Problem/Motivation

I am practicing some dark arts involving setting default query parameters for json:api resource endpoints if they are not set in the client request. I want to back these defaults out of the pagination URLs sent back to the client because 1) they're defaults, and don't need to get sent back to the server and 2) reveal some of our back-end logic (that is, I don't want the client to know some of the defaults.)

I initially thought I could do this with an outbound path processor, but it turns out that json:api in core does not give the path processors any opportunity to act on the generated URL, by virtue of the fact it simply reflects the request URL.

See https://git.drupalcode.org/project/jsonapi/-/blob/a6f230f3641214be7a2b5e...

I did some archaeology and found where this was implemented...looks like @wimleers changed this at #2937797-35: Entity UUID Converter performance. The surrounding discussion was about avoiding calls to the param converter?

https://git.drupalcode.org/project/jsonapi/-/commit/fd0c2e7#ca9c156ebc07...

The outbound path processor does not get called because the Url::fromUri() sets the URL object's unrouted flag, and Url::toString() uses that flag to send the processing down a path which does not do outbound processing, because it considers the URL to be "external."

Steps to reproduce

Try to apply an outbound path processor to pagination URLs.

Proposed resolution

I think the solution here is either to:

  • Strip the site's base path from the request URL, essentially turning it into a relative URL when it gets processed in the Link constructor. There are some examples of this (or the inverse) being done in core and contrib but it feels a little rough.
  • Change UnroutedUrlAssembler::buildExternalUrl(), which is what gets used now, to consult UrlHelper::externalIsLocal(), and conditionally do outbound path processing akin to what is done in UnroutedUrlAssembler::buildLocalUrl(). I like this best, and it improves the DX of URL generation even more broadly.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Comments

bradjones1 created an issue. See original summary.

bradjones1’s picture

bradjones1
Primary language English
commented
Related issues: +#3268508: Perform outbound path processing on "local" external URLs

See related for proposed approach #2.

Shower thoughts on this: It would appear to me that re-using the URI from the request object is the easiest/least computational/path of least resistance in reflecting the URL back to the user. It's not 100% ideal, but the whole ideal of canonical routing in json:api is a bit different than Drupal's traditional approach.

I'm not going to mark this postponed/duplicate in case someone else has some better ideas on handling this simply within json:api.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

arun.k’s picture

arun.k commented

@bradjones1 we need more information and steps, how to check it.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.