add unrestricted deserializer for backward compatibility

Author: NullVoxPopuli

.rubocop.yml

@@ -4,6 +4,7 @@ AllCops:
     - !ruby/regexp /(vendor|bundle|bin|db|tmp)\/.*/
   DisplayCopNames: true
   DisplayStyleGuide: true
+  TargetRubyVersion: 2.3
 
 Lint/AssignmentInCondition:
   Enabled: false
@@ -34,6 +35,10 @@ Metrics/LineLength:
 Metrics/MethodLength:
   Max: 25
 
+Metrics/BlockLength:
+  Exclude:
+    - spec/**/*
+
 Metrics/PerceivedComplexity:
   Max: 9 # TODO: Lower to 7
 

README.md

@@ -26,10 +26,14 @@ require 'jsonapi'
 Then, parse a JSON API document:
 
 ```ruby
-hash = JSONAPI.to_active_record_hash(json_api_params, options: {}, klass: nil)
+hash = JSONAPI::Rails.to_active_record_hash(json_api_params, options: {}, klass: nil)
 ```
 
-Note that klass is optional, and defaults to nil, but will infer the type from the json api document.
+Notes
+ - that klass is optional, and defaults to nil, but will infer the type from the json api document.
+ - this will not do any key transforms -- casing will be consistent from input to output
+ - this does not perform validations. (see jsonapi/validations)
+
 
 ### Available Options
 

lib/jsonapi/rails/deserializable_resource.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'jsonapi/deserializable'
 
 module JSONAPI
@@ -20,6 +21,7 @@ module Rails
     #      jsonapi/deserializable
     class DeserializableResource
       require_relative 'deserializable_resource/builder'
+      require_relative 'deserializable_resource/unrestricted'
 
       class << self
         def deserializable_cache
@@ -39,12 +41,16 @@ def deserializable_for(klass)
           DeserializableResource::Builder.for_class(klass)
         end
 
+        def unrestricted_deserialization(hash)
+          DeserializableResource::Unrestricted.to_active_record_hash(hash)
+        end
+
         def deserializable_class(type, klass)
           klass || type_to_model(type)
         end
 
         def type_to_model(type)
-          type.classify.constantize
+          type.classify.safe_constantize
         end
       end
 
@@ -56,6 +62,11 @@ def type_to_model(type)
       # then when to_hash is called, the class will be derived, and
       # a class will be used for deserialization as if the
       # user specified the deserialization target class.
+      #
+      # Note that by specifying klass to false, no class will be used.
+      # This means that every part of the JSONAPI Document will be
+      # deserialized, and none of it will be whitelisted against any
+      # class
       def initialize(hash, options: {}, klass: nil)
         @_hash = hash
         @_options = options
@@ -66,6 +77,11 @@ def to_hash
         type = _hash['data']['type']
         klass = self.class.deserializable_class(type, _klass)
 
+        if _klass == false || klass.nil?
+          puts "WARNING: class not found for type of `#{type}` or specified _klass `#{_klass&.name}`"
+          return self.class.unrestricted_deserialization(_hash)
+        end
+
         self.class[klass].call(_hash).with_indifferent_access
       end
     end

lib/jsonapi/rails/deserializable_resource/unrestricted.rb

@@ -0,0 +1,79 @@
+module JSONAPI
+  module Rails
+    class DeserializableResource
+      # Taken and stripped down from ActiveModelSerializers
+      # 0.10.2
+      #
+      # For use when a type in ruby is not present.
+      # - it is dangerous to use this, as it may lead to corrupt data
+      #   (nothing is whitelisted based on type)
+      # - Strongy encourage the use of strang parameters in conjunction with this
+      # - the relationship type is always returned, because there is no way
+      #   to test if the relationsihp is polymorphic or not
+      module Unrestricted
+        module_function
+
+        def to_active_record_hash(document)
+          primary_data = document['data']
+          attributes = primary_data['attributes'] || {}
+          attributes['id'] = primary_data['id'] if primary_data['id']
+          relationships = primary_data['relationships'] || {}
+
+          hash = {}
+          hash.merge!(parse_attributes(attributes))
+          hash.merge!(parse_relationships(relationships))
+
+          hash.with_indifferent_access
+        end
+
+        def parse_attributes(attributes)
+          attributes
+            # .map { |(k, v)| { k => v } }
+            # .reduce({}, :merge)
+        end
+
+
+        # Given an association name, and a relationship data attribute, build a hash
+        # mapping the corresponding ActiveRecord attribute to the corresponding value.
+        #
+        # @example
+        #   parse_relationship(:comments, [{ 'id' => '1', 'type' => 'comments' },
+        #                                  { 'id' => '2', 'type' => 'comments' }],
+        #                                 {})
+        #    # => { :comment_ids => ['1', '2'] }
+        #   parse_relationship(:author, { 'id' => '1', 'type' => 'users' }, {})
+        #    # => { :author_id => '1' }
+        #   parse_relationship(:author, nil, {})
+        #    # => { :author_id => nil }
+        # @param [Symbol] assoc_name
+        # @param [Hash] assoc_data
+        # @param [Hash] options
+        # @return [Hash{Symbol, Object}]
+        #
+        # @api private
+        def parse_relationship(assoc_name, assoc_data)
+          prefix_key = assoc_name.to_s.singularize
+          hash =
+            if assoc_data.is_a?(Array)
+              { "#{prefix_key}_ids".to_sym => assoc_data.map { |ri| ri['id'] } }
+            else
+              { "#{prefix_key}_id".to_sym => assoc_data ? assoc_data['id'] : nil }
+            end
+
+          unless assoc_data.is_a?(Array)
+            hash["#{prefix_key}_type".to_sym] = assoc_data.present? ? assoc_data['type'] : nil
+          end
+
+          hash
+        end
+
+        # @api private
+        def parse_relationships(relationships)
+          relationships
+            .map { |(k, v)| parse_relationship(k, v['data']) }
+            .reduce({}, :merge)
+        end
+      end # Unrestricted
+    end # DeserializableResource
+  end # Rails
+end # JSONAPI

spec/integration/unrestricted_spec.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+describe JSONAPI::Rails::DeserializableResource::Unrestricted do
+  let(:klass) { JSONAPI::Rails::DeserializableResource::Unrestricted }
+
+  describe '.to_active_record_hash' do
+    it 'uses unrestricted deserialization when a type is not found' do
+      hash = {
+        'data' => {
+          'type' => 'restraints',
+          'relationships' => {
+            'restriction_for' => {
+              'data' => {
+                'type' => 'discounts',
+                'id' => '67'
+              }
+            }
+          }
+        }
+      }
+      actual = JSONAPI::Rails.to_active_record_hash(hash)
+
+      expected = {
+        'restriction_for_id' => '67',
+        'restriction_for_type' => 'discounts'
+      }
+      expect(actual).to eq expected
+    end
+
+    it 'deserializes just the relationships' do
+      hash = {
+        'data' => {
+          'type' => 'restraints',
+          'relationships' => {
+            'restriction_for' => {
+              'data' => {
+                'type' => 'discounts',
+                'id' => '67'
+              }
+            },
+            'restricted_to' => {
+              'data' => nil
+            }
+          }
+        }
+      }
+
+
+      expected = {
+        'restriction_for_id' => '67',
+        'restriction_for_type' => 'discounts',
+        'restricted_to_id' => nil,
+        'restricted_to_type' => nil
+      }
+      actual = klass.to_active_record_hash(hash)
+      expect(actual).to eq expected
+    end
+
+    it 'deserializes attributes and relationships' do
+      hash = {
+        'data' => {
+          'type' => 'photos',
+          'id' => 'zorglub',
+          'attributes' => {
+            'title' => 'Ember Hamster',
+            'src' => 'http://example.com/images/productivity.png',
+            'image_width' => '200',
+            'image_height' => '200',
+            'image_size' => '1024'
+          },
+          'relationships' => {
+            'author' => {
+              'data' => nil
+            },
+            'photographer' => {
+              'data' => { 'type' => 'people', 'id' => '9' }
+            },
+            'comments' => {
+              'data' => [
+                { 'type' => 'comments', 'id' => '1' },
+                { 'type' => 'comments', 'id' => '2' }
+              ]
+            },
+            'related_images' => {
+              'data' => [
+                { 'type' => 'image', 'id' => '7' },
+                { 'type' => 'image', 'id' => '8' }
+              ]
+            }
+          }
+        }
+      }
+
+      actual = klass.to_active_record_hash(hash)
+
+      expected = {
+        'id' => 'zorglub',
+        'title' => 'Ember Hamster',
+        'src' => 'http://example.com/images/productivity.png',
+        'image_width' => '200',
+        'image_height' => '200',
+        'image_size' => '1024',
+        'author_id' => nil,
+        'author_type' => nil,
+        'photographer_id' => '9',
+        'photographer_type' => 'people',
+        'comment_ids' => %w(1 2),
+        'related_image_ids' => %w(7 8)
+      }
+
+      expect(actual).to eq expected
+    end
+  end
+end