src/RestfulServer.php
protected function getHandler($className, $id, $relationName)
    {
        $sort = '';

        if ($this->request->getVar('sort')) {
            $dir = $this->request->getVar('dir');
            $sort = array($this->request->getVar('sort') => ($dir ? $dir : 'ASC'));
        }

        $limit = array(
            'start' => $this->request->getVar('start'),
            'limit' => $this->request->getVar('limit')
        );

        $params = $this->request->getVars();

        $responseFormatter = $this->getResponseDataFormatter($className);
        if (!$responseFormatter) {
            return $this->unsupportedMediaType();
        }

        // $obj can be either a DataObject or a SS_List,
        // depending on the request
        if ($id) {
            // Format: /api/v1/<MyClass>/<ID>
            $obj = $this->getObjectQuery($className, $id, $params)->First();
            if (!$obj) {
                return $this->notFound();
            }
            if (!$obj->canView($this->getMember())) {
                return $this->permissionFailure();
            }

            // Format: /api/v1/<MyClass>/<ID>/<Relation>
            if ($relationName) {
                $obj = $this->getObjectRelationQuery($obj, $params, $sort, $limit, $relationName);
                if (!$obj) {
                    return $this->notFound();
                }

                // TODO Avoid creating data formatter again for relation class (see above)
                $responseFormatter = $this->getResponseDataFormatter($obj->dataClass());
            }
        } else {
            // Format: /api/v1/<MyClass>
            $obj = $this->getObjectsQuery($className, $params, $sort, $limit);
        }

        $this->getResponse()->addHeader('Content-Type', $responseFormatter->getOutputContentType());

        $rawFields = $this->request->getVar('fields');
        $realFields = $responseFormatter->getRealFields($className, explode(',', $rawFields));
        $fields = $rawFields ? $realFields : null;

        if ($obj instanceof SS_List) {
            $objs = ArrayList::create($obj->toArray());
            foreach ($objs as $obj) {
                if (!$obj->canView($this->getMember())) {
                    $objs->remove($obj);
                }
            }
            $responseFormatter->setTotalSize($objs->count());
            return $responseFormatter->convertDataObjectSet($objs, $fields);
        }

        if (!$obj) {
            $responseFormatter->setTotalSize(0);
            return $responseFormatter->convertDataObjectSet(new ArrayList(), $fields);
        }

        return $responseFormatter->convertDataObject($obj, $fields);
    }
protected function getHandler($className, $id, $relationName)
    {
        $sort = '';

        if ($this->request->getVar('sort')) {
            $dir = $this->request->getVar('dir');
            $sort = array($this->request->getVar('sort') => ($dir ? $dir : 'ASC'));
        }

        $limit = array(
            'start' => $this->request->getVar('start'),
            'limit' => $this->request->getVar('limit')
        );

        $params = $this->request->getVars();

        $responseFormatter = $this->getResponseDataFormatter($className);
        if (!$responseFormatter) {
            return $this->unsupportedMediaType();
        }

        // $obj can be either a DataObject or a SS_List,
        // depending on the request
        if ($id) {
            // Format: /api/v1/<MyClass>/<ID>
            $obj = $this->getObjectQuery($className, $id, $params)->First();
            if (!$obj) {
                return $this->notFound();
            }
            if (!$obj->canView($this->getMember())) {
                return $this->permissionFailure();
            }

            // Format: /api/v1/<MyClass>/<ID>/<Relation>
            if ($relationName) {
                $obj = $this->getObjectRelationQuery($obj, $params, $sort, $limit, $relationName);
                if (!$obj) {
                    return $this->notFound();
                }

                // TODO Avoid creating data formatter again for relation class (see above)
                $responseFormatter = $this->getResponseDataFormatter($obj->dataClass());
            }
        } else {
            // Format: /api/v1/<MyClass>
            $obj = $this->getObjectsQuery($className, $params, $sort, $limit);
        }

        $this->getResponse()->addHeader('Content-Type', $responseFormatter->getOutputContentType());

        $rawFields = $this->request->getVar('fields');
        $realFields = $responseFormatter->getRealFields($className, explode(',', $rawFields));
        $fields = $rawFields ? $realFields : null;

        if ($obj instanceof SS_List) {
            $objs = ArrayList::create($obj->toArray());
            foreach ($objs as $obj) {
                if (!$obj->canView($this->getMember())) {
                    $objs->remove($obj);
                }
            }
            $responseFormatter->setTotalSize($objs->count());
            return $responseFormatter->convertDataObjectSet($objs, $fields);
        }

        if (!$obj) {
            $responseFormatter->setTotalSize(0);
            return $responseFormatter->convertDataObjectSet(new ArrayList(), $fields);
        }

        return $responseFormatter->convertDataObject($obj, $fields);
    }
protected function getHandler ( $ className , $ id , $ relationName ) { $ sort = '' ; if ( $ this -> request -> getVar ( 'sort' ) ) { $ dir = $ this -> request -> getVar ( 'dir' ) ; $ sort = array ( $ this -> request -> getVar ( 'sort' ) => ( $ dir ? $ dir : 'ASC' ) ) ; } $ limit = array ( 'start' => $ this -> request -> getVar ( 'start' ) , 'limit' => $ this -> request -> getVar ( 'limit' ) ) ; $ params = $ this -> request -> getVars ( ) ; $ responseFormatter = $ this -> getResponseDataFormatter ( $ className ) ; if ( ! $ responseFormatter ) { return $ this -> unsupportedMediaType ( ) ; } // $obj can be either a DataObject or a SS_List, // depending on the request if ( $ id ) { // Format: /api/v1/<MyClass>/<ID> $ obj = $ this -> getObjectQuery ( $ className , $ id , $ params ) -> First ( ) ; if ( ! $ obj ) { return $ this -> notFound ( ) ; } if ( ! $ obj -> canView ( $ this -> getMember ( ) ) ) { return $ this -> permissionFailure ( ) ; } // Format: /api/v1/<MyClass>/<ID>/<Relation> if ( $ relationName ) { $ obj = $ this -> getObjectRelationQuery ( $ obj , $ params , $ sort , $ limit , $ relationName ) ; if ( ! $ obj ) { return $ this -> notFound ( ) ; } // TODO Avoid creating data formatter again for relation class (see above) $ responseFormatter = $ this -> getResponseDataFormatter ( $ obj -> dataClass ( ) ) ; } } else { // Format: /api/v1/<MyClass> $ obj = $ this -> getObjectsQuery ( $ className , $ params , $ sort , $ limit ) ; } $ this -> getResponse ( ) -> addHeader ( 'Content-Type' , $ responseFormatter -> getOutputContentType ( ) ) ; $ rawFields = $ this -> request -> getVar ( 'fields' ) ; $ realFields = $ responseFormatter -> getRealFields ( $ className , explode ( ',' , $ rawFields ) ) ; $ fields = $ rawFields ? $ realFields : null ; if ( $ obj instanceof SS_List ) { $ objs = ArrayList :: create ( $ obj -> toArray ( ) ) ; foreach ( $ objs as $ obj ) { if ( ! $ obj -> canView ( $ this -> getMember ( ) ) ) { $ objs -> remove ( $ obj ) ; } } $ responseFormatter -> setTotalSize ( $ objs -> count ( ) ) ; return $ responseFormatter -> convertDataObjectSet ( $ objs , $ fields ) ; } if ( ! $ obj ) { $ responseFormatter -> setTotalSize ( 0 ) ; return $ responseFormatter -> convertDataObjectSet ( new ArrayList ( ) , $ fields ) ; } return $ responseFormatter -> convertDataObject ( $ obj , $ fields ) ; }
Handler for object read.

The data object will be returned in the following format:

<ClassName>
<FieldName>Value</FieldName>
...
<HasOneRelName id="ForeignID" href="LinkToForeignRecordInAPI" />
...
<HasManyRelName>
<ForeignClass id="ForeignID" href="LinkToForeignRecordInAPI" />
<ForeignClass id="ForeignID" href="LinkToForeignRecordInAPI" />
</HasManyRelName>
...
<ManyManyRelName>
<ForeignClass id="ForeignID" href="LinkToForeignRecordInAPI" />
<ForeignClass id="ForeignID" href="LinkToForeignRecordInAPI" />
</ManyManyRelName>
</ClassName>

Access is controlled by two variables:

- static $api_access must be set. This enables the API on a class by class basis
- $obj->canView() must return true. This lets you implement record-level security

@todo Access checking

@param string $className
@param Int $id
@param string $relation
@return string The serialized representation of the requested object(s) - usually XML or JSON.
Handler for object read .