form depending on the current context, then they would have to implement additional measures anyways, like switching to the append strategy, or better yet the other way around, enable the replace strategy only where explicitly required.

[markstory]

@ndm2 It sounds like the kind of change that would have to go into 3.x.0 as to not surprise people.

[lorenzo]

You have a point in that today all records but one can be removed

[lorenzo]

If your were presented with an external API you need to use, and it required require sending an empty string instead of an array, like in every other case, what would you think of such API?

[inoas]

Can't this be fixed at the controller/table level with an option flag (e.g. declared within action code)?

[markstory]

@lorenzo In an API context couldn't you push an empty list?

[ndm2]

@lorenzo I wouldn't like that, but as @markstory mentioned, an API may be be able to receive data in a different format that can properly represent empty list structures, like for example JSON. In a form data context there is no way to send an empty list, so I'd say an empty string is the next best thing.

[inoas]

... or maybe 'false'?
Edit:

$this->Form->hidden('association', ['value' => 'false']);
// e.g:
$this->Form->hidden('Roles', ['value' => 'false']);

[ndm2]

@inoas Looks a little akward as it's very different to how to usually pass empty values in a form context, and I could easily see people pass the value in an unquoted fashion by accident, but generally something like that would work too of course.

I don't think there's any perfect solution, so I'd personally tend to simply use whatever is the least error prone, most intuitive, and easiest to remember.

[inoas]

I bet ['value' => false] will render as "value = "0" (untested). If it renders like "value" => "false" then that's okay...

[markstory]

['value' => false] will turn into value='' in HTML.

[lorenzo]

@markstory can you put an empty list using form-data as a content type?

[markstory]

@lorenzo I don't think that is possible article[comments]= makes a string while article[comments][]= makes a list with 1 element of '' in it.

[lorenzo]

I see, then accepting the empty string makes sense

[ndm2]

Finally a little time to get some stuff off of my todo list... I had a a look into this again, and after implementing it in the marshaller, I've noticed that BelongsToMany associations already have that behavior built in on association level 😑

So I guess similar could simply go into HasMany as well (instead of doing this in the marshaller)?

@lorenzo @markstory (just in case, not sure if anyone's still subscribed after felt 12 1/2 years)

[markstory]

Making HasMany and BelongsToMany association classes work similarly sounds like a good idea to me.

[ndm2]

Closing as the enhancement has been merged.