JSON:API resource types can now be configured programmatically

Some sites may not wish to expose certain JSON:API resource types or fields or may with to rename fields to provide a cleaner interface.

In the previous release, it was possible to remove resource types entirely from JSON:API's responses by marking the underlying entity type as "internal" (this is part of an entity type's annotation). However, this approach did not provide bundle-level granularity and it may have had unrelated consequences (like preventing the same entities from being moderated). Finally, it did not address how one could disable fields on those resource types or how to alias them in order to expose fewer implementation details.

To allow these alterations, JSON:API now dispatches a ResourceTypeBuildEvent event object using the event name ResourceTypeBuildEvents::BUILD.

Subscribers can call the following methods:

• ResourceTypeBuildEvent::disableResourceType()to prevent a resource type from being accessed in any way via JSON:API.
• ResourceTypeBuildEvent::disableField()to prevent a field from being accessed in any way via JSON:API.
• ResourceTypeBuildEvent::setPublicFieldName()to set a field alias so that JSON:API does not expose the internal Drupal field name.

Any module, custom or contrib, can implement a subscriber for this event. That means a module for a specific site can disable resource types and also that modules providing their own entity types can disable their own JSON:API representations.

See \Drupal\jsonapi_test_resource_type_building\EventSubscriber\ResourceTypeBuildEventSubscriber for an example.