From 7fa52be8618da6afc150f8572bd31550c7b1356e Mon Sep 17 00:00:00 2001
From: Kevin Ansfield <kevin@lookingsideways.co.uk>
Date: Thu, 5 Apr 2018 11:54:36 +0100
Subject: [PATCH] Don't send `created_by` and `updated_by` attrs in API
 requests

refs https://github.com/TryGhost/Ghost/issues/9548
- refactor serialisers to use `serialize` rather than `serializeToHash` to avoid code duplication
- strip `created_by` and `updated_by` attrs when serializing - Ghost will set these automatically based on the currently logged in user
---
 app/serializers/application.js | 10 ++++++++++
 app/serializers/post.js        | 29 ++++++++---------------------
 app/serializers/tag.js         | 13 ++++---------
 3 files changed, 22 insertions(+), 30 deletions(-)

diff --git a/app/serializers/application.js b/app/serializers/application.js
index 08669cdf38..91d954163a 100644
--- a/app/serializers/application.js
+++ b/app/serializers/application.js
@@ -3,6 +3,16 @@ import {decamelize} from '@ember/string';
 import {pluralize} from 'ember-inflector';
 
 export default RESTSerializer.extend({
+    serialize(/*snapshot, options*/) {
+        let json = this._super(...arguments);
+
+        // don't send attributes that are updated automatically on the server
+        delete json.created_by;
+        delete json.updated_by;
+
+        return json;
+    },
+
     serializeIntoHash(hash, type, record, options) {
         // Our API expects an id on the posted object
         options = options || {};
diff --git a/app/serializers/post.js b/app/serializers/post.js
index 08932b7492..4dfdc7ee8e 100644
--- a/app/serializers/post.js
+++ b/app/serializers/post.js
@@ -29,32 +29,19 @@ export default ApplicationSerializer.extend(EmbeddedRecordsMixin, {
         return this._super(...arguments);
     },
 
-    serializeIntoHash(hash, type, record, options) {
-        options = options || {};
-        options.includeId = true;
-
-        // We have a plural root in the API
-        let root = pluralize(type.modelName);
-
-        // TODO: this is throwing a warning when saving a new post:
-        // The embedded relationship 'tags' is undefined for 'post' with id 'null'.
-        // Please include it in your original payload.
-        //
-        // This appears to be an issue in Ember Data - needs further investigation
-        // and possibly an issue raised
-        let data = this.serialize(record, options);
+    serialize(/*snapshot, options*/) {
+        let json = this._super(...arguments);
 
         // Properties that exist on the model but we don't want sent in the payload
-
-        delete data.uuid;
-        delete data.html;
+        delete json.uuid;
+        delete json.html;
         // Inserted locally as a convenience.
-        delete data.author_id;
+        delete json.author_id;
         // Read-only virtual property.
-        delete data.url;
+        delete json.url;
         // Deprecated property (replaced with data.authors)
-        delete data.author;
+        delete json.author;
 
-        hash[root] = [data];
+        return json;
     }
 });
diff --git a/app/serializers/tag.js b/app/serializers/tag.js
index 7a9952f427..beffd55621 100644
--- a/app/serializers/tag.js
+++ b/app/serializers/tag.js
@@ -8,18 +8,13 @@ export default ApplicationSerializer.extend({
         updatedAtUTC: {key: 'updated_at'}
     },
 
-    serializeIntoHash(hash, type, record, options) {
-        options = options || {};
-        options.includeId = true;
-
-        let root = pluralize(type.modelName);
-        let data = this.serialize(record, options);
+    serialize(/*snapshot, options*/) {
+        let json = this._super(...arguments);
 
         // Properties that exist on the model but we don't want sent in the payload
+        delete json.count;
 
-        delete data.count;
-
-        hash[root] = [data];
+        return json;
     },
 
     // if we use `queryRecord` ensure we grab the first record to avoid