forest_liana 6.0.5 → 6.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95b8a3f6be7165cf4debb95a67e676c4846cd53dd5226ef6550b0f4a9ccab656
-  data.tar.gz: eb8b01c7bd02b0c828fd5aa7e27ee8677ff5b1711fab9dc96512d607f5562fac
+  metadata.gz: ef9f6868496eb0c7e53ccd20fc0ee0853693a9954d56254dffe3e428be975570
+  data.tar.gz: 3b929c3692e18e69d8ce423d93f3ca223dc72a482290ab37342adc649a730dfb
 SHA512:
-  metadata.gz: fbdf538274940ded194b63d76426557241122eb3ac5e1f6704e37fa295d4a3eece921d0f0c28546e919c454f580733ab9778960d21a1d758cb19f84ef4bd0771
-  data.tar.gz: 2540d9a5c6289e23ac9d9d383c2d99f86883c2f493e32e5df5de0c659957696d329ff8f60a9339e7136d783ce3cae04e1d4499f418699e70901e65241a0116b4
+  metadata.gz: ebbcc8eb29e6b4dd9e9e95c1dd85b9ccd7c8ddaa73e297abe9ed36994a139becd595f55db56a909b07c9da1c2829fea68404d85f90a99b0f8eb91a460abd377e
+  data.tar.gz: 44d9e27b058eb2c3127c9efb5670100f032cda8f606a8a3b96a9ca7fc28d2a6b4ac7b97ca70e3514e5d32521ceb6aaa70c5c57aaf12f0d7e00aa179087e18bf7

data/app/controllers/forest_liana/stats_controller.rb

@@ -1,9 +1,21 @@
 module ForestLiana
   class StatsController < ForestLiana::ApplicationController
     if Rails::VERSION::MAJOR < 4
-      before_filter :find_resource, except: [:get_with_live_query]
+      before_filter only: [:get] do
+        find_resource()
+        check_permission('statWithParameters')
+      end
+      before_filter only: [:get_with_live_query] do
+        check_permission('liveQueries')
+      end
     else
-      before_action :find_resource, except: [:get_with_live_query]
+      before_action only: [:get] do
+        find_resource()
+        check_permission('statWithParameters')
+      end
+      before_action only: [:get_with_live_query] do
+        check_permission('liveQueries')
+      end
     end
 
     CHART_TYPE_VALUE = 'Value'
@@ -64,5 +76,38 @@ module ForestLiana
         render json: {status: 404}, status: :not_found, serializer: nil
       end
     end
+
+    def get_live_query_request_info
+      params['query']
+    end
+
+    def get_stat_parameter_request_info
+      parameters = Rails::VERSION::MAJOR < 5 ? params.dup : params.permit(params.keys).to_h;
+
+      # Notice: Removes useless properties
+      parameters.delete('timezone');
+      parameters.delete('controller');
+      parameters.delete('action');
+
+      return parameters;
+    end
+
+    def check_permission(permission_name)
+      begin
+        query_request = permission_name == 'liveQueries' ? get_live_query_request_info : get_stat_parameter_request_info;
+        checker = ForestLiana::PermissionsChecker.new(
+          nil,
+          permission_name,
+          @rendering_id,
+          user_id: forest_user['id'],
+          query_request_info: query_request
+        )
+
+        return head :forbidden unless checker.is_authorized?
+      rescue => error
+        FOREST_LOGGER.error "Stats execution error: #{error}"
+        render serializer: nil, json: { status: 400 }, status: :bad_request
+      end
+    end
   end
 end

data/app/helpers/forest_liana/schema_helper.rb

@@ -4,5 +4,11 @@ module ForestLiana
       collection_name = ForestLiana.name_for(active_record_class)
       ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }
     end
+
+    def self.is_smart_field?(model, field_name)
+      collection = self.find_collection_from_model(model)
+      field_found = collection.fields.find { |collection_field| collection_field[:field].to_s == field_name } if collection
+      field_found && field_found[:is_virtual]
+    end
   end
 end

data/app/services/forest_liana/filters_parser.rb

@@ -47,30 +47,56 @@ module ForestLiana
     end
 
     def parse_condition(condition)
-      ensure_valid_condition(condition)
+      where = parse_condition_without_smart_field(condition)
 
-      operator = condition['operator']
-      value = condition['value']
-      field = condition['field']
+      field_name = condition['field']
 
-      if @operator_date_parser.is_date_operator?(operator)
-        condition = @operator_date_parser.get_date_filter(operator, value)
-        return "#{parse_field_name(field)} #{condition}"
+      if ForestLiana::SchemaHelper.is_smart_field?(@resource, field_name)
+        schema = ForestLiana.schema_for_resource(@resource)
+        field_schema = schema.fields.find do |field|
+          field[:field].to_s == field_name
+        end
+
+        unless field_schema.try(:[], :filter)
+          raise ForestLiana::Errors::NotImplementedMethodError.new("method filter on smart field '#{field_name}' not found")
+        end
+
+        return field_schema[:filter].call(condition, where)
       end
 
-      if is_belongs_to(field)
-        association = field.partition(':').first.to_sym
-        association_field = field.partition(':').last
+      where
+    end
+
+    def get_association_field_and_resource(field_name)
+      if is_belongs_to(field_name)
+        association = field_name.partition(':').first.to_sym
+        association_field = field_name.partition(':').last
 
         unless @resource.reflect_on_association(association)
           raise ForestLiana::Errors::HTTP422Error.new("Association '#{association}' not found")
         end
 
         current_resource = @resource.reflect_on_association(association).klass
+
+        return association_field, current_resource
       else
-        association_field = field
-        current_resource = @resource
+        return field_name, @resource
       end
+    end
+
+    def parse_condition_without_smart_field(condition)
+      ensure_valid_condition(condition)
+
+      operator = condition['operator']
+      value = condition['value']
+      field_name = condition['field']
+
+      if @operator_date_parser.is_date_operator?(operator)
+        condition = @operator_date_parser.get_date_filter(operator, value)
+        return "#{parse_field_name(field_name)} #{condition}"
+      end
+
+      association_field, current_resource = get_association_field_and_resource(field_name)
 
       # NOTICE: Set the integer value instead of a string if "enum" type
       # NOTICE: Rails 3 do not have a defined_enums method
@@ -78,7 +104,7 @@ module ForestLiana
         value = current_resource.defined_enums[association_field][value]
       end
 
-      parsed_field = parse_field_name(field)
+      parsed_field = parse_field_name(field_name)
       parsed_operator = parse_operator(operator)
       parsed_value = parse_value(operator, value)
       field_and_operator = "#{parsed_field} #{parsed_operator}"
@@ -149,16 +175,16 @@ module ForestLiana
 
         association = get_association_name_for_condition(field)
         quoted_table_name = ActiveRecord::Base.connection.quote_column_name(association)
-        quoted_field_name = ActiveRecord::Base.connection.quote_column_name(field.split(':')[1])
+        field_name = field.split(':')[1]
       else
         quoted_table_name = @resource.quoted_table_name
-        quoted_field_name = ActiveRecord::Base.connection.quote_column_name(field)
         current_resource = @resource
+        field_name = field
       end
+      quoted_field_name = ActiveRecord::Base.connection.quote_column_name(field_name)
 
       column_found = current_resource.columns.find { |column| column.name == field.split(':').last }
-
-      if column_found.nil?
+      if column_found.nil? && !ForestLiana::SchemaHelper.is_smart_field?(current_resource, field_name)
         raise ForestLiana::Errors::HTTP422Error.new("Field '#{field}' not found")
       end
 

data/app/services/forest_liana/permissions_checker.rb

@@ -6,13 +6,16 @@ module ForestLiana
     # TODO: handle cache scopes per rendering
     @@expiration_in_seconds = (ENV['FOREST_PERMISSIONS_EXPIRATION_IN_SECONDS'] || 3600).to_i
 
-    def initialize(resource, permission_name, rendering_id, user_id:, smart_action_request_info: nil, collection_list_parameters: nil)
-      @user_id = user_id
-      @collection_name = ForestLiana.name_for(resource)
+    def initialize(resource, permission_name, rendering_id, user_id: nil, smart_action_request_info: nil, collection_list_parameters: nil, query_request_info: nil)
+      
+      @collection_name = resource.present? ? ForestLiana.name_for(resource) : nil
       @permission_name = permission_name
       @rendering_id = rendering_id
+
+      @user_id = user_id
       @smart_action_request_info = smart_action_request_info
       @collection_list_parameters = collection_list_parameters
+      @query_request_info = query_request_info
     end
 
     def is_authorized?
@@ -48,6 +51,16 @@ module ForestLiana
 
     def is_allowed
       permissions = get_permissions_content
+
+      # NOTICE: check liveQueries permissions
+      if @permission_name === 'liveQueries'
+        return live_query_allowed?
+      elsif @permission_name === 'statWithParameters'
+        return stat_with_parameters_allowed?
+      end
+
+      
+
       if permissions && permissions[@collection_name] &&
         permissions[@collection_name]['collection']
         if @permission_name === 'actions'
@@ -98,6 +111,16 @@ module ForestLiana
       permissions && permissions['data'] && permissions['data']['collections']
     end
 
+    def get_live_query_permissions_content
+      permissions = get_permissions
+      permissions && permissions['stats'] && permissions['stats']['queries']
+    end
+    
+    def get_stat_with_parameters_content(statPermissionType)
+      permissions = get_permissions
+      permissions && permissions['stats'] && permissions['stats'][statPermissionType]
+    end
+
     def get_last_fetch
       permissions = get_permissions
       permissions && permissions['last_fetch']
@@ -138,6 +161,32 @@ module ForestLiana
       ).is_scope_in_request?(@collection_list_parameters)
     end
 
+    def live_query_allowed?
+      live_queries_permissions = get_live_query_permissions_content
+
+      return false unless live_queries_permissions
+
+      # NOTICE: @query_request_info matching an existing live query 
+      return live_queries_permissions.include? @query_request_info
+    end
+
+    def stat_with_parameters_allowed?
+      permissionType = @query_request_info['type'].downcase + 's'
+      pool_permissions = get_stat_with_parameters_content(permissionType)
+
+      return false unless pool_permissions
+
+      # NOTICE: equivalent to Object.values in js & removes nil values
+      array_query_request_info = @query_request_info.values.filter_map{ |x| x unless x.nil? }
+
+      # NOTICE: pool_permissions contains the @query_request_info
+      #   we use the intersection between statPermission and @query_request_info
+      return pool_permissions.any? {
+        |statPermission|
+          (array_query_request_info & statPermission.values) == array_query_request_info;
+      }
+    end
+
     def date_difference_in_seconds(date1, date2)
       (date1 - date2).to_i
     end

data/config/initializers/errors.rb

@@ -46,6 +46,12 @@ module ForestLiana
       end
     end
 
+    class NotImplementedMethodError < ExpectedError
+      def initialize(message = "Method not implemented")
+        super(501, :internal_server_error, message, 'MethodNotImplementedError')
+      end
+    end
+
     class InconsistentSecretAndRenderingError < ExpectedError
       def initialize(message=ForestLiana::MESSAGES[:SERVER_TRANSACTION][:SECRET_AND_RENDERINGID_INCONSISTENT])
         super(500, :internal_server_error, message, 'InconsistentSecretAndRenderingError')

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "6.0.5"
+  VERSION = "6.2.2"
 end

data/spec/dummy/app/models/island.rb

@@ -2,4 +2,5 @@ class Island < ActiveRecord::Base
   self.table_name = 'isle'
 
   has_many :trees
+  has_one :location
 end

data/spec/dummy/app/models/location.rb

@@ -0,0 +1,3 @@
+class Location < ActiveRecord::Base
+  belongs_to :island
+end

data/spec/dummy/app/models/reference.rb

@@ -0,0 +1,2 @@
+class Reference < ActiveRecord::Base
+end

data/spec/dummy/db/migrate/20210326110524_create_references.rb

@@ -0,0 +1,8 @@
+class CreateReferences < ActiveRecord::Migration[6.0]
+  def change
+    create_table :references do |t|
+
+      t.timestamps
+    end
+  end
+end

data/spec/dummy/db/migrate/20210326140855_create_locations.rb

@@ -0,0 +1,10 @@
+class CreateLocations < ActiveRecord::Migration[6.0]
+  def change
+    create_table :locations do |t|
+      t.string :coordinates
+      t.references :island, index: true
+
+      t.timestamps
+    end
+  end
+end

data/spec/dummy/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2019_07_16_135241) do
+ActiveRecord::Schema.define(version: 2021_03_26_140855) do
 
   create_table "isle", force: :cascade do |t|
     t.string "name"
@@ -19,6 +19,19 @@ ActiveRecord::Schema.define(version: 2019_07_16_135241) do
     t.datetime "updated_at"
   end
 
+  create_table "locations", force: :cascade do |t|
+    t.string "coordinates"
+    t.integer "island_id"
+    t.datetime "created_at", precision: 6, null: false
+    t.datetime "updated_at", precision: 6, null: false
+    t.index ["island_id"], name: "index_locations_on_island_id"
+  end
+
+  create_table "references", force: :cascade do |t|
+    t.datetime "created_at", precision: 6, null: false
+    t.datetime "updated_at", precision: 6, null: false
+  end
+
   create_table "trees", force: :cascade do |t|
     t.string "name"
     t.integer "owner_id"

data/spec/dummy/lib/forest_liana/collections/location.rb

@@ -0,0 +1,10 @@
+class Forest::Location
+  include ForestLiana::Collection
+
+  collection :Location
+
+  field :alter_coordinates, type: 'String' do
+    object.name + 'XYZ'
+  end
+
+end

data/spec/dummy/lib/forest_liana/collections/user.rb

@@ -0,0 +1,15 @@
+class Forest::User
+  include ForestLiana::Collection
+
+  collection :User
+
+  filter_cap_name = lambda do |condition, where|
+    capitalize_name = condition['value'].capitalize
+    "name IS '#{capitalize_name}'"
+  end
+
+  field :cap_name, type: 'String', filter: filter_cap_name do
+    object.name.upcase
+  end
+
+end

data/spec/requests/stats_spec.rb

@@ -0,0 +1,114 @@
+require 'rails_helper'
+require 'json'
+
+describe "Stats", type: :request do
+
+  token = JWT.encode({
+    id: 38,
+    email: 'michael.kelso@that70.show',
+    first_name: 'Michael',
+    last_name: 'Kelso',
+    team: 'Operations',
+    rendering_id: 16,
+    exp: Time.now.to_i + 2.weeks.to_i
+  }, ForestLiana.auth_secret, 'HS256')
+
+  headers = {
+    'Accept' => 'application/json',
+    'Content-Type' => 'application/json',
+    'Authorization' => "Bearer #{token}"
+  }
+
+  let(:schema) {
+    [
+      ForestLiana::Model::Collection.new({
+        name: 'Products',
+        fields: [],
+        actions: []
+      })
+    ]
+  }
+
+  before do
+    allow(ForestLiana).to receive(:apimap).and_return(schema)
+  end
+
+  before(:each) do
+    allow(ForestLiana::IpWhitelist).to receive(:retrieve) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+    
+    allow_any_instance_of(ForestLiana::PermissionsChecker).to receive(:is_authorized?) { true }
+
+    allow_any_instance_of(ForestLiana::ValueStatGetter).to receive(:perform) { true }
+    allow_any_instance_of(ForestLiana::QueryStatGetter).to receive(:perform) { true }
+  end
+
+
+
+  describe 'POST /stats/:collection' do
+    params = { type: 'Value', collection: 'User', aggregate: 'Count' }
+
+    it 'should respond 200' do
+      data = ForestLiana::Model::Stat.new(value: { countCurrent: 0, countPrevious: 0 })
+      allow_any_instance_of(ForestLiana::ValueStatGetter).to receive(:record) { data }
+      # NOTICE: bypass : find_resource error
+      allow_any_instance_of(ForestLiana::StatsController).to receive(:find_resource) { true }
+      allow(ForestLiana::QueryHelper).to receive(:get_one_association_names_symbol) { true }
+
+      post '/forest/stats/Products', params: JSON.dump(params), headers: headers
+      expect(response.status).to eq(200)
+    end
+
+    it 'should respond 401 with no headers' do
+      post '/forest/stats/Products', params: JSON.dump(params)
+      expect(response.status).to eq(401)
+    end
+
+    it 'should respond 404 with non existing collection' do
+      allow_any_instance_of(ForestLiana::ValueStatGetter).to receive(:record) { nil }
+
+      post '/forest/stats/NoCollection', params: {}, headers: headers
+      expect(response.status).to eq(404)
+    end
+
+    # it 'should respond 403 Forbidden' do
+    #   allow_any_instance_of(ForestLiana::PermissionsChecker).to receive(:is_authorized?) { false }
+
+    #   post '/forest/stats/Products', params: JSON.dump(params), headers: headers
+    #   expect(response.status).to eq(403)
+    # end
+  end
+  
+  describe 'POST /stats' do
+    params = { query: 'SELECT COUNT(*) AS value FROM products;' }
+
+    it 'should respond 200' do
+      data = ForestLiana::Model::Stat.new(value: { value: 0, objective: 0 })
+      allow_any_instance_of(ForestLiana::QueryStatGetter).to receive(:record) { data }
+
+      post '/forest/stats', params: JSON.dump(params), headers: headers
+      expect(response.status).to eq(200)
+    end
+
+    it 'should respond 401 with no headers' do
+      post '/forest/stats', params: JSON.dump(params)
+      expect(response.status).to eq(401)
+    end
+
+    it 'should respond 403 Forbidden' do
+      allow_any_instance_of(ForestLiana::PermissionsChecker).to receive(:is_authorized?) { false }
+
+      post '/forest/stats', params: JSON.dump(params), headers: headers
+      expect(response.status).to eq(403)
+    end
+
+    it 'should respond 422 with unprocessable query' do
+      allow_any_instance_of(ForestLiana::QueryStatGetter).to receive(:perform) { raise ForestLiana::Errors::LiveQueryError.new }
+      
+      post '/forest/stats', params: JSON.dump(params), headers: headers
+      expect(response.status).to eq(422)
+    end
+  end
+
+end