active_record_api-rest 1.0.11 → 1.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ab132ecc0b2f3ccd7c4c151674e9c2623450c674fb88aee69e4277f9510a7ba
-  data.tar.gz: d2e16fa7cb20a80c1104f2f71f576a0791e585d52e8f227d54eb3d79472d0417
+  metadata.gz: 611e471608273e7647e08ba152cfec1e5e425000d836c7f74de9a89bd90310b2
+  data.tar.gz: e68c84e08ea9cd77936f211e414e74a2b9f55bdb388d1dec972408913fa7e051
 SHA512:
-  metadata.gz: 6bbd71ac2d4987ac9c54a3eb840d71b536959c1f47aa1116124a4f805477e1c4f0300548ab28714ba1f14338156dcaf202662d18bf4cf62aa046b66f66db5798
-  data.tar.gz: c22e0faaae9fea5191fdf34449368fe8533ca85de1fe7111bb6aa6b8c419ae5bb6782cfaa357bfd186fbf6bc163134154524249886b8bd0e65e192e03ab4dac0
+  metadata.gz: 15de71085aafd16d806be6b554352344420c88ed9eeb8bb1bea2d38905047b40bdf6cb16588c939a2e8831e0c7ab27ace372136872f7e387b1346e5e39315131
+  data.tar.gz: 053014c8a27878aeb7a71b1e0942c5a7d310ea572aac40a4284e65ea519e669d501201390cae087ad80878502da30970b754b6468e754c08969d06ece10228df

data/.gitlab-ci.yml

@@ -45,6 +45,7 @@ rspec:
 
 codequality-verify:
   retry: 2
+  allow_failure: true
   image: ruby:2.5.1
   script:
     - ruby -r json -r yaml -e "puts JSON.parse(File.open('gl-code-quality-report.json', 'r', &:read)).to_yaml"

data/lib/active_record_api/rest/auth/access_denied_exception.rb

@@ -0,0 +1,15 @@
+module ActiveRecordApi
+  module Rest
+    module Auth
+      class AccessDeniedException < StandardError
+        attr_reader :action
+        attr_reader :controller
+        def initialize(controller, action, message)
+          super(message)
+          @action = action
+          @controller = controller
+        end
+      end
+    end
+  end
+end

data/lib/active_record_api/rest/auth/bad_session_exception.rb

@@ -0,0 +1,15 @@
+module ActiveRecordApi
+  module Rest
+    module Auth
+      class BadSessionException < StandardError
+        attr_reader :action
+        attr_reader :controller
+        def initialize(controller, action)
+          super("No user for session on #{action} #{controller}")
+          @action = action
+          @controller = controller
+        end
+      end
+    end
+  end
+end

data/lib/active_record_api/rest/auth/controller.rb

@@ -0,0 +1,44 @@
+module ActiveRecordApi
+  module Rest
+    module Auth
+      class Controller < ActiveRecordApi::Rest::Controller
+        before_action :authorize
+
+        protected
+
+        def initialize_model
+          @model = authorized_models.update_attributes(modifiable_params)
+        end
+
+        def authorize
+          raise BadSessionException.new(controller_name, action_name) if session.nil?
+          raise AccessDeniedException.new(controller_name, action_name, 'Insufficient permissions') unless can?
+        end
+
+        def can?
+          @can ||= policy.can?
+        end
+
+        def authorized_models
+          @authorized_models ||= scope.authorized_models
+        end
+
+        def policy
+          @policy ||= policy_klass.new(session: session, model_klass: model_klass, action_name: action_name, params: params)
+        end
+
+        def policy_klass
+          "#{self.class.name.remove(/Controller$/)}Policy".safe_constantize || Policy
+        end
+
+        def scope
+          @scope ||= scope_klass.new(session: session, model_klass: model_klass, action_name: action_name)
+        end
+
+        def scope_klass
+          "#{self.class.name.remove(/Controller$/)}Scope".safe_constantize || Scope
+        end
+      end
+    end
+  end
+end

data/lib/active_record_api/rest/auth/policy.rb

@@ -0,0 +1,44 @@
+module ActiveRecordApi
+  module Rest
+    module Auth
+      class Policy
+        include ActiveAttr::Model
+        attr_accessor :session, :model_klass, :action_name, :params
+
+        def can?
+          send("#{action_name}?")
+        end
+
+        def can_manage?
+          false
+        end
+
+        def can_read?
+          false
+        end
+
+        protected
+
+        def index?
+          can_manage? || can_read?
+        end
+
+        def show?
+          can_manage? || can_read?
+        end
+
+        def create?
+          can_manage?
+        end
+
+        def update?
+          can_manage?
+        end
+
+        def destroy?
+          can_manage?
+        end
+      end
+    end
+  end
+end

data/lib/active_record_api/rest/auth/scope.rb

@@ -0,0 +1,32 @@
+module ActiveRecordApi
+  module Rest
+    module Auth
+      class Scope
+        include ActiveAttr::Model
+        attr_accessor :session, :model_klass, :action_name
+
+        def authorized_models
+          send(action_name)
+        end
+
+        protected
+
+        def index
+          model_klass.where('1=0')
+        end
+
+        def show
+          model_klass.where('1=0')
+        end
+
+        def create
+          model_klass.new
+        end
+
+        def update
+          model_klass.where('1=0')
+        end
+      end
+    end
+  end
+end

data/lib/active_record_api/rest/controller.rb

@@ -1,14 +1,18 @@
-require_relative 'index_controller'
-
+puts 'I was loaded'
 module ActiveRecordApi
   module Rest
-    class Controller < IndexController
-      attr_reader :model
-
+    class Controller < ApplicationController
+      include GracefulErrors
+      delegate :validate_params, :previous_id, :limit, :queryable_params, :modifiable_params, :not_allowed_params, to: :parameters
+      delegate :next_url, :redirect_url, to: :request_url_generator
       before_action :initialize_model, only: :create
-      before_action :load_model, only: %i[show update destroy]
-      before_action :only_valid_params, only: %i[create update]
-      before_action :authorize
+      before_action :validate_params
+
+      def index
+        response.headers['x-total'] = models.count
+        response.headers['x-link-next'] = next_url
+        render json: models, each_serializer: serializer
+      end
 
       def show
         return unless stale?(last_modified: model.updated_at)
@@ -24,7 +28,7 @@ module ActiveRecordApi
       end
 
       def update
-        if model.update(filtered_params)
+        if model.update(modifiable_params)
           redirect_to_model
         else
           render json: model.errors, status: :unprocessable_entity
@@ -38,69 +42,67 @@ module ActiveRecordApi
 
       protected
 
-      def redirect_to_model
-        if request.path.include?(model.id)
-          redirect_to "#{protocol}#{request.host_with_port}#{request.path}", status: :see_other
-        else
-          redirect_to "#{protocol}#{request.host_with_port}#{request.path}/#{model.id}", status: :see_other
-        end
+      def validate_params
+        return unless not_allowed_params.present?
+        render json: { base: "Extra parameters are not allow: #{not_allowed_params.join(', ')}" }, status: :unprocessable_entity
       end
 
-      def protocol
-        return 'http://' if Rails.env.development?
-        'https://'
+      def redirect_to_model
+        redirect_to redirect_url(model), status: :see_other
       end
 
-      def only_valid_params
-        return unless not_allowed_params.present?
-        render json: { base: "Extra parameters are not allow: #{not_allowed_params.join(', ')}" }, status: :unprocessable_entity
+      def model
+        @model ||= authorized_models.find_by(id: queryable_params[:id])
       end
 
-      def not_allowed_params
-        @not_allowed_params ||= ((params.keys.map(&:to_sym) - [:controller, :action, :id, :created_at, :updated_at, controller_name.singularize.to_sym]) - filtered_params.keys.map(&:to_sym))
+      def models
+        return @models unless @models.nil?
+        @models = authorized_models.where(queryable_params)
+        return @models unless pagination_param_value.present?
+        @models = @models&.where("\"#{pagination_param_name}\" > ?", pagination_param_value)
       end
 
-      def load_model
-        @model ||= scope_filter(model_klass).find(params[:id])
+      def initialize_model
+        @model = model_klass.new(modifiable_params)
       end
 
-      def initialize_model
-        @model = model_klass.new(filtered_params)
+      def authorized_models
+        model_klass.where('1 = 1')
       end
 
-      def authorize
-        raise BadSessionException.new(controller_name, action_name) if session.nil?
-        raise AccessDeniedException.new(controller_name, action_name, 'Insufficient permissions') unless policy.send("#{action_name}?")
+      def model_klass
+        @model_klass ||= controller_name.classify.constantize
       end
 
-      def scope_filter(scope)
-        "#{policy.class.name}::Scope".constantize.new(session, scope).resolve
+      def pagination_param_name
+        @pagination_param_name ||= :id
       end
 
-      def filtered_params
-        @simple_params = params.permit!.to_h.select! { |key, _value| allowed_params.include?(key.to_sym) }
+      def pagination_param_value
+        @pagination_param_value = params[pagination_param_name]
       end
 
-      def allowed_params
-        @allowed_params ||= model_klass.column_names.flat_map do |column_name|
-          col = column_name.to_s.gsub('encrypted_', '').to_sym
-          col_def = column_definition(column_name)
-          if col_def&.type == :jsonb
-            [col, col => {}]
-          else
-            col
-          end
-        end - %i[created_at updated_at id]
+      def serializer
+        "#{model_klass.name}Serializer".safe_constantize
       end
 
-      def column_definition(column_name)
-        model_klass.columns.detect do |column|
-          column.name == column_name
-        end
+      def parameters
+        @parameters ||= Parameters.new(
+          model_klass: model_klass,
+          controller_name: controller_name,
+          pagination_param_name: pagination_param_name,
+          params: params,
+          action_name: action_name
+        )
       end
 
-      def policy
-        @policy ||= ("#{controller_name.classify}Policy".safe_constantize) ? "#{controller_name.classify}Policy".constantize.new(session, model_klass) : ApplicationPolicy.new(session, model_klass)
+      def request_url_generator
+        RequestUrlGenerator.new(
+          action_name: action_name,
+          request: request,
+          models: models,
+          pagination_param_name: pagination_param_name
+        )
       end
     end
   end

data/lib/active_record_api/rest/graceful_errors.rb

@@ -8,11 +8,11 @@ module ActiveRecordApi
           render status: :not_found, json: { base: exception.message }
         end
 
-        rescue_from BadSessionException do |exception|
-          render status: :unauthorized, json: { base: "No user for session on #{exception.action} #{exception.controller}" }
+        rescue_from ActiveRecordApi::Rest::Auth::BadSessionException do |exception|
+          render status: :unauthorized, json: { base: "No user for session on #{exception.action} #{exception.controller}", message: exception.message }
         end
 
-        rescue_from AccessDeniedException do |exception|
+        rescue_from ActiveRecordApi::Rest::Auth::AccessDeniedException do |exception|
           render status: :forbidden, json: { base: "Access denied on #{exception.action} #{exception.controller}", message: exception.message }
         end
       end

data/lib/active_record_api/rest/parameters.rb

@@ -0,0 +1,54 @@
+module ActiveRecordApi
+  module Rest
+    class Parameters
+      include ActiveAttr::Model
+      attr_accessor :model_klass, :pagination_param_name, :params, :controller_name, :action_name
+
+      def modifiable_params
+        @modifiable = params.permit!.to_h.select! { |key, _value| clean(modifiable_names).include?(key.to_sym) }
+      end
+
+      def queryable_params
+        @queryable = params.permit!.to_h.select! { |key, _value| clean(queryable_names).include?(key.to_sym) }
+      end
+
+      def valid_params
+        queryable_names
+      end
+
+      def limit
+        @limit ||= params[:limit]&.to_i || 50
+      end
+
+      def not_allowed_params
+        @not_allowed_params ||= clean_request_names - valid_params
+      end
+
+      protected
+
+      def clean_request_names
+        params.keys.map(&:to_sym) - [:controller, :action, controller_name.to_sym, controller_name.singularize.to_sym]
+      end
+
+      def modifiable_names
+        @model_columns ||= clean(queryable_names - %i[created_at updated_at id])
+      end
+
+      def queryable_names
+        @model_columns ||= clean(model_klass.column_names.flatten)
+      end
+
+      def clean(attributes)
+        @allowed ||= attributes.map do |column_name|
+          column_name.to_s.gsub('encrypted_', '').to_sym
+        end
+      end
+
+      def column_definition(column_name)
+        model_klass.columns.detect do |column|
+          column.name == column_name
+        end
+      end
+    end
+  end
+end

data/lib/active_record_api/rest/request_url_generator.rb

@@ -0,0 +1,39 @@
+require 'active_attr'
+module ActiveRecordApi
+  module Rest
+    class RequestUrlGenerator
+      include ActiveAttr::Model
+      attribute :request
+      attribute :action_name
+      attribute :models
+      attribute :pagination_param_name
+      delegate :host_with_port, :path, :query_params, to: :request
+
+      def next_url
+        return if models.count == 0
+        "#{current_url}?#{new_params}"
+      end
+
+      def new_params
+        request.query_parameters.dup.merge(pagination_param_name.to_s => models.last.send(pagination_param_name))
+      end
+
+      def current_url
+        "#{protocol}#{host_with_port}#{path}"
+      end
+
+      def redirect_url(model)
+        if action_name == 'update'
+          current_url
+        else
+          "#{current_url}/#{model.id}"
+        end
+      end
+
+      def protocol
+        return 'http://' if Rails.env.development?
+        'https://'
+      end
+    end
+  end
+end

data/lib/active_record_api/rest/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveRecordApi
   module Rest
-    VERSION = '1.0.11'.freeze
+    VERSION = '1.0.12'.freeze
   end
 end

data/lib/active_record_api-rest.rb

@@ -5,13 +5,19 @@ require 'active_support'
 module ActiveRecordApi
   module Rest
     extend ActiveSupport::Autoload
-    autoload :AccessDeniedException
-    autoload :ApplicationPolicy
-    autoload :BadSessionException
     autoload :Controller
     autoload :GracefulErrors
     autoload :RequestUrlGenerator
+    autoload :Parameters
     autoload :VERSION
+    module Auth
+      extend ActiveSupport::Autoload
+      autoload :Policy
+      autoload :Scope
+      autoload :AccessDeniedException
+      autoload :BadSessionException
+      autoload :Controller
+    end
   end
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: active_record_api-rest
 version: !ruby/object:Gem::Version
-  version: 1.0.11
+  version: 1.0.12
 platform: ruby
 authors:
 - Full Measure Education
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-04-10 00:00:00.000000000 Z
+date: 2019-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -144,12 +144,15 @@ files:
 - bin/console
 - bin/setup
 - lib/active_record_api-rest.rb
-- lib/active_record_api/rest/access_denied_exception.rb
-- lib/active_record_api/rest/application_policy.rb
-- lib/active_record_api/rest/bad_session_exception.rb
+- lib/active_record_api/rest/auth/access_denied_exception.rb
+- lib/active_record_api/rest/auth/bad_session_exception.rb
+- lib/active_record_api/rest/auth/controller.rb
+- lib/active_record_api/rest/auth/policy.rb
+- lib/active_record_api/rest/auth/scope.rb
 - lib/active_record_api/rest/controller.rb
 - lib/active_record_api/rest/graceful_errors.rb
-- lib/active_record_api/rest/index_controller.rb
+- lib/active_record_api/rest/parameters.rb
+- lib/active_record_api/rest/request_url_generator.rb
 - lib/active_record_api/rest/spec.rb
 - lib/active_record_api/rest/spec/rest_controller_shared_example.rb
 - lib/active_record_api/rest/version.rb

data/lib/active_record_api/rest/access_denied_exception.rb

@@ -1,13 +0,0 @@
-module ActiveRecordApi
-  module Rest
-    class AccessDeniedException < Exception
-      attr_reader :action
-      attr_reader :controller
-      def initialize(controller, action, message)
-        super(message)
-        @action = action
-        @controller = controller
-      end
-    end
-  end
-end

data/lib/active_record_api/rest/application_policy.rb

@@ -1,61 +0,0 @@
-module ActiveRecordApi
-  module Rest
-    class ApplicationPolicy
-      class Scope
-        attr_reader :session, :scope
-
-        def initialize(session, scope)
-          @session = session
-          @scope = scope
-        end
-
-        def resolve
-          @scope.where(id: false)
-        end
-      end
-
-      attr_reader :session
-      attr_reader :model_class
-
-      READ = 'read'.freeze
-      MANAGE = 'manage'.freeze
-
-      def initialize(session, model_class)
-        @session = session
-        @model_class = model_class
-      end
-
-      def index?
-        can?(READ)
-      end
-
-      def show?
-        can?(READ)
-      end
-
-      def create?
-        can?(MANAGE)
-      end
-
-      def update?
-        can?(MANAGE)
-      end
-
-      def destroy?
-        can?(MANAGE)
-      end
-
-      protected
-
-      def can?(action)
-        session['permissions'].include?("#{service_name}__#{@model_class.name.downcase}:#{action}")
-      end
-
-      private
-
-      def service_name
-        File.basename(Rails.root.to_s)
-      end
-    end
-  end
-end

data/lib/active_record_api/rest/bad_session_exception.rb

@@ -1,12 +0,0 @@
-module ActiveRecordApi
-  module Rest
-    class BadSessionException < Exception
-      attr_reader :action
-      attr_reader :controller
-      def initialize(controller, action)
-        @action = action
-        @controller = controller
-      end
-    end
-  end
-end

data/lib/active_record_api/rest/index_controller.rb

@@ -1,66 +0,0 @@
-module ActiveRecordApi
-  module Rest
-    class IndexController < ApplicationController
-      attr_reader :models
-      include GracefulErrors
-      before_action :load_models, only: :index
-
-      def index
-        response.headers['x-total'] = @total
-        response.headers['x-link-next'] = next_link
-        render json: models, each_serializer: serializer
-      end
-
-      protected
-
-      def next_link
-        return unless @remaining_count > limit
-        new_params = request.query_parameters.dup
-        new_params['previous_id'] = models.last.id
-        RequestUrlGenerator.new(request: request, new_params: new_params).url
-      end
-
-      def serializer
-        "#{model_klass.name}Serializer".safe_constantize
-      end
-
-      def allowed_params_query
-        @allowed_params_query ||= model_klass.column_names.flat_map do |column_name|
-          col = column_name.to_s.gsub('encrypted_', '').to_sym
-          [col, col => []]
-        end
-      end
-
-      def filtered_params_query
-        @filtered_params_query ||= params.permit(allowed_params_query).to_h
-      end
-
-      def load_models
-        @models = scope_filter(model_klass).where(filtered_params_query)
-        @total = models.count
-        page_models
-      end
-
-      def page_models
-        id_field = model_klass.arel_table[:id]
-        updated_models = @models.order(:id)
-        updated_models = updated_models.where(id_field.gt previous_id) if previous_id.present?
-        @models = updated_models
-        @remaining_count = models.count
-        @models = @models.limit(limit)
-      end
-
-      def model_klass
-        @model_klass ||= controller_name.classify.constantize
-      end
-
-      def limit
-        @limit ||= params[:limit]&.to_i || 50
-      end
-
-      def previous_id
-        @previous_id ||= params[:previous_id]
-      end
-    end
-  end
-end