access qualifiers to restrict PUT and POST on individual properties [DATAREST-153]

Thomas Darimont opened DATAREST-153 and commented

Github Author: PantagruelsTeeth
Github Last-Updated: 2012-11-29T17:46:58Z
This issue was automatically imported from github

This is particularly important when using natural keys because changing a primary key is undefined behaviour in JPA (see issue https://github.com/SpringSource/spring-data-rest/pull/44). But, I think this would be useful for other fields. I will describe the general idea although of course there may be a better way.

Each property would have an access qualifier in the schema. The possible qualifiers are "read", "create" and "update". This would be controlled by annotation or the aliasField proposed in issue https://github.com/SpringSource/spring-data-rest/pull/44. Default is complete access, but we should enforce that @Id is "create"-only, even when it is exported. I also think that fields with private or missing setter should be read-only be default, but this is open to discussion.

An example output schema is:

{
"links" : [ {
"rel" : "self",
"href" : "http://server/rest/user/schema"
}, {
"rel" : "user",
"href" : "http://server/rest/user"
} ],
"content" : {
"type" : "object",
"properties" : {
"username" : {
"type" : "string"
"access" : ["read", "create"]
},
"firstname" : {
"type" : "string"
"access" : ["read", "create", "update"]
}
"lastname" : {
"type" : "string"
"access" : ["read", "create", "update"]
}
"reputation" : {
"type" : "integer"
"access" : ["read"]
}
....

We can GET all fields. We can never modify "reputation". Username can be set on create (PUT or POST) but never modified for an existing resource.

Since modifying the schema generated by JSON is probably the most complex part of this task, I think the priority would be to simply support the annotations and check them as appropriate when accessing fields with ReflectionUtils

Reference URL: https://api.github.com/repos/SpringSource/spring-data-rest/issues/52

1 votes, 2 watchers