Problem/Motivation
Around fourteen resources declare the Drupal path they stand for as a literal node ID: /node/1010, /node/1108, /node/353, /node/5 and so on. Those are node IDs of the site this module was first written for, and they mean something else, or nothing, anywhere else. The resources themselves do not depend on them - each one already resolves its node through the setting that names it, so the annotation is a stale copy of configuration that has moved on.
It is not harmless. The declaration is read to decide which endpoint answers for a page: on a site that happens to have a node with one of those IDs, an alias can be answered with a different page's body. It is currently guarded by a check that the site actually configured that node as one of its pages, which turns a wrong answer into a missing one - but the underlying data is still one site's content model shipped inside a module meant for any site.
The same pattern appears once more in the alias path processor, where a branch matches the literal URL segment reviews and answers with a particular endpoint, plus a query parameter it sets by hand.
Proposed resolution
- Let a resource declare the role it serves - the reviews index, the contacts page - rather than the node ID of one site's copy of it. The roles already exist as settings; what is missing is the resource saying which one it belongs to.
- Resolve the node from that role at runtime, which is what the resource bodies already do, and drop the literal IDs from the annotations.
- Replace the check that a declaration names a configured node: with roles there is nothing to guess, the setting either names a node or it does not.
- Take the
reviewsURL segment from configuration too, or express it as the role it stands for. - Cover with a test that two sites configuring different node IDs for the same role both resolve correctly, which is impossible to get right with literals.
Remaining tasks
Everything.
Issue fork myrest-3618485
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #4
sergeydruua commentedComment #6
sergeydruua commented