Loopback: PATCH verb for model relation methods

[PaddyMann]

As of Loopback 3, we're told to use PATCH if we want to updateAttributes rather than replace an entire model.

Fine. So we've moved over to PATCH.

But I can't find any way to set up an ACL for a related model that I wish to update with a PATCH. If I define it with (e.g.) __update__account, then it's the PUT method that is activated. There doesn't seem to be an equivalent for PATCH.

Not clear if this is a bug or missing documentation (https://loopback.io/doc/en/lb3/Accessing-related-models.html).

The only workaround I can currently think of is to revert to using PUT and add replaceOnPUT to all my models. Wishing someone had added a simpler way of setting replaceOnPUT as default for all models if this is the case.

[jjhesk]

current version: LB 3.4

I have the same experience where I use PATCH as the request with header token fashion Authorization: $TOKEN_ID from the login token object. @PaddyMann @bajtos I have defined the ACL in such way
```
...

"acls": [
{
"accessType": "*",
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "DENY"
},
{
"accessType": "READ",
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "find"
},
{
"accessType": "READ",
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "findById"
},
{
"accessType": "EXECUTE",
"principalType": "ROLE",
"principalId": "$authenticated",
"permission": "ALLOW",
"property": "update"
},
{
"accessType": "EXECUTE",
"principalType": "ROLE",
"principalId": "admin",
"permission": "ALLOW",
"property": "listing"
}
],
"methods": [],
"injectOptionsFromRemoteContext": true
```

It turns out that the request with patch still getting the 401 unauthorized error. is that a bug or there i still need to setup some other things?

[bajtos]

@PaddyMann

But I can't find any way to set up an ACL for a related model that I wish to update with a PATCH. If I define it with (e.g.) __update__account, then it's the PUT method that is activated. There doesn't seem to be an equivalent for PATCH.

From what I can tell by reading the source code, it seems the relation methods were not updated to use PATCH instead of PUT. See e.g. https://github.com/strongloop/loopback/blob/cb7e2114ecfad9d852bb8da70a44fe74d6fa0ef7/lib/model.js#L655-L670

I think this was an oversight on our side, IMO the relation methods should be using PATCH for partial update and PUT for full replace too.

@jjhesk

current version: LB 3.4
I have the same experience where I use PATCH as the request with header token fashion Authorization: $TOKEN_ID from the login token object. I have defined the ACL in such way (...)

This looks like an unrelated problem to me. Please open a new issue and provide us with a small app reproducing the problem - see our bug reporting instructions.

[PaddyMann]

OK - we've now reverted to PUT and replaceOnPUT so no urgency for me but would be good to see this fixed :)

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jcolemorrison]

We've wound up using with PUT as well for now on partial updates. PATCH still works on the top level, but with embedded relations, PUT seems to be the only way. I didn't need replaceOnPUT, so it must default to partial updates on PUT.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale[bot]]

This issue has been closed due to continued inactivity. Thank you for your understanding. If you believe this to be in error, please contact one of the code owners, listed in the CODEOWNERS file at the top-level of this repository.

[ivanschwarz]

@bajtos : Hello. I don't think this issue was solved. If I clone a getting started repository and run it, I don't see in StrongLoop API Explorer any PATCH endpoints being generated for related methods (e.g. PATCH /Reviewers/{id}/reviews).

Steps to reproduce:

$ git clone https://github.com/strongloop/loopback-getting-started-intermediate.git
$ cd loopback-getting-started-intermediate
$ git checkout step3
$ npm install
$ node .

Navigate to http://localhost:3000/explorer/

[bajtos]

@ivanschwarz I am afraid we don't have bandwidth to make this change ourselves. Would you like to contribute a pull request? I am happy to help you along the way.

[karanssj4]

@bajtos how to proceed to add this functionality? I tried adding a function in lib/model.js similar to updateById but I get an error - Cannot read property 'apply' of undefined

I was, however, able to achieve the desired functionality by adding these two functions in lib/model.js like this.

// added by me
define('__update_patch__' + relationName, {
      isStatic: false,
      http: {verb: 'patch', path: '/' + pathName},
      accepts: [
        {
          arg: 'data', type: 'object', model: toModelName,
          http: {source: 'body'},
        },
        {arg: 'options', type: 'object', http: 'optionsFromRequest'},
      ],
      description: format('Patch %s of this model.', relationName),
      accessType: 'WRITE',
      returns: {arg: 'data', type: toModelName, root: true},
    });

    // added by me
    var updateByIdPatchFunc = this.prototype['__updateById_patch__' + relationName];
    define('__updateById_patch__' + relationName, {
      isStatic: false,
      http: {verb: 'patch', path: '/' + pathName + '/:fk'},
      accepts: [
        {arg: 'fk', type: 'any',
          description: format('Foreign key for %s', relationName),
          required: true,
          http: {source: 'path'}},
        {arg: 'data', type: 'object', model: toModelName, http: {source: 'body'}},
        {arg: 'options', type: 'object', http: 'optionsFromRequest'},
      ],
      description: format('Patch a related item by id for %s.', relationName),
      accessType: 'WRITE',
      returns: {arg: 'result', type: toModelName, root: true},
    }, updateByIdFunc);
// updateByIdPatchFunc does not work in the above line

any suggestions?

[bajtos]

@karanssj4 sorry for a late response.

I tried adding a function in lib/model.js similar to updateById but I get an error - Cannot read property 'apply' of undefined

I am afraid I cannot fully understand what you have tried from your description. Can you open a pull request showing what you have tried?

I was, however, able to achieve the desired functionality by adding these two functions in lib/model.js like this.

It should be enough to add a new item to the list of http endpoints of each affected relation method. Please see https://github.com/strongloop/loopback/pull/2316 for inspiration, that's the pull request which remapped POST/PUT/PATCH endpoints.

What's important:

• Backwards compatibility needs to be preserved. Adding another endpoint alongside the existing PUT one is ok.
• New tests are needed to verify that the new PATCH endpoint works as expected.

[jackrvaughan]

Can we reopen the issue because it's not resolved?

[bajtos]

@jackrvaughan

Can we reopen the issue because it's not resolved?

Done.

Please note this feature is not our priority. Unless a community member contributes the necessary changes, the issue will be closed by our stalebot in few months again.

[stale[bot]]

This issue has been closed due to continued inactivity. Thank you for your understanding. If you believe this to be in error, please contact one of the code owners, listed in the CODEOWNERS file at the top-level of this repository.