README.md in json_api_client-1.10.0 vs README.md in json_api_client-1.11.0

- old
+ new

@@ -50,18 +50,18 @@ u.update_attributes( a: "b", c: "d" ) -u.persisted? +u.persisted? # => true u.destroy -u.destroyed? +u.destroyed? # => true -u.persisted? +u.persisted? # => false u = MyApi::Person.create( a: "b", c: "d" @@ -162,11 +162,11 @@ ```ruby module MyApi class Account < JsonApiClient::Resource belongs_to :user end - + class Customer < JsonApiClient::Resource belongs_to :user, shallow_path: true end end @@ -474,11 +474,11 @@ end ``` ##### Custom status handler -You can change handling of response status using `connection_options`. For example you can override 400 status handling. +You can change handling of response status using `connection_options`. For example you can override 400 status handling. By default it raises `JsonApiClient::Errors::ClientError` but you can skip exception if you want to process errors from the server. You need to provide a `proc` which should call `throw(:handled)` default handler for this status should be skipped. ```ruby class ApiBadRequestHandler def self.call(_env) @@ -632,9 +632,40 @@ ```ruby class Order < JsonApiClient::Resource property :total_amount, type: :money end +``` + +### Safe singular resource fetching + +That is a bit curios, but `json_api_client` returns an array from `.find` method, always. +The history of this fact was discussed [here](https://github.com/JsonApiClient/json_api_client/issues/75) + +So, when we searching for a single resource by primary key, we typically write the things like + +```ruby +admin = User.find(id).first +``` + +The next thing which we need to notice - `json_api_client` will just interpolate the incoming `.find` param to the end of API URL, just like that: + +> http://somehost/api/v1/users/{id} + +What will happen if we pass the blank id (nil or empty string) to the `.find` method then?.. Yeah, `json_api_client` will try to call the INDEX API endpoint instead of SHOW one: + +> http://somehost/api/v1/users/ + +Lets sum all together - in case if `id` comes blank (from CGI for instance), we can silently receive the `admin` variable equal to some existing resource, with all the consequences. + +Even worse, `admin` variable can equal to *random* resource, depends on ordering applied by INDEX endpoint. + +If you prefer to get `JsonApiClient::Errors::NotFound` raised, please define in your base Resource class: + +```ruby +class Resource < JsonApiClient::Resource + self.raise_on_blank_find_param = true +end ``` ## Contributing Contributions are welcome! Please fork this repo and send a pull request. Your pull request should have: