It is possible to access a disabled resource via the include parameter, related routes and relationship routes.

When the field is a single field, the related route results in a 500 Internal Server Error with the detail, "Route \"jsonapi.user--user.individual\" does not exist."

This was uncovered as part of #2932035: ResourceTypes should be internal when EntityType::isInternal is TRUE.

... I just noticed that the UI says: "Disabling a resource can have unexpected results when following relationships belonging to that resource."

Since this throws a 500, I still think it's worth reporting.

CommentFileSizeAuthor
#4 2933354--fix-related-relationship-disabled--4.patch8.7 KBe0ipso
#2 2933354--fix-related-relationship-disabled--2.patch8.19 KBe0ipso
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

gabesullice created an issue. See original summary.

e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
CreditAttribution: e0ipso as a volunteer and at Lullabot commented
Status: Active » Needs review
FileSize
2933354--fix-related-relationship-disabled--2.patch8.19 KB

Kicking off tests.

Status: Needs review » Needs work

The last submitted patch, 2: 2933354--fix-related-relationship-disabled--2.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
CreditAttribution: e0ipso as a volunteer and at Lullabot commented
Status: Needs work » Needs review
FileSize
2933354--fix-related-relationship-disabled--4.patch8.7 KB

This requires the latest JSON API release (1.7).

  • e0ipso committed e7441fc on 8.x-1.x 
    Issue #2933354 by e0ipso: Disabled resources are still accessible via...
e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
CreditAttribution: e0ipso as a volunteer and at Lullabot commented
Status: Needs review » Fixed
Wim Leers’s picture

Wim Leers
Location Ghent 🇧🇪🇪🇺
CreditAttribution: Wim Leers at Acquia commented
Related issues: +#2933615: Fix related and relationships endpoints for disabled resources

This requires the latest JSON API release (1.7).

By this, @e0ipso means #2933615: Fix related and relationships endpoints for disabled resources.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Anybody’s picture

Anybody
Primary language German
Location Porta Westfalica
CreditAttribution: Anybody as a volunteer and at DROWL.de commented

I created an issue for the opposite requirement: Being able to add the reference data (like it was a scalar field value and not an entity reference), even if the target entity type resource is disabled, so it can't be requested directly: #3437873: Disabled resources vs. includes (for referenced data)

Would be great to have your feedback!