Disabling JSONAPI.configuration.raise_if_parameters_not_allowed allows you to remove forbidden relationships

If raise_if_parameters_not_allowed is set to false, then something strange happens.

In https://github.com/cerebris/jsonapi-resources/blob/master/lib/jsonapi/request_parser.rb#L237 the params are first filtered using parse_params. Suppose I have a model with an author relationship (like in the tests) that is optional (so presence is not validated) but remove the author from updatable_fields:

class Post < ActiveRecord::Base
  belongs_to :author, optional: true
end

class PostResource < JSONAPI::Resource
  has_one :author

  def self.updatable_fields(context)
    super - [:author]
  end
end

If I send an update_relationship request to the PostResource, then any relationship data I send to the PostResource gets set to nil. The post's author is set to nil and, since that is a valid value, the update is saved to the database. In other words, the following controller test would fail:

  def test_update_relationship_to_one_forbidden_relationship_filtered_parameter
    JSONAPI.configuration.raise_if_parameters_not_allowed = false

    refute_nil Post.find(1).author

    set_content_type_header!
    put :update_relationship, params: {post_id: 1, relationship: 'author', data: {anything: "really"}}

    assert_response :bad_request
    refute_nil Post.find(1).author
  ensure
    JSONAPI.configuration.raise_if_parameters_not_allowed = true
  end

Commencez dans lib/jsonapi/request_parser.rb, au niveau du chemin parse_params décrit dans l’issue, puis suivez le point d’entrée update_relationship. Utilisez le scénario de test du contrôleur indiqué pour vérifier qu’une relation interdite n’efface pas l’auteur existant et que la requête renvoie bad_request.