Unconditional altering and overriding of existing menu links breaks comment permalinks and possibly others

RestWS currently takes over $resource/% and assumes that existing menu links always follow the pattern "$resource/%$resource".

Among other things, this breaks comment permalinks, whose menu link is 'comment/%'. RestWS looks for 'comment/%' and if doesn't find that, it simply overrides it completely.

I am seriously wondering if it is a good idea to do this unconditionally for any entities. Sure, you could fix this special case for comments but there are many entities for which there is absolutely no reason to be *ever* exposed like this.

For example, private messages are entities in D7 and it's permission handling is *way* more complex than you could possibly handle out of the box in a general way. Someone is going to check the view permission and then the have a problem at hand :) And the possible (security) issues are limitless, just have a look at what restws is doing in my current (large) project:


mysql> select path, page_callback, page_arguments from menu_router where page_callback like 'restws%';
+--------------------------------+----------------------+---------------------------------------------------------+
| path | page_callback | page_arguments |
+--------------------------------+----------------------+---------------------------------------------------------+
| comment | restws_page_callback | a:1:{i:0;s:7:"comment";} |
| comment/% | restws_page_callback | a:1:{i:0;s:7:"comment";} |
| comment/%/view | restws_page_callback | a:1:{i:0;s:7:"comment";} |
| commerce_customer_profile | restws_page_callback | a:1:{i:0;s:25:"commerce_customer_profile";} |
| commerce_customer_profile/% | restws_page_callback | a:1:{i:0;s:25:"commerce_customer_profile";} |
| commerce_line_item | restws_page_callback | a:1:{i:0;s:18:"commerce_line_item";} |
| commerce_line_item/% | restws_page_callback | a:1:{i:0;s:18:"commerce_line_item";} |
| commerce_order | restws_page_callback | a:1:{i:0;s:14:"commerce_order";} |
| commerce_order/% | restws_page_callback | a:1:{i:0;s:14:"commerce_order";} |
| commerce_payment_transaction | restws_page_callback | a:1:{i:0;s:28:"commerce_payment_transaction";} |
| commerce_payment_transaction/% | restws_page_callback | a:1:{i:0;s:28:"commerce_payment_transaction";} |
| commerce_product | restws_page_callback | a:1:{i:0;s:16:"commerce_product";} |
| commerce_product/% | restws_page_callback | a:1:{i:0;s:16:"commerce_product";} |
| file | restws_page_callback | a:1:{i:0;s:4:"file";} |
| file/% | restws_page_callback | a:1:{i:0;s:4:"file";} |
| node | restws_page_callback | a:2:{i:0;s:4:"node";i:1;s:17:"node_page_default";} |
| node/% | restws_page_callback | a:3:{i:0;s:4:"node";i:1;s:14:"node_page_view";i:2;i:1;} |
| node/%/view | restws_page_callback | a:3:{i:0;s:4:"node";i:1;s:14:"node_page_view";i:2;i:1;} |
| redirect | restws_page_callback | a:1:{i:0;s:8:"redirect";} |
| redirect/% | restws_page_callback | a:1:{i:0;s:8:"redirect";} |
| rules_config | restws_page_callback | a:1:{i:0;s:12:"rules_config";} |
| rules_config/% | restws_page_callback | a:1:{i:0;s:12:"rules_config";} |
| search_api_index | restws_page_callback | a:1:{i:0;s:16:"search_api_index";} |
| search_api_index/% | restws_page_callback | a:1:{i:0;s:16:"search_api_index";} |
| search_api_server | restws_page_callback | a:1:{i:0;s:17:"search_api_server";} |
| search_api_server/% | restws_page_callback | a:1:{i:0;s:17:"search_api_server";} |
| taxonomy_term | restws_page_callback | a:1:{i:0;s:13:"taxonomy_term";} |
| taxonomy_term/% | restws_page_callback | a:1:{i:0;s:13:"taxonomy_term";} |
| taxonomy_vocabulary | restws_page_callback | a:1:{i:0;s:19:"taxonomy_vocabulary";} |
| taxonomy_vocabulary/% | restws_page_callback | a:1:{i:0;s:19:"taxonomy_vocabulary";} |
| user | restws_page_callback | a:2:{i:0;s:4:"user";i:1;s:9:"user_page";} |
| user/% | restws_page_callback | a:3:{i:0;s:4:"user";i:1;s:14:"user_view_page";i:2;i:1;} |
| user/%/view | restws_page_callback | a:3:{i:0;s:4:"user";i:1;s:14:"user_view_page";i:2;i:1;} |
| user/login | restws_page_callback | a:2:{i:0;s:4:"user";i:1;s:9:"user_page";} |
| wysiwyg_profile | restws_page_callback | a:1:{i:0;s:15:"wysiwyg_profile";} |
| wysiwyg_profile/% | restws_page_callback | a:1:{i:0;s:15:"wysiwyg_profile";} |
+--------------------------------+----------------------+---------------------------------------------------------+

What's the point of exposing stuff like rules configs, wysywig profiles, redirects, all that commerce stuff, search api configuration *out of the box*?

So why not do at least one of the following things, possibly both:
- Provide a simple list that allows to check of the resources/entities that you want to have exposed
- Use something like rest/$resource or maybe a configurable endpoint per entity/resource. Overriding menu callbacks of other modules like is just a mess IMHO and will always result in issues (like the currently open issue about the page manager conflict).

Sure this means that the "no configuration required" turns into a "minimal configuration required" but is that so bad? :)