The fix for DATAREST-1535 has changed the default allowed methods for CORS requests to a smaller set than we originally returned. This commit reinstantiates the default to be set to all HTTP methods, Spring Data repositories support by default.
Related tickets: DATAREST-1535.
Moved off Spring Framework deprecations for HttpMessageNotReadableException. This required some rearrangements of method signatures for types (hopefully) exclusively used by internal abstractions (some public, but not very friendly for user extension in the first place).
Switched to consistent use of Pageable.unpaged() instead of null. Switched to the use of new factory methods in Spring HATEOAS. Some Java 8 based improvements in request handling to simplify the implementation code. Deprecation of code that got obsolete due to the use of the factory methods.
Moved off some deprecations in Jackson APIs.
Removed a couple of unused imports. General avoidance of common warnings. Suppression where needed. Removed dead code in configuration.
Correct a regression regarding association links. Introduce several test cases to prove this situation is fixed regarding PUTs for association links.
Source of the bug: 554d6cb27b (diff-1d7c16fe1992fef13a47fa8ab8599718L317) flips the criteria from "not single" to "single" without checking for related impacts.
We now rely on the MessageResolver capabilities of Spring HATEOAS to benefit of the optimizations in resource bundle resolution. Tweaked a couple of tests to make sure they properly use the resolver resorting to the default message the MessageResourceResolvable exposes.
We now enable CORS handling for all requests by overriding the newly introduced hasCorsConfigurationSource method. We cannot detect CORS configuration handling solely on the handler but require path headers to resolve repository interface mappings.
Adapted RepositoryRestMvcConfiguration to now create a shared fallback ObjectMapper and avoid to register it as Spring Bean. Adapted test cases that previously were relying on such a bean being present.
Adapted test cases to verify on the correct ALPS document structure (see spring-projects/spring-hateoas#665).
ExposureConfiguration exposes methods to register AggregateResourceHttpMethodsFilter and AssociationResourceHttpMethodsFilter (both applied by type or globally) to customize the supported HTTP methods by collection, item and association resources. It also provides shortcuts for common use cases like disabling PUT for item resources etc.
We now recommend to implement RepositoryRestConfigurer directly as its declared methods are now default methods. We also introduced a static factory method to easily create a configurer to customize RepositoryRestConfiguration via a Lambda expression.
Moved test case setups that use that deprecated API to the new one.
The default exposure of repository methods is now controlled via RepositoryRestConfiguration.setExposeRepositoryMethodsByDefault(…). That allows us to remove the additional API from RepositoryDetectionStrategy as the mere detection is an orthogonal topic.
Also added RepositoryRestConfiguration.disableDefaultExposure() to set the RepositoryDetectionStategy to ANNOTATED and disables default method exposure in one go. That can be exposed via a Spring Boot configuration property downstream.
Spring Framework 5.0.2 changes the default for the Allow-Credentials header to false. We now adapted our test case to that and also drop the expectation to see the request URL in the Allow-Origin header as that is only returned if Allow-Credentials is true, which it now isn't by default.
Additional cleanups in QuerydslAwareRootResourceInformationHandlerMethodArgumentResolver to make sure a QuerydslRepositoryInvokerAdapter is only applied if the QuerydslPredicateBuilder actually exposes a predicate. Extracted a couple of methods to make sure the mapping pipeline reads nicely.
We now allow sorting by properties of embedded objects. An embedded object is not linkable to a root object but embedded in the resource itself. If any part of the sort property path points to a linkable association, the whole sort property path is discarded silently and not used for sorting any further.
Original pull request: #251.
We now interpret If-None-Match and If-Modified-Since headers on requests to resources backed by query methods returning a single instance only. This allows clients to optimize GET requests to those resources to save bandwidth.
We now support nested Sort properties considering Jackson mapping. Sort translation is optional and skipped if the domain class is not resolvable. Translation in the scope of a domain class maps property paths to apply sorting using embedded properties.
A sort string `nested-name` resolves to a property path `anotherWrap.embedded.name`.
class Aggregate {
@JsonUnwrapped
public UnwrapEmbedded anotherWrap;
}
class UnwrapEmbedded {
@JsonUnwrapped(prefix = "nested-")
public Embedded embedded;
}
class Embedded {
public String name;
}
Original pull request: #232.
The serializer for projection resources now also invokes ResourceProcessor instances registered for that particular projection.
Original pull request: #238.
Removed RepositoryRestConfiguration.addCorsMapping(…) as we currently don't have any other shortcut methods for configuration like this.
Tweaked the setup of (now Repository)CorsConfigurationAccessor to be created earlier so that we avoid recreation for every lookup. Introduced a NoOpStringValueResolver to be used by default so that we don't need to deal with the case of the resolver being null at the end of the call chain. Replaced constructor of RepositoryCorsConfigurationAccessor with corresponding Lombok annotation.
Updated reference documentation accordingly.
Original pull request: #233.
We now support CORS configuration mechanisms introduced in Spring 4.2. CORS can be configured on multiple levels: Repository interface, Repository REST controller and global level. Spring Data REST CORS configuration is isolated so Spring Web MVC'S CORS configuration does not apply to Spring Data REST resources.
Multiple configuration sources are merged so different aspects of CORS can be configured in separate locations.
@CrossOrigin
interface PersonRepository extends CrudRepository<Person, Long> {}
@RepositoryRestController
@RequestMapping("/person")
public class PersonController {
@CrossOrigin(maxAge = 3600)
@RequestMapping(method = RequestMethod.GET, "/xml/{id}", produces = MediaType.APPLICATION_XML_VALUE)
public Person retrieve(@PathVariable Long id) {
// ...
}
}
@Component
public class SpringDataRestCustomization extends RepositoryRestConfigurerAdapter {
@Override
public void configureRepositoryRestConfiguration(RepositoryRestConfiguration config) {
config.addCorsMapping("/person/**")
.allowedOrigins("http://domain2.com")
.allowedMethods("PUT", "DELETE")
.allowedHeaders("header1", "header2", "header3")
.exposedHeaders("header1", "header2")
.allowCredentials(false).maxAge(3600);
}
}
We now resolve default configured Pageable without dropping them if their Sort is empty. Previously, any default Pageable was dropped if its Sort was empty which caused null being handed to controller methods of @RepositoryRestController instances.
Original pull request: #231.
Switched to use @RequiredArgsConstructor where possible. Slightly rearranged test cases. Inlined JacksonMappingAwareSortTranslator to not expose it as bean unless necessary. Use static Jackson BeanClassIntrospector to avoid unnecessary recreation.
Original pull request: #222.
We now consider Jackson field names when resolving Sort arguments. Domain model properties annotated with @JsonProperty("sales") can be specified by their Jackson-mapped field name in sort arguments. Field names are mapped to their according persistent property names to be used in repository query method sorting. Unknown field names are silently dropped.
Original pull request: #222.
