jsonapi 8.x-2.0-beta1

This is the first release of JSON API 2.x 🎉

Unlike many module major version bumps, 2.x does not mean that we rewrote the module! In fact, we've increased the stability of this module 💯🤘💥

So, why has the major version been bumped? While making the module more specification compliant, and while adding more tests, and while covering more edge cases, we ran into a few things that we couldn't make better without breaking some things...

What did we break? Well, we've tried very hard to document each and every change. 90% of JSON API clients won't need to change anything, BC was only broken in edge cases. We think you'll be okay with them 🙏 and we're pretty confident that the most disruptive changes have a relatively simple upgrade path. BUT, we could be wrong 😱 and that's what this beta is for! _{The most disruptive change is probably that Drupal's UNIX timestamps are now exposed as ISO timestamps via JSON API.}

We know what you're thinking, "alright, you've convinced me!" So, when and if you do find breaking changes that aren't documented in the change records, please let us know by filing an issue. If you're having trouble figuring out how to upgrade, please file a "support request" so that we can improve the change record with more thorough instructions. We're happy to help you, if you'll help us find those cases 😘

We've also documented the two new features that are already in this beta:

1. Entities that you are not allowed to view, but you are allowed to view the label of are no longer omitted; instead you can only see their label!
2. the new meta.links.me entry provided by /jsonapi which links to the current user

And for those of you thinking, "oh man, I just can't upgrade right now", we've tried to think of you too 🤗. JSON API 1.22 marked the beginning of a "critical support" phase for the 1.x branch. We'll do our best to backport any security fixes and/or critical bugs affecting all users to the 1.x branch for a while yet.

We hope you love JSON API as much as we do. Please consider filing an "experience report" in the issue queue to tell us how you're using it or what you've built with it, especially your successes! Believe it or not, we seem to only see your problems! ¯\_(ツ)_/¯

❤️❤️❤️

- The JSON API Maintainers 👚

API-first Drupal with multiple consumers @DrupalConNA :D pic.twitter.com/GhgY8O5SSa

— Gábor Hojtsy (@gaborhojtsy) April 11, 2018

Summary: 8.x-2.0-beta1

Contributors: (21) Wim Leers, e0ipso, gabesullice, hampercm, clemens.tolboom, dawehner, gargsuchi, justafish, sonnykt, alexpott, jlscott, DavidSpiessens, BR0kEN, danielnv18, drpal, martin107, effulgentsia, webchick, balsama, nileshlohar, garphy

Issues: 49 issues resolved.

Changes since 8.x-1.22:

Bug

• #2853066 by gabesullice, Wim Leers, e0ipso, hampercm, clemens.tolboom, dawehner: Spec Compliance: Inaccessible collection/related resources surface errors: should be 200 with hypermedia + metadata
• #2977659 by gabesullice, Wim Leers: Spec Compliance: POST|PATCH|DELETE on relationships should respect arity rules
• #2977600 by Wim Leers, gabesullice, e0ipso: Spec Compliance: `_format` is a disallowed query parameter name
• #2949807 by Wim Leers, gabesullice: Spec Compliance: Error responses are missing the `jsonapi` top-level member
• #2985426 by gabesullice, Wim Leers: Spec compliance: `related` routes should return 200, not 403, if field access is allowed but the related resources are forbidden
• #2990552 by gabesullice: Followup to #2986383: Custom content blocks are now reusable in 8.6 also
• #2990532 by gabesullice: Drupal core compatibility: Terms are now publishable in 8.6+
• #2986899 by gabesullice: Drupal core compatibility: SchemaIncompleteException for some config entity types
• #2986900 by e0ipso: Unnecessary asserts break installation in distros that include JSON API
• #2977669 by Wim Leers, gargsuchi, gabesullice, e0ipso, justafish, sonnykt: Spec Compliance: some entity types have an "id", "type" or "uuid" field, this violates the spec
• #2942549 by gabesullice, Wim Leers: Spec Compliance: JSON API allows POSTing relationship fields in 'attributes' rather than in 'relationships'
• #2986383 by gabesullice: Drupal core compatibility: Block content entities have a `reusable` field in 8.7+
• #2984964 by Wim Leers, jlscott, DavidSpiessens, gabesullice: JSON API + hook_node_grants() implementations: accessing /jsonapi/node/article as non-admin user results in a cacheability metadata leak
• #2984494 by sonnykt, Wim Leers, gabesullice: EntityResource calls `$entity->get('field_name')` without first ensuring the entity is a fieldable entity
• #2955615 by Wim Leers, gabesullice, e0ipso: Field properties are not being denormalized
• #2934149 by Wim Leers, gabesullice: [>=8.5] JSON API routes not specifying _content_type_format route requirement, resulting in bad DX
• #2982478 by Wim Leers, gabesullice: JsonApiRequestValidator creates ResourceResponse object with array instead of JsonApiDocumentTopLevelNormalizerValue
• #2933062 by Wim Leers, gabesullice: [>=8.5.4] Spec Compliance: Return 400 for unrecognized/unsupported query parameters

Feature

• #2986484 by e0ipso, Wim Leers: Add verbose logging to failed assertions for base path
• #2927037 by Wim Leers, danielnv18, gabesullice, e0ipso: Provide a mechanism to get information about the current user: "me" meta link in /jsonapi, and make /jsonapi accessible to all
• #2843922 by drpal, Wim Leers, hampercm, e0ipso, gabesullice: Show label of inaccessible entities ('view' access denied) when 'view label' access is allowed

Task

• #2936754 by Wim Leers, e0ipso, gabesullice: Avoid using the Serialization component for JSON API specific tasks
• #2994479 by gabesullice: Followup to #2934362: remove 'code' in most cases
• #2987205 by Wim Leers, e0ipso: FormatSetter doesn't set the format to `api_json` when accessing just `/jsonapi`
• #2991389 by gabesullice, Wim Leers: Test coverage: relationship response cacheabiliity
• #2987604 by gabesullice, Wim Leers: Turn EntityResource into a service
• #2987603 by gabesullice, Wim Leers: Make resource type an explicit parameter to each EntityResource method
• #2987206 by gabesullice, Wim Leers: Refactor `getEntityAndAccess` to return cacheable objects with access cacheability rather than an entity/access pair
• #2986987 by gabesullice, Wim Leers, e0ipso: Convert EntityAccessDeniedHttpException into cacheable exception
• #2982479 by alexpott, gabesullice, justafish, Wim Leers: Handle entities with no bundle in ResourceTypeRepository
• #2985321 by Wim Leers: Follow-up for #2929932: two @todos left for that issue that actually already have been addressed
• #2953346 by gabesullice, Wim Leers, BR0kEN: Define related/relationship routes per field, not dynamically (with route parameters that need validating)
• #2984607 by Wim Leers, gabesullice: Remove Drupal core <8.5 BC layer code and require Drupal >=8.5
• #2973784 by Wim Leers, gabesullice, e0ipso: JSON API should check entity access during routing, not in controller, for the "individual" route
• #2983631 by martin107: Update @throws documentation in the EntityResource class
• #2983196 by Wim Leers: Fix all deprecation errors in Drupal 8.6
• #2983051 by Wim Leers: Allow ResourceResponseValidatorTest to run non-schemata tests when schemata is not installed
• #2982964 by Wim Leers: Add a drupalci.yml to JSON API to match Drupal core's and fix all surfaced deprecation errors
• #2929932 by Wim Leers, e0ipso, gabesullice: Work around core's ill-designed @FieldType-level TimestampItemNormalizer normalization until #2926508 lands
• #2957474 by Wim Leers, gabesullice, e0ipso, effulgentsia, dawehner, webchick, balsama, drpal: Move the write functionality of config entities to a sub-module in preparation for removal
• #2971040 by Wim Leers, nileshlohar, gabesullice: PHP 7.1 Compatibility Warning
• #2982210 by Wim Leers: Move EntityToJsonApi service to JSON API Extras
• #2957271 by gabesullice, Wim Leers: [>=8.5] Fix RouteEnhancerInterface deprecation errors
• #2933895 by Wim Leers, gabesullice, e0ipso: [>=8.5] Update type hint to interface instead of concrete class in FieldResolver
• #2926463 by Wim Leers, garphy, e0ipso: [>=8.5] Remove JSON API's "file URL" field work-around now that Drupal core 8.5 fixed it