Merge pull request #14734 from jntullo/bz/expand_attributes

Return only requested attributes

app/controllers/api/base_controller/parameters.rb

@@ -44,8 +44,10 @@ def attribute_format(attr)
       end
 
       def attribute_selection
-        if !@req.attributes.empty? || @additional_attributes
-          @req.attributes | Array(@additional_attributes) | ID_ATTRS
+        if @req.attributes.empty? && @additional_attributes
+          Array(@additional_attributes) | ID_ATTRS
+        elsif !@req.attributes.empty?
+          @req.attributes | ID_ATTRS
         else
           "all"
         end

app/controllers/api/base_controller/renderer.rb

@@ -192,7 +192,24 @@ def expand_subcollections(json, type, resource)
       end
 
       def expand_subcollection?(sc, target)
-        respond_to?(target) && (@req.expand?(sc) || collection_config.show?(sc))
+        return false unless respond_to?(target) # If there's no query method, no need to go any further
+        expand_resources?(sc) || expand_action_resource?(sc) || resource_requested?(sc)
+      end
+
+      # Expand if: expand='resources' && no attributes specified && subcollection is configured
+      def expand_resources?(sc)
+        @req.expand?('resources') && @req.attributes.empty? && collection_config.show?(sc)
+      end
+
+      # Expand if: resource is being returned and subcollection is configured
+      # IE an update to /service_catalogs expects service_templates as part of its resource
+      def expand_action_resource?(sc)
+        @req.method != :get && collection_config.show?(sc)
+      end
+
+      # Expand if: explicitly requested
+      def resource_requested?(sc)
+        @req.expand?(sc)
       end
 
       #

spec/requests/api/automate_spec.rb

@@ -28,6 +28,15 @@
       )
     end
 
+    it 'returns only the requested attributes' do
+      api_basic_authorize action_identifier(:automate, :read, :collection_actions, :get)
+
+      run_get automate_url, :expand => 'resources', :attributes => 'name'
+
+      expect(response).to have_http_status(:ok)
+      response.parsed_body['resources'].each { |res| expect_hash_to_have_only_keys(res, %w(fqname name)) }
+    end
+
     it "default to depth 0 for non-root queries" do
       api_basic_authorize action_identifier(:automate, :read, :collection_actions, :get)
 

spec/requests/api/categories_spec.rb

@@ -46,6 +46,16 @@
     expect(response).to have_http_status(:ok)
   end
 
+  it "will only return the requested attributes" do
+    FactoryGirl.create(:category, :example_text => 'foo')
+    api_basic_authorize collection_action_identifier(:categories, :read, :get)
+
+    run_get categories_url, :expand => 'resources', :attributes => 'example_text'
+
+    expect(response).to have_http_status(:ok)
+    response.parsed_body['resources'].each { |res| expect_hash_to_have_only_keys(res, %w(href id example_text)) }
+  end
+
   it "can list all the tags under a category" do
     classification = FactoryGirl.create(:classification_tag)
     category = FactoryGirl.create(:category, :children => [classification])

spec/requests/api/reports_spec.rb

@@ -17,6 +17,16 @@
     expect(response).to have_http_status(:ok)
   end
 
+  it 'returns only the requested attributes' do
+    FactoryGirl.create(:miq_report_with_results)
+    api_basic_authorize collection_action_identifier(:reports, :read, :get)
+
+    run_get reports_url, :expand => 'resources', :attributes => 'template_type'
+
+    expect(response).to have_http_status(:ok)
+    response.parsed_body['resources'].each { |res| expect_hash_to_have_only_keys(res, %w(href id template_type)) }
+  end
+
   it "can fetch a report" do
     report = FactoryGirl.create(:miq_report_with_results)
 

spec/requests/api/roles_spec.rb

@@ -80,6 +80,15 @@ def test_features_query(role, role_url, klass, attr = :id)
                                 :miq_product_features => @product_features)
       test_features_query(role, roles_url(role.id), MiqProductFeature, :identifier)
     end
+
+    it 'returns only the requested attributes' do
+      api_basic_authorize action_identifier(:roles, :read, :collection_actions, :get)
+
+      run_get roles_url, :expand => 'resources', :attributes => 'name'
+
+      expect(response).to have_http_status(:ok)
+      response.parsed_body['resources'].each { |res| expect_hash_to_have_only_keys(res, %w(href id name)) }
+    end
   end
 
   describe "Roles create" do

spec/requests/api/service_catalogs_spec.rb

@@ -24,6 +24,18 @@ def sc_templates_url(id, st_id = nil)
     st_id ? "#{st_base}/#{st_id}" : st_base
   end
 
+  describe "Service Catalog Index" do
+    it "will return only the requested attributes" do
+      FactoryGirl.create(:service_template_catalog)
+      api_basic_authorize collection_action_identifier(:service_catalogs, :read, :get)
+
+      run_get service_catalogs_url, :expand => 'resources', :attributes => 'name'
+
+      expect(response).to have_http_status(:ok)
+      response.parsed_body['resources'].each { |res| expect_hash_to_have_only_keys(res, %w(href id name)) }
+    end
+  end
+
   describe "Service Catalogs create" do
     it "rejects resource creation without appropriate role" do
       api_basic_authorize