{"action":"created","issue":{"url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/1000","repository_url":"https://api.github.com/repos/cerebris/jsonapi-resources","labels_url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/1000/labels{/name}","comments_url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/1000/comments","events_url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/1000/events","html_url":"https://github.com/cerebris/jsonapi-resources/issues/1000","id":213977365,"number":1000,"title":"JR 0.9 ignores #records_for, crashes from nonstandard #records","user":{"login":"NuckChorris","id":430411,"avatar_url":"https://avatars1.githubusercontent.com/u/430411?v=3","gravatar_id":"","url":"https://api.github.com/users/NuckChorris","html_url":"https://github.com/NuckChorris","followers_url":"https://api.github.com/users/NuckChorris/followers","following_url":"https://api.github.com/users/NuckChorris/following{/other_user}","gists_url":"https://api.github.com/users/NuckChorris/gists{/gist_id}","starred_url":"https://api.github.com/users/NuckChorris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NuckChorris/subscriptions","organizations_url":"https://api.github.com/users/NuckChorris/orgs","repos_url":"https://api.github.com/users/NuckChorris/repos","events_url":"https://api.github.com/users/NuckChorris/events{/privacy}","received_events_url":"https://api.github.com/users/NuckChorris/received_events","type":"User","site_admin":false},"labels":[{"id":89079094,"url":"https://api.github.com/repos/cerebris/jsonapi-resources/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-03-14T06:08:48Z","updated_at":"2017-03-22T11:31:42Z","closed_at":null,"body":"We've moved our main app to JR 0.9 (yay caching!) but are facing an issue where `#records_for` isn't being called to get associated records for a request with `include` param.  Instead, the associated resource's `#records` method is being called.\r\n\r\nI'm inclined to call this a regression, honestly, since `#records_for` is still documented as a potential hookup location for authorization code.  I was actually just about to override this so that certain associations would ignore our authorization code, and found that it wasn't being called at all.\r\n\r\nIt doesn't appear to be a security issue for us (due to the way our authorization works), but this behavior could potentially cause security issues in other apps, depending on how they are architected (namely, if their `#records_for` authorized differently from their `#records`)\r\n\r\nStrongly related: if the `#records` call on the associated resource causes some of the associations to be nonexistent, it causes an exception, since it can't find the ID of the associated record in the Hash it's built up for preload data"},"comment":{"url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/comments/288371701","html_url":"https://github.com/cerebris/jsonapi-resources/issues/1000#issuecomment-288371701","issue_url":"https://api.github.com/repos/cerebris/jsonapi-resources/issues/1000","id":288371701,"user":{"login":"lgebhardt","id":29154,"avatar_url":"https://avatars3.githubusercontent.com/u/29154?v=3","gravatar_id":"","url":"https://api.github.com/users/lgebhardt","html_url":"https://github.com/lgebhardt","followers_url":"https://api.github.com/users/lgebhardt/followers","following_url":"https://api.github.com/users/lgebhardt/following{/other_user}","gists_url":"https://api.github.com/users/lgebhardt/gists{/gist_id}","starred_url":"https://api.github.com/users/lgebhardt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lgebhardt/subscriptions","organizations_url":"https://api.github.com/users/lgebhardt/orgs","repos_url":"https://api.github.com/users/lgebhardt/repos","events_url":"https://api.github.com/users/lgebhardt/events{/privacy}","received_events_url":"https://api.github.com/users/lgebhardt/received_events","type":"User","site_admin":false},"created_at":"2017-03-22T11:31:42Z","updated_at":"2017-03-22T11:31:42Z","body":"@NuckChorris I agree, it's a big caveat. I have updated the docs with a note in the [finders](http://jsonapi-resources.com/v0.9/guide/resources.html#Finders) section. Hopefully we'll get a fix in place to remove the limitation, but if not I'll update the docs at a minimum."}}
{"actor":{"display_login":"lgebhardt"}}