Consolidate access control API: fold readable and writable flags into…

… the Ag entity model #491

* replacing EntityConstraint with direct checks for readability of attributes

UPGRADE-NOTES.md

@@ -1,9 +1,17 @@
 ## Upgrading to 4.7
 
-### @ClientReadable and @ClientWritable annotations are removed in favor of per-attribute access controls 
-[#491](https://github.com/agrestio/agrest/issues/491)
+### `@ClientReadable` and `@ClientWritable` annotations are removed in favor of per-attribute access controls [#491](https://github.com/agrestio/agrest/issues/491)
 
-TODO
+`@ClientReadable` and `@ClientWritable` annotations have been removed 
+
+### Injectable EntityConstraint is removed in favor of per-attribute access controls [#491](https://github.com/agrestio/agrest/issues/491)
+
+There was a little-known mechanism to programmatically define runtime-wide policy for entity read and write property
+exclusion - an injectable `EntityConstraint`. List injection keys were `agrest.constraints.read.list` and `agrest.constraints.write.list`
+for read and write constraints respectively. As a part of an effort to unify constrain handling, this mechanism was
+removed. There are two alternatives: `@Ag*` annotations on attributes, relationships and ids now have "readable" and 
+"writable" properties; also `AgEntityOverlay` API allows redefining existing property readability and writeability, 
+either globally or per-request.
 
 ### Updates may return "201" status where previously they returned "200" [#490](https://github.com/agrestio/agrest/issues/490)
 

agrest-engine/src/main/java/io/agrest/ResourceEntity.java

@@ -92,6 +92,13 @@ public List<Sort> getOrderings() {
         return orderings;
     }
 
+    /**
+     * @since 4.7
+     */
+    public AgAttribute getAttribute(String name) {
+        return attributes.get(name);
+    }
+
     /**
      * @since 1.12
      */

agrest-engine/src/main/java/io/agrest/runtime/AgBuilder.java

@@ -343,8 +343,6 @@ private Module createCoreModule() {
                     .put(DataResponse.class.getName(), DataResponseWriter.class)
                     .put(MetadataResponse.class.getName(), MetadataResponseWriter.class);
 
-            binder.bindList(EntityConstraint.class, ConstraintsHandler.DEFAULT_READ_CONSTRAINTS_LIST);
-            binder.bindList(EntityConstraint.class, ConstraintsHandler.DEFAULT_WRITE_CONSTRAINTS_LIST);
             binder.bindMap(PropertyMetadataEncoder.class).putAll(metadataEncoders);
 
             if (agServiceType != null) {

agrest-engine/src/main/java/io/agrest/runtime/constraints/ConstraintsHandler.java

@@ -1,16 +1,12 @@
 package io.agrest.runtime.constraints;
 
-import io.agrest.EntityConstraint;
 import io.agrest.ResourceEntity;
 import io.agrest.SizeConstraints;
 import io.agrest.constraints.Constraint;
 import io.agrest.runtime.processor.update.UpdateContext;
-import org.apache.cayenne.di.Inject;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import java.util.List;
-
 /**
  * An {@link IConstraintsHandler} that ensures that no target attributes exceed
  * the defined bounds.
@@ -19,21 +15,15 @@
  */
 public class ConstraintsHandler implements IConstraintsHandler {
 
-    public static final String DEFAULT_READ_CONSTRAINTS_LIST = "agrest.constraints.read.list";
-    public static final String DEFAULT_WRITE_CONSTRAINTS_LIST = "agrest.constraints.write.list";
-
     private static final Logger LOGGER = LoggerFactory.getLogger(ConstraintsHandler.class);
 
     private RequestConstraintsHandler requestConstraintHandler;
     private EntityConstraintHandler modelConstraintHandler;
 
-    public ConstraintsHandler(
-            @Inject(DEFAULT_READ_CONSTRAINTS_LIST) List<EntityConstraint> readConstraints,
-            @Inject(DEFAULT_WRITE_CONSTRAINTS_LIST) List<EntityConstraint> writeConstraints
-    ) {
+    public ConstraintsHandler() {
 
         this.requestConstraintHandler = new RequestConstraintsHandler();
-        this.modelConstraintHandler = new EntityConstraintHandler(readConstraints, writeConstraints);
+        this.modelConstraintHandler = new EntityConstraintHandler();
     }
 
     @Override