model_driven_api 3.11.5 → 3.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb9afc3599f034ab37d86d55596de1178e05602ad93d7d4dd2a95c6a8bbd0de8
-  data.tar.gz: 1c9af1949e7f014dacd324bef341cd3bf51cfc361988d82930bd8979c688ba7a
+  metadata.gz: '0877810a34bb2f213343f3e5f13bfee52b0cec2d8da29431c64466185078d01b'
+  data.tar.gz: d52e6f70ae1da5655ab7b5ad605c400c88ed659d84425b91e5a239506d2d9d6a
 SHA512:
-  metadata.gz: 52ee2968b5191da54df00040993a8882b45d3ac541f68f336aaff76253a3f71f81fcac1157797da4e7d70ea5e43a11163479e13db04fc46d3ef04baf64f99ffd
-  data.tar.gz: fe03e92b64d3b8d260f94b4e3bb03ec4d9b8576d464d5ba6adafb96538af53f7aa671b32511cba6bbd255accd4e8bcb8dec14d7e80090c4c4749fc6a435f6437
+  metadata.gz: 2a557cb8c023b0e98fc299c3c2334e6720faa58f2383f8f207ad53a5d00f6b66a8b92c9756d467aed8b02a21fc0beb145c5eb92d3fe20ca226de2963fe4ef7ab
+  data.tar.gz: eccaf19b8ecdf2c13283c3918ec4be6d1d8c27d4e52b1e37490ddae532720be75a03a11853f882bb14778c141198cb123f2c610a518d3397b351157e7de523b9

data/app/controllers/api/v2/application_controller.rb

@@ -75,8 +75,7 @@ class Api::V2::ApplicationController < ActionController::API
     # TODO: Remove it
     # @record.user_id = current_user.id if @model.column_names.include? "user_id"
     @record = @model.new(@body)
-    @record.save!
-    render json: @record.to_json(json_attrs), status: 201
+    create_once(@record) { render json: @record.to_json(json_attrs), status: 201 }
   end
 
   def update
@@ -210,6 +209,46 @@ class Api::V2::ApplicationController < ActionController::API
     return not_found! if @record.blank?
   end
 
+  # A model may declare `self.creation_key`: the columns identifying a record its client
+  # generated. A create whose key matches an existing record is a repeat of a creation that
+  # already happened (a client resending after a lost response), so the caller gets that
+  # record back instead of a copy.
+  def existing_by_creation_key(record)
+    return unless @model.respond_to?(:creation_key)
+
+    key = @model.creation_key.index_with { |column| record[column] }
+    return if key.values.any?(&:nil?)
+
+    @model.find_by(key)
+  end
+
+  # Saves +record+ and yields to render it, unless its creation key matches an existing
+  # record, which is rendered instead (render_existing). Shared by v2 and v3, which differ
+  # only in how they render.
+  def create_once(record)
+    existing = existing_by_creation_key(record)
+    return render_existing(existing) if existing
+
+    # In its own savepoint, so a unique-index violation leaves any enclosing transaction
+    # usable for the lookup that follows it.
+    @model.transaction(requires_new: true) { record.save! }
+    yield
+  rescue ActiveRecord::RecordNotUnique
+    # A racing request with the same creation key committed between the lookup and the
+    # insert: the unique index stopped this one, so hand back what the other created.
+    existing = existing_by_creation_key(record)
+    raise unless existing
+
+    render_existing(existing)
+  end
+
+  # Only to a caller who could read it anyway (the same check as show): a key is no
+  # credential, so guessing someone else's must not hand their record over.
+  def render_existing(existing)
+    authorize! :show, existing
+    render json: existing.to_json(json_attrs), status: 200
+  end
+
   def json_attrs
     # In order of importance: if you send the configuration via querystring you are ok
     # has precedence over if you have setup the json_attrs in the model concern

data/app/controllers/api/v3/application_controller.rb

@@ -34,9 +34,10 @@ class Api::V3::ApplicationController < Api::V2::ApplicationController
     return render json: result, status: (status_number.presence || 200) if status == true
 
     record = @model.new(jsonapi_attributes)
-    record.save!
-    serializer = Api::V3::SerializerFactory.serializer_for(@model)
-    render json: serializer.new(record, **serializer_opts).serializable_hash, status: :created
+    create_once(record) do
+      serializer = Api::V3::SerializerFactory.serializer_for(@model)
+      render json: serializer.new(record, **serializer_opts).serializable_hash, status: :created
+    end
   end
 
   def update
@@ -64,6 +65,13 @@ class Api::V3::ApplicationController < Api::V2::ApplicationController
 
   private
 
+  # v2's read check, with a JSON:API envelope.
+  def render_existing(existing)
+    authorize! :show, existing
+    serializer = Api::V3::SerializerFactory.serializer_for(@model)
+    render json: serializer.new(existing, **serializer_opts).serializable_hash, status: :ok
+  end
+
   def apply_filters(scope)
     filter_params = params[:filter] || {}
     filter_params.each do |field, value|

data/lib/model_driven_api/version.rb

@@ -1,3 +1,3 @@
 module ModelDrivenApi
-  VERSION = "3.11.5".freeze
+  VERSION = "3.12.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: model_driven_api
 version: !ruby/object:Gem::Version
-  version: 3.11.5
+  version: 3.12.0
 platform: ruby
 authors:
 - Gabriele Tassoni