Restrict Clan creation

[IDragonfire]

It should not be possible to create Clan Entities over the JSON API.
Instead the ClanController should be used ...
https://github.com/FAForever/faf-java-api/blob/develop/src/main/java/com/faforever/api/clan/ClansController.java#L59

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[Brutus5000]

What exactly happens? Maybe we can handle adding the clan leader by adding a @OnCreatePostCommit as described here?

[IDragonfire]

We have a invalid clan... I think the validation will fail... The elide annotations looks new... Did you test them? Because jpa annotation have some restrictions http://www.objectdb.com/java/jpa/persistence/event e. G. Is it not allowed to use an Entity manager or Query.
I am also not sure if this is against the rest principle... You request the creation of one Ressource and two are created...

[Brutus5000]

No I did not test it, I just saw it in the docs.

You can't have a clan without a clan leader and you can't have a clan leader without a clan. I see no problem there. Furthermore even if it against the REST principle, moving it to a controller URL does not change anything about the semantics.

[IDragonfire]

The clan leader is not the problem... The clan leader must be member of a clan and every clan need at least one member... The validation of the clan will fail because no members exists and you can not add members because the clan doesn't exist

[Brutus5000]

Yeah so? That is a basic problem with referential integrity across all databases and need to be done inside a transaction. Sounds like a job for @OnCreatePreCommit This annotation executes after the object is created and all security checks are evaluated on the server-side but before it is committed/persisted in the backend.

[IDragonfire]

Any idea how I can get the player and clan repository? It looks like a bad idea to include the repository in every entitiy ...
The clan repository is needed to check if the tag and name is unique.
The player repository is needed to get the player out of the request scope.

Test Branch https://github.com/FAForever/faf-java-api/tree/feature/108-clan-commit
Commit 7a884bc#diff-b1ca2e9e0e3deff624edda7e40f83888R111

[Brutus5000]

After intense research I come to the conclusion that the Elide extensions are not suited for this use case. We could use Hibernate's extensions like PreCommit instead.

[Brutus5000]

Using Hibernate entity listeners works and I will move clan creation back to the Elide route. See #362