haveapi 0.29.3 → 0.29.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 885ac3cc2e4b40ee6595f9beadad79e75f371d607dd0d49d02f67a01cece7d7f
-  data.tar.gz: 8c8b186ae1299655f952bedf5cd857042df97b060a0fda7e43ef6b9bc0ec6393
+  metadata.gz: 0ea4a91d72110b964bf06310d13e19e2ac99629f842d8a7086b3ee8d1a060868
+  data.tar.gz: 26e7304458138efa50732b94f86c2de050e72539b07a7d6e6faa87ef4ecc5d5c
 SHA512:
-  metadata.gz: 8b3cd3b9dabb84f88119dde487b150ea6694ab76450d24df1c8f7ff9309b5fcb91638d58f4794db0236de5d8a81c01693c3a5adfc9665200bdb24915599d131e
-  data.tar.gz: c738c43d4cc3437124e9af50cd1ae70c84d3f5a91cb93f4c6d1b0966257e011f438f8ecf36639ba0da5044b0b06aa5c8b6072dce4793d4546df424ebdc50a1a9
+  metadata.gz: 38851b2f109fd4f502fd95237caa8c22a4bcb0c98171832ee88da356f61946234af9890a5c1565948db81a3186871b5c97eb68c2659ee9df5c28150f53e62b4a
+  data.tar.gz: 131e6a523d0147b10a1f0e7c399d2a879fbca04bf5b148eaf4639eff10abc0977c31323f7c74638dbb325440b9b1f32facf21986ec28e15eeb4bb1ab9d13b1d5

data/haveapi.gemspec

@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.required_ruby_version = ">= #{File.read('../../.ruby-version').strip}"
 
   s.add_dependency 'activesupport', '>= 7.1'
-  s.add_dependency 'haveapi-client', '~> 0.29.3'
+  s.add_dependency 'haveapi-client', '~> 0.29.4'
   s.add_dependency 'i18n', '>= 1.6', '< 2'
   s.add_dependency 'json'
   s.add_dependency 'mail'

data/lib/haveapi/model_adapters/active_record.rb

@@ -362,7 +362,7 @@ module HaveAPI::ModelAdapters
         resolve_assoc = includes_include?(param.name)
         pass_includes = includes_pass_on_to(param.name) if resolve_assoc
 
-        with_association_context(res_show, args) do |show|
+        with_association_context(param, res_show, args) do |show|
           # Tell the child action it is being checked as a nested association.
           show.flags[:inner_assoc] = true
 
@@ -393,15 +393,17 @@ module HaveAPI::ModelAdapters
         end
       end
 
-      def with_association_context(res_show, args)
+      def with_association_context(param, res_show, args)
         push_cls = @context.action
         push_ins = @context.action_instance
         push_path = @context.path
         push_path_params = @context.path_params
+        push_resource_path = @context.resource_path
         path = @context.action_path_for(res_show)
         path_params = @context.path_params_for(res_show, args)
         @context.path = path
         @context.path_params = path_params
+        @context.resource_path = param.resource_path
 
         res_show.new(
           push_ins.request,
@@ -412,14 +414,15 @@ module HaveAPI::ModelAdapters
         )
         yield @context.action_instance
       ensure
-        restore_context(push_cls, push_ins, push_path, push_path_params)
+        restore_context(push_cls, push_ins, push_path, push_path_params, push_resource_path)
       end
 
-      def restore_context(action, action_instance, path, path_params)
+      def restore_context(action, action_instance, path, path_params, resource_path)
         @context.action = action
         @context.action_instance = action_instance
         @context.path = path
         @context.path_params = path_params
+        @context.resource_path = resource_path
       end
 
       def show_prepared?(show)

data/lib/haveapi/parameters/resource.rb

@@ -5,7 +5,7 @@ module HaveAPI::Parameters
     include MetadataI18n
 
     attr_reader :name, :resource, :label, :desc, :type, :value_id, :value_label,
-                :choices, :value_params
+                :choices, :value_params, :resource_path
 
     def initialize(resource, name: nil, label: nil, desc: nil,
                    choices: nil, value_id: :id, value_label: :label, required: nil,
@@ -177,7 +177,8 @@ module HaveAPI::Parameters
         path_params:,
         input: {},
         user: context.current_user,
-        endpoint: context.endpoint
+        endpoint: context.endpoint,
+        resource_path: @resource_path
       )
       action = show_action.new(context.request, context.version, path_params, {}, child_context)
       return if action.authorized?(context.current_user)

data/lib/haveapi/version.rb

@@ -1,4 +1,4 @@
 module HaveAPI
   PROTOCOL_VERSION = '2.0'.freeze
-  VERSION = '0.29.3'.freeze
+  VERSION = '0.29.4'.freeze
 end

data/spec/model_adapters/active_record_spec.rb

@@ -572,6 +572,18 @@ describe HaveAPI::ModelAdapters::ActiveRecord do
     validators[klass] || validators[short_name.to_sym] || validators[short_name.to_s]
   end
 
+  def with_pre_authorize(listener)
+    hooks = HaveAPI::Hooks.hooks
+    action_hooks = hooks[HaveAPI::Action][:pre_authorize]
+    original = action_hooks[:listeners].dup
+
+    HaveAPI::Action.connect_hook(:pre_authorize, &listener)
+
+    yield
+  ensure
+    action_hooks[:listeners] = original
+  end
+
   it 'translates ActiveModel validators to HaveAPI validators' do
     app
     create_action = action_class(:User, :create)
@@ -644,6 +656,27 @@ describe HaveAPI::ModelAdapters::ActiveRecord do
     expect(group_data).not_to have_key(:note)
   end
 
+  it 'uses the associated resource scope when authorizing output records' do
+    group = ARAdapterSpec::Group.create!(label: 'grp', note: 'GRP_NOTE')
+    user = create_user(name: 'user', group:)
+    group_show = action_class(:Group, :show)
+    scopes = []
+
+    with_pre_authorize(proc do |ret, context|
+      if context.action == group_show
+        scopes << context.action_scope
+      end
+      ret
+    end) do
+      get "/v1/users/#{user.id}", {}, input: ''
+    end
+
+    expect(api_response).to be_ok
+    expect(api_response[:user][:group][:id]).to eq(group.id)
+    expect(scopes.length).to eq(1)
+    expect(scopes.first).to end_with('.group#show')
+  end
+
   it 'resolves direct associations when included' do
     environment = ARAdapterSpec::Environment.create!(label: 'env', note: 'ENV_NOTE')
     group = ARAdapterSpec::Group.create!(label: 'grp', note: 'GRP_NOTE', environment: environment)
@@ -723,16 +756,25 @@ describe HaveAPI::ModelAdapters::ActiveRecord do
 
   it 'uses full nested paths when authorizing resource input records' do
     _dataset, snapshot, link = create_snapshot_link
-
-    put "/v1/snapshot_links/#{link.id}", {
-      snapshot_link: {
-        snapshot: snapshot.id
-      }
-    }.to_json, 'CONTENT_TYPE' => 'application/json'
+    scopes = []
+
+    with_pre_authorize(proc do |ret, context|
+      scopes << context.action_scope
+      ret[:blocks] << proc { deny if context.action_scope == '#show' }
+      ret
+    end) do
+      put "/v1/snapshot_links/#{link.id}", {
+        snapshot_link: {
+          snapshot: snapshot.id
+        }
+      }.to_json, 'CONTENT_TYPE' => 'application/json'
+    end
 
     expect(last_response.status).to eq(200)
     expect(api_response).to be_ok
     expect(api_response[:snapshot_link]).to eq(assigned: true)
+    expect(scopes).to include(a_string_ending_with('dataset.snapshot#show'))
+    expect(scopes).not_to include('#show')
   end
 
   it 'drops invalid nested include paths from requests' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: haveapi
 version: !ruby/object:Gem::Version
-  version: 0.29.3
+  version: 0.29.4
 platform: ruby
 authors:
 - Jakub Skokan
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.29.3
+        version: 0.29.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.29.3
+        version: 0.29.4
 - !ruby/object:Gem::Dependency
   name: i18n
   requirement: !ruby/object:Gem::Requirement