{"action":"created","issue":{"url":"https://api.github.com/repos/colymba/silverstripe-restfulapi/issues/43","labels_url":"https://api.github.com/repos/colymba/silverstripe-restfulapi/issues/43/labels{/name}","comments_url":"https://api.github.com/repos/colymba/silverstripe-restfulapi/issues/43/comments","events_url":"https://api.github.com/repos/colymba/silverstripe-restfulapi/issues/43/events","html_url":"https://github.com/colymba/silverstripe-restfulapi/issues/43","id":88419526,"number":43,"title":"Add a callback handler to check incoming payload data before writing.","user":{"login":"bummzack","id":1006185,"avatar_url":"https://avatars.githubusercontent.com/u/1006185?v=3","gravatar_id":"","url":"https://api.github.com/users/bummzack","html_url":"https://github.com/bummzack","followers_url":"https://api.github.com/users/bummzack/followers","following_url":"https://api.github.com/users/bummzack/following{/other_user}","gists_url":"https://api.github.com/users/bummzack/gists{/gist_id}","starred_url":"https://api.github.com/users/bummzack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bummzack/subscriptions","organizations_url":"https://api.github.com/users/bummzack/orgs","repos_url":"https://api.github.com/users/bummzack/repos","events_url":"https://api.github.com/users/bummzack/events{/privacy}","received_events_url":"https://api.github.com/users/bummzack/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-06-15T12:56:25Z","updated_at":"2015-06-22T10:00:07Z","closed_at":null,"body":"When serializing data, there's a callback `onBeforeSerialize` and `onAfterSerialize` which allows a developer to control what gets sent to the client.\r\n\r\nI'm missing something similar in the case of updating records, where I'd love to inspect incoming payload before writing it to the DataObject.\r\n\r\nImagine a DataObject which has some fields that should not be allowed to be modified via REST. Of course I can hide the fields from being serialized, but with proper knowledge of the system, a request could still contain field values which are undesirable.\r\n\r\nLet's assume the following:\r\n\r\n    MyDataObject\r\n        AllowedProperty: Varchar\r\n        has_one: Member\r\n\r\nA user could PUT another Member ID to the DataObject, because there's currently no way for a developer to prevent updating of fields that shouldn't be updated via the REST API. Writing a `onBeforeWrite` hook is cumbersome and affects all writes (not only the ones via REST API)\r\n\r\nI'd propose something like this in [RESTfulAPI_DefaultQueryHandler.php (Line 412)](https://github.com/colymba/silverstripe-restfulapi/blob/master/code/queryHandlers/RESTfulAPI_DefaultQueryHandler.php#L412)\r\n\r\n    if( method_exists($model, 'onBeforeApplyPayload') )\r\n    {\r\n      $model->onBeforeApplyPayload($payload);\r\n    }\r\n    $model->extend('onBeforeApplyPayload');\r\n\r\nA developer could then sanitize incoming data if neede.\r\nI'd be interested in your thoughts about this. Can create a PR if wanted."},"comment":{"url":"https://api.github.com/repos/colymba/silverstripe-restfulapi/issues/comments/114055958","html_url":"https://github.com/colymba/silverstripe-restfulapi/issues/43#issuecomment-114055958","issue_url":"https://api.github.com/repos/colymba/silverstripe-restfulapi/issues/43","id":114055958,"user":{"login":"bummzack","id":1006185,"avatar_url":"https://avatars.githubusercontent.com/u/1006185?v=3","gravatar_id":"","url":"https://api.github.com/users/bummzack","html_url":"https://github.com/bummzack","followers_url":"https://api.github.com/users/bummzack/followers","following_url":"https://api.github.com/users/bummzack/following{/other_user}","gists_url":"https://api.github.com/users/bummzack/gists{/gist_id}","starred_url":"https://api.github.com/users/bummzack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bummzack/subscriptions","organizations_url":"https://api.github.com/users/bummzack/orgs","repos_url":"https://api.github.com/users/bummzack/repos","events_url":"https://api.github.com/users/bummzack/events{/privacy}","received_events_url":"https://api.github.com/users/bummzack/received_events","type":"User","site_admin":false},"created_at":"2015-06-22T10:00:07Z","updated_at":"2015-06-22T10:00:07Z","body":"Awesome. Will send a PR for the deserialize hooks shortly."}}