Allow client to specify no include paths when server has default include paths

[lindyhopchris]

Where the server decides to use default include paths, i.e. when the client does not provide any include paths, there seems no way for the client to specify that it does not want any include paths.

I.e. these two requests:

GET /api/posts
GET /api/post?include

both use the default include paths. However, in the second one the client has specified no include paths, so none should be used... i.e. default include paths should only be used if the client has not provided an include query parameter.

This is potentially breaking though (i.e. if there are clients out there doing request with an empty include parameter), so probably needs to be fixed for 2.0.

[jelhan]

This should be considered a bug IMO as it violates JSON:API specification:

Inclusion of Related Resources

[...]

If an endpoint supports the include parameter and a client supplies it, the server MUST NOT include unrequested resource objects in the included section of the compound document.

https://jsonapi.org/format/#fetching-includes

[lindyhopchris]

Yeah agreed. I'll take another look at it to see if it can be fixed in a 1.x release...

[lindyhopchris]

This is not fixable in 1.x because the neomerx package uses the default include paths from the schema if the include paths from the encoding parameters are empty. I.e. there is no way for the client to indicate that it wants nothing included.

Parsing here:
https://github.com/neomerx/json-api/blob/c911b7494496e79f9de72ee40d6a2b791caaf95b/src/Http/Query/QueryParametersParser.php#L77-L83

And decision as to whether to use the defaults from the schema here:
https://github.com/neomerx/json-api/blob/c911b7494496e79f9de72ee40d6a2b791caaf95b/src/Encoder/Parameters/ParametersAnalyzer.php#L188-L201

Will have to investigate what happens in more recent versions of the neomerx encoder before deciding whether to raise an issue in that package.