lockbox_middleware 1.2.0 → 1.2.1

data/vendor/plugins/active_scaffold/lib/active_scaffold/config/show.rb

@@ -0,0 +1,36 @@
+module ActiveScaffold::Config
+  class Show < Base
+    self.crud_type = :read
+
+    def initialize(core_config)
+      @core = core_config
+      # start with the ActionLink defined globally
+      @link = self.class.link.clone
+    end
+
+    # global level configuration
+    # --------------------------
+    cattr_accessor :link
+    @@link = ActiveScaffold::DataStructures::ActionLink.new('show', :label => :show, :type => :record, :security_method => :show_authorized?)
+    # instance-level configuration
+    # ----------------------------
+
+    # the ActionLink for this action
+    attr_accessor :link
+    # the label for this action. used for the header.
+    attr_writer :label
+    def label
+      @label ? as_(@label) : as_(:show_model, :model => @core.label(:count => 1))
+    end
+
+    # provides access to the list of columns specifically meant for this action to use
+    def columns
+      self.columns = @core.columns._inheritable unless @columns # lazy evaluation
+      @columns
+    end
+    def columns=(val)
+      @columns = ActiveScaffold::DataStructures::ActionColumns.new(*val)
+      @columns.action = self
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/config/subform.rb

@@ -0,0 +1,36 @@
+module ActiveScaffold::Config
+  class Subform < Base
+    def initialize(core_config)
+      @core = core_config
+      @layout = :horizontal # default layout
+    end
+
+    # global level configuration
+    # --------------------------
+
+    # instance-level configuration
+    # ----------------------------
+
+    attr_accessor :layout
+
+    # provides access to the list of columns specifically meant for the Sub-Form to use
+    def columns
+      # we want to delay initializing to the @core.update.columns set for as long as possible. but we have to eventually clone, or else have a configuration "leak"
+      unless @columns
+        if @core.actions.include? :update
+          @columns = @core.update.columns.clone
+        else
+          self.columns = @core.columns._inheritable
+        end
+      end
+
+      @columns
+    end
+
+    def columns=(val)
+      @columns = ActiveScaffold::DataStructures::ActionColumns.new(*val)
+      @columns.action = self
+      return @columns
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/config/update.rb

@@ -0,0 +1,32 @@
+module ActiveScaffold::Config
+  class Update < Form
+    self.crud_type = :update
+    def initialize(*args)
+      super
+      self.nested_links = self.class.nested_links
+    end
+
+    # global level configuration
+    # --------------------------
+    # the ActionLink for this action
+    def self.link
+      @@link
+    end
+    def self.link=(val)
+      @@link = val
+    end
+    @@link = ActiveScaffold::DataStructures::ActionLink.new('edit', :label => :edit, :type => :record, :security_method => :update_authorized?)
+
+    # instance-level configuration
+    # ----------------------------
+
+    # the label= method already exists in the Form base class
+    def label
+      @label ? as_(@label) : as_(:update_model, :model => @core.label(:count => 1))
+    end
+
+    attr_accessor :nested_links
+    cattr_accessor :nested_links
+    @@nested_links = false
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/configurable.rb

@@ -0,0 +1,29 @@
+module ActiveScaffold
+  # Exposes a +configure+ method that accepts a block and runs all contents of the block in two contexts, as opposed to the normal one. First, everything gets evaluated as part of the object including Configurable. Then, as a failover, missing methods and variables are evaluated in the original binding of the block.
+  #
+  # Note that this only works with "barewords". Constants, instance variables, and class variables are not currently supported in both contexts.
+  #
+  # May add the given functionality at both the class and instance level. For the former, use +extend+, and for the latter, use +include+.
+  module Configurable
+    def configure(&configuration_block)
+      return unless configuration_block
+      @configuration_binding = configuration_block.binding
+      ret = instance_exec self, &configuration_block
+      @configuration_binding = nil
+      return ret
+    end
+
+    # this method will surely need tweaking. for example, i'm not sure if it should call super before or after it tries to eval with the binding.
+    def method_missing(name, *args)
+      begin
+        super
+      rescue NoMethodError, NameError
+        if @configuration_binding.nil?
+          raise $!
+        else
+          eval("self", @configuration_binding).send(name, *args)
+        end
+      end
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/constraints.rb

@@ -0,0 +1,181 @@
+module ActiveScaffold
+  module Constraints
+    def self.included(base)
+      base.module_eval do
+        before_filter :register_constraints_with_action_columns
+      end
+    end
+
+    protected
+
+    # Returns the current constraints
+    def active_scaffold_constraints
+      return active_scaffold_session_storage[:constraints] || {}
+    end
+
+    # For each enabled action, adds the constrained columns to the ActionColumns object (if it exists).
+    # This lets the ActionColumns object skip constrained columns.
+    #
+    # If the constraint value is a Hash, then we assume the constraint is a multi-level association constraint (the reverse of a has_many :through) and we do NOT register the constraint column.
+    def register_constraints_with_action_columns
+      constrained_fields = active_scaffold_constraints.reject{|k, v| v.is_a? Hash}.keys.collect{|k| k.to_sym}
+
+      if self.class.uses_active_scaffold?
+        # we actually want to do this whether constrained_fields exist or not, so that we can reset the array when they don't
+        active_scaffold_config.actions.each do |action_name|
+          action = active_scaffold_config.send(action_name)
+          next unless action.respond_to? :columns
+          action.columns.constraint_columns = constrained_fields
+        end
+      end
+    end
+
+    # Returns search conditions based on the current scaffold constraints.
+    #
+    # Supports constraints based on either a column name (in which case it checks for an association
+    # or just uses the search_sql) or a database field name.
+    #
+    # All of this work is primarily to support nested scaffolds in a manner generally useful for other
+    # embedded scaffolds.
+    def conditions_from_constraints
+      conditions = nil
+      active_scaffold_constraints.each do |k, v|
+        column = active_scaffold_config.columns[k]
+        constraint_condition = if column
+          # Assume this is a multi-level association constraint.
+          # example:
+          #   data model: Park -> Den -> Bear
+          #   constraint: :den => {:park => 5}
+          if v.is_a? Hash
+            far_association = column.association.klass.reflect_on_association(v.keys.first)
+            field = far_association.klass.primary_key
+            table = far_association.table_name
+
+            active_scaffold_joins.concat([{k => v.keys.first}]) # e.g. {:den => :park}
+            constraint_condition_for("#{table}.#{field}", v.values.first)
+
+          # association column constraint
+          elsif column.association
+            if column.association.macro == :has_and_belongs_to_many
+              active_scaffold_habtm_joins.concat column.includes
+            else
+              active_scaffold_joins.concat column.includes
+            end
+            condition_from_association_constraint(column.association, v)
+
+          # regular column constraints
+          elsif column.searchable?
+            active_scaffold_joins.concat column.includes
+            constraint_condition_for(column.search_sql, v)
+          end
+        # unknown-to-activescaffold-but-real-database-column constraint
+        elsif active_scaffold_config.model.column_names.include? k.to_s
+          constraint_condition_for(k.to_s, v)
+        else
+          raise ActiveScaffold::MalformedConstraint, constraint_error(active_scaffold_config.model, k), caller
+        end
+
+        conditions = merge_conditions(conditions, constraint_condition)
+      end
+
+      conditions
+    end
+
+    # We do NOT want to use .search_sql. If anything, search_sql will refer
+    # to a human-searchable value on the associated record.
+    def condition_from_association_constraint(association, value)
+      # when the reverse association is a :belongs_to, the id for the associated object only exists as
+      # the primary_key on the other table. so for :has_one and :has_many (when the reverse is :belongs_to),
+      # we have to use the other model's primary_key.
+      #
+      # please see the relevant tests for concrete examples.
+      field = if [:has_one, :has_many].include?(association.macro)
+        association.klass.primary_key
+      elsif [:has_and_belongs_to_many].include?(association.macro)
+        association.association_foreign_key
+      else
+        association.options[:foreign_key] || association.name.to_s.foreign_key
+      end
+
+      table = case association.macro
+        when :has_and_belongs_to_many
+        association.options[:join_table]
+
+        when :belongs_to
+        active_scaffold_config.model.table_name
+
+        else
+        association.table_name
+      end
+
+      if association.options[:primary_key]
+        value = association.klass.find(value).send(association.options[:primary_key])
+      end
+
+      condition = constraint_condition_for("#{table}.#{field}", value)
+      if association.options[:polymorphic]
+        condition = merge_conditions(
+          condition,
+          constraint_condition_for("#{table}.#{association.name}_type", params[:parent_model].to_s)
+        )
+      end
+
+      condition
+    end
+
+    def constraint_error(klass, column_name)
+      "Malformed constraint `#{klass}##{column_name}'. If it's a legitimate column, and you are using a nested scaffold, please specify or double-check the reverse association name."
+    end
+
+    # Applies constraints to the given record.
+    #
+    # Searches through the known columns for association columns. If the given constraint is an association,
+    # it assumes that the constraint value is an id. It then does a association.klass.find with the value
+    # and adds the associated object to the record.
+    #
+    # For some operations ActiveRecord will automatically update the database. That's not always ok.
+    # If it *is* ok (e.g. you're in a transaction), then set :allow_autosave to true.
+    def apply_constraints_to_record(record, options = {})
+      options[:allow_autosave] = false if options[:allow_autosave].nil?
+
+      active_scaffold_constraints.each do |k, v|
+        column = active_scaffold_config.columns[k]
+        if column and column.association
+          if v.is_a? Hash # reverse of a through association ... we need to set the far association
+            # example
+            #   data model: Park -> Den -> Bear
+            #   constraint: :den => {:park => 5}
+            #   remote_klass: Park
+            remote_klass = column.association.klass.reflect_on_association(v.keys.first).klass
+            first_associated = record.send("#{k}")
+            first_associated.send("#{v.keys.first}=", remote_klass.find(v.values.first)) if first_associated
+          elsif column.plural_association?
+            record.send("#{k}").send(:<<, column.association.klass.find(v))
+          elsif column.association.options[:polymorphic]
+            record.send("#{k}=", params[:parent_model].constantize.find(v))
+          else # regular singular association
+            record.send("#{k}=", column.association.klass.find(v))
+
+            # setting the belongs_to side of a has_one isn't safe. if the has_one was already
+            # specified, rails won't automatically clear out the previous associated record.
+            #
+            # note that we can't take the extra step to correct this unless we're permitted to
+            # run operations where activerecord auto-saves the object.
+            reverse = column.association.klass.reflect_on_association(column.association.reverse)
+            if reverse.macro == :has_one and options[:allow_autosave]
+              record.send(k).send("#{column.association.reverse}=", record)
+            end
+          end
+        else
+          record.send("#{k}=", v)
+        end
+      end
+    end
+
+    private
+
+    def constraint_condition_for(sql, value)
+      value.nil? ? "#{sql} IS NULL" : ["#{sql} = ?", value]
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/data_structures/action_columns.rb

@@ -0,0 +1,97 @@
+module ActiveScaffold::DataStructures
+  # A set of columns. These structures can be nested for organization.
+  class ActionColumns < Set
+    include ActiveScaffold::Configurable
+
+    # this lets us refer back to the action responsible for this link, if it exists.
+    # the immediate need here is to get the crud_type so we can dynamically filter columns from the set.
+    attr_accessor :action
+
+    # labels are useful for the Create/Update forms, when we display columns in a grouped fashion and want to name them separately
+    attr_writer :label
+    def label
+      as_(@label) if @label
+    end
+
+    # Whether this column set is collapsed by default in contexts where collapsing is supported
+    attr_accessor :collapsed
+
+    # nests a subgroup in the column set
+    def add_subgroup(label, &proc)
+      columns = ActiveScaffold::DataStructures::ActionColumns.new
+      columns.label = label
+      columns.action = self.action
+      columns.configure &proc
+      self.exclude columns.collect_columns
+      self.add columns
+    end
+
+    def include?(item)
+      @set.each do |c|
+        return true if !c.is_a? Symbol and c.include? item
+        return true if c == item.to_sym
+      end
+      return false
+    end
+
+    protected
+
+    def collect_columns
+      @set.collect {|col| col.is_a?(ActiveScaffold::DataStructures::ActionColumns) ? col.collect_columns : col}
+    end
+
+    # called during clone or dup. makes the clone/dup deeper.
+    def initialize_copy(from)
+      @set = from.instance_variable_get('@set').clone
+    end
+
+    # A package of stuff to add after the configuration block. This is an attempt at making a certain level of functionality inaccessible during configuration, to reduce possible breakage from misuse.
+    # The bulk of the package is a means of connecting the referential column set (ActionColumns) with the actual column objects (Columns). This lets us iterate over the set and yield real column objects.
+    module AfterConfiguration
+      # Redefine the each method to yield actual Column objects.
+      # It will skip constrained and unauthorized columns.
+      #
+      # Options:
+      #  * :flatten - whether to recursively iterate on nested sets. default is false.
+      #  * :for - the record (or class) being iterated over. used for column-level security. default is the class.
+      def each(options = {}, &proc)
+        options[:for] ||= @columns.active_record_class
+
+        @set.each do |item|
+          unless item.is_a? ActiveScaffold::DataStructures::ActionColumns
+            item = (@columns[item] || ActiveScaffold::DataStructures::Column.new(item.to_sym, @columns.active_record_class))
+            # skip if this matches a constrained column
+            next if constraint_columns.include?(item.name.to_sym)
+            # skip if this matches the field_name of a constrained column
+            next if item.field_name and constraint_columns.include?(item.field_name.to_sym)
+            # skip this field if it's not authorized
+            next unless options[:for].authorized_for?(:action => options[:action] || self.action.crud_type, :column => item.name)
+          end
+          if item.is_a? ActiveScaffold::DataStructures::ActionColumns and options.has_key?(:flatten) and options[:flatten]
+            item.each(options, &proc)
+          else
+            yield item
+          end
+        end
+      end
+
+      # registers a set of column objects (recursively, for all nested ActionColumns)
+      def set_columns(columns)
+        @columns = columns
+        # iterate over @set instead of self to avoid dealing with security queries
+        @set.each do |item|
+          item.set_columns(columns) if item.respond_to? :set_columns
+        end
+      end
+
+      attr_writer :constraint_columns
+      def constraint_columns
+        @constraint_columns ||= []
+      end
+      
+      def length
+        (@set - self.constraint_columns).length
+      end
+    end
+  end
+end

data/vendor/plugins/active_scaffold/lib/active_scaffold/data_structures/action_link.rb

@@ -0,0 +1,140 @@
+module ActiveScaffold::DataStructures
+  class ActionLink
+    # provides a quick way to set any property of the object from a hash
+    def initialize(action, options = {})
+      # set defaults
+      self.action = action.to_s
+      self.label = action
+      self.confirm = false
+      self.type = :table
+      self.inline = true
+      self.method = :get
+      self.crud_type = :destroy if [:destroy].include?(action.to_sym)
+      self.crud_type = :create if [:create, :new].include?(action.to_sym)
+      self.crud_type = :update if [:edit, :update].include?(action.to_sym)
+      self.crud_type ||= :read
+      self.html_options = {}
+
+      # apply quick properties
+      options.each_pair do |k, v|
+        setter = "#{k}="
+        self.send(setter, v) if self.respond_to? setter
+      end
+    end
+
+    # the action-path for this link. what page to request? this is required!
+    attr_accessor :action
+    
+    # the controller for this action link. if nil, the current controller should be assumed.
+    attr_accessor :controller
+
+    # a hash of request parameters
+    attr_accessor :parameters
+
+    # the RESTful method
+    attr_accessor :method
+
+    # what string to use to represent this action
+    attr_writer :label
+    def label
+      @label.is_a?(Symbol) ? as_(@label) : @label
+    end
+
+    # if the action requires confirmation
+    attr_writer :confirm
+    def confirm
+      @confirm.is_a?(String) ? as_(@confirm) : @confirm
+    end
+    def confirm?
+      @confirm ? true : false
+    end
+    
+    # if the action uses a DHTML based (i.e. 2-phase) confirmation
+    attr_writer :dhtml_confirm
+    def dhtml_confirm
+      @dhtml_confirm
+    end
+    def dhtml_confirm?
+      @dhtml_confirm
+    end
+
+    # what method to call on the controller to see if this action_link should be visible
+    # note that this is only the UI part of the security. to prevent URL hax0rz, you also need security on requests (e.g. don't execute update method unless authorized).
+    attr_writer :security_method
+    def security_method
+      @security_method || "#{self.label.underscore.downcase.gsub(/ /, '_')}_authorized?"
+    end
+
+    def security_method_set?
+      !!@security_method
+    end
+
+    # the crud type of the (eventual?) action. different than :method, because this crud action may not be imminent.
+    # this is used to determine record-level authorization (e.g. record.authorized_for?(:action => link.crud_type).
+    # options are :create, :read, :update, and :destroy
+    attr_accessor :crud_type
+
+    # an "inline" link is inserted into the existing page
+    # exclusive with popup? and page?
+    def inline=(val)
+      @inline = (val == true)
+      self.popup = self.page = false if @inline
+    end
+    def inline?; @inline end
+
+    # a "popup" link displays in a separate (browser?) window. this will eventually take arguments.
+    # exclusive with inline? and page?
+    def popup=(val)
+      @popup = (val == true)
+      if @popup
+        self.inline = self.page = false
+
+        # the :method parameter doesn't mix with the :popup parameter
+        # when/if we start using DHTML popups, we can bring :method back
+        self.method = nil
+      end
+    end
+    def popup?; @popup end
+
+    # a "page" link displays by reloading the current page
+    # exclusive with inline? and popup?
+    def page=(val)
+      @page = (val == true)
+      if @page
+        self.inline = self.popup = false
+
+        # when :method is defined, ActionView adds an onclick to use a form ...
+        # so it's best to just empty out :method whenever possible.
+        # we only ever need to know @method = :get for things that default to POST.
+        # the only things that default to POST are forms and ajax calls.
+        # when @page = true, we don't use ajax.
+        self.method = nil if method == :get
+      end
+    end
+    def page?; @page end
+
+    # where the result of this action should insert in the display.
+    # for :type => :table, supported values are:
+    #   :top
+    #   :bottom
+    #   :replace (for updating the entire table)
+    #   false (no attempt at positioning)
+    # for :type => :record, supported values are:
+    #   :before
+    #   :replace
+    #   :after
+    #   false (no attempt at positioning)
+    attr_writer :position
+    def position
+      return @position unless @position.nil? or @position == true
+      return :replace if self.type == :record
+      return :top if self.type == :table
+      raise "what should the default position be for #{self.type}?"
+    end
+
+    # what type of link this is. currently supported values are :table and :record.
+    attr_accessor :type
+    # html options for the link
+    attr_accessor :html_options
+  end
+end