model_driven_api 3.6.3 → 3.7.1

data/Rakefile

@@ -3,6 +3,9 @@
 require "bundler/gem_tasks"
 require "rake/testtask"
 
+APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
+load "rails/tasks/engine.rake"
+
 Rake::TestTask.new(:test) do |t|
   t.libs << "test"
   t.libs << "lib"

data/app/controllers/api/v2/application_controller.rb

@@ -13,7 +13,7 @@ class Api::V2::ApplicationController < ActionController::API
 
   # GET :controller/
   def index
-    authorize! :index, @model
+    authorize! :index, @model unless public_custom_action?
 
     # Custom Action
     status, result, status_number = check_for_custom_action
@@ -67,7 +67,7 @@ class Api::V2::ApplicationController < ActionController::API
   def create
     # Normal Create Action
     Rails.logger.debug("Creating a new record #{@record}")
-    authorize! :create, @record.presence || @model
+    authorize! :create, @record.presence || @model unless public_custom_action?
     # Custom Action
     status, result, status_number = check_for_custom_action
     return render json: result, status: (status_number.presence || 200) if status == true
@@ -127,6 +127,19 @@ class Api::V2::ApplicationController < ActionController::API
 
   private
 
+  # Returns true if the current request is for a NonCrudEndpoints custom action
+  # that has been declared as public (no authentication required).
+  # Forces autoloading of the Endpoints::<Model> class so the public_action_registry
+  # is populated before authenticate_request checks it.
+  def public_custom_action?
+    return false unless request.url.include?("/custom_action/")
+    model_name = params[:ctrl].to_s.classify
+    action_name = params[:action_name].to_s
+    # Ensure the endpoint class is loaded so its public_action declarations are registered.
+    ("Endpoints::#{model_name}".constantize rescue nil)
+    NonCrudEndpoints.public_action?(model_name, action_name)
+  end
+
   ## CUSTOM ACTION
   # [GET|PUT|POST|DELETE] :controller?do=:custom_action
   # or
@@ -140,43 +153,9 @@ class Api::V2::ApplicationController < ActionController::API
   # or
   # [GET|PUT|POST|DELETE] :controller/custom_action/:custom_action/:id
   def check_for_custom_action
-    custom_action, token = if !params[:do].blank?
-        # This also responds to custom actions which have the bearer token in the custom action name. A workaround to remove for some IoT devices
-        # Which don't support token in header or in querystring
-        # This is for backward compatibility and in future it can ben removed
-        params[:do].split("-")
-      elsif request.url.include? "/custom_action/"
-        [params[:action_name], nil]
-      else
-        # Not a custom action call
-        false
-      end
-    return false unless custom_action
-    # Poor man's solution to avoid the possibility to
-    # call an unwanted method in the AR Model.
-
-    # Adding some useful information to the params hash
-    params[:request_url] = request.url
-    params[:remote_ip] = request.remote_ip
-    params[:request_verb] = request.request_method
-    params[:token] = token.presence || bearer_token
-    # The endpoint can be expressed in two ways:
-    # 1. As a method in the model, with suffix custom_action_<custom_action>
-    # 2. As a module instance method in the model, like Track::Endpoints.inventory
-    # Example:
-    # Endpoints::TestApi.new(:test, {request_verb: "POST", is_connected: "Uhhhh"}).result
-    Rails.logger.debug("Checking for custom action #{custom_action} in #{@model}")
-    if @model.respond_to?("custom_action_#{custom_action}")
-      body, status = @model.send("custom_action_#{custom_action}", params)
-    elsif ("Endpoints::#{@model}".constantize rescue false) && "Endpoints::#{@model}".constantize.instance_methods.include?(custom_action.to_sym)
-      # Custom endpoint exists and can be called in the sub-modules form
-      body, status = "Endpoints::#{@model}".constantize.new(custom_action, params).result
-    else
-      # Custom endpoint does not exist or cannot be called
-      raise NoMethodError
-    end
-
-    return true, body.to_json(json_attrs), status
+    dispatched, body, status = Api::CustomActionDispatcher.call(@model, params, request)
+    return false unless dispatched
+    [true, body.to_json(json_attrs), status]
   end
 
   def bearer_token
@@ -193,6 +172,9 @@ class Api::V2::ApplicationController < ActionController::API
   end
 
   def authenticate_request
+    # Skip auth for public NonCrudEndpoints actions (e.g. vapid_public_key).
+    return if public_custom_action?
+
     @current_user = nil
     Settings.ns(:security).allowed_authorization_headers.split(",").each do |header|
       # puts "Found header #{header}: #{request.headers[header]}"
@@ -229,17 +211,10 @@ class Api::V2::ApplicationController < ActionController::API
   end
 
   def extract_model
-    # This method is only valid for ActiveRecords
-    # For any other model-less controller, the actions must be
-    # defined in the route, and must exist in the controller definition.
-    # So, if it's not an activerecord, the find model makes no sense at all
-    # thus must return 404.
-    @model = (params[:ctrl].classify.constantize rescue params[:path].split("/").first.classify.constantize rescue controller_path.classify.constantize rescue controller_name.classify.constantize rescue nil)
-    # Getting the body of the request if it exists, it's ok the singular or
-    # plural form, this helps with automatic tests with Insomnia.
+    @model = Api::ModelResolver.resolve(params, controller_path, controller_name)
     @body = (params[@model.model_name.singular].presence || params[@model.model_name.route_key]) rescue params
-    # Only ActiveRecords can have this model caputed
-    return not_found! if (@model != TestApi && !@model.new.is_a?(ActiveRecord::Base) rescue false)
+  rescue Api::ModelResolver::NotFound
+    not_found!
   end
 
   def check_authorization(cmd)