labimotion 2.3.0 → 2.4.0.rc11

data/lib/labimotion/apis/generic_klass_api.rb

@@ -14,18 +14,21 @@ module Labimotion
         desc 'export klass'
         params do
           requires :id, type: Integer, desc: 'element id'
-          requires :klass, type: String, desc: 'Klass', values: %w[ElementKlass SegmentKlass DatasetKlass]
+          requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
         end
         get do
-          entity = "Labimotion::#{params[:klass]}".constantize.find_by(id: params[:id])
-          entity.update_columns(identifier: SecureRandom.uuid) if entity&.identifier.nil?
+          # This export previously accepted any logged-in account (no admin gate at all) and,
+          # worse, wrote through update_columns inside a GET — minting the identifier that Hub
+          # sync keys on, for whoever happened to press download first. Gated :read now, and a
+          # template with no identifier simply exports without one; minting stays with the
+          # write paths.
+          entity = fetch_klass(params[:klass], params[:id])
+          authorize_klass!(entity, :read)
           env['api.format'] = :binary
           content_type('application/json')
           filename = CGI.escape("LabIMotion_#{params[:klass]}_#{entity.label}-#{Time.new.strftime("%Y%m%d%H%M%S")}.json")
-          # header['Content-Disposition'] = "attachment; filename=abc.docx"
           header('Content-Disposition', "attachment; filename=\"#{filename}\"")
           "Labimotion::#{params[:klass]}Entity".constantize.represent(entity)
-          # klass.as_json
         rescue StandardError => e
           Labimotion.log_exception(e, current_user)
           {}
@@ -35,12 +38,12 @@ module Labimotion
       namespace :de_activate do
         desc 'activate or deactivate Generic Klass'
         params do
-          requires :klass, type: String, desc: 'Klass', values: %w[ElementKlass SegmentKlass DatasetKlass]
+          requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
           requires :id, type: Integer, desc: 'Klass ID'
           requires :is_active, type: Boolean, desc: 'Active or Inactive Klass'
         end
         after_validation do
-          authenticate_admin!(params[:klass].gsub(/(Klass)/, 's').downcase)
+          # authorize_klass!(:deactivate) runs inside the helper, on the loaded record.
           fetch_klass(params[:klass], params[:id])
         end
         post do
@@ -54,11 +57,74 @@ module Labimotion
         end
       end
 
+      namespace :update_settings do
+        desc 'update Generic Klass settings'
+        params do
+          requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
+          requires :id, type: Integer, desc: 'Klass ID'
+          requires :settings, type: Hash, desc: 'Klass settings'
+        end
+        after_validation do
+          # authorize_klass!(:write) runs inside the helper, on the loaded record.
+          fetch_klass(params[:klass], params[:id])
+        end
+        post do
+          updated_klass = update_klass_settings(params)
+          entity_class = "Labimotion::#{params[:klass]}Entity".constantize
+          serialized_data = entity_class.represent(updated_klass)
+          { mc: 'ss00', data: serialized_data }
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { mc: 'se00', msg: e.message, data: {} }
+        end
+      end
+
+      namespace :deleted_klasses do
+        desc 'list the soft-deleted Generic Klasses of one type'
+        params do
+          requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
+        end
+        after_validation do
+          authenticate_admin!(Labimotion::Constants::Family::FAMILY_OF[params[:klass]])
+        end
+        get do
+          list = deleted_klasses(params)
+          entity_class = "Labimotion::#{params[:klass]}Entity".constantize
+          # `deleted_at` is not on the klass entities (a sibling PR owns those files), and a
+          # restore list that cannot say when a template was deleted is not much of a list.
+          serialized = list.map do |klz|
+            entity_class.represent(klz).as_json.merge(deleted_at: klz.deleted_at&.iso8601)
+          end
+          { klass: serialized }
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { mc: 'se00', msg: e.message, klass: [] }
+        end
+      end
+
+      namespace :restore_klass do
+        desc 'restore a soft-deleted Generic Klass'
+        params do
+          requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
+          requires :id, type: Integer, desc: 'Klass ID'
+        end
+        # authorize_klass!(:destroy) runs inside the helper, on the loaded deleted record —
+        # shares survive deletion, so the owner row is still there to gate the restore.
+        post do
+          restored_klass = restore_klass(params)
+          entity_class = "Labimotion::#{params[:klass]}Entity".constantize
+          { mc: 'ss00', data: entity_class.represent(restored_klass) }
+        rescue StandardError => e
+          Labimotion.log_exception(e, current_user)
+          { mc: 'se00', msg: e.message, data: {} }
+        end
+      end
+
       namespace :fetch do
         desc 'fetch Generic Klass by id'
         params do
           requires :id, type: Integer, desc: 'Klass ID'
-          requires :klass, type: String, desc: 'Klass', values: %w[ElementKlass SegmentKlass DatasetKlass]
+          requires :klass, type: String, desc: 'Klass', values: Labimotion::Constants::Klass::ALL
         end
         get do
           klass_obj = fetch_klass(params[:klass], params[:id])