model_driven_api 3.11.4 → 3.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f561a2d22648c4e007dfc73788277d525bff52b8b441bcafc030d96be12034b
-  data.tar.gz: c4aab8c26319cfe1988b8fd7ac889c8d5c6b975e4e58eca31a0f566767f017eb
+  metadata.gz: '0877810a34bb2f213343f3e5f13bfee52b0cec2d8da29431c64466185078d01b'
+  data.tar.gz: d52e6f70ae1da5655ab7b5ad605c400c88ed659d84425b91e5a239506d2d9d6a
 SHA512:
-  metadata.gz: 2a50be7ab0901fcd345403ce5fa46c6a98446303be27fd380dc4202e37366fe86dc51bbb06dc8a9d9c9350bec20e95938e0ff1ecaa5d25006f2c2dfea53c2491
-  data.tar.gz: bda7a791bc646f8326ca00efd5ae04b9df7dd02e1f36ffb8e8edbcd40055e24034e47d76594f5f5aae4838ddbe17699f33eb85fbe284d5bf3e538df5f035a1d9
+  metadata.gz: 2a557cb8c023b0e98fc299c3c2334e6720faa58f2383f8f207ad53a5d00f6b66a8b92c9756d467aed8b02a21fc0beb145c5eb92d3fe20ca226de2963fe4ef7ab
+  data.tar.gz: eccaf19b8ecdf2c13283c3918ec4be6d1d8c27d4e52b1e37490ddae532720be75a03a11853f882bb14778c141198cb123f2c610a518d3397b351157e7de523b9

data/app/controllers/api/v2/application_controller.rb

@@ -75,8 +75,7 @@ class Api::V2::ApplicationController < ActionController::API
     # TODO: Remove it
     # @record.user_id = current_user.id if @model.column_names.include? "user_id"
     @record = @model.new(@body)
-    @record.save!
-    render json: @record.to_json(json_attrs), status: 201
+    create_once(@record) { render json: @record.to_json(json_attrs), status: 201 }
   end
 
   def update
@@ -210,6 +209,46 @@ class Api::V2::ApplicationController < ActionController::API
     return not_found! if @record.blank?
   end
 
+  # A model may declare `self.creation_key`: the columns identifying a record its client
+  # generated. A create whose key matches an existing record is a repeat of a creation that
+  # already happened (a client resending after a lost response), so the caller gets that
+  # record back instead of a copy.
+  def existing_by_creation_key(record)
+    return unless @model.respond_to?(:creation_key)
+
+    key = @model.creation_key.index_with { |column| record[column] }
+    return if key.values.any?(&:nil?)
+
+    @model.find_by(key)
+  end
+
+  # Saves +record+ and yields to render it, unless its creation key matches an existing
+  # record, which is rendered instead (render_existing). Shared by v2 and v3, which differ
+  # only in how they render.
+  def create_once(record)
+    existing = existing_by_creation_key(record)
+    return render_existing(existing) if existing
+
+    # In its own savepoint, so a unique-index violation leaves any enclosing transaction
+    # usable for the lookup that follows it.
+    @model.transaction(requires_new: true) { record.save! }
+    yield
+  rescue ActiveRecord::RecordNotUnique
+    # A racing request with the same creation key committed between the lookup and the
+    # insert: the unique index stopped this one, so hand back what the other created.
+    existing = existing_by_creation_key(record)
+    raise unless existing
+
+    render_existing(existing)
+  end
+
+  # Only to a caller who could read it anyway (the same check as show): a key is no
+  # credential, so guessing someone else's must not hand their record over.
+  def render_existing(existing)
+    authorize! :show, existing
+    render json: existing.to_json(json_attrs), status: 200
+  end
+
   def json_attrs
     # In order of importance: if you send the configuration via querystring you are ok
     # has precedence over if you have setup the json_attrs in the model concern

data/app/controllers/api/v3/application_controller.rb

@@ -34,9 +34,10 @@ class Api::V3::ApplicationController < Api::V2::ApplicationController
     return render json: result, status: (status_number.presence || 200) if status == true
 
     record = @model.new(jsonapi_attributes)
-    record.save!
-    serializer = Api::V3::SerializerFactory.serializer_for(@model)
-    render json: serializer.new(record, **serializer_opts).serializable_hash, status: :created
+    create_once(record) do
+      serializer = Api::V3::SerializerFactory.serializer_for(@model)
+      render json: serializer.new(record, **serializer_opts).serializable_hash, status: :created
+    end
   end
 
   def update
@@ -64,6 +65,13 @@ class Api::V3::ApplicationController < Api::V2::ApplicationController
 
   private
 
+  # v2's read check, with a JSON:API envelope.
+  def render_existing(existing)
+    authorize! :show, existing
+    serializer = Api::V3::SerializerFactory.serializer_for(@model)
+    render json: serializer.new(existing, **serializer_opts).serializable_hash, status: :ok
+  end
+
   def apply_filters(scope)
     filter_params = params[:filter] || {}
     filter_params.each do |field, value|

data/lib/concerns/api_exception_management.rb

@@ -19,7 +19,9 @@ module ApiExceptionManagement
             # #destroy! — reuse invalid! since both exceptions expose the same .record interface.
             rescue_from ActiveRecord::RecordNotDestroyed, with: :invalid!
             rescue_from ActiveRecord::RecordNotFound, with: :not_found!
-            rescue_from ActiveRecord::RecordNotUnique, with: :invalid!
+            # Not invalid!: RecordNotUnique carries no .record, so invalid! itself raised and
+            # every unique-index violation answered 500.
+            rescue_from ActiveRecord::RecordNotUnique, with: :not_unique!
             # Rescue Stale Object in Optimistick locking with stale!
             rescue_from ActiveRecord::StaleObjectError, with: :stale!
             rescue_from EndpointValidationError, with: :endpoint_invalid!
@@ -51,6 +53,13 @@ module ApiExceptionManagement
             return api_error status: 422, errors: exception.record.errors 
         end
         
+        # The database message names tables, columns and index definitions: log it, don't
+        # send it back.
+        def not_unique! exception = ActiveRecord::RecordNotUnique.new
+            Rails.logger.warn("RecordNotUnique: #{exception.message}")
+            return api_error status: 422, errors: "A record with the same unique values already exists"
+        end
+
         def fivehundred! exception = StandardError.new
             return api_error status: 500, errors: exception.message
         end

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.11.4".freeze
+  VERSION = "3.12.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.11.4
+  version: 3.12.0
 platform: ruby
 authors:
 - Gabriele Tassoni