Preventing fields from being updated on a PATCH request

I need to perform validation on specific fields, such that the user would be able to assign them a value on a POST request, yet would not be able to update their value in a PATCH request. Since @JsonProperty provides limitation on READ and/or WRITE access only, I would not be able to perform such functionality using this annotation.

A solution I was trying to implement was to retrieve the attributes specified by the user in the body of a PATCH request, so as to identify those fields that will be updated. If I perform such a check from inside my repository class, I would not be able to identify the updated attributes since the resource would have already been merged.

A potential solution I was investigating was extending the ResourcePatchController class so that I can get the list of updated attributes in my overridden handleAsync(..) method from the requestDocument parameter. In order to implement such a solution, I would require to add my custom extended class as a controller instead of the default ResourcePatchController.

Is there any way of how I can achieve such a behaviour?

[remmeier]

@JsonApiField.patchable seems what you are looking for? Or if you need more advanced logic, you can provide a custom ResourceFilter implementation.

[duncanportelli]

Hi @remmeier,

Managed to achieve this by using the DocumentFilter. Thanks for all your help!

@Override
public Response filter(DocumentFilterContext context, DocumentFilterChain chain) {

	if (context.getMethod().equals(HttpMethod.PATCH.name())) {
		Set<String> modifiedAttributes = context.getRequestBody().getSingleData().get().getAttributes().keySet();

		List<ResourceField> forbiddenPatchFields =
			context.getQueryAdapter().getResourceInformation().getAttributeFields()
			.stream()
			.filter(field -> !field.getAccess().isPatchable() && modifiedAttributes.contains(field.getJsonName()))
				.collect(Collectors.toList());

		// Do logic
	}

	return super.filter(context, chain);
}