lockbox_middleware 1.2.0 → 1.2.1

data/vendor/plugins/active_scaffold/lib/active_scaffold/actions/live_search.rb

@@ -0,0 +1,57 @@
+module ActiveScaffold::Actions
+  module LiveSearch
+    def self.included(base)
+      base.before_filter :search_authorized_filter, :only => :show_search
+      base.before_filter :do_search
+    end
+
+    def show_search
+      respond_to_action(:live_search)
+    end
+
+    protected
+
+    def live_search_respond_to_html
+      if successful?
+        render(:partial => "live_search", :layout => true)
+      else
+        return_to_main
+      end
+    end
+    
+    def live_search_respond_to_js
+      render(:partial => "live_search")
+    end
+
+    def do_search
+      @query = params[:search].to_s.strip rescue ''
+
+      unless @query.empty?
+        columns = active_scaffold_config.live_search.columns
+        like_pattern = active_scaffold_config.live_search.full_text_search? ? '%?%' : '?%'
+        search_conditions = self.class.create_conditions_for_columns(@query.split(' '), columns, like_pattern)
+        self.active_scaffold_conditions = merge_conditions(self.active_scaffold_conditions, search_conditions)
+        @filtered = !search_conditions.blank?
+
+        includes_for_search_columns = columns.collect{ |column| column.includes}.flatten.uniq.compact
+        self.active_scaffold_joins.concat includes_for_search_columns
+
+        active_scaffold_config.list.user.page = nil
+      end
+    end
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def search_authorized?
+      authorized_for?(:action => :read)
+    end
+    private
+    def search_authorized_filter
+      link = active_scaffold_config.live_search.link || active_scaffold_config.live_search.class.link
+      raise ActiveScaffold::ActionNotAllowed unless self.send(link.security_method)
+    end
+    def live_search_formats
+      (default_formats + active_scaffold_config.formats + active_scaffold_config.live_search.formats).uniq
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/actions/nested.rb

@@ -0,0 +1,217 @@
+module ActiveScaffold::Actions
+  # The Nested module basically handles automatically linking controllers together. It does this by creating column links with the right parameters, and by providing any supporting systems (like a /:controller/nested action for returning associated scaffolds).
+  module Nested
+
+    def self.included(base)
+      super
+      base.module_eval do
+        include ActiveScaffold::Actions::Nested::ChildMethods if active_scaffold_config.model.reflect_on_all_associations.any? {|a| a.macro == :has_and_belongs_to_many}
+      end
+      base.before_filter :include_habtm_actions
+      base.helper_method :nested_habtm?
+    end
+
+    def nested
+      do_nested
+      respond_to_action(:nested)
+    end
+
+    protected
+    def nested_respond_to_html
+      render :partial => 'nested', :layout => true
+    end
+    def nested_respond_to_js
+      render :partial => 'nested'
+    end
+    # A simple method to find the record we'll be nesting *from*
+    # May be overridden to customize the behavior
+    def do_nested
+      @record = find_if_allowed(params[:id], :read)
+    end
+
+    def nested_authorized?
+      true
+    end
+
+    def include_habtm_actions
+      if nested_habtm?
+        # Production mode is ok with adding a link everytime the scaffold is nested - we ar not ok with that.
+        active_scaffold_config.action_links.add('new_existing', :label => :add_existing, :type => :table, :security_method => :add_existing_authorized?) unless active_scaffold_config.action_links['new_existing']
+        if active_scaffold_config.nested.shallow_delete
+          active_scaffold_config.action_links.add('destroy_existing', :label => :remove, :type => :record, :confirm => 'are_you_sure', :method => :delete, :position => false, :security_method => :delete_existing_authorized?) unless active_scaffold_config.action_links['destroy_existing']
+          active_scaffold_config.action_links.delete("delete") if active_scaffold_config.action_links['delete']
+        end
+      else
+        # Production mode is caching this link into a non nested scaffold
+        active_scaffold_config.action_links.delete('new_existing') if active_scaffold_config.action_links['new_existing']
+        
+        if active_scaffold_config.nested.shallow_delete
+          active_scaffold_config.action_links.delete("destroy_existing") if active_scaffold_config.action_links['destroy_existing']
+          active_scaffold_config.action_links.add(ActiveScaffold::Config::Delete.link) unless active_scaffold_config.action_links['delete']
+        end
+        
+      end
+    end
+
+    def nested?
+      !params[:nested].nil?
+    end
+
+    def nested_habtm?
+      begin
+        a = active_scaffold_config.columns[nested_association]
+        return a.association.macro == :has_and_belongs_to_many if a and nested?
+        false
+      rescue
+        raise ActiveScaffold::MalformedConstraint, constraint_error(active_scaffold_config.model, nested_association), caller
+      end
+    end
+
+    def nested_association
+      return active_scaffold_constraints.keys.to_s.to_sym if nested?
+      nil
+    end
+
+    def nested_parent_id
+      return active_scaffold_constraints.values.to_s if nested?
+      nil
+    end
+    private
+    def nested_formats
+      (default_formats + active_scaffold_config.formats + active_scaffold_config.nested.formats).uniq
+    end
+  end
+end
+
+module ActiveScaffold::Actions::Nested
+  module ChildMethods
+
+    def self.included(base)
+      super
+      base.verify :method => :post,
+                  :only => :add_existing,
+                  :redirect_to => { :action => :index }
+    end
+
+    def new_existing
+      do_new
+      respond_to_action(:new_existing)
+    end
+
+    def add_existing
+      do_add_existing
+      respond_to_action(:add_existing)
+    end
+
+    def destroy_existing
+      return redirect_to(params.merge(:action => :delete)) if request.get?
+      do_destroy_existing
+      respond_to_action(:destroy_existing)
+    end
+    
+    protected
+    def new_existing_respond_to_html
+      if successful?
+        render(:action => 'add_existing_form')
+      else
+        return_to_main
+      end
+    end
+    def new_existing_respond_to_js
+      render(:partial => 'add_existing_form')
+    end
+    def add_existing_respond_to_html
+      if successful?
+        flash[:info] = as_(:created_model, :model => @record.to_label)
+        return_to_main
+      else
+        render(:action => 'add_existing_form')
+      end
+    end
+    def add_existing_respond_to_js
+      if successful?
+        render :action => 'add_existing'
+      else
+        render :action => 'form_messages'
+      end
+    end
+    def add_existing_respond_to_xml
+      render :xml => response_object.to_xml, :content_type => Mime::XML, :status => response_status
+    end
+    def add_existing_respond_to_json
+      render :text => response_object.to_json, :content_type => Mime::JSON, :status => response_status
+    end
+    def add_existing_respond_to_yaml
+      render :text => response_object.to_yaml, :content_type => Mime::YAML, :status => response_status
+    end
+    def destroy_existing_respond_to_html
+      flash[:info] = as_(:deleted_model, :model => @record.to_label)
+      return_to_main
+    end
+
+    def destroy_existing_respond_to_js
+      render(:action => 'destroy')
+    end
+
+    def destroy_existing_respond_to_xml
+      render :xml => successful? ? "" : response_object.to_xml, :content_type => Mime::XML, :status => response_status
+    end
+
+    def destroy_existing_respond_to_json
+      render :text => successful? ? "" : response_object.to_json, :content_type => Mime::JSON, :status => response_status
+    end
+
+    def destroy_existing_respond_to_yaml
+      render :text => successful? ? "" : response_object.to_yaml, :content_type => Mime::YAML, :status => response_status
+    end
+
+    def add_existing_authorized?
+      true
+    end
+    def delete_existing_authorized?
+      true
+    end
+ 
+    def after_create_save(record)
+      if params[:association_macro] == :has_and_belongs_to_many
+        params[:associated_id] = record
+        do_add_existing
+      end
+    end
+
+    def nested_action_from_params
+      return params[:parent_model].constantize, nested_parent_id, params[:parent_column]
+    end
+
+    # The actual "add_existing" algorithm
+    def do_add_existing
+      parent_model, id, association = nested_action_from_params
+      parent_record = find_if_allowed(id, :update, parent_model)
+      @record = active_scaffold_config.model.find(params[:associated_id])
+      parent_record.send(association) << @record
+      parent_record.save
+    end
+
+    def do_destroy_existing
+      if active_scaffold_config.nested.shallow_delete
+        parent_model, id, association = nested_action_from_params
+        @record = find_if_allowed(id, :update, parent_model)
+        collection = @record.send(association)
+        assoc_record = collection.find(params[:id])
+        collection.delete(assoc_record)
+      else
+        do_destroy
+      end
+    end
+    private
+    def new_existing_formats
+      (default_formats + active_scaffold_config.formats).uniq
+    end
+    def add_existing_formats
+      (default_formats + active_scaffold_config.formats).uniq
+    end
+    def destroy_existing_formats
+      (default_formats + active_scaffold_config.formats).uniq
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/actions/search.rb

@@ -0,0 +1,50 @@
+module ActiveScaffold::Actions
+  module Search
+    def self.included(base)
+      base.before_filter :search_authorized_filter, :only => :show_search
+      base.before_filter :do_search
+    end
+
+    def show_search
+      respond_to_action(:search)
+    end
+
+    protected
+    def search_respond_to_html
+      render(:action => "search")
+    end
+    def search_respond_to_js
+      render(:partial => "search")
+    end
+    def do_search
+      @query = params[:search].to_s.strip rescue ''
+
+      unless @query.empty?
+        columns = active_scaffold_config.search.columns
+        like_pattern = active_scaffold_config.search.full_text_search? ? '%?%' : '?%'
+        search_conditions = self.class.create_conditions_for_columns(@query.split(' '), columns, like_pattern)
+        self.active_scaffold_conditions = merge_conditions(self.active_scaffold_conditions, search_conditions)
+        @filtered = !search_conditions.blank?
+
+        includes_for_search_columns = columns.collect{ |column| column.includes}.flatten.uniq.compact
+        self.active_scaffold_joins.concat includes_for_search_columns
+
+        active_scaffold_config.list.user.page = nil
+      end
+    end
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def search_authorized?
+      authorized_for?(:action => :read)
+    end
+    private
+    def search_authorized_filter
+      link = active_scaffold_config.search.link || active_scaffold_config.search.class.link
+      raise ActiveScaffold::ActionNotAllowed unless self.send(link.security_method)
+    end
+    def search_formats
+      (default_formats + active_scaffold_config.formats + active_scaffold_config.search.formats).uniq
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/actions/show.rb

@@ -0,0 +1,54 @@
+module ActiveScaffold::Actions
+  module Show
+    def self.included(base)
+      base.before_filter :show_authorized_filter, :only => :show
+    end
+
+    def show
+      do_show
+      successful?
+      respond_to_action(:show)
+    end
+
+    protected
+    
+    def show_respond_to_json
+      render :text => response_object.to_json, :content_type => Mime::JSON, :status => response_status
+    end
+
+    def show_respond_to_yaml
+      render :text => response_object.to_yaml, :content_type => Mime::YAML, :status => response_status
+    end
+
+    def show_respond_to_xml
+      render :xml => response_object.to_xml, :content_type => Mime::XML, :status => response_status
+    end
+
+    def show_respond_to_js
+      render :partial => 'show'
+    end
+
+    def show_respond_to_html
+      render :action => 'show'
+    end
+    # A simple method to retrieve and prepare a record for showing.
+    # May be overridden to customize show routine
+    def do_show
+      @record = find_if_allowed(params[:id], :read)
+    end
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def show_authorized?
+      authorized_for?(:action => :read)
+    end
+    private 
+    def show_authorized_filter
+      link = active_scaffold_config.show.link || active_scaffold_config.show.class.link
+      raise ActiveScaffold::ActionNotAllowed unless self.send(link.security_method)
+    end
+    def show_formats
+      (default_formats + active_scaffold_config.formats + active_scaffold_config.show.formats).uniq
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/actions/subform.rb

@@ -0,0 +1,17 @@
+module ActiveScaffold::Actions
+  module Subform
+    def edit_associated
+      @parent_record = params[:id].nil? ? active_scaffold_config.model.new : find_if_allowed(params[:id], :update)
+      @column = active_scaffold_config.columns[params[:association]]
+
+      # NOTE: we don't check whether the user is allowed to update this record, because if not, we'll still let them associate the record. we'll just refuse to do more than associate, is all.
+      @record = @column.association.klass.find(params[:associated_id]) if params[:associated_id]
+      @record ||= @column.association.klass.new
+
+      @scope = "[#{@column.name}]"
+      @scope += (@record.new_record?) ? "[#{(Time.now.to_f*1000).to_i.to_s}]" : "[#{@record.id}]" if @column.plural_association?
+
+      render :action => 'edit_associated'
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/actions/update.rb

@@ -0,0 +1,126 @@
+module ActiveScaffold::Actions
+  module Update
+    def self.included(base)
+      base.before_filter :update_authorized_filter, :only => [:edit, :update]
+      base.verify :method => [:post, :put],
+                  :only => :update,
+                  :redirect_to => { :action => :index }
+    end
+
+    def edit
+      do_edit
+      respond_to_action(:edit)
+    end
+
+    def update
+      do_update
+      respond_to_action(:update)
+    end
+
+    # for inline (inlist) editing
+    def update_column
+      do_update_column
+      render :action => 'update_column'
+    end
+
+    protected
+    def edit_respond_to_html
+      if successful?
+        render(:action => 'update')
+      else
+        return_to_main
+      end
+    end
+    def edit_respond_to_js
+      render(:partial => 'update_form')
+    end
+    def update_respond_to_html  
+      if params[:iframe]=='true' # was this an iframe post ?
+        responds_to_parent do
+          if successful?
+            render :action => 'on_update.js'
+          else
+            render :action => 'form_messages_on_update.js'
+          end
+        end
+      else # just a regular post
+        if successful?
+          flash[:info] = as_(:updated_model, :model => @record.to_label)
+          return_to_main
+        else
+          render(:action => 'update')
+        end
+      end
+    end
+    def update_respond_to_js
+      render :action => 'on_update'
+    end
+    def update_respond_to_xml
+      render :xml => response_object.to_xml, :content_type => Mime::XML, :status => response_status
+    end
+    def update_respond_to_json
+      render :text => response_object.to_json, :content_type => Mime::JSON, :status => response_status
+    end
+    def update_respond_to_yaml
+      render :text => response_object.to_yaml, :content_type => Mime::YAML, :status => response_status
+    end
+    # A simple method to find and prepare a record for editing
+    # May be overridden to customize the record (set default values, etc.)
+    def do_edit
+      @record = find_if_allowed(params[:id], :update)
+    end
+
+    # A complex method to update a record. The complexity comes from the support for subforms, and saving associated records.
+    # If you want to customize this algorithm, consider using the +before_update_save+ callback
+    def do_update
+      do_edit
+      begin
+        active_scaffold_config.model.transaction do
+          @record = update_record_from_params(@record, active_scaffold_config.update.columns, params[:record])
+          before_update_save(@record)
+          self.successful = [@record.valid?, @record.associated_valid?].all? {|v| v == true} # this syntax avoids a short-circuit
+          if successful?
+            @record.save! and @record.save_associated!
+            after_update_save(@record)
+          end
+        end
+      rescue ActiveRecord::RecordInvalid
+      rescue ActiveRecord::StaleObjectError
+        @record.errors.add_to_base as_(:version_inconsistency)
+        self.successful=false
+      end
+    end
+
+    def do_update_column
+      @record = active_scaffold_config.model.find(params[:id])
+      if @record.authorized_for?(:action => :update, :column => params[:column])
+        params[:value] ||= @record.column_for_attribute(params[:column]).default unless @record.column_for_attribute(params[:column]).null
+        @record.send("#{params[:column]}=", params[:value])
+        @record.save
+      end
+    end
+
+    # override this method if you want to inject data in the record (or its associated objects) before the save
+    def before_update_save(record); end
+
+    # override this method if you want to do something after the save
+    def after_update_save(record); end
+
+    # The default security delegates to ActiveRecordPermissions.
+    # You may override the method to customize.
+    def update_authorized?
+      authorized_for?(:action => :update)
+    end
+    private
+    def update_authorized_filter
+      link = active_scaffold_config.update.link || active_scaffold_config.update.class.link
+      raise ActiveScaffold::ActionNotAllowed unless self.send(link.security_method)
+    end
+    def edit_formats
+      (default_formats + active_scaffold_config.formats).uniq
+    end
+    def update_formats
+      (default_formats + active_scaffold_config.formats + active_scaffold_config.update.formats).uniq
+    end
+  end
+end