PATCH verb for model relation methods

[PaddyMann]

As of Loopback 3, we're told to use PATCH if we want to updateAttributes rather than replace an entire model.

Fine. So we've moved over to PATCH.

But I can't find any way to set up an ACL for a related model that I wish to update with a PATCH. If I define it with (e.g.) __update__account, then it's the PUT method that is activated. There doesn't seem to be an equivalent for PATCH.

Not clear if this is a bug or missing documentation (https://loopback.io/doc/en/lb3/Accessing-related-models.html).

The only workaround I can currently think of is to revert to using PUT and add replaceOnPUT to all my models. Wishing someone had added a simpler way of setting replaceOnPUT as default for all models if this is the case.

[jjhesk]

current version: LB 3.4

I have the same experience where I use PATCH as the request with header token fashion Authorization: $TOKEN_ID from the login token object. @PaddyMann @bajtos I have defined the ACL in such way

...

"acls": [
   {
     "accessType": "*",
     "principalType": "ROLE",
     "principalId": "$everyone",
     "permission": "DENY"
   },
   {
     "accessType": "READ",
     "principalType": "ROLE",
     "principalId": "$everyone",
     "permission": "ALLOW",
     "property": "find"
   },
   {
     "accessType": "READ",
     "principalType": "ROLE",
     "principalId": "$everyone",
     "permission": "ALLOW",
     "property": "findById"
   },
   {
     "accessType": "EXECUTE",
     "principalType": "ROLE",
     "principalId": "$authenticated",
     "permission": "ALLOW",
     "property": "update"
   },
   {
     "accessType": "EXECUTE",
     "principalType": "ROLE",
     "principalId": "admin",
     "permission": "ALLOW",
     "property": "listing"
   }
 ],
 "methods": [],
 "injectOptionsFromRemoteContext": true

It turns out that the request with patch still getting the 401 unauthorized error. is that a bug or there i still need to setup some other things?

[bajtos]

@PaddyMann

But I can't find any way to set up an ACL for a related model that I wish to update with a PATCH. If I define it with (e.g.) __update__account, then it's the PUT method that is activated. There doesn't seem to be an equivalent for PATCH.

From what I can tell by reading the source code, it seems the relation methods were not updated to use PATCH instead of PUT. See e.g.

loopback/lib/model.js

Lines 655 to 670 in cb7e211

	var updateByIdFunc = this.prototype['__updateById__' + relationName];
	define('__updateById__' + relationName, {
	isStatic: false,
	http: {verb: 'put', path: '/' + pathName + '/:fk'},
	accepts: [
	{arg: 'fk', type: 'any',
	description: format('Foreign key for %s', relationName),
	required: true,
	http: {source: 'path'}},
	{arg: 'data', type: 'object', model: toModelName, http: {source: 'body'}},
	{arg: 'options', type: 'object', http: 'optionsFromRequest'},
	],
	description: format('Update a related item by id for %s.', relationName),
	accessType: 'WRITE',
	returns: {arg: 'result', type: toModelName, root: true},
	}, updateByIdFunc);

I think this was an oversight on our side, IMO the relation methods should be using PATCH for partial update and PUT for full replace too.

@jjhesk

current version: LB 3.4
I have the same experience where I use PATCH as the request with header token fashion Authorization: $TOKEN_ID from the login token object. I have defined the ACL in such way (...)

This looks like an unrelated problem to me. Please open a new issue and provide us with a small app reproducing the problem - see our bug reporting instructions.

[PaddyMann]

OK - we've now reverted to PUT and replaceOnPUT so no urgency for me but would be good to see this fixed :)

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jcolemorrison]

We've wound up using with PUT as well for now on partial updates. PATCH still works on the top level, but with embedded relations, PUT seems to be the only way. I didn't need replaceOnPUT, so it must default to partial updates on PUT.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.