autoforme 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 299ca55f54b46bf0629229262853d3dc19a5bc64
-  data.tar.gz: c136195e2191c628c71b0e66e8dad48db965ac37
+  metadata.gz: 7431cd2d4051bea42ed58879c0d0418de7282b5d
+  data.tar.gz: f8d7d4c14152aef6efeedd2fb763df6cd3d4e77d
 SHA512:
-  metadata.gz: 0fe74271b2d60e2269041d3c8c17300538d043eb5901d97e4c73936a088c8f9d9524c9c09419edac647188eb3ffecc6b2fee1b91ccf05516694e43c16c0ebdb7
-  data.tar.gz: f4680d5384dfa5984579f4d7022b956d1e0d6c077b3069de0543b5a8d4260d0bb23e662839f7992f434cd2542cb8ce3766cc8cc32c2d0d94203424071996a2d9
+  metadata.gz: 3047d058fccd77841b9caa2855e9f9a0ecbb54e975c44586c68d01ddcdc5a06a10769ed7f207740318b0be748b7becff1b2f3178ef5fcb5ee8a17d661d65dfb0
+  data.tar.gz: 82b9b6c81507bae202145f7b4af5d1eec35eec0bade86491a08a389a85896849d5f5c2d0f5ce524ee25fab51bb5f250dd6d1caa9166e9e4196e9e7df761f99cc

data/CHANGELOG

@@ -1,3 +1,13 @@
+=== 1.5.0 (2016-11-18)
+
+* Allow autocompleting for associated objects even if current class doesn't support autocompleting (jeremyevans)
+
+* [SECURITY] Fix check for non-idempotent GET requests (jeremyevans)
+
+* Fix some deprecation warnings on Rails 5 (jeremyevans)
+
+* Make sinatra routes handle namespaced models by default (jeremyevans)
+
 === 1.4.0 (2016-05-18)
 
 * Handle selecting a blank object during show/edit/delete/mtm_edit by showing the same page (jeremyevans)

data/Rakefile

@@ -12,7 +12,7 @@ end
 
 spec = proc do |env|
   env.each{|k,v| ENV[k] = v}
-  sh "#{FileUtils::RUBY} -rubygems -I lib -e 'ARGV.each{|f| require f}' ./spec/*_spec.rb"
+  sh "#{FileUtils::RUBY} spec/all.rb"
   env.each{|k,v| ENV.delete(k)}
 end
 task :default => :roda_spec
@@ -30,10 +30,15 @@ task :spec => spec_tasks
     spec.call('FRAMEWORK'=>framework)
   end
 
-  desc "Run specs with for #{framework}"
+  desc "Run specs with coverage for #{framework}"
   task "#{framework}_spec_cov" do
     spec.call('FRAMEWORK'=>framework, 'COVERAGE'=>'1')
   end
+
+  desc "Run specs with -w for #{framework}, some warnings filtered"
+  task "#{framework}_spec_w" do
+    spec.call('FRAMEWORK'=>framework, 'RUBYOPT'=>'-w', 'WARNING'=>'1')
+  end
 end
 
 ### RDoc

data/lib/autoforme.rb

@@ -27,7 +27,7 @@ module AutoForme
       unless klass = @mutex.synchronize{map[type]}
         require "autoforme/#{map_type}s/#{type}"
         unless klass = @mutex.synchronize{map[type]}
-          raise Error, "unsupported framework: #{type.inspect}"
+          raise Error, "unsupported #{map_type}: #{type.inspect}"
         end
       end
       klass

data/lib/autoforme/action.rb

@@ -34,7 +34,7 @@ module AutoForme
     ALL_SUPPORTED_ACTIONS = %w'new create show edit update delete destroy browse search mtm_edit mtm_update association_links autocomplete'.freeze
 
     # Map of regular type symbols to normalized type symbols
-    NORMALIZED_ACTION_MAP = {:create=>:new, :update=>:edit, :destroy=>:delete, :mtm_update=>:mtm_edit}
+    NON_IDEMPOTENT_TYPES = NORMALIZED_ACTION_MAP = {:create=>:new, :update=>:edit, :destroy=>:delete, :mtm_update=>:mtm_edit}
 
     # Map of type symbols to HTML titles
     TITLE_MAP = {:new=>'New', :show=>'Show', :edit=>'Edit', :delete=>'Delete', :browse=>'Browse', :search=>'Search', :mtm_edit=>'Many To Many Edit'}
@@ -53,11 +53,10 @@ module AutoForme
     #
     # As a side-effect, this sets up additional state related to the request.
     def supported?
-      return false unless idempotent? || request.post?
       return false unless ALL_SUPPORTED_ACTIONS.include?(request.action_type)
-
-      @type = request.action_type.to_sym
-      @normalized_type = NORMALIZED_ACTION_MAP.fetch(@type, @type)
+      type = @type = request.action_type.to_sym
+      @normalized_type = NORMALIZED_ACTION_MAP.fetch(type, type)
+      return false if NON_IDEMPOTENT_TYPES[type] && !request.post?
 
       case type
       when :mtm_edit
@@ -79,10 +78,12 @@ module AutoForme
           return false unless model.association?(assoc)
           @params_association = assoc.to_sym
           @subtype = :association
+          return false unless associated_class = model.associated_model_class(@params_association)
+          return false unless associated_class.autocomplete_options_for(@subtype, request)
         else
           @subtype = subtype
+          return false unless model.autocomplete_options_for(@subtype, request)
         end
-        return false unless model.autocomplete_options_for(@subtype, request)
       else
         return false unless model.supported_action?(normalized_type, request)
 
@@ -99,11 +100,6 @@ module AutoForme
       Rack::Utils.escape_html(s.to_s)
     end
 
-    # Return whether the current action is an idempotent action.
-    def idempotent?
-      type == normalized_type
-    end
-
     # Get request parameters for the model.  Used when retrieving form
     # values that use namespacing.
     def model_params
@@ -140,8 +136,6 @@ module AutoForme
           "edit/#{model.primary_key_value(obj)}"
         when :mtm_edit
           "mtm_edit/#{model.primary_key_value(obj)}?association=#{params_association}"
-        else
-          raise Error, "Unhandled redirect type: #{type.inspect}"
         end
         path = url_for(path)
       end
@@ -319,13 +313,13 @@ module AutoForme
         end
         t << '</table>'
         if type == :show && model.supported_action?(:edit, request)
-          t << Forme.form(form_attributes(:action=>url_for("edit/#{model.primary_key_value(obj)}")), form_opts) do |f|
-            f.button(:value=>'Edit', :class=>'btn btn-primary')
+          t << Forme.form(form_attributes(:action=>url_for("edit/#{model.primary_key_value(obj)}")), form_opts) do |f1|
+            f1.button(:value=>'Edit', :class=>'btn btn-primary')
           end.to_s
         end
         if type == :delete
-          t << Forme.form(form_attributes(:action=>url_for("destroy/#{model.primary_key_value(obj)}"), :method=>:post), form_opts) do |f|
-            f.button(:value=>'Delete', :class=>'btn btn-danger')
+          t << Forme.form(form_attributes(:action=>url_for("destroy/#{model.primary_key_value(obj)}"), :method=>:post), form_opts) do |f1|
+            f1.button(:value=>'Delete', :class=>'btn btn-danger')
           end.to_s
         else
           t << association_links(obj)
@@ -473,7 +467,7 @@ module AutoForme
     # Handle the mtm_edit action by showing a list page if there is no model object selected, a list of associations for that model
     # if there is a model object but no association selected, or a mtm_edit form if there is a model object and association selected.
     def handle_mtm_edit
-      if id = request.id
+      if request.id
         obj = model.with_pk(:edit, request, request.id)
         unless assoc = params_association
           options = model.mtm_association_select_options(request)
@@ -520,7 +514,7 @@ module AutoForme
       assoc_obj = model.mtm_update(request, assoc, obj, request.params['add'], request.params['remove'])
       request.set_flash_notice("Updated #{assoc} association for #{model.class_name}") unless request.xhr?
       if request.xhr?
-        if add = request.params['add']
+        if request.params['add']
           @type = :edit
           mtm_edit_remove(assoc, model.associated_model_class(assoc), obj, assoc_obj)
         else
@@ -599,9 +593,9 @@ module AutoForme
 
         unless assoc_objs.empty?
           t << "<ul>\n"
-          assoc_objs.each do |assoc_obj|
+          assoc_objs.each do |assoc_obj1|
             t << "<li>"
-            t << association_link(mc, assoc_obj)
+            t << association_link(mc, assoc_obj1)
             t << "</li>"
           end
           t << "</ul>"

data/lib/autoforme/frameworks/rails.rb

@@ -8,7 +8,7 @@ module AutoForme
           @controller = request
           @params = request.params
           @session = request.session
-          @env = request.env
+          @env = request.request.env
           @method = @env['REQUEST_METHOD']
           @model = @params['autoforme_model']
           @action_type = @params['autoforme_action']
@@ -54,14 +54,14 @@ module AutoForme
             elsif @autoforme_action.output_type == 'csv'
               response.headers['Content-Type'] = 'text/csv'
               response.headers['Content-Disposition'] = "attachment; filename=#{@autoforme_action.output_filename}"
-              render :text=>@autoforme_text
+              render :body=>@autoforme_text
             elsif @autoforme_action.request.xhr?
-              render :text=>@autoforme_text
+              render :html=>@autoforme_text.html_safe
             else
               render :inline=>"<%=raw @autoforme_text %>", :layout=>true
             end
           else
-            render :text=>'Unhandled Request', :status=>404
+            render :plain=>'Unhandled Request', :status=>404
           end
         end
       end

data/lib/autoforme/frameworks/roda.rb

@@ -18,7 +18,9 @@ module AutoForme
           remaining_path = if @request.respond_to?(:remaining_path)
             @request.remaining_path
           else
+            # :nocov:
             @env['PATH_INFO']
+            # :nocov:
           end
 
           path_id = $1 if remaining_path =~ %r{\A\/([\w-]+)\z}
@@ -59,11 +61,13 @@ module AutoForme
           path = if r.respond_to?(:matched_path)
             r.matched_path
           else
+            # :nocov:
             r.env['SCRIPT_NAME']
+            # :nocov:
           end
           current_matchers = matchers + [lambda{@autoforme_action = framework.action_for(Request.new(self, path))}]
 
-          r.on *current_matchers do
+          r.on(*current_matchers) do
             @autoforme_text = @autoforme_action.handle
             if @autoforme_action.output_type == 'csv'
               response['Content-Type'] = 'text/csv'

data/lib/autoforme/frameworks/sinatra.rb

@@ -58,8 +58,8 @@ module AutoForme
         end
 
         prefix = Regexp.escape(framework.prefix) if framework.prefix
-        @controller.get %r{\A#{prefix}/(\w+)/(\w+)(?:/([\w-]+))?\z}, &block
-        @controller.post %r{\A#{prefix}/(\w+)/(\w+)(?:/([\w-]+))?\z}, &block
+        @controller.get %r{\A#{prefix}/([\w:]+)/(\w+)(?:/([\w-]+))?\z}, &block
+        @controller.post %r{\A#{prefix}/([\w:]+)/(\w+)(?:/([\w-]+))?\z}, &block
       end
     end
   end

data/lib/autoforme/model.rb

@@ -319,15 +319,8 @@ module AutoForme
     end
 
     # An array of pairs for the select options to return for the given type.
-    def select_options(type, request, opts={})
-      case nm = opts[:name_method]
-      when Symbol, String
-        all_rows_for(type, request).map{|obj| [obj.send(nm), primary_key_value(obj)]}
-      when nil
-        all_rows_for(type, request).map{|obj| [object_display_name(type, request, obj), primary_key_value(obj)]}
-      else
-        all_rows_for(type, request).map{|obj| [nm.call(obj), primary_key_value(obj)]}
-      end
+    def select_options(type, request)
+      all_rows_for(type, request).map{|obj| [object_display_name(type, request, obj), primary_key_value(obj)]}
     end
 
     # A human readable string representing the object.
@@ -335,7 +328,7 @@ module AutoForme
       apply_name_method(display_name_for, obj, type, request).to_s
     end
 
-    # A human reable string for the associated object.
+    # A human readable string for the associated object.
     def associated_object_display_name(assoc, request, obj)
       apply_name_method(column_options_for(:mtm_edit, request, assoc)[:name_method], obj, :mtm_edit, request)
     end

data/lib/autoforme/models/sequel.rb

@@ -21,11 +21,6 @@ module AutoForme
         S::Model
       end
 
-      # A completely empty search object, with no defaults.
-      def new_search
-        model.call({})
-      end
-
       # The name of the form param for the given association.
       def form_param_name(assoc)
         "#{model.send(:underscore, model.name)}[#{association_key(assoc)}]"
@@ -279,7 +274,7 @@ module AutoForme
         display = display.call(callback_opts) if display.respond_to?(:call)
         limit = opts[:limit] || 10
         limit = limit.call(callback_opts) if limit.respond_to?(:call)
-        opts[:filter] ||= lambda{|ds, opts| ds.where(S.ilike(display, "%#{ds.escape_like(query)}%"))}
+        opts[:filter] ||= lambda{|ds1, _| ds1.where(S.ilike(display, "%#{ds.escape_like(query)}%"))}
         ds = opts[:filter].call(ds, callback_opts)
         ds = ds.select(S.join([S.qualify(model.table_name, model.primary_key), display], ' - ').as(:v)).
           limit(limit)

data/lib/autoforme/table.rb

@@ -21,17 +21,13 @@ module AutoForme
     # An array of objects to show in the table
     attr_reader :objs
 
-    # Any options for the table
-    attr_reader :opts
-
-    def initialize(action, objs, opts={})
+    def initialize(action, objs)
       @action = action
       @request = action.request
       @model = action.model
       @type = action.normalized_type
       @columns = model.columns_for(type, request)
       @objs = objs
-      @opts = opts
     end
     
     def h(s)
@@ -42,9 +38,6 @@ module AutoForme
     def to_s
       html = String.new
       html << "<table id=\"autoforme_table\" class=\"#{model.table_class_for(type, request)}\">"
-      if caption = opts[:caption]
-        html << "<caption>#{h caption}</caption>"
-      end
 
       html << "<thead><tr>"
       columns.each do |column|

data/lib/autoforme/version.rb

@@ -2,7 +2,7 @@
 
 module AutoForme
   # Version constant, use <tt>AutoForme.version</tt> instead.
-  VERSION = '1.4.0'.freeze
+  VERSION = '1.5.0'.freeze
 
   # Returns the version as a frozen string (e.g. '0.1.0')
   def self.version

data/spec/all.rb

@@ -0,0 +1,2 @@
+puts "Running specs with #{ENV['FRAMEWORK']||'roda'} framework"
+Dir['./spec/*_spec.rb'].each{|f| require f}

data/spec/associations_spec.rb

@@ -38,8 +38,8 @@ describe AutoForme do
     click_link 'Show'
     select 'Album1'
     click_button 'Show'
-    page.html.must_match /Name.+Album1b/m
-    page.html.must_match /Artist.+Artist2/m
+    page.html.must_match(/Name.+Album1b/m)
+    page.html.must_match(/Artist.+Artist2/m)
 
     click_link 'Search'
     fill_in 'Name', :with=>'1b'
@@ -70,6 +70,11 @@ describe AutoForme do
     click_button 'Create'
     Album.first.artist_id.must_equal a.id
 
+    click_link 'Show'
+    select 'Album1'
+    click_button 'Show'
+    page.body.must_include 'TestArtist'
+
     click_link 'Edit'
     select 'Album1'
     click_button 'Edit'
@@ -83,6 +88,15 @@ describe AutoForme do
     fill_in 'Artist', :with=>b.id.to_s
     click_button 'Search'
     page.all('td').map{|s| s.text}.must_equal ["Album1b", "TestArtist2", "Show", "Edit", "Delete"]
+
+    visit '/Artist/autocomplete?q=Test'
+    page.body.must_match(/\d+ - TestArtist\n\d+ - TestArtist2/m)
+
+    visit '/Album/autocomplete/artist?q=Test'
+    page.body.must_match(/\d+ - TestArtist\n\d+ - TestArtist2/m)
+
+    visit '/Album/autocomplete/artist?type=edit&q=Test'
+    page.body.must_match(/\d+ - TestArtist\n\d+ - TestArtist2/m)
   end
 
   it "should be able to used specified name formatting in other model" do
@@ -109,8 +123,8 @@ describe AutoForme do
     click_link 'Show'
     select 'Album1'
     click_button 'Show'
-    page.html.must_match /Name.+Album1/m
-    page.html.must_match /Artist.+A1A1/m
+    page.html.must_match(/Name.+Album1/m)
+    page.html.must_match(/Artist.+A1A1/m)
 
     click_link 'Edit'
     select 'Album1'
@@ -152,8 +166,8 @@ describe AutoForme do
     click_link 'Show'
     select 'Album1'
     click_button 'Show'
-    page.html.must_match /Name.+Album1/m
-    page.html.must_match /Artist.+A1A1/m
+    page.html.must_match(/Name.+Album1/m)
+    page.html.must_match(/Artist.+A1A1/m)
 
     click_link 'Edit'
     select 'Album1'
@@ -172,6 +186,49 @@ describe AutoForme do
     page.all('td').map{|s| s.text}.must_equal ["Album1b", "A2A2", "Show", "Edit", "Delete"]
   end
 
+  it "should be able to used specified name formatting for current association" do
+    app_setup do
+      model Artist
+      model Album do
+        columns [:name, :artist]
+        column_options :artist=>{:name_method=>:name}
+      end
+    end
+
+    visit("/Artist/new")
+    fill_in 'Name', :with=>'A1'
+    click_button 'Create'
+    fill_in 'Name', :with=>'A2'
+    click_button 'Create'
+
+    visit("/Album/new")
+    fill_in 'Name', :with=>'Album1'
+    select 'A1'
+    click_button 'Create'
+
+    click_link 'Show'
+    select 'Album1'
+    click_button 'Show'
+    page.html.must_match(/Name.+Album1/m)
+    page.html.must_match(/Artist.+A1/m)
+
+    click_link 'Edit'
+    select 'Album1'
+    click_button 'Edit'
+    fill_in 'Name', :with=>'Album1b'
+    select 'A2'
+    click_button 'Update'
+
+    click_link 'Search'
+    fill_in 'Name', :with=>'1b'
+    select 'A2'
+    click_button 'Search'
+    page.all('td').map{|s| s.text}.must_equal ["Album1b", "A2", "Show", "Edit", "Delete"]
+
+    click_link 'Album'
+    page.all('td').map{|s| s.text}.must_equal ["Album1b", "A2", "Show", "Edit", "Delete"]
+  end
+
   it "should be able to eager load associations when loading model" do
     app_setup do
       model Artist
@@ -196,8 +253,52 @@ describe AutoForme do
     click_link 'Show'
     select 'A1-Album1'
     click_button 'Show'
-    page.html.must_match /Name.+Album1/m
-    page.html.must_match /Artist.+A1/m
+    page.html.must_match(/Name.+Album1/m)
+    page.html.must_match(/Artist.+A1/m)
+
+    click_link 'Edit'
+    select 'A1-Album1'
+    click_button 'Edit'
+    fill_in 'Name', :with=>'Album1b'
+    select 'A2'
+    click_button 'Update'
+
+    click_link 'Search'
+    fill_in 'Name', :with=>'1b'
+    select 'A2'
+    click_button 'Search'
+    page.all('td').map{|s| s.text}.must_equal ["Album1b", "A2", "Show", "Edit", "Delete"]
+
+    click_link 'Album'
+    page.all('td').map{|s| s.text}.must_equal ["Album1b", "A2", "Show", "Edit", "Delete"]
+
+    click_link 'Delete', :match=>:first
+    select 'A2-Album1b'
+    click_button 'Delete'
+  end
+
+  it "should be able to eager load associations when loading model without autoforme for associated model" do
+    app_setup do
+      model Album do
+        columns [:name, :artist]
+        eager :artist
+        display_name{|obj| "#{obj.associations[:artist].name}-#{obj.name}"}
+      end
+    end
+
+    Artist.create(:name=>'A1')
+    Artist.create(:name=>'A2')
+
+    visit("/Album/new")
+    fill_in 'Name', :with=>'Album1'
+    select 'A1'
+    click_button 'Create'
+
+    click_link 'Show'
+    select 'A1-Album1'
+    click_button 'Show'
+    page.html.must_match(/Name.+Album1/m)
+    page.html.must_match(/Artist.+A1/m)
 
     click_link 'Edit'
     select 'A1-Album1'
@@ -274,8 +375,8 @@ describe AutoForme do
     page.all('select option').map{|s| s.text}.must_equal ['', 'A-Y', 'B-X', 'B-Z']
     select 'B-X'
     click_button 'Show'
-    page.html.must_match /Name.+X/m
-    page.html.must_match /Artist.+B/m
+    page.html.must_match(/Name.+X/m)
+    page.html.must_match(/Artist.+B/m)
 
     click_link 'Edit'
     page.all('select option').map{|s| s.text}.must_equal ['', 'X (B)', 'Y (A)', 'Z (B)']
@@ -340,8 +441,8 @@ describe AutoForme do
     click_link 'Show'
     select 'D'
     click_button 'Show'
-    page.html.must_match /Name.+D/m
-    page.html.must_match /Artist.+Y 2/m
+    page.html.must_match(/Name.+D/m)
+    page.html.must_match(/Artist.+Y 2/m)
 
     click_link 'Edit'
     select 'C'
@@ -419,6 +520,31 @@ describe AutoForme do
     page.current_path.must_match %r{Artist/edit/\d+}
     click_link 'Albums'
     page.current_path.must_equal '/Album/browse'
+
+    visit "/Album/association_links/#{Artist.first.id}"
+    click_link 'Artist1'
+    click_button 'Update'
+    page.current_path.must_match %r{Artist/edit/\d+}
+  end
+
+  it "should have working associations listed without links if there is no autoforme for other model" do
+    app_setup do
+      model Artist do
+        association_links :all
+      end
+    end
+
+    visit("/Artist/new")
+    fill_in 'Name', :with=>'Artist1'
+    click_button 'Create'
+
+    Artist.first.add_album(:name=>'Album1')
+    click_link 'Edit'
+    select 'Artist1'
+    click_button 'Edit'
+    page.html.must_include 'Album1'
+    page.html.wont_include 'create'
+    page.html.wont_include '/Album'
   end
 
   it "should display but not link if the action is not supported " do
@@ -447,8 +573,8 @@ describe AutoForme do
     visit("/Artist/edit")
     select 'Artist1'
     click_button 'Edit'
-    page.html.must_match /Album1/
-    page.html.wont_match />edit</
+    page.html.must_include 'Album1'
+    page.html.wont_include '>edit<'
   end
 
   it "should support lazy loading association links on show and edit pages" do
@@ -471,7 +597,7 @@ describe AutoForme do
     click_link 'Edit'
     select 'Artist1'
     click_button 'Edit'
-    page.html.wont_match /create/
+    page.html.wont_include 'create'
     click_link 'Show Associations'
     click_link 'create'
     fill_in 'Name', :with=>'Album1'
@@ -545,8 +671,8 @@ describe AutoForme do
     click_link 'Show'
     select 'Album1'
     click_button 'Show'
-    page.html.must_match /Name.+Album1b/m
-    page.html.must_match /Artist.+Artist2/m
+    page.html.must_match(/Name.+Album1b/m)
+    page.html.must_match(/Artist.+Artist2/m)
 
     click_link 'Search'
     fill_in 'Name', :with=>'1b'
@@ -589,8 +715,8 @@ describe AutoForme do
     click_link 'Show'
     select 'Album1'
     click_button 'Show'
-    page.html.must_match /Name.+Album1b/m
-    page.html.must_match /Artist.+Artist2/m
+    page.html.must_match(/Name.+Album1b/m)
+    page.html.must_match(/Artist.+Artist2/m)
 
     click_link 'Search'
     fill_in 'Name', :with=>'1b'