Operations constrained by controller generation?

[bjornharrtell]

SUMMARY

AFAIK atomic operations are constrained by what controller generation allows. So, if I only generate contollers for Query, the operations will not allow any add/update/remove.

I wonder if that is intentional? In my mind it would make sense to decouple because it can make sense to enforce resource API to be Query only and mandate atomic operations for add/update/remove.

VERSIONS USED

• JsonApiDotNetCore version: 5.8.1
• ASP.NET Core version: 8.0
• Entity Framework Core version: 8.0
• Database provider: PostgreSQL

[bkoelman]

Yes, that's intentional. When a developer expresses to expose only a subset of endpoints, it could be considered a security vulnerability when unpermitted changes are still possible via the operations endpoint.

You can achieve what you want by registering IAtomicOperationFilter.AlwaysEnabled, or your own IAtomicOperationFilter implementation if you need more fine-grained control.

It's not wrong to require all changes to be done through operations, but it wouldn't be a good default because there are various factors to consider:

• The operations endpoint wraps all database access in a transaction, which has a performance cost. The guarantees and costs depend on the isolation level, which can be customized via options.TransactionIsolationLevel. Resource/relationship post/patch/delete endpoints are only transactional when changes are saved. The difference with operations is that reads occur outside of a transaction.
• Being a framework, we intend to expose the features of JSON:API, so that developers can choose which bits to use.
• It may be counterproductive to enforce the use of operations in a public API. External consumers may use all kinds of client libraries, and because atomic:operations is an extension to the JSON:API spec, most third-party clients don't support it.

[bjornharrtell]

Thanks @bkoelman, I agree with your arguments and IAtomicOperationFilter.AlwaysEnabled was exactly what I was looking for. I will see if I can provide a PR with additions to the docs to clarify the default and the filter extension point.

[bkoelman]

A docs update would be welcome. There's a similar filter for non-operations.