Filtering keys at serializer level

[oyeanuj]

Hi @yosiat, another question about an AMS as I analyze my code to estimate effort to migrate:

I use the following two patterns quite a bit to ensure the user gets data consistent with their level of authorization:

#1 Pattern: Utilizing the fact that AMS calls `filter` for each serializer

class PostSerializer < ActiveModel::Serializer
     # ..attributes comes here

	def filter(keys)
		if scope && scope.is_admin?
			keys
			
		else
			keys - [:draft, :created_at, :notes]

		end
	end
end

#2 Pattern: Using AMS `initialize` and `attributes` method

class PostSerializer < ActiveModel::Serializer

  #.. basic attributes come here

  def initialize(object, options = {})
		@owner = scope && (object.id == scope.id) ? true : false
		@logged_in = scope
		super(object, options)
	end

	def attributes(*args)
		return super if @owner
		if @logged_in
			attributes_to_remove = [
				:preview,
			]

		else
			attributes_to_remove = [
				:is_published
			]

		end
		filtered = super.except(*attributes_to_remove)
		filtered
	end
end

How can I achieve the same with Panko so that whenever Post Serializer is called, it renders appropriately?

Thank you!

[yosiat]

Hi @oyeanuj !

Overriding the attributes on the serializer level dynamically isn't possible with Panko, since Panko is designed to compute all of this before the "serialization loop", so while we are iterating the posts records we only read attributes & serialize them and don't do extra stuff (feel free to read more here - Design Choices - Figuring out the metadata, ahead of time).

The only way to achieve this is via only and except filters, but in order to not write repetitive code in each render method you can write something like this:

# In serializer definition create an helper method
# for returning the filters based of the given user
class PostSerializer < Panko::PostSerializer
  attributes :id, :title, :body, :draft

  self.filters_for_user(user)
    return { except: [:draft] } if user.is_admin?
    return {}
  end
end


# controller
class PostsController
  def index
    posts = Post.all

    serializer_options = { each_serializer: PostSerializer }
    serializer_options.merge! PostSerializer.filters_for_user(current_user)

    render json: Panko::ArraySerializer.new(posts, serializer_options).to_json
  end
end

Maybe in the future (near?) I'll make this a feature that will pass the context and maybe serialization_scope (#15 ) to this static filter method.

But for now, those this statisfy your requirements?

[oyeanuj]

@yosiat I think that might work but I am a little unclear about one thing - so, in the above solution that you recommended, when does Panko call this line in its processing -

    serializer_options.merge! PostSerializer.filters_for_user(current_user)

So, I did read the design choices again and my initial guess was the Pattern 1 I specified above might work well for Panko if it calls the filter function on the serializer always before it enters the serialization loop - by default, it would get all the attributes and methods back unless the user decided to edit out some. I assume I missing something in my understanding of the library since Iam unclear about the problematic part?

[yosiat]

@oyeanuj about when does Panko would call this -

    serializer_options.merge! PostSerializer.filters_for_user(current_user)

Currently, you will call this manually and on the next release of Panko, before running all filters and everything, Panko will check if you serializer have filters_for class method, if so, it will call it with context and in the near future, it will pass #15 serialization scope.

About the serialization loop, let me explain this further, Let's say we have ArraySerializer with 3,000 posts to serialize with PostSerializer, this is the flow to serialize it -

• First, we create serialization descriptor for this serializer - a serialization descriptor have all attributes, method attributes, associations for serializer, in order to create serialization descriptor we take the metadata of serializer and apply all the filters.
• Now, we enter the serialization loop - we have all the data we need to start serializing - we have attributes list filtered, and all we do is serializing the attributes.

In pseudo-code it looks like this:

def serialize(posts, serializer, options)
	# Build the descriptor based on options (only, except) and 
	# serializer metadata
	metadata = serializer.metadata
	descriptor = apply_filters(metadata, options)

	writer = create_json_writer

	# run the serialization loop
	posts.each do |post|
		descriptor.attributes.each do |attribute|
			value = get_value(post, attribute.name)
			writer.write(attribute.name, value)
		end
	end
end

Now, let's say the filters method is on the instance method, the code will look like this -

def serialize(posts, serializer, options)
	# Build the descriptor based on options (only, except) and 
	# serializer metadata
	metadata = serializer.metadata
	descriptor = apply_filters(metadata, options)

	writer = create_json_writer

	# run the serialization loop
	posts.each do |post|
		# ADDITION: we need to create serializer instance for each post (because of object and context)
		# and we need to apply filters for each post
		instance = create_serializer_instance
		filters = instance.filters(options[:context])
		descriptor = apply_filters(descriptor, options.merge(filters))

		descriptor.attributes.each do |attribute|
			value = get_value(post, attribute.name)
			writer.write(attribute.name, value)
		end
	end
end

As you can see, this is costy, with the filters static method approach, it will be something like this -

def serialize(posts, serializer, options)
	# Build the descriptor based on options (only, except) and 
	# serializer metadata
	metadata = serializer.metadata

	extra_filters = {}
	if serializer.respond_to?(:filters_for)
		extra_filters = serializer.filters_for(options[:context])
	end		
	descriptor = apply_filters(metadata, options.merge(extra_filters))


	writer = create_json_writer

	# run the serialization loop
	posts.each do |post|
		descriptor.attributes.each do |attribute|
			value = get_value(post, attribute.name)
			writer.write(attribute.name, value)
		end
	end
end

As you can see the difference is now, that we calculate the filters once and not for each object.

Hopefully it now makes sense, if not feel free to ask more questions!

[oyeanuj]

@yosiat thank you for the detailed explanation. I think I get it now - essentially, any methods or filters that need to be called need to be 'static' methods of the serializer rather than instance (or instance-specific methods). Is that understanding correct?

So, I think your solution does work well especially if the filter_for method is called automatically (therefore, less boilerplate!)

[yosiat]

@oyeanuj it's merged to master, feel free to test it and let me know if there any issues.
I will release a new version with this feature in a week or two

[oyeanuj]

@yosiat thank you! i was hoping to test this out alongside #6 and #15 and do a solid proof of concept altogether. any updates on those?

ps. appreciate your responsiveness :)

[yosiat]

Hi @oyeanuj ,
Just merged seriailzing plain ruby objects, since this is big feautre I will release a version with this and filtering keys at serializer level.

Probably next week #6 and #15 will be done

[yosiat]

Done at v0.3.5 - https://github.com/yosiat/panko_serializer/releases/tag/v0.3.5