4

I am currently using @RestResource(exported = false) on all delete operations in a repository to hide delete requests. This is done explicitly in repositories extending JPA repository.

Is there a global switch to block all delete operations?

Pau
  • 14,917
  • 14
  • 67
  • 94
beeCoder
  • 495
  • 6
  • 24
  • You could have `interface ModelRepository extends CrudRepository { @RestResource(exported = false) void delete(ID id); @RestResource(exported = false) void delete(T entity); @RestResource(exported = false) void delete(Iterable extends T> entities); @RestRespource(exported = false) void deleteAll(); }` and then `interface MyRepository extends ModelRepository`. – manish Aug 14 '16 at 03:39
  • You can create a read-only repository, as described in this question: https://stackoverflow.com/questions/11107136/creating-a-read-only-repository-with-springdata – Jefferson Lima Nov 27 '18 at 19:24

2 Answers2

0

No. You need to annotate all your delete operations with @RestResource(exported = false).

Example from Spring data doc:

@RepositoryRestResource(path = "people", rel = "people")
interface PersonRepository extends CrudRepository<Person, Long> {

@Override
  @RestResource(exported = false)
  void delete(Long id);

  @Override
  @RestResource(exported = false)
  void delete(Person entity);
}

Explanation below:

If you want turn them off, then just keep in mind you have to annotate both versions with exported = false.

So by default, if there is not new you need to annotate all your operations. But if you are very interested at the moment you could perform your own annotation with a implementation which does it.

Pau
  • 14,917
  • 14
  • 67
  • 94
  • Thanks for the reply. I have another follow-up question. Does DELETE request on the association item calls this delete operation internally ? – beeCoder Aug 16 '16 at 21:54
  • I'm not sure if I understand the question. So if I understand it: `void delete(Person entity)` internally calls `void delete(ID id)` how? it extracts the ID from `entity` and then calls `void delete(ID id)` as next `delete(entityInformation.getId(entity));` – Pau Aug 17 '16 at 15:45
  • Delete on /{repository}/{id}/{property} internally calls findOne(id) -> BeforeLinkDeleteEvent -> Save() -> AfterLinkDeleteEvent. How to block such a request ? – beeCoder Aug 17 '16 at 20:24
0

As of 2018, there is now the ability to only expose repository methods explicitly declared for exposure

See RepositoryRestConfiguration

Snekse
  • 15,474
  • 10
  • 62
  • 77
  • If this is of interest to you, consider also upvoting this ticket https://jira.spring.io/browse/DATAREST-1034 – Snekse Mar 06 '18 at 18:25