motor-admin 0.1.56 → 0.1.62

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 636cbcca8a6ab6e4f15e066e8727aab49511b6f2b7c3d9794360e297e1035a8e
-  data.tar.gz: dcd4161710151dc7a4cffc43848a69ece9bed649f1e8c2de690569fcedec4a56
+  metadata.gz: 2b1e931dc58724b3ae9e207d86d4ca7a9c68d7cfeae0e0c482a7cd21d23c4258
+  data.tar.gz: d11ea5ce285bf4c44f6e772970b26bc7deede0b055e7c264c3039833c3d29534
 SHA512:
-  metadata.gz: 227f976e31fe8f6fdac7c3e62d9c47a39b4310d136d1b8bb748153e29aeccf4e314b37aaf7ff377b966831f9f9e942e5112ea63c86149fa83fd00a0b64338966
-  data.tar.gz: 9d6acd9089a7f84a7bcb8d088ea05718b15f171c9ffe00ac6419a3d234760a271119577f155e718f40e8dbc1f5a6e5b1ded478fc3d99f4524ac15bfbea0fbdf1
+  metadata.gz: 05bef6829304b10adab88dc9860ad2b97c44a50cce1017cba21efcbc8799a7b996125bcc21abc8dbda3d333e4fd0aaa4200c03a565e51393d9d5c3018b00cd62
+  data.tar.gz: 40041861d8e1d81e76065862db59ab88713e799b9859867e91979f1e5ccc73bf6eeab77c3130108ac063da128d3a7d41db1da600c5c50f2301a4ddbefd15a29e

data/README.md

@@ -1,8 +1,8 @@
-# ⚡ Motor Admin
+# ⚡ Motor Admin ⚡
 
 Low-code Admin panel and Business intelligence Rails engine **(no DSL - configurable from the UI)**.
 
-🤓 [Demo App](https://motor-admin.herokuapp.com/demo) | [Features overview](https://www.youtube.com/watch?v=ngVoci8Hll4&list=PLu7llEMh0KcOkR3Uy_RJT0cXPZQKAYVsq&index=1)
+🤓 [Demo App](https://motor-admin.herokuapp.com/demo) | 👀 [Features overview](https://www.youtube.com/watch?v=ngVoci8Hll4&list=PLu7llEMh0KcOkR3Uy_RJT0cXPZQKAYVsq&index=1) | ⭐ [Stargathers](https://github.com/omohokcoj/motor-admin/stargazers)
 
 [![Admin Panel](https://user-images.githubusercontent.com/5418788/119318538-1f30e300-bc82-11eb-94a4-107c31c93b13.png)](https://motor-admin.herokuapp.com/demo)
 
@@ -32,6 +32,7 @@ $ rails motor:install && rake db:migrate
 * [Data visualization](#data-visualization)
 * [Dashboards](#dashboards)
 * [Email alerts](#email-alerts)
+* [Authorization](#authorization)
 * [Intelligence search](#intelligence-search)
 * [Optimized for mobile](#optimized-for-mobile)
 * [Configurations sync between environments](#configurations-sync)
@@ -42,9 +43,9 @@ $ rails motor:install && rake db:migrate
 
 ![Settings UI](https://user-images.githubusercontent.com/5418788/119263883-90708780-bbe9-11eb-9f9f-f76fed0b7f27.png)
 
-Everything in the admin panel can be configured using intuitive settings UI, which can be opened via the icon in the top right corner.
+Everything in the admin panel can be configured using the intuitive settings UI, which can be opened via the icon in the top right corner.
 
-Data displayed on the resource page can be completely custimized via [SQL queries](#sql-queries) and [dashboards](#dashboards) attached to the resource as a tab. Usually, queries used to display resource data should contain `{{resource_name_id}}` [variable](#sql-queries).
+Data displayed on the resource page can be completely customized via [SQL queries](#sql-queries) and [dashboards](#dashboards) attached to the resource as a tab. Usually, queries used to display resource data should contain `{{resource_name_id}}` [variable](#sql-queries).
 
 ### Custom Actions
 
@@ -62,7 +63,7 @@ Values from the form fields can be used in API path via `{field_name}` syntax: `
 
 ![SQL query](https://user-images.githubusercontent.com/5418788/119264127-84d19080-bbea-11eb-9903-ef465d1d2c97.png)
 
-Queries can include embeded variables via `{{variable}}` syntax ([mustache](https://mustache.github.io)). `{{#variable}} ... {{/variable}}` syntax allows to decide if conditions inside the scope should be included in the query.
+Queries can include embedded variables via `{{variable}}` syntax ([mustache](https://mustache.github.io)). `{{#variable}} ... {{/variable}}` syntax allows to decide if conditions inside the scope should be included in the query.
 
 ### Data Visualization
 
@@ -90,6 +91,9 @@ Sender address can be specified using `MOTOR_ALERTS_FROM_ADDRESS` environment va
 
 Intelligence search can be opened via the top right corner button or using <kbd>Cmd</kbd> + <kbd>P</kbd> shortcut.
 
+### Authorization
+
+Motor Admin allows to set row-level and column-level permissions via [cancan](https://github.com/CanCanCommunity/cancancan) gem. Admin UI permissions should be defined in `app/models/motor/ability.rb` file in `Motor::Ability` class. See [Motor Admin guide](https://github.com/omohokcoj/motor-admin/blob/master/guides/defining_permissions.md) and [CanCan documentation](https://github.com/CanCanCommunity/cancancan/blob/develop/docs/Defining-Abilities.md) to learn how to define user permissions.
 
 ### Optimized for Mobile
 
@@ -139,14 +143,6 @@ Start example application in development mode:
 MOTOR_DEVELOPMENT=true rails s
 ```
 
-## Comming Soon
-
-* User groups
-* Row-level permissions
-* Multiple databases
-* NoSQL data sources
-* Pro Bussines intelligence features
-
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://github.com/omohokcoj/motor-admin/blob/master/LICENSE).

data/app/controllers/concerns/motor/current_ability.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Motor
+  module CurrentAbility
+    def current_ability
+      @current_ability ||=
+        if defined?(Motor::Ability) && current_user
+          klass = Motor::Ability.dup.tap do |k|
+            k.prepend(Motor::CancanUtils::AbilityPatch)
+          end
+
+          params = [current_user]
+          params << request if Motor::Ability.instance_method(:initialize).arity == 2
+
+          klass.new(*params)
+        else
+          Motor::CancanUtils::CanManageAll.new
+        end
+    end
+  end
+end

data/app/controllers/concerns/motor/current_user_method.rb

@@ -3,13 +3,14 @@
 module Motor
   module CurrentUserMethod
     def current_user
-      if defined?(current_admin)
-        current_admin
-      elsif defined?(current_admin_user)
-        current_admin_user
-      elsif defined?(super)
-        super
-      end
+      @current_user ||=
+        if defined?(current_admin)
+          current_admin
+        elsif defined?(current_admin_user)
+          current_admin_user
+        elsif defined?(super)
+          super
+        end
     end
   end
 end

data/app/controllers/motor/alerts_controller.rb

@@ -10,11 +10,11 @@ module Motor
     authorize_resource :alert, only: :create
 
     def index
-      render json: { data: Motor::ApiQuery::BuildJson.call(@alerts.active, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@alerts.active, params, current_ability) }
     end
 
     def show
-      render json: { data: Motor::ApiQuery::BuildJson.call(@alert, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@alert, params, current_ability) }
     end
 
     def create
@@ -25,7 +25,7 @@ module Motor
         Motor::Alerts::ScheduledAlertsCache.clear
         Motor::Configs::WriteToFile.call
 
-        render json: { data: Motor::ApiQuery::BuildJson.call(@alert, params) }
+        render json: { data: Motor::ApiQuery::BuildJson.call(@alert, params, current_ability) }
       end
     rescue Motor::Alerts::Persistance::InvalidInterval
       invalid_interval_response
@@ -36,7 +36,7 @@ module Motor
       Motor::Alerts::ScheduledAlertsCache.clear
       Motor::Configs::WriteToFile.call
 
-      render json: { data: Motor::ApiQuery::BuildJson.call(@alert, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@alert, params, current_ability) }
     rescue Motor::Alerts::Persistance::NameAlreadyExists
       name_already_exists_response
     rescue Motor::Alerts::Persistance::InvalidInterval

data/app/controllers/motor/api_base_controller.rb

@@ -3,25 +3,15 @@
 module Motor
   class ApiBaseController < ActionController::API
     include Motor::CurrentUserMethod
-
-    class CanCanAbilityManageAll
-      include CanCan::Ability
-
-      def initialize(_)
-        can :manage, :all
-      end
-    end
+    include Motor::CurrentAbility
 
     unless Rails.env.test?
       rescue_from StandardError do |e|
         Rails.logger.error(e)
+        Rails.logger.error(e.backtrace.join("\n"))
 
         render json: { errors: [e.message] }, status: :internal_server_error
       end
     end
-
-    def current_ability
-      CanCanAbilityManageAll.new(current_user)
-    end
   end
 end

data/app/controllers/motor/application_controller.rb

@@ -3,5 +3,6 @@
 module Motor
   class ApplicationController < ActionController::Base
     include Motor::CurrentUserMethod
+    include Motor::CurrentAbility
   end
 end

data/app/controllers/motor/audits_controller.rb

@@ -8,7 +8,7 @@ module Motor
       audits = Motor::ApiQuery.call(@audits, params)
 
       render json: {
-        data: Motor::ApiQuery::BuildJson.call(audits, params),
+        data: Motor::ApiQuery::BuildJson.call(audits, params, current_ability),
         meta: Motor::ApiQuery::BuildMeta.call(audits, params)
       }
     end

data/app/controllers/motor/auth_tokens_controller.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Motor
+  class AuthTokensController < ApiBaseController
+    GENERIC_TOKEN_TTL = 2.hours
+
+    skip_authorization_check
+
+    def create
+      return render json: {} unless current_user
+
+      if defined?(Devise::JWT)
+        respond_with_devise_jwt
+      elsif defined?(JWT)
+        respond_with_generic_jwt
+      else
+        render json: {}
+      end
+    end
+
+    private
+
+    def respond_with_devise_jwt
+      warden.set_user(current_user)
+
+      render json: { token: request.env['warden-jwt_auth.token'] }
+    end
+
+    def respond_with_generic_jwt
+      payload = { uid: current_user.id, exp: GENERIC_TOKEN_TTL.from_now.to_i }
+      token = JWT.encode(payload, Rails.application.secrets.secret_key_base)
+
+      render json: { token: token }
+    end
+  end
+end

data/app/controllers/motor/configs_controller.rb

@@ -7,7 +7,7 @@ module Motor
     load_and_authorize_resource
 
     def index
-      render json: { data: Motor::ApiQuery::BuildJson.call(@configs, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@configs, params, current_ability) }
     end
 
     def create
@@ -19,7 +19,7 @@ module Motor
       @config.save!
       Motor::Configs::WriteToFile.call
 
-      render json: { data: Motor::ApiQuery::BuildJson.call(@config, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@config, params, current_ability) }
     rescue ActiveRecord::RecordNotUnique
       retry
     end

data/app/controllers/motor/dashboards_controller.rb

@@ -10,11 +10,11 @@ module Motor
     authorize_resource :dashboard, only: :create
 
     def index
-      render json: { data: Motor::ApiQuery::BuildJson.call(@dashboards.active, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@dashboards.active, params, current_ability) }
     end
 
     def show
-      render json: { data: Motor::ApiQuery::BuildJson.call(@dashboard, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@dashboard, params, current_ability) }
     end
 
     def create
@@ -24,7 +24,7 @@ module Motor
         ApplicationRecord.transaction { @dashboard.save! }
         Motor::Configs::WriteToFile.call
 
-        render json: { data: Motor::ApiQuery::BuildJson.call(@dashboard, params) }
+        render json: { data: Motor::ApiQuery::BuildJson.call(@dashboard, params, current_ability) }
       end
     rescue ActiveRecord::RecordNotUnique
       retry
@@ -34,7 +34,7 @@ module Motor
       Motor::Dashboards::Persistance.update_from_params!(@dashboard, dashboard_params)
       Motor::Configs::WriteToFile.call
 
-      render json: { data: Motor::ApiQuery::BuildJson.call(@dashboard, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@dashboard, params, current_ability) }
     rescue Motor::Dashboards::Persistance::TitleAlreadyExists
       render json: { errors: [{ source: 'title', detail: 'Title already exists' }] }, status: :unprocessable_entity
     end
@@ -51,6 +51,10 @@ module Motor
 
     def build_dashboard
       @dashboard = Motor::Dashboards::Persistance.build_from_params(dashboard_params)
+
+      @dashboard.define_singleton_method(:tags) do
+        taggable_tags.map(&:tag)
+      end
     end
 
     def dashboard_params

data/app/controllers/motor/data_controller.rb

@@ -11,19 +11,19 @@ module Motor
       @resources = Motor::ApiQuery.call(@resources, params)
 
       render json: {
-        data: Motor::ApiQuery::BuildJson.call(@resources, params),
+        data: Motor::ApiQuery::BuildJson.call(@resources, params, current_ability),
         meta: Motor::ApiQuery::BuildMeta.call(@resources, params)
       }
     end
 
     def show
-      render json: { data: Motor::ApiQuery::BuildJson.call(@resource, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@resource, params, current_ability) }
     end
 
     def create
       @resource.save!
 
-      render json: { data: Motor::ApiQuery::BuildJson.call(@resource, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@resource, params, current_ability) }
     rescue ActiveRecord::RecordInvalid
       render json: { errors: @resource.errors }, status: :unprocessable_entity
     end
@@ -31,7 +31,7 @@ module Motor
     def update
       @resource.update!(resource_params)
 
-      render json: { data: Motor::ApiQuery::BuildJson.call(@resource, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@resource, params, current_ability) }
     rescue ActiveRecord::RecordInvalid
       render json: { errors: @resource.errors }, status: :unprocessable_entity
     end
@@ -47,6 +47,11 @@ module Motor
     end
 
     def execute
+      resource_preferences = Motor::Resource.find_by(name: @resource.class.name.underscore).preferences
+      resource_action = resource_preferences[:actions].find { |a| a[:preferences][:method_name] == params[:method] }
+
+      authorize!(resource_action[:name].to_sym, @resource)
+
       @resource.public_send(params[:method].to_sym)
 
       head :ok

data/app/controllers/motor/forms_controller.rb

@@ -10,11 +10,11 @@ module Motor
     authorize_resource :form, only: :create
 
     def index
-      render json: { data: Motor::ApiQuery::BuildJson.call(@forms.active, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@forms.active, params, current_ability) }
     end
 
     def show
-      render json: { data: Motor::ApiQuery::BuildJson.call(@form, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@form, params, current_ability) }
     end
 
     def create
@@ -24,7 +24,7 @@ module Motor
         ApplicationRecord.transaction { @form.save! }
         Motor::Configs::WriteToFile.call
 
-        render json: { data: Motor::ApiQuery::BuildJson.call(@form, params) }
+        render json: { data: Motor::ApiQuery::BuildJson.call(@form, params, current_ability) }
       end
     rescue ActiveRecord::RecordNotUnique
       retry
@@ -34,7 +34,7 @@ module Motor
       Motor::Forms::Persistance.update_from_params!(@form, form_params)
       Motor::Configs::WriteToFile.call
 
-      render json: { data: Motor::ApiQuery::BuildJson.call(@form, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@form, params, current_ability) }
     rescue Motor::Forms::Persistance::NameAlreadyExists
       render json: { errors: [{ source: 'name', detail: 'Name already exists' }] }, status: :unprocessable_entity
     end

data/app/controllers/motor/icons_controller.rb

@@ -2,6 +2,8 @@
 
 module Motor
   class IconsController < ApiBaseController
+    skip_authorization_check
+
     CACHE_STORE = ActiveSupport::Cache::MemoryStore.new
 
     def index

data/app/controllers/motor/queries_controller.rb

@@ -10,11 +10,11 @@ module Motor
     authorize_resource :query, only: :create
 
     def index
-      render json: { data: Motor::ApiQuery::BuildJson.call(@queries.active, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@queries.active, params, current_ability) }
     end
 
     def show
-      render json: { data: Motor::ApiQuery::BuildJson.call(@query, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@query, params, current_ability) }
     end
 
     def create
@@ -24,7 +24,7 @@ module Motor
         ApplicationRecord.transaction { @query.save! }
         Motor::Configs::WriteToFile.call
 
-        render json: { data: Motor::ApiQuery::BuildJson.call(@query, params) }
+        render json: { data: Motor::ApiQuery::BuildJson.call(@query, params, current_ability) }
       end
     rescue ActiveRecord::RecordNotUnique
       retry
@@ -34,7 +34,7 @@ module Motor
       Motor::Queries::Persistance.update_from_params!(@query, query_params)
       Motor::Configs::WriteToFile.call
 
-      render json: { data: Motor::ApiQuery::BuildJson.call(@query, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@query, params, current_ability) }
     rescue Motor::Queries::Persistance::NameAlreadyExists
       render json: { errors: [{ source: 'name', detail: 'Name already exists' }] }, status: :unprocessable_entity
     end

data/app/controllers/motor/resource_methods_controller.rb

@@ -2,6 +2,8 @@
 
 module Motor
   class ResourceMethodsController < ApiBaseController
+    skip_authorization_check
+
     before_action :authorize_resource
 
     def show

data/app/controllers/motor/resources_controller.rb

@@ -7,14 +7,14 @@ module Motor
     load_and_authorize_resource
 
     def index
-      render json: { data: Motor::ApiQuery::BuildJson.call(@resources, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@resources, params, current_ability) }
     end
 
     def create
       Motor::BuildSchema::PersistResourceConfigs.call(@resource)
       Motor::Configs::WriteToFile.call
 
-      render json: { data: Motor::ApiQuery::BuildJson.call(@resource, params) }
+      render json: { data: Motor::ApiQuery::BuildJson.call(@resource, params, current_ability) }
     end
 
     private