How do I use friendsofcake/crud bulk delete? - cakephp-3.0

Question

The docs are here: https://crud.readthedocs.io/en/latest/actions/bulk-delete.html
But what I don't understand is what should my request URL look like in order to hit bulk delete? I assume it is just the usual crud path to the model as a json file using the DELETE method. However this doesn't seem to work.
Presumably that's because I'm mapping it incorrectly to the actions. Here's what I've done as a Controller:
namespace App\Controller\Api;
use Cake\Controller\Controller;
class ApiAppController extends Controller
{
use \Crud\Controller\ControllerTrait;
public $components = [
'RequestHandler',
'Crud.Crud' => [
'actions' => [
'Crud.Index',
'Crud.View',
'Crud.Add',
'Crud.Edit',
'Crud.Delete',
'Crud.Bulk/Delete'
],
'listeners' => [
'Crud.Api',
'Crud.ApiPagination',
'Crud.ApiQueryLog',
'Crud.Search'
]
]
];
}
I also tried the controller like this:
use App\Controller\Api\ApiAppController;
/**
* Devices Controller
*
* #property \App\Model\Table\DevicesTable $Devices
*
* #method \App\Model\Entity\Device[]|\Cake\Datasource\ResultSetInterface paginate($object = null, array $settings = [])
*/
class DataController extends ApiAppController
{
public function initialize()
{
parent::initialize();
$this->Crud->mapAction('deleteAll', 'Crud.Bulk/Delete');
}
public function deleteAll()
{
$connection = ConnectionManager::get('default');
$results = $connection->execute('TRUNCATE TABLE data');
}
}
With various attempts at the URL like so:
DELETE http://my-site:8888/api/data.json
DELETE http://my-site:8888/api/data/delete.json
DELETE http://my-site:8888/api/data/delete-all.json
DELETE http://my-site:8888/api/data/all.json
It doesn't seem to even hit the CRUD plugin as I'm getting a CSRF token error. Normal crud routes don't get that CSRF error because they are picked up by the routing:
Router::prefix('api', function ($routes) {
$routes->extensions(['json', 'xml']);
$routes->resources('Data');
});
The cakephp docs on RESTful routing don't cover how to address bulk actions:
https://book.cakephp.org/3.0/en/development/routing.html#resource-routes

Answer 1

So there are a number of things I would look at to fix this.
Firstly would be your routing. If you're using DashedRoute then the url would be http://example.com/examples/delete-all.json. Unless you also pass the Accept: application/json header.
You can also set an action as the key in the actions config, which can be used to change the action name. See the documentation.
'actions' => [
'delete-all' => [
'className' => 'Crud.Bulk/Delete'
]
]
As for your CSRF token issue, you will need to unlock the action to be able to use DELETE without generating a token.
In your controller
$this->Security->setConfig('unlockedActions', ['deleteAll']);
Or you'll need to generate a CSRF token and send it with your request. Read more on CSRF in the book.