activity_notification 2.7.1 → 2.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56122565c61de552c48285f449429a7d64616f5c13f04f0e023a68b33273db6f
-  data.tar.gz: 6462762a8f2d8b7b68b82be0632c1dd3d89379aa7fe904c6f4492053be2633fb
+  metadata.gz: 9c4c8885cdeaf0c979ae2474e5ca5459a16e0f14c605fa5d2f0ad37076e7c793
+  data.tar.gz: 267223c3dbc745920baabb75d5e936cafef5a3fbe2e301f46aab04ae9d6a34a8
 SHA512:
-  metadata.gz: fd7b507f00663ebcf26694a0c8c98a0051f51f7bf35e67687a77e668fb61f500f1cf84e2fa433ecbc39bf59357449fcd0cfd0303b107b7e16ea9838d39e3848f
-  data.tar.gz: 12cd4b4e589aa66e4ccb6108beb5624d5b13f3d327234491520551c5d9134afabe718367ee3d5193a92e9a1fd2491c9bf5d59250e8e2bb8588c3bcdfaf8565b7
+  metadata.gz: bcb53649395b3e43ab8e3b4a043a40947305ee35cd15fe16a9737f16c866ff543749e78b00c5c5659d8a34eaf198a6c30b6933d29a048db00d56ea17b7c4694e
+  data.tar.gz: cc390e51688280d2c84bb949814ae6a3ecad9f1c444066b45d91316d47fea5bb71a7dec03fd4a582d503cc5f7aad70e47c9c0f7ddf16b1da1f92ae1485c10595

data/app/controllers/activity_notification/notifications_controller.rb

@@ -4,6 +4,7 @@ module ActivityNotification
     # Include CommonController to select target and define common methods
     include CommonController
     before_action :set_notification, except: [:index, :open_all, :destroy_all]
+    before_action :validate_time_params, only: [:index, :open_all, :destroy_all]
 
     # Shows notification index of the target.
     #
@@ -125,6 +126,7 @@ module ActivityNotification
     # @overload open(params)
     #   @param [Hash] params Request parameters
     #   @option params [String] :open                   ('false') Whether the notification will be opened
+    #   @option params [String] :open_token             (nil)     Token to open the notification, which is required with open parameter since GET requests are not protected from CSRF (See Notification#open_token)
     #   @option params [String] :filter                 (nil)     Filter option to load notification index by their status (Nothing as auto, 'opened' or 'unopened')
     #   @option params [String] :limit                  (nil)     Maximum number of notifications to return
     #   @option params [String] :without_grouping       ('false') Whether notification index will include group members
@@ -133,7 +135,7 @@ module ActivityNotification
     #   @return [Response] JavaScript view for ajax request or redirects to back as default
     def move
       with_members = !(params[:with_group_members].to_s.to_boolean(false) || params[:without_grouping].to_s.to_boolean(false))
-      @opened_notifications_count = @notification.open!(with_members: with_members) if params[:open].to_s.to_boolean(false)
+      @opened_notifications_count = @notification.open!(with_members: with_members) if params[:open].to_s.to_boolean(false) && @notification.valid_open_token?(params[:open_token])
       redirect_to_notifiable_path
     end
   
@@ -171,7 +173,7 @@ module ActivityNotification
       # @api protected
       # @return [Hash] options to load notification index
       def set_index_options
-        limit              = params[:limit].to_i > 0 ? params[:limit].to_i : nil
+        limit              = index_limit
         reverse            = params[:reverse].present? ?
                                params[:reverse].to_s.to_boolean(false) : nil
         with_group_members = params[:with_group_members].present? || params[:without_grouping].present? ? params[:with_group_members].to_s.to_boolean(false) || params[:without_grouping].to_s.to_boolean(false) : nil
@@ -180,6 +182,21 @@ module ActivityNotification
                                    .merge(limit: limit, reverse: reverse, with_group_members: with_group_members)
       end
 
+      # Validates ISO 8601 time parameters and returns HTTP 400 when they are invalid.
+      # @api protected
+      # @return [void]
+      def validate_time_params
+        [:later_than, :earlier_than].each do |param_name|
+          next unless params.key?(param_name)
+          begin
+            Time.iso8601(params[param_name].to_s)
+          rescue ArgumentError
+            render_invalid_parameter("Parameter is not ISO 8601 time: #{param_name}")
+            return
+          end
+        end
+      end
+
       # Loads notification index with request parameters.
       # @api protected
       # @return [Array] Array of notification index

data/app/controllers/activity_notification/subscriptions_controller.rb

@@ -198,7 +198,7 @@ module ActivityNotification
       # @api protected
       # @return [Hash] options to load subscription index
       def set_index_options
-        limit          = params[:limit].to_i > 0 ? params[:limit].to_i : nil
+        limit          = index_limit
         reverse        = params[:reverse].present? ? params[:reverse].to_s.to_boolean(false) : nil
         @index_options = params.permit(:filter, :filtered_by_key, :routing_scope, :devise_default_routes)
                                .to_h.symbolize_keys.merge(limit: limit, reverse: reverse)

data/lib/activity_notification/apis/notification_api.rb

@@ -707,6 +707,23 @@ module ActivityNotification
       unopened_member_count + 1
     end
 
+    # Returns a token to open the notification by HTTP GET request to move action.
+    # GET requests are not protected from CSRF, so move action opens the notification only with this token.
+    # move_notification_path_for and move_notification_url_for helpers add this token when open: true is specified.
+    #
+    # @return [String] Token to open the notification by move action
+    def open_token
+      ActivityNotification.open_token_verifier.generate(id.to_s, purpose: :open_notification)
+    end
+
+    # Returns if the token is valid to open the notification by move action.
+    #
+    # @param [String] token Token to verify
+    # @return [Boolean] If the token is valid to open the notification
+    def valid_open_token?(token)
+      token.is_a?(String) && ActivityNotification.open_token_verifier.verified(token, purpose: :open_notification) == id.to_s
+    end
+
     # Returns if the notification is unopened.
     #
     # @return [Boolean] If the notification is unopened

data/lib/activity_notification/common.rb

@@ -92,6 +92,12 @@ module ActivityNotification
   end
   private_class_method :contains_javascript_query_operator?
 
+  # Returns message verifier to generate and verify tokens to open notifications by move action.
+  # @return [ActiveSupport::MessageVerifier] Message verifier for open tokens
+  def self.open_token_verifier
+    Rails.application.message_verifier("activity_notification_open_token")
+  end
+
   # Casts to indifferent hash
   # @param [ActionController::Parameters, Hash] hash
   # @return [HashWithIndifferentAccess] Converted indifferent hash

data/lib/activity_notification/config.rb

@@ -249,6 +249,15 @@ module ActivityNotification
     #   @return [Boolean] Whether the REST API restricts embedded associated records to their id and printable_* method values.
     attr_accessor :restrict_api_response_fields
 
+    # @overload max_index_limit
+    #   Returns maximum number of records that notification and subscription index actions of the controllers return
+    #   @return [Integer, nil] Maximum number of records that index actions return.
+    # @overload max_index_limit=(value)
+    #   Sets maximum number of records that notification and subscription index actions of the controllers return. The limit request parameter is capped by this value, and this value is used when the limit parameter is not specified. Set nil to remove the cap.
+    #   @param [Integer, nil] max_index_limit The new max_index_limit
+    #   @return [Integer, nil] Maximum number of records that index actions return.
+    attr_accessor :max_index_limit
+
     # Initialize configuration for ActivityNotification.
     # These configuration can be overridden in initializer.
     # @return [Config] A new instance of Config
@@ -282,6 +291,7 @@ module ActivityNotification
       @notification_api_channel_prefix          = 'activity_notification_api_channel'
       @rescue_optional_target_errors            = true
       @restrict_api_response_fields             = false
+      @max_index_limit                          = 1000
     end
 
     # Sets ORM name for ActivityNotification (:active_record, :mongoid or :dynamodb)

data/lib/activity_notification/controllers/common_controller.rb

@@ -103,6 +103,15 @@ module ActivityNotification
         render status: 400, json: error_response(code: 400, message: "Invalid parameter", type: message)
       end
 
+      # Returns limit for index actions from request parameter, capped by ActivityNotification.config.max_index_limit.
+      # @api protected
+      # @return [Integer, nil] Limit for index actions
+      def index_limit
+        limit     = params[:limit].to_i > 0 ? params[:limit].to_i : nil
+        max_limit = ActivityNotification.config.max_index_limit
+        max_limit ? [limit || max_limit, max_limit].min : limit
+      end
+
       # Validate param and return HTTP 400 unless it presents.
       # @api protected
       # @param [String, Symbol] param_name Parameter name to validate

data/lib/activity_notification/controllers/concerns/swagger/notifications_api.rb

@@ -294,11 +294,18 @@ module ActivityNotification
           parameter do
             key :name, :open
             key :in, :query
-            key :description, "Whether the notification will be opened"
+            key :description, "Whether the notification will be opened. The notification is opened only with a valid open_token, since GET requests are not protected from CSRF. Use PUT /{target_type}/{target_id}/notifications/{id}/open with move parameter to open and move without a token."
             key :required, false
             key :type, :boolean
             key :default, false
           end
+          parameter do
+            key :name, :open_token
+            key :in, :query
+            key :description, "Token to open the notification with open parameter, which is generated by Notification#open_token and added by move_notification_path_for and move_notification_url_for helpers"
+            key :required, false
+            key :type, :string
+          end
 
           response 302 do
             key :description, "Redirection to notifiable path"

data/lib/activity_notification/helpers/view_helpers.rb

@@ -111,7 +111,7 @@ module ActivityNotification
     # @todo Needs any other better implementation
     # @todo Must handle devise namespace
     def move_notification_path_for(notification, params = {})
-      options = params.dup
+      options = move_notification_options(notification, params)
       options.delete(:devise_default_routes) ?
         send("move_#{routing_scope(options)}notification_path", notification, options) :
         send("move_#{routing_scope(options)}#{notification.target.to_resource_name}_notification_path", notification.target, notification, options)
@@ -195,7 +195,7 @@ module ActivityNotification
     # @todo Needs any other better implementation
     # @todo Must handle devise namespace
     def move_notification_url_for(notification, params = {})
-      options = params.dup
+      options = move_notification_options(notification, params)
       options.delete(:devise_default_routes) ?
         send("move_#{routing_scope(options)}notification_url", notification, options) :
         send("move_#{routing_scope(options)}#{notification.target.to_resource_name}_notification_url", notification.target, notification, options)
@@ -553,6 +553,14 @@ module ActivityNotification
         [root, path].map(&:to_s).join('/')
       end
 
+      # Prepare options for move_notification path with token to open the notification
+      # @api private
+      def move_notification_options(notification, params)
+        options = params.dup
+        options[:open_token] = notification.open_token if options[:open].to_s.to_boolean(false)
+        options
+      end
+
       # Prepare routing scope from options
       # @api private
       def routing_scope(options = {})

data/lib/activity_notification/version.rb

@@ -1,3 +1,3 @@
 module ActivityNotification
-  VERSION = "2.7.1"
+  VERSION = "2.7.2"
 end

data/lib/generators/templates/activity_notification.rb

@@ -129,4 +129,9 @@ ActivityNotification.configure do |config|
   # your application (see the :with_devise routing option). Default value is false.
   # config.restrict_api_response_fields = false
 
+  # Configure maximum number of records that notification and subscription index actions of the controllers return.
+  # The limit request parameter is capped by this value, and this value is used when the limit parameter is not specified.
+  # Set nil to remove the cap. Default value is 1000.
+  # config.max_index_limit = 1000
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activity_notification
 version: !ruby/object:Gem::Version
-  version: 2.7.1
+  version: 2.7.2
 platform: ruby
 authors:
 - Shota Yamazaki