{"action":"created","issue":{"url":"https://api.github.com/repos/venuu/jsonapi-authorization/issues/30","repository_url":"https://api.github.com/repos/venuu/jsonapi-authorization","labels_url":"https://api.github.com/repos/venuu/jsonapi-authorization/issues/30/labels{/name}","comments_url":"https://api.github.com/repos/venuu/jsonapi-authorization/issues/30/comments","events_url":"https://api.github.com/repos/venuu/jsonapi-authorization/issues/30/events","html_url":"https://github.com/venuu/jsonapi-authorization/issues/30","id":169787495,"number":30,"title":"API proposal for authorizing relationships","user":{"login":"valscion","id":482561,"avatar_url":"https://avatars.githubusercontent.com/u/482561?v=3","gravatar_id":"","url":"https://api.github.com/users/valscion","html_url":"https://github.com/valscion","followers_url":"https://api.github.com/users/valscion/followers","following_url":"https://api.github.com/users/valscion/following{/other_user}","gists_url":"https://api.github.com/users/valscion/gists{/gist_id}","starred_url":"https://api.github.com/users/valscion/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/valscion/subscriptions","organizations_url":"https://api.github.com/users/valscion/orgs","repos_url":"https://api.github.com/users/valscion/repos","events_url":"https://api.github.com/users/valscion/events{/privacy}","received_events_url":"https://api.github.com/users/valscion/received_events","type":"User","site_admin":false},"labels":[{"id":354696405,"url":"https://api.github.com/repos/venuu/jsonapi-authorization/labels/discussion","name":"discussion","color":"c5def5","default":false},{"id":315023499,"url":"https://api.github.com/repos/venuu/jsonapi-authorization/labels/help%20wanted","name":"help wanted","color":"159818","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":27,"created_at":"2016-08-07T09:08:31Z","updated_at":"2016-12-12T17:21:15Z","closed_at":null,"body":"UPDATE on 2016-10-29:\n\nThe approach I want to take on authorizing relationships relies on always using a whitelist instead of blacklist. This means that:\n- There won't be a generic `allow_relationship?` method that would handle all relationships.\n- Using `update?` after trying to set a foreign key won't work, as it is a blacklist approach.\n\nSo even at the cost of some policies becoming huge, I want to keep each method as small and unambiguous as possible. That means methods named like this:\n\n``` rb\nclass CommentPolicy\n  def allow_relationship_article?(article)\n    # ...\n  end\nend\n```\n\nI haven't yet made up my mind on which side of the association the authorization should happen, but I'd like that choice to be abstracted away from the [`AuthorizingProcessor`](https://github.com/venuu/jsonapi-authorization/blob/v0.8.1/lib/jsonapi/authorization/authorizing_processor.rb). It could live inside [`DefaultPunditAuthorizer`](https://github.com/venuu/jsonapi-authorization/blob/v0.8.1/lib/jsonapi/authorization/default_pundit_authorizer.rb), if it would make sense, or we could come up with a new place for that logic to live in.\n\nSee [my comment about this](https://github.com/venuu/jsonapi-authorization/issues/30#issuecomment-250911834) for more details, and to continue the discussion.\n\n<details>\n<summary>\n\nOpen this to read the old proposal that kicked off the conversation</summary>\n\n\n\nFor a create request that looks like this:\n\n``` json\n{\n  \"data\": {\n    \"id\": \"post-1\",\n    \"type\": \"posts\",\n    \"relationships\": {\n      \"author\": {\n        \"data\": {\n          \"id\": \"user-1\", \"type\": \"user\"\n        }\n      },\n      \"comments\": {\n        \"data\": [\n          { \"id\": \"comment-1\", \"type\": \"comments\" },\n          { \"id\": \"comment-2\", \"type\": \"comments\" }\n        ]\n      },\n      \"tags\": {\n        \"data\": [\n          { \"id\": \"tag-1\", \"type\": \"tags\" },\n          { \"id\": \"tag-2\", \"type\": \"tags\" }\n        ]\n      }\n    }\n  }\n}\n```\n\nWe authorize with these methods:\n1. `PostPolicy.new(post_1, current_user).create?`\n2. `PostPolicy.new(post_1, current_user).associate_with_author(user_1)?`\n3. `PostPolicy.new(post_1, current_user).associate_with_comments([comment_1, comment_2])?`\n4. `PostPolicy.new(post_1, current_user).associate_with_tags([tag_1, tag_2])?`\n\nFor this request, no matter if it's an update or a create call, we are able to only use `PostPolicy` to authorize for every association.\n\nI can't see there being any other way as we ​_cannot_​ change the `UserPolicy#associate_with_comments` call to these without a huge scope creep:\n1. `CommentPolicy.new(comment_1, user).associate_with_post(post_1)?`\n2. `CommentPolicy.new(comment_2, user).associate_with_post(post_1)?`\n\nWho knows, the `Comment` resource might even call that association with a completely different name than `post` underneath!\n\nIf that request would be an update request, it would only change the `PostPolicy#create?` call to be `PostPolicy#update?` and the association checks would remain the same.\n\nI know this goes against Pundit architecture, but I can't really see there being any other way because we aren't able to call `post_1.author = author_1` nor `post_1.comments = [comment_1, comment_2]` before authorizing as it would implicitly save the association immediately. So we aren't able to just use the `post_1.author` value in `PostPolicy#update?` to check for authorization, as it isn't set yet.\n- [`has_one` association reference —  When are objects saved? (Ruby on Rails Guides)](http://guides.rubyonrails.org/association_basics.html#has-one-association-reference-when-are-objects-saved-questionmark)\n  \n  > When you assign an object to a `has_one` association, that object is automatically saved (in order to update its foreign key). In addition, any object being replaced is also automatically saved, because its foreign key will change too.\n- [`has_many` association reference — When are objects saved?  (Ruby on Rails Guides)](http://guides.rubyonrails.org/association_basics.html#has-many-association-reference-when-are-objects-saved-questionmark)\n  \n  > When you assign an object to a `has_many` association, that object is automatically saved (in order to update its foreign key). If you assign multiple objects in one statement, then they are all saved.\n  > </details>\n"},"comment":{"url":"https://api.github.com/repos/venuu/jsonapi-authorization/issues/comments/266492734","html_url":"https://github.com/venuu/jsonapi-authorization/issues/30#issuecomment-266492734","issue_url":"https://api.github.com/repos/venuu/jsonapi-authorization/issues/30","id":266492734,"user":{"login":"matthias-g","id":1591161,"avatar_url":"https://avatars.githubusercontent.com/u/1591161?v=3","gravatar_id":"","url":"https://api.github.com/users/matthias-g","html_url":"https://github.com/matthias-g","followers_url":"https://api.github.com/users/matthias-g/followers","following_url":"https://api.github.com/users/matthias-g/following{/other_user}","gists_url":"https://api.github.com/users/matthias-g/gists{/gist_id}","starred_url":"https://api.github.com/users/matthias-g/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthias-g/subscriptions","organizations_url":"https://api.github.com/users/matthias-g/orgs","repos_url":"https://api.github.com/users/matthias-g/repos","events_url":"https://api.github.com/users/matthias-g/events{/privacy}","received_events_url":"https://api.github.com/users/matthias-g/received_events","type":"User","site_admin":false},"created_at":"2016-12-12T17:21:15Z","updated_at":"2016-12-12T17:21:15Z","body":"I've thought about this issue and I've come up with a proposal that looks (too?) simple. For easier discussion of the changes I've submitted a [PR](venuu/jsonapi-authorization#40) instead of posting the code here."}}
{"actor":{"display_login":"matthias-g"}}