drillbit 1.1.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 477a99cfe9c988e804d76c42b67dd503d71716ca
-  data.tar.gz: 2cbc77f50321b0d52b0209df5228c564a68f7993
+  metadata.gz: 362e3bda774e3c8a662b8dc640281e0ae389c953
+  data.tar.gz: ffa6d8b3eb8c83f52496a103378b994302d01fc2
 SHA512:
-  metadata.gz: 0a2cf2c6301d8d29a8936e3c73334f074ab0c27087a326ee8228c627dad73c55d8eb39b84bf741ddb3b458d595ff287cc8fe4fd95d6d570decf357c0fe04a140
-  data.tar.gz: cd9c47f410eeda20b0ff09b0ede87c8febb5cc9a971853cb59b71e2f567fc370887022eda8519a87688ed40a5f78b2055e061f6f4700deacac6f976421ce8ea7
+  metadata.gz: b6d144f2c1b07894b0ed5ebf08e308720b882ed3892dea1e55f4a4a77a3dd348d933b56be2f9357b19bc651759380d9b52834274745e3651b76d3f32648ad2da
+  data.tar.gz: e0be2925d007e7771501b62fc28d2561445edd900ea584ccc6685c90de6b19cca7df02340e5342fbd7efd41bc0791d5bcc87c7d939e11b827ec0f339b6ff0405

data/lib/drillbit.rb

@@ -13,7 +13,9 @@ require 'drillbit/matchers/version'
 require 'drillbit/resource'
 require 'drillbit/serializers/json_api'
 
-require 'drillbit/middleware/api_request'
+require 'drillbit/middleware/api_request_validator'
+require 'drillbit/middleware/token_processor'
+require 'drillbit/middleware/parameter_parser'
 
 require 'drillbit/responses/invalid_api_request'
 require 'drillbit/responses/invalid_subdomain'

data/lib/drillbit/authorizable_resource.rb

@@ -99,6 +99,12 @@ module  AuthorizableResource
                            call
   end
 
+  def authorized_attributes
+    @authorized_attributes ||= authorized_params.
+                                 fetch(:data,       {}).
+                                 fetch(:attributes, {})
+  end
+
   def authorized_resource
     return nil if RESOURCE_COLLECTION_ACTIONS.include?(action_name)
 

data/lib/drillbit/authorizers/parameters/filtering.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require 'drillbit/authorizers/parameters'
 
+# :reek:UnusedPrivateMethod
 module  Drillbit
 module  Authorizers
 class   Parameters

data/lib/drillbit/authorizers/parameters/resource.rb

@@ -1,10 +1,69 @@
 # frozen_string_literal: true
 require 'drillbit/authorizers/parameters'
 
+# :reek:UnusedPrivateMethod
 module  Drillbit
 module  Authorizers
 class   Parameters
 class   Resource < Authorizers::Parameters
+  def call
+    params.permit(*authorized_params)
+  end
+
+  private
+
+  def authorized_params
+    @authorized_params ||= [
+                             data: [
+                                     :type,
+                                     :id,
+                                     {
+                                       attributes:    [
+                                                        {},
+                                                      ],
+                                       relationships: [
+                                                        {},
+                                                      ],
+                                     },
+                                   ],
+                           ]
+  end
+
+  def add_authorized_attribute(name)
+    param = params.fetch(:data,       {}).
+                   fetch(:attributes, {}).
+                   fetch(name,        nil)
+
+    if param.class == Array
+      authorized_params[0][:data][:attributes][0][name] = []
+    else
+      authorized_params[0][:data][2][:attributes] << name
+    end
+  end
+
+  def add_authorized_attributes(*names)
+    names.each do |name|
+      add_authorized_attribute(name)
+    end
+  end
+
+  def add_authorized_relationship(name)
+    param = params.fetch(:data,          {}).
+                   fetch(:relationships, {}).
+                   fetch(name,           nil)
+
+    if param.class == Array
+      authorized_params[0][:data][:relationships][0][name] = []
+    else
+      authorized_params[0][:data][2][:relationships] << name
+    end
+  end
+
+  def add_authorized_relationships(*names)
+    names.each do |name|
+      add_authorized_relationship(name)
+    end
+  end
 end
 end
 end

data/lib/drillbit/errors/invalid_request_body.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+require 'erratum'
+
+module  Drillbit
+module  Errors
+class   InvalidRequestBody < RuntimeError
+  include Erratum::Error
+
+  attr_accessor :request_body
+
+  def http_status
+    400
+  end
+
+  def title
+    'Invalid Request Body'
+  end
+
+  def detail
+    'The information you attempted to send in the request cannot be parsed as ' \
+    'a valid JSON document.'
+  end
+
+  def source
+    { request_body: request_body }
+  end
+end
+end
+end

data/lib/drillbit/middleware/api_request_validator.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+require 'drillbit/configuration'
+require 'drillbit/matchers/subdomain'
+require 'drillbit/matchers/accept_header'
+require 'drillbit/requests/base'
+require 'drillbit/responses/invalid_api_request'
+require 'drillbit/responses/invalid_subdomain'
+
+module  Drillbit
+module  Middleware
+class   ApiRequestValidator
+  JSON_API_MIME_TYPE_PATTERN = %r{application/vnd\.api\+json(?=\z|;)}
+
+  def initialize(app)
+    @app = app
+  end
+
+  # rubocop:disable Metrics/LineLength
+  # :reek:FeatureEnvy
+  def call(env)
+    env['HTTP_X_APPLICATION_NAME'] = Drillbit.configuration.application_name
+
+    request               = Requests::Base.resolve(env)
+    subdomain_matcher     = Matchers::Subdomain.new
+    accept_header_matcher = Matchers::AcceptHeader.new
+
+    return Responses::InvalidSubdomain.call(env)  unless subdomain_matcher.matches?(request)
+    return Responses::InvalidApiRequest.call(env) if     subdomain_matcher.matches_api_subdomain?(request) &&
+                                                         !accept_header_matcher.matches?(request)
+
+    env['CONTENT_TYPE'] = env['CONTENT_TYPE'].
+                          to_s.
+                          gsub(JSON_API_MIME_TYPE_PATTERN, 'application/json')
+
+    @app.call(env)
+  end
+  # rubocop:enable Metrics/LineLength
+end
+end
+end

data/lib/drillbit/middleware/parameter_parser.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+require 'json'
+require 'stringio'
+require 'drillbit/responses/invalid_request_body'
+
+module  Drillbit
+module  Middleware
+class   ParameterParser
+  def initialize(app)
+    @app = app
+  end
+
+  # :reek:FeatureEnvy
+  def call(env)
+    env['QUERY_STRING'] = underscore_query_string(env['QUERY_STRING'])
+
+    if env['CONTENT_LENGTH'].to_i > 0 && env['CONTENT_TYPE'] =~ /json/
+      if env['rack.input']
+        env['rack.input'] = StringIO.new(underscore_request_parameters(env['rack.input']))
+      elsif env['RACK_INPUT']
+        env['RACK_INPUT'] = underscore_request_parameters(env['RACK_INPUT'])
+      end
+    end
+
+    @app.call(env)
+  rescue JSON::ParserError => _error
+    return Responses::InvalidRequestBody.call(env)
+  end
+
+  private
+
+  def underscore_request_parameters(request_parameters)
+    data = JSON.load(request_parameters)
+    data = underscore_parameters(data)
+
+    JSON.dump(data)
+  end
+
+  # :reek:UtilityFunction
+  def underscore_query_string(query_string)
+    return query_string unless query_string.respond_to? :gsub
+
+    query_string.gsub(/(?<=\A|&|\?)[^=&]+/) do |match|
+      match.tr('-', '_')
+    end
+  end
+
+  # :reek:UtilityFunction
+  # :reek:FeatureEnvy
+  def underscore_parameters(parameters)
+    return parameters unless parameters.is_a? Hash
+
+    parameters.each_with_object({}) do |(key, value), hash|
+      value = underscore_parameters(value) if value.is_a? Hash
+
+      hash[key.tr('-', '_')] = value
+    end
+  end
+end
+end
+end

data/lib/drillbit/middleware/token_processor.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+require 'drillbit/requests/base'
+require 'drillbit/responses/invalid_token'
+
+module  Drillbit
+module  Middleware
+class   TokenProcessor
+  def initialize(app)
+    @app = app
+  end
+
+  # :reek:FeatureEnvy
+  def call(env)
+    request = Requests::Base.resolve(env)
+    token   = request.authorization_token
+
+    return Responses::InvalidToken.call(env, application_name: request.application_name) \
+           unless token.valid?
+
+    env['X_JSON_WEB_TOKEN'] = token.to_h
+
+    @app.call(env)
+  end
+end
+end
+end

data/lib/drillbit/requests/base.rb

@@ -32,21 +32,24 @@ class   Base
     end
   end
 
+  # rubocop:disable Style/ClosingParenthesisIndentation
   def authorization_token
     if (
          !authorization_token_from_header.blank? &&
          authorization_token_from_header.valid?
-    ) ||
-    (
-      authorization_token_from_params.blank? ||
-      !authorization_token_from_params.valid?
-    )
+       ) \
+       ||
+       (
+         authorization_token_from_params.blank? ||
+         !authorization_token_from_params.valid?
+       )
 
       authorization_token_from_header
     else
       authorization_token_from_params
     end
   end
+  # rubocop:enable Style/ClosingParenthesisIndentation
 
   def application_name
     raw_request_application_name || Drillbit.configuration.application_name

data/lib/drillbit/responses/invalid_request_body.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+require 'drillbit/errors/invalid_request_body'
+
+module  Drillbit
+module  Responses
+class   InvalidRequestBody
+  def self.call(env)
+    error = Drillbit::Errors::InvalidRequestBody.new(request_body: env['RACK_INPUT'])
+
+    [
+      error.http_status,  # HTTP Status Code
+      {},                 # Response Headers
+      [error.to_json],  # Message
+    ]
+  end
+end
+end
+end

data/lib/drillbit/tokens/json_web_token.rb

@@ -88,7 +88,15 @@ class   JsonWebToken
   end
 
   def blank?
-    false
+    data.empty?
+  end
+
+  def present?
+    data.any?
+  end
+
+  def empty?
+    data.empty?
   end
 
   def to_h

data/lib/drillbit/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Drillbit
-  VERSION = '1.1.0'
+  VERSION = '2.0.0'
 end

data/spec/drillbit/accept_header_spec.rb

@@ -3,8 +3,8 @@ require 'spec_helper'
 require 'drillbit/accept_header'
 
 # rubocop:disable Metrics/LineLength
-module          Drillbit
-RSpec.describe  AcceptHeader do
+module    Drillbit
+describe  AcceptHeader do
   it 'can validate an accept header with all the pieces of information' do
     header = AcceptHeader.new(application: 'westeros',
                               header:      'application/vnd.westeros+redkeep;version=1.0.0')

data/spec/drillbit/authorizers/parameters/filtering_spec.rb

@@ -2,10 +2,10 @@
 require 'rspeckled'
 require 'drillbit/authorizers/parameters/filtering'
 
-module          Drillbit
-module          Authorizers
-class           Parameters
-RSpec.describe  Filtering do
+module    Drillbit
+module    Authorizers
+class     Parameters
+describe  Filtering do
   let(:params) { { filter: { name: 'Bill', age: 26 } } }
 
   it 'can authorize new filter parameters', verify: false do

data/spec/drillbit/authorizers/parameters/resource_spec.rb

@@ -2,10 +2,10 @@
 require 'rspeckled'
 require 'drillbit/authorizers/parameters/resource'
 
-module          Drillbit
-module          Authorizers
-class           Parameters
-RSpec.describe  Resource do
+module    Drillbit
+module    Authorizers
+class     Parameters
+describe  Resource do
 end
 end
 end

data/spec/drillbit/authorizers/parameters_spec.rb

@@ -2,9 +2,9 @@
 require 'rspeckled'
 require 'drillbit/authorizers/parameters'
 
-module          Drillbit
-module          Authorizers
-RSpec.describe  Parameters do
+module    Drillbit
+module    Authorizers
+describe  Parameters do
   it 'defaults to nothing' do
     parameters = Parameters.new(token:  '123',
                                 user:   'my_user',

data/spec/drillbit/authorizers/query_spec.rb

@@ -2,9 +2,9 @@
 require 'rspeckled'
 require 'drillbit/authorizers/query'
 
-module          Drillbit
-module          Authorizers
-RSpec.describe  Query do
+module    Drillbit
+module    Authorizers
+describe  Query do
   it 'does not authorize the resource by default' do
     authorizer = Query.new(token:    '123',
                            user:     'my_user',

data/spec/drillbit/authorizers/scope_spec.rb

@@ -3,9 +3,9 @@ require 'rspeckled'
 require 'ostruct'
 require 'drillbit/authorizers/scope'
 
-module          Drillbit
-module          Authorizers
-RSpec.describe  Scope do
+module    Drillbit
+module    Authorizers
+describe  Scope do
   it 'defaults to nothing' do
     scope = Scope.new(token:          '123',
                       user:           'my_user',

data/spec/drillbit/errors/invalid_api_request_spec.rb

@@ -2,9 +2,9 @@
 require 'spec_helper'
 require 'drillbit/errors/invalid_api_request'
 
-module          Drillbit
-module          Errors
-RSpec.describe  InvalidApiRequest do
+module    Drillbit
+module    Errors
+describe  InvalidApiRequest do
   let(:error) { InvalidApiRequest.new }
 
   it 'has a status of 400' do