avo 0.4.10 → 0.5.0.beta5

data/app/controllers/avo/application_controller.rb

@@ -1,15 +1,21 @@
 module Avo
-  class ApplicationController < ActionController::Base
-    rescue_from ActiveRecord::RecordInvalid, with: :exception_logger
+  class ApplicationController < ::ActionController::Base
+    include Pundit
+    include Pagy::Backend
     protect_from_forgery with: :exception
     before_action :init_app
+    before_action :set_authorization
     before_action :_authenticate!
+    before_action :set_container_classes
+
+    rescue_from Pundit::NotAuthorizedError, with: :render_unauthorized
+    rescue_from ActiveRecord::RecordInvalid, with: :exception_logger
 
-    helper_method :_current_user
+    helper_method :_current_user, :resources_path, :resource_path, :new_resource_path, :edit_resource_path, :resource_attach_path, :resource_detach_path
+    add_flash_types :info, :warning, :success, :error
 
     def init_app
-      Avo::App.boot if Avo::IN_DEVELOPMENT
-      Avo::App.init request
+      Avo::App.init request: request, context: context
 
       @license = Avo::App.license
     end
@@ -18,7 +24,7 @@ module Avo
       respond_to do |format|
         format.html { raise exception }
         format.json { render json: {
-          errors: exception.respond_to?(:record) && exception.record.present? ? exception.record.errors : [],
+          errors: exception.record.present? ? exception.record.errors : [],
           message: exception.message,
           traces: exception.backtrace,
         }, status: ActionDispatch::ExceptionWrapper.status_code_for_exception(exception.class.name) }
@@ -29,47 +35,203 @@ module Avo
       instance_eval(&Avo.configuration.current_user)
     end
 
+    def context
+      instance_eval(&Avo.configuration.context)
+    end
+
+    def resources_path(model, keep_query_params: false, **args)
+      return if model.nil?
+
+      existing_params = {}
+
+      begin
+        if keep_query_params
+          existing_params = Addressable::URI.parse(request.fullpath).query_values.symbolize_keys
+        end
+      rescue;end
+
+      send :"resources_#{model.model_name.route_key}_path", **existing_params, **args
+    end
+
+    def resource_path(model = nil, resource_id: nil, keep_query_params: false, **args)
+      existing_params = {}
+
+      begin
+        if keep_query_params
+          existing_params = Addressable::URI.parse(request.fullpath).query_values.symbolize_keys
+        end
+      rescue;end
+
+      return send :"resources_#{model.model_name.route_key.singularize}_path", resource_id, **args if resource_id.present?
+
+      send :"resources_#{model.model_name.route_key.singularize}_path", model, **args
+    end
+
+    def resource_attach_path(model_name, model_id, related_name, related_id = nil)
+      path = "#{Avo.configuration.root_path}/resources/#{model_name}/#{model_id}/#{related_name}/new"
+
+      path += "/#{related_id}" if related_id.present?
+
+      path
+    end
+
+    def resource_detach_path(model_name, model_id, related_name, related_id = nil)
+      path = "#{Avo.configuration.root_path}/resources/#{model_name}/#{model_id}/#{related_name}"
+
+      path += "/#{related_id}" if related_id.present?
+
+      path
+    end
+
+    def new_resource_path(model, **args)
+      send :"new_resources_#{model.model_name.route_key.singularize}_path", **args
+    end
+
+    def edit_resource_path(model, **args)
+      send :"edit_resources_#{model.model_name.route_key.singularize}_path", model, **args
+    end
+
     private
-      def resource
-        eager_load_files(resource_model).find params[:id]
+      def set_resource_name
+        @resource_name = resource_name
       end
 
-      def eager_load_files(query)
-        if avo_resource.attached_file_fields.present?
-          avo_resource.attached_file_fields.map(&:id).map do |field|
-            query = query.send :"with_attached_#{field}"
-          end
-        end
+      def set_related_resource_name
+        @related_resource_name = related_resource_name
+      end
 
-        query
+      def set_resource
+        @resource = resource.hydrate(params: params)
+      end
+
+      def set_related_resource
+        @related_resource = related_resource.hydrate(params: params)
       end
 
-      def resource_model
-        avo_resource.model
+      def set_model
+        @model = eager_load_files(@resource, @resource.model_class).find params[:id]
       end
 
-      def avo_resource
-        App.get_resource params[:resource_name].to_s.camelize.singularize
+      def set_related_model
+        @related_model = eager_load_files(@related_resource, @related_resource.model_class).find params[:related_id]
       end
 
-      def authorize_user
-        return if params[:controller] == 'avo/search'
+      def hydrate_resource
+        @resource.hydrate(view: action_name.to_sym, user: _current_user)
+      end
+
+      def hydrate_related_resource
+        @related_resource.hydrate(view: action_name.to_sym, user: _current_user)
+      end
+
+      def authorize_action
+        if @model.present?
+          @authorization.set_record(@model).authorize_action :index
+        else
+          @authorization.set_record(@resource.model_class).authorize_action :index
+        end
+      end
+
+      # Get the pluralized resource name for this request
+      # Ex: projects, teams, users
+      def resource_name
+        return params[:resource_name] if params[:resource_name].present?
+
+        return controller_name if controller_name.present?
+
+        begin
+          request.path
+            .match(/\/?#{Avo.configuration.root_path.gsub('/', '')}\/resources\/([a-z1-9\-_]*)\/?/mi)
+            .captures
+            .first
+        rescue => exception
+        end
+      end
 
-        model = record = avo_resource.model
+      def related_resource_name
+        params[:related_name]
+      end
 
-        if ['show', 'edit', 'update'].include?(params[:action]) && params[:controller] == 'avo/resources'
-          record = resource
+      # Gets the Avo resource for this request based on the request from the `resource_name` "param"
+      # Ex: Avo::Resources::Project, Avo::Resources::Team, Avo::Resources::User
+      def resource
+        App.get_resource @resource_name.to_s.camelize.singularize
+      end
+
+      def related_resource
+        reflection = @model._reflections[params[:related_name]]
+
+        if reflection.is_a? ::ActiveRecord::Reflection::HasOneReflection
+          reflected_model = reflection.klass
+        else
+          reflected_model = reflection.klass
         end
 
-        return render_unauthorized unless AuthorizationService::authorize_action _current_user, record, params[:action]
+        App.get_resource_by_model_name reflected_model
       end
 
-      def render_unauthorized
-        render json: { message: I18n.t('avo.unauthorized') }, status: 403
+      def eager_load_files(resource, query)
+        if resource.attached_file_fields.present?
+          resource.attached_file_fields.map do |field|
+            # abort "#{field.pluralize}".inspect
+            # abort field.class.inspect
+            attachment = case field.class.to_s
+            when 'Avo::Fields::FileField'
+              'attachment'
+            when 'Avo::Fields::FilesField'
+              'attachments'
+            else
+              'attachment'
+            end
+
+            return query.eager_load "#{field.id}_#{attachment}": :blob
+            # return query.send :"with_attached_#{field}"
+          end
+        end
+
+        query
       end
 
+
+      # def authorize_user
+      #   return if params[:controller] == 'avo/search'
+
+      #   model = record = resource.model
+
+      #   if ['show', 'edit', 'update'].include?(params[:action]) && params[:controller] == 'avo/resources'
+      #     record = resource
+      #   end
+
+      #   # AuthorizationService::authorize_action _current_user, record, params[:action] return render_unauthorized unless
+      # end
+
       def _authenticate!
         instance_eval(&Avo.configuration.authenticate)
       end
+
+      def render_unauthorized(exception)
+        if !exception.is_a? Pundit::NotDefinedError
+          flash[:notice] = t 'avo.not_authorized'
+
+          redirect_url = if request.referrer.blank? or request.referrer == request.url
+            root_url
+          else
+            request.referrer
+          end
+
+          redirect_to(redirect_url)
+        end
+      end
+
+      def set_authorization
+        @authorization = Services::AuthorizationService.new _current_user
+      end
+
+      def set_container_classes
+        contain = !Avo.configuration.full_width_container
+        contain = false if Avo.configuration.full_width_index_view && action_name.to_sym == :index && self.class.superclass.to_s == 'Avo::ResourcesController'
+
+        @container_classes = contain ? '2xl:container 2xl:mx-auto' : ''
+      end
   end
 end

data/app/controllers/avo/attachments_controller.rb

@@ -0,0 +1,25 @@
+require_dependency 'avo/application_controller'
+
+module Avo
+  class AttachmentsController < ApplicationController
+    before_action :set_resource_name, only: :destroy
+    before_action :set_resource, only: :destroy
+    before_action :set_model, only: :destroy
+
+    def show
+    end
+
+    def destroy
+      blob = ActiveStorage::Blob.find(params[:signed_attachment_id])
+      attachment = blob.attachments.find_by record_id: params[:id], record_type: @model.class.to_s
+
+      if attachment.present?
+        attachment.destroy
+
+        redirect_to params[:referrer] || resource_path(@model), notice: t('avo.attachment_destroyed')
+      else
+        redirect_back fallback_location: resource_path(@model), notice: t('avo.failed_to_find_attachment')
+      end
+    end
+  end
+end

data/app/controllers/avo/base_controller.rb

@@ -0,0 +1,226 @@
+require_dependency 'avo/application_controller'
+
+module Avo
+  class BaseController < ApplicationController
+    before_action :set_resource_name
+    before_action :set_resource
+    before_action :hydrate_resource
+    before_action :authorize_action
+    before_action :set_model, only: [:show, :edit, :destroy, :update]
+
+    def index
+      set_index_params
+      set_filters
+      set_actions
+
+      # If we don't get a query object predefined from a child controller like relations, just spin one up
+      unless defined? @query
+        @query = @authorization.apply_policy @resource.model_class
+      end
+
+      # Eager load the relations
+      if @resource.includes.present?
+        @query = @query.includes(*@resource.includes)
+      end
+
+      # Eager load the active storage attachments
+      @query = eager_load_files(@resource, @query)
+
+      # Sort the items
+      if @index_params[:sort_by].present?
+        @query = @query.order("#{@resource.model_class.table_name}.#{@index_params[:sort_by]} #{@index_params[:sort_direction]}")
+      end
+
+      # Apply filters
+      applied_filters.each do |filter_class, filter_value|
+        @query = filter_class.safe_constantize.new.apply_query request, @query, filter_value
+      end
+
+      @pagy, @models = pagy(@query, items: @index_params[:per_page], link_extra: "data-turbo-frame=\"#{params[:turbo_frame]}\"", size: [1, 2, 2, 1])
+
+      # Create resources for each model
+      @resources = @models.map do |model|
+        @resource.hydrate(model: model, params: params).dup
+      end
+    end
+
+    def show
+      set_actions
+
+      @resource = @resource.hydrate(model: @model, view: :show, user: _current_user, params: params)
+    end
+
+    def new
+      @model = @resource.model_class.new
+      @resource = @resource.hydrate(model: @model, view: :new, user: _current_user)
+    end
+
+    def edit
+      @resource = @resource.hydrate(model: @model, view: :edit, user: _current_user)
+    end
+
+    def create
+      @model = @resource.fill_model(@resource.model_class.new, cast_nullable(model_params))
+      saved = @model.save
+      @resource.hydrate(model: @model, view: :new, user: _current_user)
+
+      respond_to do |format|
+        if saved
+          if params[:via_relation_class].present? && params[:via_resource_id].present?
+            redirect_path = resource_path(params[:via_relation_class].safe_constantize, resource_id: params[:via_resource_id])
+          else
+            redirect_path = resource_path(@model)
+          end
+
+          format.html { redirect_to redirect_path, notice: "#{@model.class.name} was successfully created." }
+          format.json { render :show, status: :created, location: @model }
+        else
+          flash[:error] = t 'avo.you_missed_something_check_form'
+          format.html { render :new, status: :unprocessable_entity }
+          format.json { render json: @model.errors, status: :unprocessable_entity }
+        end
+      end
+    end
+
+    def update
+      @model = @resource.fill_model(@model, cast_nullable(model_params))
+      saved = @model.save
+      @resource = @resource.hydrate(model: @model, view: :edit, user: _current_user)
+
+      respond_to do |format|
+        if saved
+          format.html { redirect_to params[:referrer] || resource_path(@model), notice: "#{@model.class.name} was successfully updated." }
+          format.json { render :show, status: :ok, location: @model }
+        else
+          flash[:error] = t 'avo.you_missed_something_check_form'
+          format.html { render :edit, status: :unprocessable_entity }
+          format.json { render json: @model.errors, status: :unprocessable_entity }
+        end
+      end
+    end
+
+    def destroy
+      @model.destroy!
+
+      respond_to do |format|
+        format.html { redirect_to params[:referrer] || resources_path(@model), notice: t('avo.resource_destroyed', attachment_class: @attachment_class) }
+        format.json { head :no_content }
+      end
+    end
+
+    private
+      def model_route_key
+        @resource.model_class.model_name.route_key.singularize
+      end
+
+      def model_params
+        request_params = params.require(model_route_key).permit(permitted_params)
+
+        if @resource.devise_password_optional and request_params[:password].blank? and request_params[:password_confirmation].blank?
+          request_params.delete(:password_confirmation)
+          request_params.delete(:password)
+        end
+
+        request_params
+      end
+
+      def permitted_params
+        @resource.get_field_definitions.select(&:updatable).map(&:to_permitted_param)
+      end
+
+      def cast_nullable(params)
+        fields = @resource.get_field_definitions
+
+        nullable_fields = fields.filter do |field|
+          field.nullable
+        end
+        .map do |field|
+          [field.id, field.null_values]
+        end
+        .to_h
+
+        params.each do |key, value|
+          nullable = nullable_fields[key.to_sym]
+
+          if nullable.present? && value.in?(nullable)
+            params[key] = nil
+          end
+        end
+
+        params
+      end
+
+      def set_index_params
+        @index_params = {}
+
+        # Pagination
+        @index_params[:page] = params[:page] || 1
+        @index_params[:per_page] = Avo.configuration.per_page
+
+        if cookies[:per_page].present?
+          @index_params[:per_page] = cookies[:per_page]
+        end
+
+        if params[:per_page].present?
+          @index_params[:per_page] = params[:per_page]
+        end
+
+        if params[:per_page].present?
+          cookies[:per_page] = params[:per_page]
+        end
+
+        if @parent_model.present?
+          @index_params[:per_page] = Avo.configuration.via_per_page
+        end
+
+        # Sorting
+        @index_params[:sort_by] = params[:sort_by] || :created_at
+        @index_params[:sort_direction] = params[:sort_direction] || :desc
+
+        # View types
+        @index_params[:view_type] = params[:view_type] || @resource.default_view_type || Avo.configuration.default_view_type
+        @index_params[:available_view_types] = @resource.available_view_types
+      end
+
+      def set_filters
+        @filters = @resource.get_filters.map do |filter_class|
+          filter = filter_class.new
+
+          filter
+        end
+      end
+
+      def set_actions
+        if params[:resource_id].present?
+          model = @resource.model_class.find params[:resource_id]
+        end
+
+        @actions = @resource.get_actions.map do |action|
+          action = action.new
+
+          action.hydrate(model: model, resource: @resource)
+          action.boot_fields request
+
+          action
+        end
+      end
+
+      def applied_filters
+        if params[:filters].present?
+          return JSON.parse(Base64.decode64(params[:filters]))
+        end
+
+        filter_defaults = {}
+
+        @resource.get_filters.each do |filter_class|
+          filter = filter_class.new
+
+          if filter.default.present?
+            filter_defaults[filter_class.to_s] = filter.default
+          end
+        end
+
+        filter_defaults
+      end
+  end
+end