Wire-up callbacks for serialization

Author: Bart Koelman

benchmarks/Serialization/JsonApiSerializerBenchmarks.cs

@@ -36,8 +36,10 @@ public JsonApiSerializerBenchmarks()
 
             var resourceObjectBuilder = new ResourceObjectBuilder(resourceGraph, new ResourceObjectBuilderSettings());
 
-            _jsonApiSerializer = new ResponseSerializer<BenchmarkResource>(metaBuilder, linkBuilder,
-                includeBuilder, fieldsToSerialize, resourceObjectBuilder, options);
+            IResourceDefinitionAccessor resourceDefinitionAccessor = new Mock<IResourceDefinitionAccessor>().Object;
+
+            _jsonApiSerializer = new ResponseSerializer<BenchmarkResource>(metaBuilder, linkBuilder, includeBuilder, fieldsToSerialize, resourceObjectBuilder,
+                resourceDefinitionAccessor, options);
         }
 
         private static FieldsToSerialize CreateFieldsToSerialize(IResourceGraph resourceGraph)

src/JsonApiDotNetCore/Resources/IResourceDefinition.cs

@@ -160,7 +160,7 @@ public interface IResourceDefinition<TResource, TId>
         /// <summary>
         /// Executes before replacing (overwriting) a to-one relationship.
         /// <para>
-        /// Implementing this method enables to perform validations and change <see cref="rightResourceId" />, before the relationship is updated.
+        /// Implementing this method enables to perform validations and change <paramref name="rightResourceId" />, before the relationship is updated.
         /// </para>
         /// </summary>
         /// <param name="leftResource">
@@ -269,8 +269,8 @@ Task OnRemoveFromRelationshipAsync(TResource leftResource, HasManyAttribute hasM
         /// <param name="resource">
         /// The original resource retrieved from the underlying data store (or a freshly instantiated resource in case of a POST resource request), updated with
         /// the changes from the incoming request. Exception: In case <paramref name="operationKind" /> is <see cref="OperationKind.DeleteResource" /> or
-        /// <see cref="OperationKind.AddToRelationship" />, this is an empty object with only the <see cref="Identifiable.Id" /> property set, because for those
-        /// endpoints no resource is retrieved upfront.
+        /// <see cref="OperationKind.AddToRelationship" />, this is an empty object with only the <see cref="Identifiable{T}.Id" /> property set, because for
+        /// those endpoints no resource is retrieved upfront.
         /// </param>
         /// <param name="operationKind">
         /// Identifies from which endpoint this method was called. Possible values: <see cref="OperationKind.CreateResource" />,
@@ -300,5 +300,37 @@ Task OnRemoveFromRelationshipAsync(TResource leftResource, HasManyAttribute hasM
         /// Propagates notification that request handling should be canceled.
         /// </param>
         Task OnWriteSucceededAsync(TResource resource, OperationKind operationKind, CancellationToken cancellationToken);
+
+        /// <summary>
+        /// Executes after a resource has been deserialized from an incoming request body.
+        /// </summary>
+        /// <para>
+        /// Implementing this method enables to change the incoming resource before it enters an ASP.NET Controller Action method.
+        /// </para>
+        /// <para>
+        /// Changing attributes on <paramref name="resource" /> from this method may break detection of side effects on resource POST/PATCH requests, because
+        /// side effect detection considers any changes done from this method to be part of the incoming request body. So setting additional attributes from this
+        /// method (that were not sent by the client) are not considered side effects, resulting in incorrectly reporting that there were no side effects.
+        /// </para>
+        /// <param name="resource">
+        /// The deserialized resource.
+        /// </param>
+        void OnDeserialize(TResource resource);
+
+        /// <summary>
+        /// Executes before a (primary or included) resource is serialized into an outgoing response body.
+        /// </summary>
+        /// <para>
+        /// Implementing this method enables to change the returned resource, for example scrub sensitive data or transform returned attribute values.
+        /// </para>
+        /// <para>
+        /// Changing attributes on <paramref name="resource" /> from this method may break detection of side effects on resource POST/PATCH requests. What this
+        /// means is that if side effects were detected before, this is not re-evaluated after running this method, so it may incorrectly report side effects if
+        /// they were undone by this method.
+        /// </para>
+        /// <param name="resource">
+        /// The serialized resource.
+        /// </param>
+        void OnSerialize(TResource resource);
     }
 }

src/JsonApiDotNetCore/Resources/IResourceDefinitionAccessor.cs

@@ -95,5 +95,15 @@ Task OnWritingAsync<TResource>(TResource resource, OperationKind operationKind,
         /// </summary>
         Task OnWriteSucceededAsync<TResource>(TResource resource, OperationKind operationKind, CancellationToken cancellationToken)
             where TResource : class, IIdentifiable;
+
+        /// <summary>
+        /// Invokes <see cref="IResourceDefinition{TResource,TId}.OnDeserialize" /> for the specified resource.
+        /// </summary>
+        void OnDeserialize(IIdentifiable resource);
+
+        /// <summary>
+        /// Invokes <see cref="IResourceDefinition{TResource,TId}.OnSerialize" /> for the specified resource.
+        /// </summary>
+        void OnSerialize(IIdentifiable resource);
     }
 }

src/JsonApiDotNetCore/Resources/JsonApiResourceDefinition.cs

@@ -162,6 +162,16 @@ public virtual Task OnWriteSucceededAsync(TResource resource, OperationKind oper
             return Task.CompletedTask;
         }
 
+        /// <inheritdoc />
+        public virtual void OnDeserialize(TResource resource)
+        {
+        }
+
+        /// <inheritdoc />
+        public virtual void OnSerialize(TResource resource)
+        {
+        }
+
         /// <summary>
         /// This is an alias type intended to simplify the implementation's method signature. See <see cref="CreateSortExpressionFromLambda" /> for usage
         /// details.

src/JsonApiDotNetCore/Resources/ResourceDefinitionAccessor.cs

@@ -173,6 +173,24 @@ public async Task OnWriteSucceededAsync<TResource>(TResource resource, Operation
             await resourceDefinition.OnWriteSucceededAsync(resource, operationKind, cancellationToken);
         }
 
+        /// <inheritdoc />
+        public void OnDeserialize(IIdentifiable resource)
+        {
+            ArgumentGuard.NotNull(resource, nameof(resource));
+
+            dynamic resourceDefinition = ResolveResourceDefinition(resource.GetType());
+            resourceDefinition.OnDeserialize((dynamic)resource);
+        }
+
+        /// <inheritdoc />
+        public void OnSerialize(IIdentifiable resource)
+        {
+            ArgumentGuard.NotNull(resource, nameof(resource));
+
+            dynamic resourceDefinition = ResolveResourceDefinition(resource.GetType());
+            resourceDefinition.OnSerialize((dynamic)resource);
+        }
+
         protected virtual object ResolveResourceDefinition(Type resourceType)
         {
             ResourceContext resourceContext = _resourceContextProvider.GetResourceContext(resourceType);

src/JsonApiDotNetCore/Serialization/AtomicOperationsResponseSerializer.cs

@@ -20,25 +20,28 @@ public sealed class AtomicOperationsResponseSerializer : BaseSerializer, IJsonAp
         private readonly IMetaBuilder _metaBuilder;
         private readonly ILinkBuilder _linkBuilder;
         private readonly IFieldsToSerialize _fieldsToSerialize;
+        private readonly IResourceDefinitionAccessor _resourceDefinitionAccessor;
         private readonly IJsonApiRequest _request;
         private readonly IJsonApiOptions _options;
 
         /// <inheritdoc />
         public string ContentType { get; } = HeaderConstants.AtomicOperationsMediaType;
 
         public AtomicOperationsResponseSerializer(IResourceObjectBuilder resourceObjectBuilder, IMetaBuilder metaBuilder, ILinkBuilder linkBuilder,
-            IFieldsToSerialize fieldsToSerialize, IJsonApiRequest request, IJsonApiOptions options)
+            IFieldsToSerialize fieldsToSerialize, IResourceDefinitionAccessor resourceDefinitionAccessor, IJsonApiRequest request, IJsonApiOptions options)
             : base(resourceObjectBuilder)
         {
             ArgumentGuard.NotNull(metaBuilder, nameof(metaBuilder));
             ArgumentGuard.NotNull(linkBuilder, nameof(linkBuilder));
             ArgumentGuard.NotNull(fieldsToSerialize, nameof(fieldsToSerialize));
+            ArgumentGuard.NotNull(resourceDefinitionAccessor, nameof(resourceDefinitionAccessor));
             ArgumentGuard.NotNull(request, nameof(request));
             ArgumentGuard.NotNull(options, nameof(options));
 
             _metaBuilder = metaBuilder;
             _linkBuilder = linkBuilder;
             _fieldsToSerialize = fieldsToSerialize;
+            _resourceDefinitionAccessor = resourceDefinitionAccessor;
             _request = request;
             _options = options;
         }
@@ -79,6 +82,8 @@ private AtomicResultObject SerializeOperation(OperationContainer operation)
                 _request.CopyFrom(operation.Request);
                 _fieldsToSerialize.ResetCache();
 
+                _resourceDefinitionAccessor.OnSerialize(operation.Resource);
+
                 Type resourceType = operation.Resource.GetType();
                 IReadOnlyCollection<AttrAttribute> attributes = _fieldsToSerialize.GetAttributes(resourceType);
                 IReadOnlyCollection<RelationshipAttribute> relationships = _fieldsToSerialize.GetRelationships(resourceType);

src/JsonApiDotNetCore/Serialization/Building/IncludedResourceObjectBuilder.cs

@@ -135,8 +135,14 @@ private void ProcessChain(object related, IList<RelationshipAttribute> inclusion
 
         private void ProcessRelationship(IIdentifiable parent, IList<RelationshipAttribute> inclusionChain)
         {
-            // get the resource object for parent.
-            ResourceObject resourceObject = GetOrBuildResourceObject(parent);
+            ResourceObject resourceObject = TryGetBuiltResourceObjectFor(parent);
+
+            if (resourceObject == null)
+            {
+                _resourceDefinitionAccessor.OnSerialize(parent);
+
+                resourceObject = BuildCachedResourceObjectFor(parent);
+            }
 
             if (!inclusionChain.Any())
             {
@@ -188,23 +194,25 @@ protected override RelationshipEntry GetRelationshipData(RelationshipAttribute r
             };
         }
 
-        /// <summary>
-        /// Gets the resource object for <paramref name="parent" /> by searching the included list. If it was not already built, it is constructed and added to
-        /// the inclusion list.
-        /// </summary>
-        private ResourceObject GetOrBuildResourceObject(IIdentifiable parent)
+        private ResourceObject TryGetBuiltResourceObjectFor(IIdentifiable resource)
         {
-            Type type = parent.GetType();
-            string resourceName = ResourceContextProvider.GetResourceContext(type).PublicName;
-            ResourceObject entry = _included.SingleOrDefault(ro => ro.Type == resourceName && ro.Id == parent.StringId);
+            Type resourceType = resource.GetType();
+            ResourceContext resourceContext = ResourceContextProvider.GetResourceContext(resourceType);
 
-            if (entry == null)
-            {
-                entry = Build(parent, _fieldsToSerialize.GetAttributes(type), _fieldsToSerialize.GetRelationships(type));
-                _included.Add(entry);
-            }
+            return _included.SingleOrDefault(resourceObject => resourceObject.Type == resourceContext.PublicName && resourceObject.Id == resource.StringId);
+        }
+
+        private ResourceObject BuildCachedResourceObjectFor(IIdentifiable resource)
+        {
+            Type resourceType = resource.GetType();
+            IReadOnlyCollection<AttrAttribute> attributes = _fieldsToSerialize.GetAttributes(resourceType);
+            IReadOnlyCollection<RelationshipAttribute> relationships = _fieldsToSerialize.GetRelationships(resourceType);
 
-            return entry;
+            ResourceObject resourceObject = Build(resource, attributes, relationships);
+
+            _included.Add(resourceObject);
+
+            return resourceObject;
         }
     }
 }

src/JsonApiDotNetCore/Serialization/RequestDeserializer.cs

@@ -26,6 +26,7 @@ public class RequestDeserializer : BaseDeserializer, IJsonApiDeserializer
         private readonly IHttpContextAccessor _httpContextAccessor;
         private readonly IJsonApiRequest _request;
         private readonly IJsonApiOptions _options;
+        private readonly IResourceDefinitionAccessor _resourceDefinitionAccessor;
 
         public RequestDeserializer(IResourceContextProvider resourceContextProvider, IResourceFactory resourceFactory, ITargetedFields targetedFields,
             IHttpContextAccessor httpContextAccessor, IJsonApiRequest request, IJsonApiOptions options)
@@ -40,6 +41,10 @@ public RequestDeserializer(IResourceContextProvider resourceContextProvider, IRe
             _httpContextAccessor = httpContextAccessor;
             _request = request;
             _options = options;
+
+#pragma warning disable 612 // Method is obsolete
+            _resourceDefinitionAccessor = resourceFactory.GetResourceDefinitionAccessor();
+#pragma warning restore 612
         }
 
         /// <inheritdoc />
@@ -59,6 +64,11 @@ public object Deserialize(string body)
 
             object instance = DeserializeBody(body);
 
+            if (instance is IIdentifiable resource)
+            {
+                _resourceDefinitionAccessor.OnDeserialize(resource);
+            }
+
             AssertResourceIdIsNotTargeted(_targetedFields);
 
             return instance;
@@ -204,6 +214,8 @@ private OperationContainer ParseForCreateOrUpdateResourceOperation(AtomicOperati
 
             IIdentifiable primaryResource = ParseResourceObject(operation.SingleData);
 
+            _resourceDefinitionAccessor.OnDeserialize(primaryResource);
+
             request.PrimaryId = primaryResource.StringId;
             _request.CopyFrom(request);
 

src/JsonApiDotNetCore/Serialization/ResponseSerializer.cs

@@ -31,26 +31,30 @@ public class ResponseSerializer<TResource> : BaseSerializer, IJsonApiSerializer
         private readonly ILinkBuilder _linkBuilder;
         private readonly IIncludedResourceObjectBuilder _includedBuilder;
         private readonly IFieldsToSerialize _fieldsToSerialize;
+        private readonly IResourceDefinitionAccessor _resourceDefinitionAccessor;
         private readonly IJsonApiOptions _options;
         private readonly Type _primaryResourceType;
 
         /// <inheritdoc />
         public string ContentType { get; } = HeaderConstants.MediaType;
 
         public ResponseSerializer(IMetaBuilder metaBuilder, ILinkBuilder linkBuilder, IIncludedResourceObjectBuilder includedBuilder,
-            IFieldsToSerialize fieldsToSerialize, IResourceObjectBuilder resourceObjectBuilder, IJsonApiOptions options)
+            IFieldsToSerialize fieldsToSerialize, IResourceObjectBuilder resourceObjectBuilder, IResourceDefinitionAccessor resourceDefinitionAccessor,
+            IJsonApiOptions options)
             : base(resourceObjectBuilder)
         {
             ArgumentGuard.NotNull(metaBuilder, nameof(metaBuilder));
             ArgumentGuard.NotNull(linkBuilder, nameof(linkBuilder));
             ArgumentGuard.NotNull(includedBuilder, nameof(includedBuilder));
             ArgumentGuard.NotNull(fieldsToSerialize, nameof(fieldsToSerialize));
+            ArgumentGuard.NotNull(resourceDefinitionAccessor, nameof(resourceDefinitionAccessor));
             ArgumentGuard.NotNull(options, nameof(options));
 
             _metaBuilder = metaBuilder;
             _linkBuilder = linkBuilder;
             _includedBuilder = includedBuilder;
             _fieldsToSerialize = fieldsToSerialize;
+            _resourceDefinitionAccessor = resourceDefinitionAccessor;
             _options = options;
             _primaryResourceType = typeof(TResource);
         }
@@ -92,6 +96,11 @@ private string SerializeErrorDocument(ErrorDocument errorDocument)
         /// </remarks>
         internal string SerializeSingle(IIdentifiable resource)
         {
+            if (resource != null)
+            {
+                _resourceDefinitionAccessor.OnSerialize(resource);
+            }
+
             IReadOnlyCollection<AttrAttribute> attributes = _fieldsToSerialize.GetAttributes(_primaryResourceType);
             IReadOnlyCollection<RelationshipAttribute> relationships = _fieldsToSerialize.GetRelationships(_primaryResourceType);
 
@@ -119,6 +128,11 @@ internal string SerializeSingle(IIdentifiable resource)
         /// </remarks>
         internal string SerializeMany(IReadOnlyCollection<IIdentifiable> resources)
         {
+            foreach (IIdentifiable resource in resources)
+            {
+                _resourceDefinitionAccessor.OnSerialize(resource);
+            }
+
             IReadOnlyCollection<AttrAttribute> attributes = _fieldsToSerialize.GetAttributes(_primaryResourceType);
             IReadOnlyCollection<RelationshipAttribute> relationships = _fieldsToSerialize.GetRelationships(_primaryResourceType);