feat(core): validate resource update requests - #34

jsonapi-java-core/src/main/java/io/github/kazemek/jsonapi/core/validation/package-info.java (1)

9-13: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Scope the relationship requirement to the primary resource.

The validator applies the data requirement only to relationships of the primary resource. Included resources keep response semantics. State that scope here so readers do not expect the rule on included resources.

📝 Proposed wording

- * single-resource primary data, replacement {`@code` data} on every supplied relationship, and — when
+ * single-resource primary data, replacement {`@code` data} on every relationship supplied by the
+ * primary resource, and — when

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@jsonapi-java-core/src/main/java/io/github/kazemek/jsonapi/core/validation/package-info.java`
around lines 9 - 13, Update the UPDATE_REQUEST documentation in
package-info.java to clarify that the replacement data requirement applies only
to relationships of the primary resource; explicitly preserve response semantics
for included resources.

jsonapi-java-core/src/test/groovy/io/github/kazemek/jsonapi/core/validation/UpdateRequestValidationSpec.groovy (1)

282-293: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a test for endpoint identity preservation across the with* methods.

Every call here applies withExpectedEndpointIdentity last. ValidationContext.withDocumentUsage, withLinksContext, and withSparseFieldsetException now copy expectedEndpointIdentity forward. If one of those copies were dropped, this suite would still pass.

💚 Proposed additional feature

+  def "expected endpoint identity survives context derivation"() {
+    given:
+    def base = ValidationContext.defaults()
+        .withExpectedEndpointIdentity(new EndpointIdentity("articles", "1"))
+
+    expect:
+    base.withDocumentUsage(DocumentUsage.UPDATE_REQUEST).expectedEndpointIdentity() ==
+        new EndpointIdentity("articles", "1")
+    base.withLinksContext(LinksContext.RESOURCE).expectedEndpointIdentity() ==
+        new EndpointIdentity("articles", "1")
+    base.withSparseFieldsetException(true).expectedEndpointIdentity() ==
+        new EndpointIdentity("articles", "1")
+  }

As per coding guidelines, "Add or update mirrored Spock tests for requested production behavior."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@jsonapi-java-core/src/test/groovy/io/github/kazemek/jsonapi/core/validation/UpdateRequestValidationSpec.groovy`
around lines 282 - 293, Extend the UpdateRequestValidationSpec coverage around
the existing matching endpoint identity test to apply withDocumentUsage,
withLinksContext, and withSparseFieldsetException after
withExpectedEndpointIdentity, then validate the document and assert no exception
is thrown. Ensure the test verifies expectedEndpointIdentity is preserved
through each with* method rather than setting it last.

Source: Coding guidelines

jsonapi-java-core/src/main/java/io/github/kazemek/jsonapi/core/validation/JsonApiDocumentValidator.java (1)

327-348: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Replace the path-string primary-scope test with an explicit parameter.

Both this method and validateResourceRelationships at line 157 detect the primary resource by comparing path to the "/data" literal. This couples an update-policy decision to pointer formatting. A future change to the primary pointer, or a new caller that passes an equivalent path, would silently disable the update rules. Pass a boolean primary flag from validatePrimaryData instead.

This is a maintainability improvement. Current behavior is correct because validatePrimaryData is the only caller that uses PATH_DATA, and update documents allow only single-resource primary data.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@jsonapi-java-core/src/main/java/io/github/kazemek/jsonapi/core/validation/JsonApiDocumentValidator.java`
around lines 327 - 348, Replace path-based primary-resource detection in
validateUpdateEndpointIdentity and validateResourceRelationships with an
explicit boolean primary parameter. Update validatePrimaryData to pass true for
the primary resource and pass false for relationship resources or other callers,
then base the update-policy checks on that flag instead of comparing path with
PATH_DATA. Preserve the existing validation behavior for primary update data.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes