forest_liana 7.0.0.beta.3 → 7.0.0

data/app/services/forest_liana/permissions_checker.rb

@@ -7,7 +7,6 @@ module ForestLiana
     @@expiration_in_seconds = (ENV['FOREST_PERMISSIONS_EXPIRATION_IN_SECONDS'] || 3600).to_i
 
     def initialize(resource, permission_name, rendering_id, user_id: nil, smart_action_request_info: nil, collection_list_parameters: Hash.new, query_request_info: nil)
-      
       @collection_name = resource.present? ? ForestLiana.name_for(resource) : nil
       @permission_name = permission_name
       @rendering_id = rendering_id
@@ -119,7 +118,7 @@ module ForestLiana
       permissions = @@renderings_cached[@rendering_id]
       permissions && permissions['stats'] && permissions['stats']['queries']
     end
-    
+
     def get_stat_with_parameters_content(statPermissionType)
       permissions = @@renderings_cached[@rendering_id]
       permissions && permissions['stats'] && permissions['stats'][statPermissionType]
@@ -163,7 +162,7 @@ module ForestLiana
 
       return false unless segments_queries_permissions
 
-      # NOTICE: @query_request_info matching an existing segment query 
+      # NOTICE: @query_request_info matching an existing segment query
       return segments_queries_permissions.include? @collection_list_parameters[:segmentQuery]
     end
 
@@ -172,7 +171,7 @@ module ForestLiana
 
       return false unless live_queries_permissions
 
-      # NOTICE: @query_request_info matching an existing live query 
+      # NOTICE: @query_request_info matching an existing live query
       return live_queries_permissions.include? @query_request_info
     end
 

data/app/services/forest_liana/permissions_getter.rb

@@ -23,7 +23,7 @@ module ForestLiana
       #     },
       #   },
       # },
-      # rederings => {
+      # renderings => {
       #   {rendering_id} => {
       #       {collection_id} => {
       #         segments => ['query1', 'query2']
@@ -32,7 +32,7 @@ module ForestLiana
       #   }
       # }
       # With `rendering_specific_only` this returns only the permissions related data specific to the provided rendering
-      # For now this only includes scopes
+      # For now this only includes scopes (but scopes are not used anymore in permissions)
       def get_permissions_for_rendering(rendering_id, rendering_specific_only: false)
         begin
           query_parameters = { 'renderingId' => rendering_id }

data/app/services/forest_liana/pie_stat_getter.rb

@@ -7,8 +7,10 @@ module ForestLiana
         timezone_offset = @params[:timezone].to_i
         resource = get_resource().eager_load(@includes)
 
-        unless @params[:filters].blank?
-          resource = FiltersParser.new(@params[:filters], resource, @params[:timezone]).apply_filters
+        filters = ForestLiana::ScopeManager.append_scope_for_user(@params[:filters], @user, @resource.name)
+
+        unless filters.blank?
+          resource = FiltersParser.new(filters, resource, @params[:timezone]).apply_filters
         end
 
         result = resource
@@ -53,7 +55,8 @@ module ForestLiana
       if @params[:aggregate].downcase == 'sum'
         field = @params[:aggregate_field].downcase
       else
-        field = Rails::VERSION::MAJOR >= 5 || @includes.size > 0 ? 'id' : 'all'
+        # `count_id` is required only for rails v5
+        field = Rails::VERSION::MAJOR == 5 || @includes.size > 0 ? 'id' : 'all'
       end
       "#{@params[:aggregate].downcase}_#{field} #{order}"
     end

data/app/services/forest_liana/resource_getter.rb

@@ -2,16 +2,19 @@ module ForestLiana
   class ResourceGetter < BaseGetter
     attr_accessor :record
 
-    def initialize(resource, params)
+    def initialize(resource, params, forest_user)
       @resource = resource
       @params = params
-      @collection_name = ForestLiana.name_for(@resource)
+      @collection_name = ForestLiana.name_for(resource)
+      @user = forest_user
       @collection = get_collection(@collection_name)
       compute_includes()
     end
 
     def perform
-      @record = get_resource().eager_load(@includes).find(@params[:id])
+      records = get_resource().eager_load(@includes)
+      scoped_records = ForestLiana::ScopeManager.apply_scopes_on_records(records, @user, @collection_name, @params[:timezone])
+      @record = scoped_records.find(@params[:id])
     end
   end
 end

data/app/services/forest_liana/resource_updater.rb

@@ -3,15 +3,18 @@ module ForestLiana
     attr_accessor :record
     attr_accessor :errors
 
-    def initialize(resource, params)
+    def initialize(resource, params, forest_user)
       @resource = resource
       @params = params
       @errors = nil
+      @user = forest_user
     end
 
     def perform
       begin
-        @record = @resource.find(@params[:id])
+        collection_name = ForestLiana.name_for(@resource)
+        scoped_records = ForestLiana::ScopeManager.apply_scopes_on_records(@resource, @user, collection_name, @params[:timezone])
+        @record = scoped_records.find(@params[:id])
 
         if has_strong_parameter
           @record.update(resource_params)

data/app/services/forest_liana/resources_getter.rb

@@ -4,7 +4,7 @@ module ForestLiana
     attr_reader :includes
     attr_reader :records_count
 
-    def initialize(resource, params)
+    def initialize(resource, params, forest_user)
       @resource = resource
       @params = params
       @count_needs_includes = false
@@ -14,12 +14,13 @@ module ForestLiana
       @field_names_requested = field_names_requested
       get_segment
       compute_includes
-      @search_query_builder = SearchQueryBuilder.new(@params, @includes, @collection)
+      @user = forest_user
+      @search_query_builder = SearchQueryBuilder.new(@params, @includes, @collection, forest_user)
 
       prepare_query
     end
 
-    def self.get_ids_from_request(params)
+    def self.get_ids_from_request(params, user)
       attributes = params.dig('data', 'attributes')
       has_body_attributes = attributes != nil
       is_select_all_records_query = has_body_attributes && attributes[:all_records] == true
@@ -45,11 +46,11 @@ module ForestLiana
           collection: parent_collection_name,
           id: attributes[:parent_collection_id],
           association_name: attributes[:parent_association_name],
-        }))
+        }), user)
       else
         collection_name = attributes[:collection_name]
         model = ForestLiana::SchemaUtils.find_model_from_collection_name(collection_name)
-        resources_getter = ForestLiana::ResourcesGetter.new(model, attributes)
+        resources_getter = ForestLiana::ResourcesGetter.new(model, attributes, user)
       end
 
       # NOTICE: build IDs list.

data/app/services/forest_liana/scope_manager.rb

@@ -0,0 +1,102 @@
+module ForestLiana
+  class ScopeManager
+    @@scopes_cache = Hash.new
+    # 5 minutes exipration cache
+    @@scope_cache_expiration_delta = 300
+
+    def self.apply_scopes_on_records(records, forest_user, collection_name, timezone)
+      scope_filters = get_scope_for_user(forest_user, collection_name, as_string: true)
+
+      return records if scope_filters.blank?
+
+      FiltersParser.new(scope_filters, records, timezone).apply_filters
+    end
+
+    def self.append_scope_for_user(existing_filter, user, collection_name)
+      scope_filter = get_scope_for_user(user, collection_name, as_string: true)
+      filters = [existing_filter, scope_filter].compact
+
+      case filters.length
+      when 0
+        nil
+      when 1
+        filters[0]
+      else
+        "{\"aggregator\":\"and\",\"conditions\":[#{existing_filter},#{scope_filter}]}"
+      end
+    end
+
+    def self.get_scope_for_user(user, collection_name, as_string: false)
+      raise 'Missing required rendering_id' unless user['rendering_id']
+      raise 'Missing required collection_name' unless collection_name
+
+      collection_scope = get_collection_scope(user['rendering_id'], collection_name)
+
+      return nil unless collection_scope
+
+      filters = format_dynamic_values(user['id'], collection_scope)
+
+      as_string && filters ? JSON.generate(filters) : filters
+    end
+
+    def self.get_collection_scope(rendering_id, collection_name)
+      if !@@scopes_cache[rendering_id]
+        # when scope cache is unset wait for the refresh
+        refresh_scopes_cache(rendering_id)
+      elsif has_cache_expired?(rendering_id)
+        # when cache expired refresh the scopes without waiting for it
+        Thread.new { refresh_scopes_cache(rendering_id) }
+      end
+
+      @@scopes_cache[rendering_id][:scopes][collection_name]
+    end
+
+    def self.has_cache_expired?(rendering_id)
+      rendering_scopes = @@scopes_cache[rendering_id]
+      return true unless rendering_scopes
+
+      second_since_last_fetch = Time.now - rendering_scopes[:fetched_at]
+      second_since_last_fetch >= @@scope_cache_expiration_delta
+    end
+
+    def self.refresh_scopes_cache(rendering_id)
+      scopes = fetch_scopes(rendering_id)
+      @@scopes_cache[rendering_id] = {
+        :fetched_at => Time.now,
+        :scopes => scopes
+      }
+    end
+
+    def self.fetch_scopes(rendering_id)
+      query_parameters = { 'renderingId' => rendering_id }
+      response = ForestLiana::ForestApiRequester.get('/liana/scopes', query: query_parameters)
+
+      if response.is_a?(Net::HTTPOK)
+        JSON.parse(response.body)
+      else
+        raise 'Unable to fetch scopes'
+      end
+    end
+
+    def self.format_dynamic_values(user_id, collection_scope)
+      filter = collection_scope.dig('scope', 'filter')
+      return nil unless filter
+
+      dynamic_scopes_values = collection_scope.dig('scope', 'dynamicScopesValues')
+
+      # Only goes one level deep as required for now
+      filter['conditions'].map do |condition|
+        value = condition['value']
+        if value.is_a?(String) && value.start_with?('$currentUser')
+          condition['value'] = dynamic_scopes_values.dig('users', user_id, value)
+        end
+      end
+
+      filter
+    end
+
+    def self.invalidate_scope_cache(rendering_id)
+      @@scopes_cache.delete(rendering_id)
+    end
+  end
+end

data/app/services/forest_liana/search_query_builder.rb

@@ -4,12 +4,13 @@ module ForestLiana
 
     attr_reader :fields_searched
 
-    def initialize(params, includes, collection)
+    def initialize(params, includes, collection, user)
       @params = params
       @includes = includes
       @collection = collection
       @fields_searched = []
       @search = @params[:search]
+      @user = user
     end
 
     def perform(resource)
@@ -18,8 +19,10 @@ module ForestLiana
         ForestLiana::QueryHelper.get_tables_associated_to_relations_name(@resource)
       @records = search_param
 
-      unless @params[:filters].blank?
-        @records = FiltersParser.new(@params[:filters], @records, @params[:timezone]).apply_filters
+      filters = ForestLiana::ScopeManager.append_scope_for_user(@params[:filters], @user, @collection.name)
+
+      unless filters.blank?
+        @records = FiltersParser.new(filters, @records, @params[:timezone]).apply_filters
       end
 
       if @search

data/app/services/forest_liana/stat_getter.rb

@@ -2,9 +2,10 @@ module ForestLiana
   class StatGetter < BaseGetter
     attr_accessor :record
 
-    def initialize(resource, params)
+    def initialize(resource, params, forest_user)
       @resource = resource
       @params = params
+      @user = forest_user
       compute_includes()
     end
   end

data/app/services/forest_liana/value_stat_getter.rb

@@ -6,8 +6,10 @@ module ForestLiana
       return if @params[:aggregate].blank?
       resource = get_resource().eager_load(@includes)
 
-      unless @params[:filters].blank?
-        filter_parser = FiltersParser.new(@params[:filters], resource, @params[:timezone])
+      filters = ForestLiana::ScopeManager.append_scope_for_user(@params[:filters], @user, @resource.name)
+
+      unless filters.blank?
+        filter_parser = FiltersParser.new(filters, resource, @params[:timezone])
         resource = filter_parser.apply_filters
         raw_previous_interval = filter_parser.get_previous_interval_condition
 

data/config/routes.rb

@@ -20,6 +20,9 @@ ForestLiana::Engine.routes.draw do
   post '/stats/:collection' => 'stats#get'
   post '/stats' => 'stats#get_with_live_query'
 
+  # Scopes
+  post '/scope-cache-invalidation' => 'scopes#invalidate_scope_cache'
+
   # Stripe Integration
   get '(*collection)_stripe_payments' => 'stripe#payments'
   get ':collection/:id/stripe_payments' => 'stripe#payments'
@@ -57,7 +60,6 @@ ForestLiana::Engine.routes.draw do
   delete ':collection', to: router
 
   # Smart Actions forms value
-  post 'actions/:action_name/values' => 'actions#values'
   post 'actions/:action_name/hooks/load' => 'actions#load'
   post 'actions/:action_name/hooks/change' => 'actions#change'
 end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "7.0.0.beta.3"
+  VERSION = "7.0.0"
 end

data/spec/dummy/app/controllers/forest/islands_controller.rb

@@ -0,0 +1,5 @@
+class Forest::IslandsController < ForestLiana::SmartActionsController
+  def test
+    render json: { success: 'You are OK.' }
+  end
+end

data/spec/dummy/config/routes.rb

@@ -1,3 +1,7 @@
 Rails.application.routes.draw do
+  namespace :forest do
+    post '/actions/test' => 'islands#test'
+  end
+
   mount ForestLiana::Engine => "/forest"
 end

data/spec/dummy/lib/forest_liana/collections/island.rb

@@ -0,0 +1,7 @@
+class Forest::Island
+  include ForestLiana::Collection
+
+  collection :Island
+
+  action 'Test'
+end

data/spec/requests/actions_controller_spec.rb

@@ -1,23 +1,41 @@
 require 'rails_helper'
 
 describe 'Requesting Actions routes', :type => :request  do
+  let(:rendering_id) { 13 }
+  let(:scope_filters) { nil }
+
   before(:each) do
     allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
     allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
-    Island.create(name: 'Corsica')
+    Island.create(id: 1, name: 'Corsica')
+
+    ForestLiana::ScopeManager.invalidate_scope_cache(rendering_id)
+    allow(ForestLiana::ScopeManager).to receive(:get_scope_for_user).and_return(scope_filters)
   end
 
   after(:each) do
     Island.destroy_all
   end
 
-  describe 'call /values' do
-    it 'should respond 200' do
-      post '/forest/actions/foo/values', {}
-      expect(response.status).to eq(200)
-      expect(response.body).to be {}
-    end
-  end
+  let(:token) {
+    JWT.encode({
+      id: 38,
+      email: 'michael.kelso@that70.show',
+      first_name: 'Michael',
+      last_name: 'Kelso',
+      team: 'Operations',
+      rendering_id: rendering_id,
+      exp: Time.now.to_i + 2.weeks.to_i
+    }, ForestLiana.auth_secret, 'HS256')
+  }
+
+  let(:headers) {
+    {
+      'Accept' => 'application/json',
+      'Content-Type' => 'application/json',
+      'Authorization' => "Bearer #{token}"
+    }
+  }
 
   describe 'hooks' do
     foo = {
@@ -127,28 +145,32 @@ describe 'Requesting Actions routes', :type => :request  do
     island.actions = [action, fail_action, cheat_action, enums_action, multiple_enums_action]
 
     describe 'call /load' do
-      params = {recordIds: [1], collectionName: 'Island'}
+      params = {
+        data: {
+          attributes: { ids: [1], collection_name: 'Island' }
+        }
+      }
 
       it 'should respond 200' do
-        post '/forest/actions/my_action/hooks/load', params: JSON.dump(params), headers: { 'CONTENT_TYPE' => 'application/json' }
+        post '/forest/actions/my_action/hooks/load', params: JSON.dump(params), headers: headers
         expect(response.status).to eq(200)
         expect(JSON.parse(response.body)).to eq({'fields' => [foo.merge({:value => nil}).stringify_keys]})
       end
 
       it 'should respond 500 with bad params' do
-        post '/forest/actions/my_action/hooks/load', params: {}
+        post '/forest/actions/my_action/hooks/load', params: {}, headers: headers
         expect(response.status).to eq(500)
         expect(JSON.parse(response.body)).to eq({'error' => 'Error in smart action load hook: cannot retrieve action from collection'})
       end
 
       it 'should respond 500 with bad hook result type' do
-        post '/forest/actions/fail_action/hooks/load', params: JSON.dump(params), headers: { 'CONTENT_TYPE' => 'application/json' }
+        post '/forest/actions/fail_action/hooks/load', params: JSON.dump(params), headers: headers
         expect(response.status).to eq(500)
         expect(JSON.parse(response.body)).to eq({'error' => 'Error in smart action load hook: hook must return an array of fields'})
       end
 
       it 'should respond 500 with bad hook result data structure' do
-        post '/forest/actions/cheat_action/hooks/load', params: JSON.dump(params), headers: { 'CONTENT_TYPE' => 'application/json' }
+        post '/forest/actions/cheat_action/hooks/load', params: JSON.dump(params), headers: headers
         expect(response.status).to eq(500)
         expect(JSON.parse(response.body)).to eq({'error' => 'Error in smart action load hook: hook must return an array of fields'})
       end
@@ -156,10 +178,19 @@ describe 'Requesting Actions routes', :type => :request  do
 
     describe 'call /change' do
       updated_foo = foo.clone.merge({:previousValue => nil, :value => 'bar'})
-      params = {recordIds: [1], fields: [updated_foo], collectionName: 'Island', changedField: 'foo'}
+      params = {
+        data: {
+          attributes: {
+            ids: [1],
+            fields: [updated_foo],
+            collection_name: 'Island',
+            changed_field: 'foo'
+          }
+        }
+      }
 
       it 'should respond 200' do
-        post '/forest/actions/my_action/hooks/change', params: JSON.dump(params), headers: { 'CONTENT_TYPE' => 'application/json' }
+        post '/forest/actions/my_action/hooks/change', params: JSON.dump(params), headers: headers
         expect(response.status).to eq(200)
         expected = updated_foo.clone.merge({:value => 'baz'})
         expected[:widgetEdit] = nil
@@ -168,21 +199,30 @@ describe 'Requesting Actions routes', :type => :request  do
       end
 
       it 'should respond 500 with bad params' do
-        post '/forest/actions/my_action/hooks/change', params: JSON.dump({collectionName: 'Island'}), headers: { 'CONTENT_TYPE' => 'application/json' }
+        post '/forest/actions/my_action/hooks/change', params: JSON.dump({ data: { attributes: { collection_name: 'Island' }}}), headers: headers
         expect(response.status).to eq(500)
         expect(JSON.parse(response.body)).to eq({'error' => 'Error in smart action change hook: fields params is mandatory'})
       end
 
       it 'should respond 500 with bad hook result type' do
-        post '/forest/actions/fail_action/hooks/change', params: JSON.dump(params), headers: { 'CONTENT_TYPE' => 'application/json' }
+        post '/forest/actions/fail_action/hooks/change', params: JSON.dump(params), headers: headers
         expect(response.status).to eq(500)
         expect(JSON.parse(response.body)).to eq({'error' => 'Error in smart action load hook: hook must return an array of fields'})
       end
 
       it 'should reset value when enums has changed' do
         updated_enum = enum.clone.merge({:previousValue => nil, :value => 'a'}) # set value to a
-        p = {recordIds: [1], fields: [updated_foo, updated_enum], collectionName: 'Island', changedField: 'foo'}
-        post '/forest/actions/enums_action/hooks/change', params: JSON.dump(p), headers: { 'CONTENT_TYPE' => 'application/json' }
+        p = {
+          data: {
+            attributes: {
+              ids: [1],
+              fields: [updated_foo, updated_enum],
+              collection_name: 'Island',
+              changed_field: 'foo'
+            }
+          }
+        }
+        post '/forest/actions/enums_action/hooks/change', params: JSON.dump(p), headers: headers
         expect(response.status).to eq(200)
 
         expected_enum = updated_enum.clone.merge({ :enums => %w[c d e], :value => nil, :widgetEdit => nil})
@@ -195,8 +235,17 @@ describe 'Requesting Actions routes', :type => :request  do
 
       it 'should not reset value when every enum values are in the enums definition' do
         updated_multiple_enum = multiple_enum.clone.merge({:previousValue => nil, :value => %w[c]})
-        p = {recordIds: [1], fields: [foo, updated_multiple_enum], collectionName: 'Island', changedField: 'foo'}
-        post '/forest/actions/multiple_enums_action/hooks/change', params: JSON.dump(p), headers: { 'CONTENT_TYPE' => 'application/json' }
+        p = {
+          data: {
+            attributes: {
+              ids: [1],
+              fields: [foo, updated_multiple_enum],
+              collection_name: 'Island',
+              changed_field: 'foo'
+            }
+          }
+        }
+        post '/forest/actions/multiple_enums_action/hooks/change', params: JSON.dump(p), headers: headers
         expect(response.status).to eq(200)
 
         expected_multiple_enum = updated_multiple_enum.clone.merge({ :enums => %w[c d z], :widgetEdit => nil, :value => %w[c]})
@@ -209,8 +258,18 @@ describe 'Requesting Actions routes', :type => :request  do
 
       it 'should reset value when one of the enum values is not in the enums definition' do
         wrongly_updated_multiple_enum = multiple_enum.clone.merge({:previousValue => nil, :value => %w[a b]})
-        p = {recordIds: [1], fields: [foo, wrongly_updated_multiple_enum], collectionName: 'Island', changedField: 'foo'}
-        post '/forest/actions/multiple_enums_action/hooks/change', params: JSON.dump(p), headers: { 'CONTENT_TYPE' => 'application/json' }
+        p = {
+          data: {
+            attributes: {
+              ids: [1],
+              fields: [foo, wrongly_updated_multiple_enum],
+              collection_name: 'Island',
+              changed_field: 'foo'
+            }
+          }
+        }
+
+        post '/forest/actions/multiple_enums_action/hooks/change', params: JSON.dump(p), headers: headers
         expect(response.status).to eq(200)
 
         expected_multiple_enum = wrongly_updated_multiple_enum.clone.merge({ :enums => %w[c d z], :widgetEdit => nil, :value => nil })
@@ -222,4 +281,66 @@ describe 'Requesting Actions routes', :type => :request  do
       end
     end
   end
+
+  describe 'calling the action' do
+    before(:each) do
+      allow_any_instance_of(ForestLiana::PermissionsChecker).to receive(:is_authorized?) { true }
+    end
+
+    let(:all_records) { false }
+    let(:params) {
+      {
+        data: {
+          attributes: {
+            collection_name: 'Island',
+            ids: ['1'],
+            all_records: all_records,
+            smart_action_id: 'Island-Test'
+          },
+          type: 'custom-action-requests'
+        },
+        timezone: 'Europe/Paris'
+      }
+    }
+
+    describe 'without scopes' do
+      it 'should respond 200 and perform the action' do
+        post '/forest/actions/test', params: JSON.dump(params), headers: headers
+        expect(response.status).to eq(200)
+        expect(JSON.parse(response.body)).to eq({'success' => 'You are OK.'})
+      end
+    end
+
+    describe 'with scopes' do
+      describe 'when record is in scope' do
+        let(:scope_filters) { JSON.generate({ field: 'name', operator: 'equal', value: 'Corsica' }) }
+
+        it 'should respond 200 and perform the action' do
+          post '/forest/actions/test', params: JSON.dump(params), headers: headers
+          expect(response.status).to eq(200)
+          expect(JSON.parse(response.body)).to eq({'success' => 'You are OK.'})
+        end
+      end
+
+      describe 'when record is out of scope' do
+        let(:scope_filters) { JSON.generate({ field: 'name', operator: 'equal', value: 'Ré' }) }
+
+        it 'should respond 400 and NOT perform the action' do
+          post '/forest/actions/test', params: JSON.dump(params), headers: headers
+          expect(response.status).to eq(400)
+          expect(JSON.parse(response.body)).to eq({ 'error' => 'Smart Action: target record not found' })
+        end
+
+        describe 'and all_records are targeted' do
+          let(:all_records) { true }
+
+          it 'should respond 200 and perform the action' do
+            post '/forest/actions/test', params: JSON.dump(params), headers: headers
+            expect(response.status).to eq(200)
+            expect(JSON.parse(response.body)).to eq({'success' => 'You are OK.'})
+          end
+        end
+      end
+    end
+  end
 end