Repository navigation
fix: return 400 for invalid relationship resource linkage - #474
Merged
mattpolzin merged 1 commit intoOct 22, 2026
Merged
Conversation
FormatRequired let any non-object relationship `data` through, so scalar
linkage ("oops", 123, true, "") and to-many arrays with malformed members
reached DataToParams and raised a FunctionClauseError.
Validate linkage per the spec: null, a resource identifier object, or an
array of them. Anything else halts with a 400 whose source pointer names
the offending member, including its index for to-many relationships.
Closes beam-community#473
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #473
FormatRequiredaccepted any non-object relationshipdata, so a scalar linkage ("oops",123,true,"") passed validation andJSONAPI.Deserializerthen raised aFunctionClauseErrorinDataToParams.transform_relationship/2. To-many arrays had the same gap:["oops"],[%{"type" => "x"}]or[%{"id" => "1"}]crashed in the same place.This PR:
null, a resource identifier object, or an array of them (possibly empty). Anything else now halts with a 400 instead of crashing.ErrorView.invalid_relationship_linkage_error_attrs/2and an optionalindexargument to the existing id/type error helpers, so the source pointer names the offending member (/data/relationships/reviews/data/1/type). Existing callers are unaffected.Note: this fixes the documented
EnsureSpec→Deserializerpipeline.Deserializerused on its own still assumes well-formed linkage; makingDataToParamsdefensive too could be a follow-up if that's wanted.