Field marked as READ_ONLY in JsonUnwrapped should not be writable

micronaut-projects · Jul 24, 2023 · e212e85 · e212e85
1 parent 385ce91
commit e212e85
Show file tree

Hide file tree

Showing 2 changed files with 61 additions and 1 deletion.
diff --git a/serde-jackson/src/test/groovy/io/micronaut/serde/jackson/annotation/JsonUnwrappedSpec.groovy b/serde-jackson/src/test/groovy/io/micronaut/serde/jackson/annotation/JsonUnwrappedSpec.groovy
@@ -297,6 +297,65 @@ class Name {
         context.close()
     }
 
+    void "test @JsonUnwrapped with readOnly field"() {
+        given:
+        def context = buildContext("""
+package unwrapped;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonUnwrapped;
+import io.micronaut.core.annotation.Introspected;
+import io.micronaut.serde.annotation.Serdeable;
+
+@Serdeable
+@Introspected(accessKind = Introspected.AccessKind.FIELD)
+class Parent {
+  public int age;
+  @JsonUnwrapped
+  public Name name;
+}
+
+@Serdeable
+@Introspected(accessKind = Introspected.AccessKind.FIELD)
+class Name {
+  public String first, last;
+  @JsonProperty(access = JsonProperty.Access.READ_ONLY)
+  public String ssn;
+}
+""")
+
+        when:
+        def name = newInstance(context, 'unwrapped.Name', [first:"Fred", last:"Flinstone", ssn:"abc-123"])
+        def parent = newInstance(context, 'unwrapped.Parent', [age:10, name:name])
+
+        def result = writeJson(jsonMapper, parent)
+
+        then:
+        result == '{"age":10,"first":"Fred","last":"Flinstone"}'
+
+        when:
+        def read = jsonMapper.readValue(result, Argument.of(context.classLoader.loadClass('unwrapped.Parent')))
+
+        then:
+        read.age == 10
+        read.name.first == 'Fred'
+        read.name.last == "Flinstone"
+        read.name.ssn == null
+
+        when:
+        def jsonStr = '{"age":15,"first":"Barney","last":"Rubble","ssn":"def-789"}'
+        read = jsonMapper.readValue(jsonStr, Argument.of(context.classLoader.loadClass('unwrapped.Parent')))
+
+        then:
+        read.age == 15
+        read.name.first == 'Barney'
+        read.name.last == "Rubble"
+        read.name.ssn == 'def-789'
+
+        cleanup:
+        context.close()
+    }
+
     @Requires({ jvm.isJava17Compatible() })
     void "test @JsonUnwrapped records"() {
         given:

diff --git a/serde-support/src/main/java/io/micronaut/serde/support/serializers/SerBean.java b/serde-support/src/main/java/io/micronaut/serde/support/serializers/SerBean.java
@@ -231,7 +231,8 @@ public int getOrder() {
                                             argument.getAnnotationMetadata(),
                                             unwrappedProperty.getAnnotationMetadata()
                                         );
-                                    if (!combinedMetadata.booleanValue(SerdeConfig.class, SerdeConfig.IGNORED).orElse(false)) {
+                                    if (!combinedMetadata.booleanValue(SerdeConfig.class, SerdeConfig.IGNORED).orElse(false) &&
+                                        !combinedMetadata.booleanValue(SerdeConfig.class, SerdeConfig.READ_ONLY).orElse(false)) {
                                         CustomSerProperty<T, Object> prop = new CustomSerProperty<>(SerBean.this, n,
                                             unwrappedPropertyArgument,
                                             combinedMetadata,