Return conflict error for incorrect id in PATCH (#298)

Author: wwwdata

api.go

@@ -699,6 +699,12 @@ func (res *resource) handleUpdate(c APIContexter, w http.ResponseWriter, r *http
 		return NewHTTPError(nil, err.Error(), http.StatusNotAcceptable)
 	}
 
+	identifiable, ok := updatingObj.Interface().(jsonapi.MarshalIdentifier)
+	if !ok || identifiable.GetID() != id {
+		conflictError := errors.New("id in the resource does not match servers endpoint")
+		return NewHTTPError(conflictError, conflictError.Error(), http.StatusConflict)
+	}
+
 	response, err := source.Update(updatingObj.Interface(), buildRequest(c, r))
 
 	if err != nil {

api_test.go

@@ -863,8 +863,8 @@ var _ = Describe("RestHandler", func() {
 			Expect(err).To(BeNil())
 			api.Handler().ServeHTTP(rec, req)
 			// It's up to the user how to implement this. Api2go just checks if the type is correct
-			Expect(rec.Code).To(Equal(http.StatusNotFound))
-			Expect(string(rec.Body.Bytes())).To(MatchJSON(`{"errors":[{"status":"404","title":"post not found"}]}`))
+			Expect(rec.Code).To(Equal(http.StatusConflict))
+			Expect(string(rec.Body.Bytes())).To(MatchJSON(`{"errors":[{"status":"409","title":"id in the resource does not match servers endpoint"}]}`))
 		})
 
 		It("POST without type returns 406", func() {
@@ -896,6 +896,15 @@ var _ = Describe("RestHandler", func() {
 				Expect(target.Value).To(Equal(null.FloatFrom(2)))
 			})
 
+			It("Update fails with incorrect id in payload", func() {
+				reqBody := strings.NewReader(`{"data": {"id": "2", "attributes": {"title": "New Title"}, "type": "posts"}}`)
+				req, err := http.NewRequest("PATCH", "/v1/posts/1", reqBody)
+				Expect(err).To(BeNil())
+				api.Handler().ServeHTTP(rec, req)
+				Expect(rec.Code).To(Equal(http.StatusConflict))
+				Expect(string(rec.Body.Bytes())).To(MatchJSON(`{"errors":[{"status":"409","title":"id in the resource does not match servers endpoint"}]}`))
+			})
+
 			It("UPDATEs correctly using null.* values", func() {
 				target := source.posts["1"]
 				target.Value = null.FloatFrom(2)