model_driven_api 2.3.8 → 2.3.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b8eeb8407dddfe99afa98093d2c16b193572843694616f7b27249c3661390b16
-  data.tar.gz: 31287c2fb6cb36353e76652e470e6d3c58ad4d4140c08a90e3b633ab98324a91
+  metadata.gz: a5497bdb2727e103fa3727595ca62bbaf065b9135dd9bfbc8674f21506929dd0
+  data.tar.gz: ad09cdae9730b0f5c7983eb478c660ef8cc1c13d1d2c1cb13cd9a143b67f4029
 SHA512:
-  metadata.gz: 519231f4c1073ffe54c3800ade34ee21cbcee27bfa8e568b66521808458a9def469679a01ca82222056ea69cbd314eb5a8a5bac979ba8801ea7ee7b926e2835c
-  data.tar.gz: 4ed7f93269ce8bf37104a36cb3b71c5de52f45d7ce6623eee6ffdcb2b95fd86c53b043ff5bf2e2692a784a9d079dfe0b787e9bb228486a4d4854faf4c7a03529
+  metadata.gz: 719fcf3175dced8eaea5e238551d7d143edc185e9131c44ae9bf5358509de252da07491c27c16f485644c782f73c8f351379744c60f20bc803b074f024ecdbb8
+  data.tar.gz: ad157de69fbd575e5a9197594901b811a0cb1e74f25eb49146c011fbec9d32ebd6874e8712f2ef8edff4799d9e46cd04e2040c5cbe7c48b3a04e7f428917ab5a

data/README.md

@@ -1,8 +1,9 @@
 # Model Driven Api
 
-## Goal
+## Goals
 
-To have a comprehensive and meaningful Model driven API right out of the box by just creating migrations in your rails app or engine. With all the CRUD operations in place out of the box and easily expandable with custom actions if needed.
+* To have a comprehensive and meaningful Model driven API right out of the box by just creating migrations in your rails app or engine. With all the CRUD operations in place out of the box and easily expandable with custom actions if needed.
+* To have a plain REST implementation which adapts the returned JSON to the specific needs of the client, **without the need to change backend code**, this may overcome the biggest disadvantage of REST vs GraphQL = client driver presentation.
 
 ## TL;DR 5-10 minutes adoption
 
@@ -27,6 +28,55 @@ I've always been interested in effortless, no-fuss, conventions' based developme
 
 Doing this means also narrowing a bit the scope of the tools, taking decisions, at least for the first implementations and versions of this engine, so, this works well if the data is relational, this is a prerequisite (postgres, mysql, mssql, etc.).
 
+## REST Enhanced
+
+Thanks to the inclusion of [Ransack](https://github.com/activerecord-hackery/ransack/wiki) and [ActiveModel::Serializer](https://api.rubyonrails.org/classes/ActiveModel/Serializers/JSON.html), by just adding the querystring keys **q** and **a**, you can create complex queries (q) to obtain just the records you need, which present in the returnd JSON just the attributes (a) needed.
+By combining the two keys, you can obtain just the data you want.
+
+The *json_attrs* or *a* query string passed accepts these keys (Please see [ActiveModel::Serializer](https://api.rubyonrails.org/classes/ActiveModel/Serializers/JSON.html) for reference):
+- only: list [] of model fields to be shown in JSON serialization
+- except: exclude these fields from the JSON serialization, this is a list []
+- methods: include the result of some methods defined in the model, this is a list []
+- include: include associated models, it's an object {} which also accepts the keys described in this document (only, except, methods, include)
+
+### Example
+
+```
+{{ base_url  }}/{{ controller  }}?a[only][]=locked&a[only][]=username&a[methods][]=jwe_data
+```
+
+Is translated to:
+
+```
+{a: {only: ["locked", "username"], methods: ["jwe_data"]}}
+```
+
+Which tells the API controller just to return this optimized serialization:
+
+```
+[
+  {
+    "username": "Administrator",
+    "locked": false,
+    "jwe_data": "eyJhbGciOiJkaXIiLCJlbmMiOiJSMTI4R0NNIn0..yz0tnC6y3BzgoOsO.BjHb9CRIb0vrv7nnEx54Ac8-cATPJ9sTlQSSxRbTmtcPHc5KhvtyE_hyBRnIcK92bzUBRwdy6ASB2XJVy1VfWxAmO8E.4tOzJlfuXi-shaRhDSkOyg"
+  }
+]
+```
+
+By combinig with Ransack's **q** query string key (please read [Ransack](https://github.com/activerecord-hackery/ransack/wiki) documentation to discover all the possible and complex searches you can make), you can obtain right what you want:
+
+```
+{{ base_url  }}/{{ controller  }}?a[only][]=locked&a[only][]=username&a[methods][]=jwe_data&q[email_cont][]=adm
+```
+
+Which translates to:
+
+```
+{a: {only: ["locked", "username"], methods: ["jwe_data"]}, q: { email_cont: ["adm"]}}
+```
+
+For bigger searches, which may over crowd the querystring length, you can always use the default [Search](#Search) POST endpoint.
+
 ## v2?
 
 Yes, this is the second version of such an effort and you can note it from the api calls, which are all under the ```/api/v2``` namespace the [/api/v1](https://github.com/gabrieletassoni/thecore_api) one, was were it all started, many ideas are ported from there, such as the generation of the automatic model based crud actions, as well as custom actions definitions and all the things that make also this gem useful for my daily job were already in place, but it was too coupled with [thecore](https://github.com/gabrieletassoni/thecore)'s [rails_admin](https://github.com/sferik/rails_admin) UI, making it impossible to create a complete UI-less, API only application, out of the box and directly based of the DB schema, with all the bells and whistles I needed (mainly self adapting, data and schema driven API functionalities).

data/app/controllers/api/v2/application_controller.rb

@@ -20,7 +20,10 @@ class Api::V2::ApplicationController < ActionController::API
         return render json: result, status: 200 if status == true
 
         # Normal Index Action with Ransack querying
-        @q = (@model.column_names.include?("user_id") ? @model.where(user_id: current_user.id) : @model).ransack(@query.presence|| params[:q])
+        # Keeping this automation can be too dangerous and lead to unpredicted results
+        # TODO: Remove it
+        # @q = (@model.column_names.include?("user_id") ? @model.where(user_id: current_user.id) : @model).ransack(@query.presence|| params[:q])
+        @q = @model.ransack(@query.presence|| params[:q])
         @records_all = @q.result # (distinct: true) Removing, but I'm not sure, with it I cannot sort in postgres for associated records (throws an exception on misuse of sort with distinct)
         page = (@page.presence || params[:page])
         per = (@per.presence || params[:per])
@@ -66,7 +69,9 @@ class Api::V2::ApplicationController < ActionController::API
         return render json: result, status: 200 if status == true
 
         # Normal Create Action
-        @record.user_id = current_user.id if @model.column_names.include? "user_id"
+        # Keeping this automation can be too dangerous and lead to unpredicted results
+        # TODO: Remove it
+        # @record.user_id = current_user.id if @model.column_names.include? "user_id"
         @record.save!
         render json: @record.to_json(json_attrs), status: 201
     end
@@ -108,7 +113,8 @@ class Api::V2::ApplicationController < ActionController::API
             resource = "custom_action_#{params[:do]}"
             raise NoMethodError unless @model.respond_to?(resource)
             # return true, MultiJson.dump(params[:id].blank? ? @model.send(resource, params) : @model.send(resource, params[:id].to_i, params))
-            return true, MultiJson.dump(@model.send(resource, params))
+            puts json_attrs
+            return true, @model.send(resource, params).to_json(json_attrs)
         end
         # if it's here there is no custom action in the request querystring
         return false
@@ -122,15 +128,12 @@ class Api::V2::ApplicationController < ActionController::API
     end
     
     def authenticate_request
-        # puts request.headers.inspect
         @current_user = nil
-        # puts "Are there wbehooks headers to check for? #{Settings.ns(:security).allowed_authorization_headers}"
         Settings.ns(:security).allowed_authorization_headers.split(",").each do |header|
             # puts "Found header #{header}: #{request.headers[header.underscore.dasherize]}" 
             check_authorization("Authorize#{header}".constantize.call(request.headers, request.raw_post)) if request.headers[header.underscore.dasherize]
         end
         
-        # This is the default one, if the header doesn't have a valid form for one of the other Auth methods, then use this Auth Class
         check_authorization AuthorizeApiRequest.call(request.headers) unless @current_user
         return unauthenticated!(OpenStruct.new({message: @auth_errors})) unless @current_user
         
@@ -143,12 +146,19 @@ class Api::V2::ApplicationController < ActionController::API
     
     def find_record
         record_id ||= (params[:path].split("/").second.to_i rescue nil)
-        @record = @model.column_names.include?("user_id") ? @model.where(id: (record_id.presence || @record_id.presence || params[:id]), user_id: current_user.id).first : @model.find((@record_id.presence || params[:id]))
+        # Keeping this automation can be too dangerous and lead to unpredicted results
+        # TODO: Remove it
+        # @record = @model.column_names.include?("user_id") ? @model.where(id: (record_id.presence || @record_id.presence || params[:id]), user_id: current_user.id).first : @model.find((@record_id.presence || params[:id]))
+        @record = @model.find((@record_id.presence || params[:id]))
         return not_found! if @record.blank?
     end
     
     def json_attrs
-        ((@model.json_attrs.presence || @json_attrs.presence || {}) rescue {})
+        # In order of importance: if you send the configuration via querystring you are ok 
+        # has precedence over if you have setup the json_attrs in the model concern
+        from_params = params[:a].deep_symbolize_keys unless params[:a].blank? 
+        from_params = params[:json_attrs].deep_symbolize_keys unless params[:json_attrs].blank?
+        from_params.presence || @json_attrs.presence || @model.json_attrs.presence || {} rescue {}
     end
     
     def extract_model

data/lib/concerns/api_exception_management.rb

@@ -10,6 +10,7 @@ module ApiExceptionManagement
             rescue_from ActiveModel::ForbiddenAttributesError, with: :fivehundred!
             rescue_from ActiveRecord::RecordInvalid, with: :invalid!
             rescue_from ActiveRecord::RecordNotFound, with: :not_found!
+            rescue_from ActiveRecord::RecordNotUnique, with: :invalid!
         end
         
         def unauthenticated! exception = AuthenticateUser::AccessDenied.new

data/lib/json_web_token.rb

@@ -1,11 +1,11 @@
 class JsonWebToken
     class << self
       def encode(payload, expiry = 15.minutes.from_now.to_i)
-        ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base))
+        ::JWT.encode(payload.merge(exp: expiry), ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])
       end
       
       def decode(token)
-        body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base))[0]
+        body = ::JWT.decode(token, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"])[0]
         ::HashWithIndifferentAccess.new body
       rescue
         nil

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 2.3.8
+  version: 2.3.13
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-08 00:00:00.000000000 Z
+date: 2021-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thecore_backend_commons