api: refactor only param.

app/controllers/application_controller.rb

@@ -9,7 +9,6 @@ class ApplicationController < ActionController::Base
   before_action :normalize_search
   before_action :api_check
   before_action :set_variant
-  before_action :track_only_param
   before_action :enable_cors
   after_action :reset_current_user
   layout "default"
@@ -28,12 +27,6 @@ class ApplicationController < ActionController::Base
     response.headers["Access-Control-Allow-Origin"] = "*"
   end
 
-  def track_only_param
-    if params[:only]
-      RequestStore[:only_param] = params[:only].split(/,/)
-    end
-  end
-
   def api_check
     return if CurrentUser.is_anonymous? || request.get? || request.head?
 

app/logical/application_responder.rb

@@ -17,6 +17,8 @@ class ApplicationResponder < ActionController::Responder
       options[:root] ||= resource.table_name.dasherize if resource.respond_to?(:table_name)
     end
 
+    options[:only] ||= params["only"].scan(/\w+/) if params["only"]
+
     super
   end
 end

app/models/application_record.rb

@@ -215,7 +215,7 @@ class ApplicationRecord < ActiveRecord::Base
   module ApiMethods
     extend ActiveSupport::Concern
 
-    def as_json(options = {})
+    def serializable_hash(options = {})
       options ||= {}
 
       options[:include] ||= []
@@ -226,51 +226,12 @@ class ApplicationRecord < ActiveRecord::Base
       options[:methods] ||= []
       options[:methods] += method_attributes
 
-      if !options.key?(:only) && RequestStore.exist?(:only_param)
-        options[:only] = RequestStore[:only_param]
-      end
-
-      if options[:only].is_a?(String)
-        options[:only] = options[:only].split(/,/)
-      end
-
       if options[:only]
         options[:methods] = options[:methods] & options[:only].map(&:to_sym)
         options[:include] = options[:include] & options[:only].map(&:to_sym)
       end
 
-      super(options)
-    end
-
-    def to_xml(options = {}, &block)
-      options ||= {}
-
-      options[:include] ||= []
-
-      options[:except] ||= []
-      options[:except] += hidden_attributes
-
-      options[:methods] ||= []
-      options[:methods] += method_attributes
-
-      if !options.key?(:only) && RequestStore.exist?(:only_param)
-        options[:only] = RequestStore[:only_param]
-      end
-
-      if options[:only].is_a?(String)
-        options[:only] = options[:only].split(/,/)
-      end
-
-      if options[:only]
-        options[:methods] = options[:methods] & options[:only]
-        options[:include] = options[:include] & options[:only]
-      end
-
-      super(options, &block)
-    end
-
-    def serializable_hash(*args)
-      hash = super(*args)
+      hash = super(options)
       hash.transform_keys { |key| key.delete("?") }
     end
 

test/functional/application_controller_test.rb

@@ -206,6 +206,14 @@ class ApplicationControllerTest < ActionDispatch::IntegrationTest
       assert_equal("max-age=#{5.minutes}, private", response.headers["Cache-Control"])
     end
 
+    should "support the only parameter" do
+      create(:post)
+      get posts_path, as: :json, params: { only: "id,rating score" }
+
+      assert_response :success
+      assert_equal(%w[id rating score].sort, response.parsed_body.first.keys.sort)
+    end
+
     should "return the correct root element name for empty xml responses" do
       get tags_path, as: :xml