Hide POST, PUT, and DELETE endpoints when JSON:API is configured to be read-only

Created on 4 September 2019, over 5 years ago
Updated 9 September 2024, 4 months ago

Problem/motivation

When JSON:API is set to readonly, the results of the openapi module still defines the endpoints for creating, updating and deleting resources.

This makes the documentation a bit weird since the endpoints don't really work but are documented.

Proposed solution

It seems the routes from the`getJsonApiRoutes` method that are used in the `JsonApiGenerator` returns routes with all methods enabled even though only `GET` is allowed when switching the `jsonapi` to readonly. This should not be the case.

It should probably be fixed in `JsonApiGenerator` to check if readonly is enabled in the config.

Feature request
Status

Needs review

Version

3.0

Component

Code

Created by

🇳🇱Netherlands bbrala Netherlands

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024