disable `POST /model/{modelId}/` about safrs HOT 5 CLOSED

Hi Patrick,

IIRC the IDs are generated server-side so it shouldn't be possible to create an item with a user-defined ID so the POSTs to /model/{modelId}/ should probably be deleted altogether.
Does a POST to /model/{modelId}/ work for you?

no worries about the amount of issues, I want this thing to be perfect :), I'll be on holiday next week however :| .

from safrs.

In 10aee62 I removed the swagger and changed the jsonapi POST request processing a bit. I try to follow the spec, eg. https://jsonapi.org/format/#crud-creating-client-ids .

Also, you should be careful when implementing fine-grained access control: We're pretty much reading and writing to the database directly, this may be a bit dangerous. For example by requesting related resources through the "include" request parameter it may be possible to retrieve information that you would like to hide. Similarly, POSTing to a relationship may cause related database objects to be updated.

from safrs.

is there an easy way to hide certain attributes? for example the password hash of a user?

from safrs.

You can overwrite the _s_to_dict method. I should update the readme, it is still called to_dict there.

from safrs.

fixed in v2.1.0

from safrs.