Fixed: use intersection on serialize sparse fieldset from ResourceDefinition. This hides forced included fields from output, but still fetches them.

Author: Bart Koelman

src/JsonApiDotNetCore/Models/ResourceDefinition.cs

@@ -142,11 +142,17 @@ public virtual PaginationExpression OnApplyPagination(PaginationExpression exist
         /// Tip: Use <see cref="SparseFieldSetExtensions.Including{TResource}"/> and <see cref="SparseFieldSetExtensions.Excluding{TResource}"/>
         /// to safely change the fieldset without worrying about nulls.
         /// </summary>
-        /// <param name="existingSparseFieldSet">
-        /// An optional existing sparse fieldset, coming from query string. Can be <c>null</c>.
+        /// <remarks>
+        /// This method executes twice for a single request: first to select which fields to retrieve from the data store and then to
+        /// select which fields to serialize. Including extra fields from this method will retrieve them, but not include them in the json output.
+        /// This enables you to expose calculated properties whose value depends on a field that is not in the sparse fieldset.
+        /// </remarks>
+        /// <param name="existingSparseFieldSet">The incoming sparse fieldset from query string.
+        /// At query execution time, this is <c>null</c> if the query string contains no sparse fieldset.
+        /// At serialization time, this contains all viewable fields if the query string contains no sparse fieldset.
         /// </param>
         /// <returns>
-        /// The new sparse fieldset, or <c>null</c> to disable the existing sparse fieldset and select all fields.
+        /// The new sparse fieldset, or <c>null</c> to discard the existing sparse fieldset and select all viewable fields.
         /// </returns>
         public virtual SparseFieldSetExpression OnApplySparseFieldSet(SparseFieldSetExpression existingSparseFieldSet)
         {

src/JsonApiDotNetCore/Serialization/Server/Contracts/IFieldsToSerialize.cs

@@ -15,11 +15,11 @@ namespace JsonApiDotNetCore.Serialization.Server
     public interface IFieldsToSerialize
     {
         /// <summary>
-        /// Gets the list of attributes that are to be serialized for resource of type <paramref name="type"/>.
+        /// Gets the list of attributes that are to be serialized for resource of type <paramref name="resourceType"/>.
         /// If <paramref name="relationship"/> is non-null, it will consider the allowed list of attributes
         /// as an included relationship.
         /// </summary>
-        IReadOnlyCollection<AttrAttribute> GetAttributes(Type type, RelationshipAttribute relationship = null);
+        IReadOnlyCollection<AttrAttribute> GetAttributes(Type resourceType, RelationshipAttribute relationship = null);
 
         /// <summary>
         /// Gets the list of relationships that are to be serialized for resource of type <paramref name="type"/>.

src/JsonApiDotNetCore/Serialization/Server/FieldsToSerialize.cs

@@ -28,7 +28,7 @@ public FieldsToSerialize(
         }
 
         /// <inheritdoc/>
-        public IReadOnlyCollection<AttrAttribute> GetAttributes(Type type, RelationshipAttribute relationship = null)
+        public IReadOnlyCollection<AttrAttribute> GetAttributes(Type resourceType, RelationshipAttribute relationship = null)
         {   
             var sparseFieldSetAttributes = _constraintProviders
                 .SelectMany(p => p.GetConstraints())
@@ -42,23 +42,35 @@ public IReadOnlyCollection<AttrAttribute> GetAttributes(Type type, RelationshipA
 
             if (!sparseFieldSetAttributes.Any())
             {
-                sparseFieldSetAttributes = _resourceGraph.GetAttributes(type).ToHashSet();
+                sparseFieldSetAttributes = GetViewableAttributes(resourceType);
             }
 
-            sparseFieldSetAttributes.RemoveWhere(attr => !attr.Capabilities.HasFlag(AttrCapabilities.AllowView));
-
-            var resourceDefinition = _resourceDefinitionProvider.Get(type);
+            var resourceDefinition = _resourceDefinitionProvider.Get(resourceType);
             if (resourceDefinition != null)
             {
-                var tempExpression = sparseFieldSetAttributes.Any() ? new SparseFieldSetExpression(sparseFieldSetAttributes) : null;
-                tempExpression = resourceDefinition.OnApplySparseFieldSet(tempExpression);
+                var inputExpression = sparseFieldSetAttributes.Any() ? new SparseFieldSetExpression(sparseFieldSetAttributes) : null;
+                var outputExpression = resourceDefinition.OnApplySparseFieldSet(inputExpression);
 
-                sparseFieldSetAttributes = tempExpression == null ? new HashSet<AttrAttribute>() : tempExpression.Attributes.ToHashSet();
+                if (outputExpression == null)
+                {
+                    sparseFieldSetAttributes = GetViewableAttributes(resourceType);
+                }
+                else
+                {
+                    sparseFieldSetAttributes.IntersectWith(outputExpression.Attributes);
+                }
             }
 
             return sparseFieldSetAttributes;
         }
 
+        private HashSet<AttrAttribute> GetViewableAttributes(Type resourceType)
+        {
+            return _resourceGraph.GetAttributes(resourceType)
+                .Where(attr => attr.Capabilities.HasFlag(AttrCapabilities.AllowView))
+                .ToHashSet();
+        }
+
         /// <inheritdoc/>
         /// <remarks>
         /// Note: this method does NOT check if a relationship is included to determine

test/JsonApiDotNetCoreExampleTests/IntegrationTests/ResourceDefinitions/CallableResource.cs

@@ -13,6 +13,9 @@ public sealed class CallableResource : Identifiable
         [Attr]
         public int PercentageComplete { get; set; }
 
+        [Attr]
+        public string Status => $"{PercentageComplete}% completed.";
+
         [Attr]
         public int RiskLevel { get; set; }
 

test/JsonApiDotNetCoreExampleTests/IntegrationTests/ResourceDefinitions/CallableResourceDefinition.cs

@@ -68,7 +68,7 @@ public override PaginationExpression OnApplyPagination(PaginationExpression exis
 
         public override SparseFieldSetExpression OnApplySparseFieldSet(SparseFieldSetExpression existingSparseFieldSet)
         {
-            // Use case: always include percentageComplete and never include riskLevel in responses.
+            // Use case: always retrieve percentageComplete and never include riskLevel in responses.
 
             return existingSparseFieldSet
                 .Including<CallableResource>(resource => resource.PercentageComplete, ResourceGraph)

test/JsonApiDotNetCoreExampleTests/IntegrationTests/ResourceDefinitions/ResourceDefinitionQueryCallbackTests.cs

@@ -295,7 +295,7 @@ await _testContext.RunOnDatabaseAsync(async dbContext =>
                 await dbContext.SaveChangesAsync();
             });
 
-            var route = $"/callableResources/{resource.StringId}?fields=label";
+            var route = $"/callableResources/{resource.StringId}?fields=label,status";
 
             // Act
             var (httpResponse, responseDocument) = await _testContext.ExecuteGetAsync<Document>(route);
@@ -306,7 +306,8 @@ await _testContext.RunOnDatabaseAsync(async dbContext =>
             responseDocument.SingleData.Should().NotBeNull();
             responseDocument.SingleData.Id.Should().Be(resource.StringId);
             responseDocument.SingleData.Attributes["label"].Should().Be(resource.Label);
-            responseDocument.SingleData.Attributes["percentageComplete"].Should().Be(resource.PercentageComplete);
+            responseDocument.SingleData.Attributes.Should().NotContainKey("percentageComplete");
+            responseDocument.SingleData.Attributes["status"].Should().Be("5% completed.");
         }
 
         [Fact]