model_driven_api 2.3.5 → 2.3.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 315cd43dc90a24097cd08e0ee261ba26b94b8b2e1a9f640416b68b7366b0352e
-  data.tar.gz: 47a36df93c41c8bcb0a32d832d3b7067e1b9894eda39c313fc0c18cdf17ced2d
+  metadata.gz: 190f87343976c6c393f9b2c80163ddc403b2575fd2c8fcceb125ef1996e7532a
+  data.tar.gz: e393facfcd2b11ac2af44df2f5602074e2da1ee48974dbb2fdec6d4f346c837e
 SHA512:
-  metadata.gz: 8d121bf09e8f799dc08ba1b7a5cb5c1b17b6d810eaee6a4c32886733f1e1133a770618bcc2c31ebbf5876f377d017244ad68d63b9d76770dfdcd4e779e09c313
-  data.tar.gz: c47b0e7fc8a63f96eb238cc8b6d8601b15e0d534b00151717ac333fff86f764998bb7857a471037c918bb25c24b89fe4ab7a63186683209c98e48eb4f18ffb4f
+  metadata.gz: b4f9083c41e709a64d99278f84594d28ac94175983678c01b2b08124facf2ccf3264808034a1c30eac3d2801a763807ffc480bbc4ab17afe929216b3ce096ece
+  data.tar.gz: 25e8013e5421b51b5fdce2d444fabdb5f66bc9e4805df7c2761646b43a0058dabf70ed7e11d2e36494740c0d5966ea300a4351a4f16754837caf0f23826a7b7e

data/README.md

@@ -1,8 +1,9 @@
 # Model Driven Api
 
-## Goal
+## Goals
 
-To have a comprehensive and meaningful Model driven API right out of the box by just creating migrations in your rails app or engine. With all the CRUD operations in place out of the box and easily expandable with custom actions if needed.
+* To have a comprehensive and meaningful Model driven API right out of the box by just creating migrations in your rails app or engine. With all the CRUD operations in place out of the box and easily expandable with custom actions if needed.
+* To have a plain REST implementation which adapts the returned JSON to the specific needs of the client, **without the need to change backend code**, this may overcome the biggest disadvantage of REST vs GraphQL = client driver presentation.
 
 ## TL;DR 5-10 minutes adoption
 
@@ -27,6 +28,55 @@ I've always been interested in effortless, no-fuss, conventions' based developme
 
 Doing this means also narrowing a bit the scope of the tools, taking decisions, at least for the first implementations and versions of this engine, so, this works well if the data is relational, this is a prerequisite (postgres, mysql, mssql, etc.).
 
+## REST Enhanced
+
+Thanks to the inclusion of [Ransack](https://github.com/activerecord-hackery/ransack/wiki) and [ActiveModel::Serializer](https://api.rubyonrails.org/classes/ActiveModel/Serializers/JSON.html), by just adding the querystring keys **q** and **a**, you can create complex queries (q) to obtain just the records you need, which present in the returnd JSON just the attributes (a) needed.
+By combining the two keys, you can obtain just the data you want.
+
+The *json_attrs* or *a* query string passed accepts these keys (Please see [ActiveModel::Serializer](https://api.rubyonrails.org/classes/ActiveModel/Serializers/JSON.html) for reference):
+- only: list [] of model fields to be shown in JSON serialization
+- except: exclude these fields from the JSON serialization, this is a list []
+- methods: include the result of some methods defined in the model, this is a list []
+- include: include associated models, it's an object {} which also accepts the keys described in this document (only, except, methods, include)
+
+### Example
+
+```
+{{ base_url  }}/{{ controller  }}?a[only][]=locked&a[only][]=username&a[methods][]=jwe_data
+```
+
+Is translated to:
+
+```
+{a: {only: ["locked", "username"], methods: ["jwe_data"]}}
+```
+
+Which tells the API controller just to return this optimized serialization:
+
+```
+[
+  {
+    "username": "Administrator",
+    "locked": false,
+    "jwe_data": "eyJhbGciOiJkaXIiLCJlbmMiOiJSMTI4R0NNIn0..yz0tnC6y3BzgoOsO.BjHb9CRIb0vrv7nnEx54Ac8-cATPJ9sTlQSSxRbTmtcPHc5KhvtyE_hyBRnIcK92bzUBRwdy6ASB2XJVy1VfWxAmO8E.4tOzJlfuXi-shaRhDSkOyg"
+  }
+]
+```
+
+By combinig with Ransack's **q** query string key (please read [Ransack](https://github.com/activerecord-hackery/ransack/wiki) documentation to discover all the possible and complex searches you can make), you can obtain right what you want:
+
+```
+{{ base_url  }}/{{ controller  }}?a[only][]=locked&a[only][]=username&a[methods][]=jwe_data&q[email_cont][]=adm
+```
+
+Which translates to:
+
+```
+{a: {only: ["locked", "username"], methods: ["jwe_data"]}, q: { email_cont: ["adm"]}}
+```
+
+For bigger searches, which may over crowd the querystring length, you can always use the default [Search](#Search) POST endpoint.
+
 ## v2?
 
 Yes, this is the second version of such an effort and you can note it from the api calls, which are all under the ```/api/v2``` namespace the [/api/v1](https://github.com/gabrieletassoni/thecore_api) one, was were it all started, many ideas are ported from there, such as the generation of the automatic model based crud actions, as well as custom actions definitions and all the things that make also this gem useful for my daily job were already in place, but it was too coupled with [thecore](https://github.com/gabrieletassoni/thecore)'s [rails_admin](https://github.com/sferik/rails_admin) UI, making it impossible to create a complete UI-less, API only application, out of the box and directly based of the DB schema, with all the bells and whistles I needed (mainly self adapting, data and schema driven API functionalities).

data/app/controllers/api/v2/application_controller.rb

@@ -20,7 +20,10 @@ class Api::V2::ApplicationController < ActionController::API
         return render json: result, status: 200 if status == true
 
         # Normal Index Action with Ransack querying
-        @q = (@model.column_names.include?("user_id") ? @model.where(user_id: current_user.id) : @model).ransack(@query.presence|| params[:q])
+        # Keeping this automation can be too dangerous and lead to unpredicted results
+        # TODO: Remove it
+        # @q = (@model.column_names.include?("user_id") ? @model.where(user_id: current_user.id) : @model).ransack(@query.presence|| params[:q])
+        @q = @model.ransack(@query.presence|| params[:q])
         @records_all = @q.result # (distinct: true) Removing, but I'm not sure, with it I cannot sort in postgres for associated records (throws an exception on misuse of sort with distinct)
         page = (@page.presence || params[:page])
         per = (@per.presence || params[:per])
@@ -66,7 +69,9 @@ class Api::V2::ApplicationController < ActionController::API
         return render json: result, status: 200 if status == true
 
         # Normal Create Action
-        @record.user_id = current_user.id if @model.column_names.include? "user_id"
+        # Keeping this automation can be too dangerous and lead to unpredicted results
+        # TODO: Remove it
+        # @record.user_id = current_user.id if @model.column_names.include? "user_id"
         @record.save!
         render json: @record.to_json(json_attrs), status: 201
     end
@@ -129,7 +134,6 @@ class Api::V2::ApplicationController < ActionController::API
             # puts "Found header #{header}: #{request.headers[header.underscore.dasherize]}" 
             check_authorization("Authorize#{header}".constantize.call(request.headers, request.raw_post)) if request.headers[header.underscore.dasherize]
         end
-        return unauthenticated!(OpenStruct.new({message: @auth_errors})) unless @current_user
         
         # This is the default one, if the header doesn't have a valid form for one of the other Auth methods, then use this Auth Class
         check_authorization AuthorizeApiRequest.call(request.headers) unless @current_user
@@ -144,12 +148,19 @@ class Api::V2::ApplicationController < ActionController::API
     
     def find_record
         record_id ||= (params[:path].split("/").second.to_i rescue nil)
-        @record = @model.column_names.include?("user_id") ? @model.where(id: (record_id.presence || @record_id.presence || params[:id]), user_id: current_user.id).first : @model.find((@record_id.presence || params[:id]))
+        # Keeping this automation can be too dangerous and lead to unpredicted results
+        # TODO: Remove it
+        # @record = @model.column_names.include?("user_id") ? @model.where(id: (record_id.presence || @record_id.presence || params[:id]), user_id: current_user.id).first : @model.find((@record_id.presence || params[:id]))
+        @record = @model.find((@record_id.presence || params[:id]))
         return not_found! if @record.blank?
     end
     
     def json_attrs
-        ((@model.json_attrs.presence || @json_attrs.presence || {}) rescue {})
+        # In order of importance: if you send the configuration via querystring you are ok 
+        # has precedence over if you have setup the json_attrs in the model concern
+        from_params = params[:a].deep_symbolize_keys unless params[:a].blank? 
+        from_params = params[:json_attrs].deep_symbolize_keys unless params[:json_attrs].blank?
+        from_params.presence || @model.json_attrs.presence || @json_attrs.presence || {} rescue {}
     end
     
     def extract_model

data/app/controllers/api/v2/info_controller.rb

@@ -6,7 +6,7 @@ class Api::V2::InfoController < Api::V2::ApplicationController
   
   # api :GET, '/api/v2/info/version', "Just prints the APPVERSION."
   def version
-    render json: { version: ModelDrivenApi::VERSION }.to_json, status: 200
+    render json: { version: "TODO: Find a Way to Dynamically Obtain It" }.to_json, status: 200
   end
 
   # api :GET, '/api/v2/info/roles'

data/config/initializers/time_with_zone.rb

@@ -0,0 +1,8 @@
+# Turns API calls to always UTC, leaving the APP the freedom to use local timezone
+module ActiveSupport
+    class TimeWithZone
+      def as_json(options = nil)
+        utc
+      end
+    end
+end

data/lib/concerns/api_exception_management.rb

@@ -2,13 +2,16 @@ module ApiExceptionManagement
     extend ActiveSupport::Concern
     
     included do
-        rescue_from NoMethodError, with: :not_found!
-        rescue_from CanCan::AccessDenied, with: :unauthorized!
-        rescue_from AuthenticateUser::AccessDenied, with: :unauthenticated!
-        rescue_from ActionController::RoutingError, with: :not_found!
-        rescue_from ActiveModel::ForbiddenAttributesError, with: :fivehundred!
-        rescue_from ActiveRecord::RecordInvalid, with: :invalid!
-        rescue_from ActiveRecord::RecordNotFound, with: :not_found!
+        if Rails.env.production?
+            rescue_from NoMethodError, with: :not_found!
+            rescue_from CanCan::AccessDenied, with: :unauthorized!
+            rescue_from AuthenticateUser::AccessDenied, with: :unauthenticated!
+            rescue_from ActionController::RoutingError, with: :not_found!
+            rescue_from ActiveModel::ForbiddenAttributesError, with: :fivehundred!
+            rescue_from ActiveRecord::RecordInvalid, with: :invalid!
+            rescue_from ActiveRecord::RecordNotFound, with: :not_found!
+            rescue_from ActiveRecord::RecordNotUnique, with: :invalid!
+        end
         
         def unauthenticated! exception = AuthenticateUser::AccessDenied.new
             response.headers['WWW-Authenticate'] = "Token realm=Application"

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "#{`git describe --tags $(git rev-list --tags --max-count=1)`}"
+  VERSION = "#{`git describe --tags $(git rev-list --tags --max-count=1)`.chomp}"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.3.5
+  version: 2.3.10
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-16 00:00:00.000000000 Z
+date: 2021-03-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons
@@ -142,6 +142,7 @@ files:
 - config/initializers/after_initialize_for_model_driven_api.rb
 - config/initializers/cors_api_thecore.rb
 - config/initializers/knock.rb
+- config/initializers/time_with_zone.rb
 - config/initializers/wrap_parameters.rb
 - config/routes.rb
 - lib/concerns/api_exception_management.rb