haveapi 0.29.3 → 0.29.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 885ac3cc2e4b40ee6595f9beadad79e75f371d607dd0d49d02f67a01cece7d7f
-  data.tar.gz: 8c8b186ae1299655f952bedf5cd857042df97b060a0fda7e43ef6b9bc0ec6393
+  metadata.gz: 91faacf7a526f1d4a85e3ac834af09b31870084892a4fe423c89f788b785831f
+  data.tar.gz: 81ece8ab753c147e13401933bd8086e11c6a20f8e1991cb86ac80df6afbfccac
 SHA512:
-  metadata.gz: 8b3cd3b9dabb84f88119dde487b150ea6694ab76450d24df1c8f7ff9309b5fcb91638d58f4794db0236de5d8a81c01693c3a5adfc9665200bdb24915599d131e
-  data.tar.gz: c738c43d4cc3437124e9af50cd1ae70c84d3f5a91cb93f4c6d1b0966257e011f438f8ecf36639ba0da5044b0b06aa5c8b6072dce4793d4546df424ebdc50a1a9
+  metadata.gz: 4d2c6c8cc96b841f645193d248023ea939f36a55af8e7dc2ed710ed770a15de89c34897cd9f3db969c4e1867b4e70ebcbcdf0c15f702d8acf917cee3cbc543a2
+  data.tar.gz: c7ff9c297474a183ba391e8567088494c0b98456f1cbb37b6a36599a955a4b6aca30ec2d5f631fc8d9fdc2c18319059eb5fda188fe75d2574d3875a52dda4544

data/haveapi.gemspec

@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.required_ruby_version = ">= #{File.read('../../.ruby-version').strip}"
 
   s.add_dependency 'activesupport', '>= 7.1'
-  s.add_dependency 'haveapi-client', '~> 0.29.3'
+  s.add_dependency 'haveapi-client', '~> 0.29.5'
   s.add_dependency 'i18n', '>= 1.6', '< 2'
   s.add_dependency 'json'
   s.add_dependency 'mail'

data/lib/haveapi/model_adapters/active_record.rb

@@ -362,7 +362,7 @@ module HaveAPI::ModelAdapters
         resolve_assoc = includes_include?(param.name)
         pass_includes = includes_pass_on_to(param.name) if resolve_assoc
 
-        with_association_context(res_show, args) do |show|
+        with_association_context(param, res_show, args) do |show|
           # Tell the child action it is being checked as a nested association.
           show.flags[:inner_assoc] = true
 
@@ -393,15 +393,17 @@ module HaveAPI::ModelAdapters
         end
       end
 
-      def with_association_context(res_show, args)
+      def with_association_context(param, res_show, args)
         push_cls = @context.action
         push_ins = @context.action_instance
         push_path = @context.path
         push_path_params = @context.path_params
+        push_resource_path = @context.resource_path
         path = @context.action_path_for(res_show)
         path_params = @context.path_params_for(res_show, args)
         @context.path = path
         @context.path_params = path_params
+        @context.resource_path = param.resource_path
 
         res_show.new(
           push_ins.request,
@@ -412,14 +414,15 @@ module HaveAPI::ModelAdapters
         )
         yield @context.action_instance
       ensure
-        restore_context(push_cls, push_ins, push_path, push_path_params)
+        restore_context(push_cls, push_ins, push_path, push_path_params, push_resource_path)
       end
 
-      def restore_context(action, action_instance, path, path_params)
+      def restore_context(action, action_instance, path, path_params, resource_path)
         @context.action = action
         @context.action_instance = action_instance
         @context.path = path
         @context.path_params = path_params
+        @context.resource_path = resource_path
       end
 
       def show_prepared?(show)

data/lib/haveapi/parameters/resource.rb

@@ -5,7 +5,7 @@ module HaveAPI::Parameters
     include MetadataI18n
 
     attr_reader :name, :resource, :label, :desc, :type, :value_id, :value_label,
-                :choices, :value_params
+                :choices, :value_params, :resource_path
 
     def initialize(resource, name: nil, label: nil, desc: nil,
                    choices: nil, value_id: :id, value_label: :label, required: nil,
@@ -177,7 +177,8 @@ module HaveAPI::Parameters
         path_params:,
         input: {},
         user: context.current_user,
-        endpoint: context.endpoint
+        endpoint: context.endpoint,
+        resource_path: @resource_path
       )
       action = show_action.new(context.request, context.version, path_params, {}, child_context)
       return if action.authorized?(context.current_user)

data/lib/haveapi/version.rb

@@ -1,4 +1,4 @@
 module HaveAPI
   PROTOCOL_VERSION = '2.0'.freeze
-  VERSION = '0.29.3'.freeze
+  VERSION = '0.29.5'.freeze
 end

data/spec/model_adapters/active_record_spec.rb

@@ -572,6 +572,18 @@ describe HaveAPI::ModelAdapters::ActiveRecord do
     validators[klass] || validators[short_name.to_sym] || validators[short_name.to_s]
   end
 
+  def with_pre_authorize(listener)
+    hooks = HaveAPI::Hooks.hooks
+    action_hooks = hooks[HaveAPI::Action][:pre_authorize]
+    original = action_hooks[:listeners].dup
+
+    HaveAPI::Action.connect_hook(:pre_authorize, &listener)
+
+    yield
+  ensure
+    action_hooks[:listeners] = original
+  end
+
   it 'translates ActiveModel validators to HaveAPI validators' do
     app
     create_action = action_class(:User, :create)
@@ -644,6 +656,27 @@ describe HaveAPI::ModelAdapters::ActiveRecord do
     expect(group_data).not_to have_key(:note)
   end
 
+  it 'uses the associated resource scope when authorizing output records' do
+    group = ARAdapterSpec::Group.create!(label: 'grp', note: 'GRP_NOTE')
+    user = create_user(name: 'user', group:)
+    group_show = action_class(:Group, :show)
+    scopes = []
+
+    with_pre_authorize(proc do |ret, context|
+      if context.action == group_show
+        scopes << context.action_scope
+      end
+      ret
+    end) do
+      get "/v1/users/#{user.id}", {}, input: ''
+    end
+
+    expect(api_response).to be_ok
+    expect(api_response[:user][:group][:id]).to eq(group.id)
+    expect(scopes.length).to eq(1)
+    expect(scopes.first).to end_with('.group#show')
+  end
+
   it 'resolves direct associations when included' do
     environment = ARAdapterSpec::Environment.create!(label: 'env', note: 'ENV_NOTE')
     group = ARAdapterSpec::Group.create!(label: 'grp', note: 'GRP_NOTE', environment: environment)
@@ -723,16 +756,25 @@ describe HaveAPI::ModelAdapters::ActiveRecord do
 
   it 'uses full nested paths when authorizing resource input records' do
     _dataset, snapshot, link = create_snapshot_link
-
-    put "/v1/snapshot_links/#{link.id}", {
-      snapshot_link: {
-        snapshot: snapshot.id
-      }
-    }.to_json, 'CONTENT_TYPE' => 'application/json'
+    scopes = []
+
+    with_pre_authorize(proc do |ret, context|
+      scopes << context.action_scope
+      ret[:blocks] << proc { deny if context.action_scope == '#show' }
+      ret
+    end) do
+      put "/v1/snapshot_links/#{link.id}", {
+        snapshot_link: {
+          snapshot: snapshot.id
+        }
+      }.to_json, 'CONTENT_TYPE' => 'application/json'
+    end
 
     expect(last_response.status).to eq(200)
     expect(api_response).to be_ok
     expect(api_response[:snapshot_link]).to eq(assigned: true)
+    expect(scopes).to include(a_string_ending_with('dataset.snapshot#show'))
+    expect(scopes).not_to include('#show')
   end
 
   it 'drops invalid nested include paths from requests' do

data/spec/validators/inclusion_spec.rb

@@ -12,30 +12,32 @@ describe HaveAPI::Validators::Inclusion do
     end
   end
 
-  [
-    %w[one two three],
-    {
-      one: 'Fancy one',
-      two: 'Fancy two',
-      three: 'Fancy three'
-    }
-  ].each do |include|
-    context "with include as a '#{include.class}'" do
-      context 'with short form' do
-        let(:validator) { described_class.new(:include, %w[one two three]) }
-
-        it_behaves_like 'all'
-      end
-
-      context 'with full form' do
-        let(:validator) do
-          described_class.new(:include, {
-            values: %w[one two three]
-          })
-        end
-
-        it_behaves_like 'all'
-      end
+  context 'with include as an Array' do
+    let(:values) { %w[one two three] }
+
+    context 'with short form' do
+      let(:validator) { described_class.new(:include, values) }
+
+      it_behaves_like 'all'
+    end
+
+    context 'with full form' do
+      let(:validator) { described_class.new(:include, { values: }) }
+
+      it_behaves_like 'all'
     end
   end
+
+  context 'with include as a Hash' do
+    let(:values) do
+      {
+        one: 'Fancy one',
+        two: 'Fancy two',
+        three: 'Fancy three'
+      }
+    end
+    let(:validator) { described_class.new(:include, { values: }) }
+
+    it_behaves_like 'all'
+  end
 end

data/test_support/client_test_api.rb

@@ -519,6 +519,31 @@ module HaveAPI
           end
         end
 
+        define_action(:EchoChoice) do
+          extend DocFilter
+
+          route 'echo_choice'
+          http_method :post
+          input(:hash) do
+            string :format,
+                   required: true,
+                   choices: {
+                     values: {
+                       archive: 'Archive',
+                       stream: 'Stream'
+                     }
+                   }
+          end
+          output(:hash) do
+            string :format
+          end
+          authorize { allow }
+
+          def exec
+            input
+          end
+        end
+
         define_action(:EchoOptional) do
           extend DocFilter
 
@@ -692,10 +717,32 @@ module HaveAPI
       HaveAPI.implicit_version = '1.0'
 
       reset!
+      ::I18n.backend.store_translations(
+        :cs,
+        client_test: {
+          resources: {
+            test: {
+              actions: {
+                echo_choice: {
+                  input: {
+                    format: {
+                      choices: {
+                        archive: { label: 'Archiv' },
+                        stream: { label: 'Proud' }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      )
 
       api = HaveAPI::Server.new(Resources)
       api.use_version(:all)
       api.default_version = '1.0'
+      api.parameter_i18n_scope = 'client_test'
       api.auth_chain << BasicProvider
       api.auth_chain << TokenProvider
       api.action_state = ActionStateBackend

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: haveapi
 version: !ruby/object:Gem::Version
-  version: 0.29.3
+  version: 0.29.5
 platform: ruby
 authors:
 - Jakub Skokan
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.29.3
+        version: 0.29.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.29.3
+        version: 0.29.5
 - !ruby/object:Gem::Dependency
   name: i18n
   requirement: !ruby/object:Gem::Requirement