motor-admin 0.1.56 → 0.1.62

data/app/controllers/motor/run_queries_controller.rb

@@ -20,7 +20,9 @@ module Motor
     private
 
     def render_result
-      query_result = Queries::RunQuery.call(@query, variables_hash: params[:variables])
+      query_result = Queries::RunQuery.call(@query, variables_hash: variables_params,
+                                                    limit: params[:limit].presence,
+                                                    filters: filter_params)
 
       if query_result.error
         render json: { errors: [{ detail: query_result.error }] }, status: :unprocessable_entity
@@ -29,6 +31,16 @@ module Motor
       end
     end
 
+    def current_user_variables
+      return {} unless current_user
+
+      current_user
+        .attributes
+        .slice('id', 'email')
+        .transform_keys { |key| "current_user_#{key}" }
+        .compact
+    end
+
     def query_result_hash(query_result)
       {
         data: query_result.data,
@@ -45,5 +57,13 @@ module Motor
     def query_params
       params.require(:data).permit(:sql_body, preferences: {})
     end
+
+    def variables_params
+      params.fetch(:variables, {}).merge(current_user_variables)
+    end
+
+    def filter_params
+      (params[:filter] || params[:filters])&.to_unsafe_h
+    end
   end
 end

data/app/controllers/motor/ui_controller.rb

@@ -4,7 +4,7 @@ module Motor
   class UiController < ApplicationController
     layout 'motor/application'
 
-    helper_method :current_user
+    helper_method :current_user, :current_ability
 
     def index
       render_ui

data/app/views/motor/ui/show.html.erb

@@ -1 +1 @@
-<%= raw(Motor::Configs::BuildUiAppTag.call(current_user)) %>
+<%= raw(Motor::Configs::BuildUiAppTag.call(current_user, current_ability)) %>

data/config/routes.rb

@@ -5,6 +5,7 @@ Motor::Admin.routes.draw do
     scope 'api', as: :api do
       resources :run_queries, only: %i[show create]
       resources :send_alerts, only: %i[create]
+      resources :auth_tokens, only: %i[create]
       resources :queries, only: %i[index show create update destroy]
       resources :tags, only: %i[index]
       resources :configs, only: %i[index create]

data/lib/generators/motor/templates/install.rb

@@ -149,6 +149,7 @@ class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Mi
     drop_table :motor_audits
     drop_table :motor_alert_locks
     drop_table :motor_alerts
+    drop_table :motor_forms
     drop_table :motor_taggable_tags
     drop_table :motor_tags
     drop_table :motor_resources

data/lib/motor.rb

@@ -53,6 +53,7 @@ require 'motor/version'
 require 'motor/admin'
 require 'motor/assets'
 require 'motor/active_record_utils'
+require 'motor/cancan_utils'
 require 'motor/build_schema'
 require 'motor/api_query'
 require 'motor/tags'

data/lib/motor/active_record_utils.rb

@@ -20,4 +20,5 @@ require_relative './active_record_utils/fetch_methods'
 require_relative './active_record_utils/defined_scopes_extension'
 require_relative './active_record_utils/active_storage_links_extension'
 require_relative './active_record_utils/active_storage_blob_patch'
-require_relative './active_record_utils/active_record_filter'
+require_relative './active_record_utils/active_record_filter_patch'
+require_relative './active_record_utils/active_record_connection_column_patch'

data/lib/motor/active_record_utils/active_record_connection_column_patch.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+begin
+  require 'active_record/connection_adapters/deduplicable'
+rescue LoadError
+  nil
+end
+
+ActiveRecord::ConnectionAdapters::Column.class_eval do
+  def array
+    false
+  end
+end

data/lib/motor/admin.rb

@@ -45,6 +45,7 @@ module Motor
     initializer 'motor.alerts.scheduler' do
       config.after_initialize do
         next unless Motor.server?
+        next if Motor.development?
 
         Motor::Alerts::Scheduler::SCHEDULER_TASK.execute
       end
@@ -65,10 +66,30 @@ module Motor
       end
     end
 
+    initializer 'warden.configure.dispatch_requests' do
+      next unless defined?(Warden::JWTAuth)
+
+      config.after_initialize do
+        Warden::JWTAuth.configure do |config|
+          config.dispatch_requests += [
+            ['POST', /\A#{Regexp.escape(Motor::Admin.routes.url_helpers.motor_api_auth_tokens_path)}\z/]
+          ]
+        end
+      end
+    end
+
     initializer 'motor.active_storage.extensions' do
       config.after_initialize do
         next unless defined?(ActiveStorage::Engine)
 
+        ActiveSupport.on_load(:active_storage_attachment) do
+          ActiveStorage::Attachment.include(Motor::ActiveRecordUtils::ActiveStorageLinksExtension)
+        end
+
+        ActiveSupport.on_load(:active_storage_blob) do
+          ActiveStorage::Blob.singleton_class.prepend(Motor::ActiveRecordUtils::ActiveStorageBlobPatch)
+        end
+
         ActiveStorage::Attachment.include(Motor::ActiveRecordUtils::ActiveStorageLinksExtension)
         ActiveStorage::Blob.singleton_class.prepend(Motor::ActiveRecordUtils::ActiveStorageBlobPatch)
       end

data/lib/motor/api_query.rb

@@ -5,9 +5,9 @@ module Motor
     module_function
 
     def call(rel, params)
-      rel = ApiQuery::Sort.call(rel, params[:sort])
+      rel = ApiQuery::Sort.call(rel, params[:sort] || params[:order])
       rel = ApiQuery::Paginate.call(rel, params[:page])
-      rel = ApiQuery::Filter.call(rel, params[:filter])
+      rel = ApiQuery::Filter.call(rel, params[:filter] || params[:filters])
       rel = ApiQuery::ApplyScope.call(rel, params[:scope])
 
       ApiQuery::Search.call(rel, params[:q] || params[:search] || params[:query])

data/lib/motor/api_query/build_json.rb

@@ -5,83 +5,90 @@ module Motor
     module BuildJson
       module_function
 
-      def call(rel, params)
-        rel = rel.none if params.dig(:page, :limit).yield_self { |limit| limit.present? && limit.to_i.zero? }
-
+      # @param rel [ActiveRecord::Base, ActiveRecord::Relation]
+      # @param params [Hash]
+      # @param current_ability [CanCan::Ability]
+      # @return [Hash]
+      def call(rel, params, current_ability = Motor::CancanUtils::CanManageAll.new)
+        rel = rel.none if limit_zero_params?(params)
         rel = rel.preload_associations_lazily if rel.is_a?(ActiveRecord::Relation)
 
-        json_params = {}.with_indifferent_access
-
-        assign_include_params(json_params, rel, params)
-        assign_fields_params(json_params, rel, params)
-
-        rel.as_json(json_params)
-      end
+        model = rel.is_a?(ActiveRecord::Relation) ? rel.klass : rel.class
 
-      def assign_include_params(json_params, _rel, api_params)
-        return if api_params['include'].blank?
+        include_hash = build_include_hash(params['include'])
+        models_index = build_models_index(model, include_hash)
 
-        include_params = api_params['include']
+        json_params = normalize_include_params(include_hash)
 
-        if include_params.is_a?(String)
-          include_params =
-            include_params.split(',').reduce({}) do |accumulator, path|
-              hash = {}
+        assign_fields_params!(json_params, model, params, current_ability, models_index)
 
-              path.split('.').reduce(hash) do |acc, part|
-                acc_hash = {}
-
-                acc[part] = acc_hash
+        rel.as_json(json_params.with_indifferent_access)
+      end
 
-                acc_hash
-              end
+      # @param include_params [Hash]
+      # @return [Hash]
+      def build_include_hash(include_params)
+        return {} if include_params.blank?
 
-              accumulator.deep_merge(hash)
-            end
+        if include_params.is_a?(String)
+          build_hash_from_string_path(include_params)
+        else
+          include_params
         end
-
-        json_params.deep_merge!(normalize_include_params(include_params))
       end
 
-      def assign_fields_params(json_params, rel, params)
+      # @param json_params [Hash]
+      # @param model [Class<ActiveRecord::Base>]
+      # @param params [Hash]
+      # @param current_ability [CanCan::Ability]
+      # @param models_index [Hash]
+      # @return [void]
+      def assign_fields_params!(json_params, model, params, current_ability, models_index)
         return if params[:fields].blank?
 
-        model = rel.is_a?(ActiveRecord::Relation) ? rel.klass : rel.class
-
         params[:fields].each do |key, fields|
-          fields = fields.split(',') if fields.is_a?(String)
-
-          merge_fields_params!(json_params, key, fields, model)
-        end
-      end
+          fields_model = models_index[key]
 
-      def merge_fields_params!(json_params, key, fields, model)
-        model_name = model.name.underscore
+          next unless model
 
-        if key == model_name || model_name.split('/').last == key
-          json_params.merge!(build_fields_hash(model, fields))
-        else
-          hash = find_key_in_params(json_params, key)
+          fields = fields.split(',') if fields.is_a?(String)
 
-          fields_hash = build_fields_hash(model.reflections[key]&.klass, fields)
+          fields_hash = fields_model == model ? json_params : find_key_in_params(json_params, key)
 
-          hash.merge!(fields_hash)
+          fields_hash.merge!(build_fields_hash(fields_model, fields, current_ability))
         end
       end
 
-      def build_fields_hash(model, fields)
-        columns = model ? model.columns.map(&:name) : []
+      # @param model [Class<ActiveRecord::Base>]
+      # @param fields [Hash]
+      # @param current_ability [CanCan::Ability]
+      # @return [Hash]
+      def build_fields_hash(model, fields, current_ability)
+        return { 'methods' => fields } unless model
+
+        column_names = model.column_names.map(&:to_sym)
+        instance_methods = model.instance_methods
+        permitted_attributes = current_ability.permitted_attributes(:read, model)
+        is_permitted_all = column_names == permitted_attributes
+
         fields_hash = { 'only' => [], 'methods' => [] }
 
         fields.each_with_object(fields_hash) do |field, acc|
-          if field.in?(columns)
+          field_symbol = field.to_sym
+
+          next if !is_permitted_all && permitted_attributes.exclude?(field_symbol)
+
+          if column_names.include?(field_symbol)
             acc['only'] << field
-          elsif model.nil? || model.instance_methods.include?(field.to_sym)
+          elsif instance_methods.include?(field_symbol)
             acc['methods'] << field
           end
         end
       end
 
+      # @param params [Hash]
+      # @param key [String]
+      # @return [Hash]
       def find_key_in_params(params, key)
         params = params['include']
 
@@ -93,6 +100,8 @@ module Motor
         end
       end
 
+      # @param params [Hash]
+      # @return [Hash]
       def normalize_include_params(params)
         case params
         when Array
@@ -112,6 +121,51 @@ module Motor
           raise ArgumentError, "Wrong include param type #{params.class}"
         end
       end
+
+      # @param model [Class<ActiveRecord::Base>]
+      # @param includes_hash [Hash]
+      # @return [Hash]
+      def build_models_index(model, includes_hash)
+        default_index = {
+          model.name.underscore => model,
+          model.name.underscore.split('/').last => model
+        }
+
+        includes_hash.reduce(default_index) do |acc, (key, value)|
+          reflection = model.reflections[key]
+
+          next acc unless reflection
+          next acc if reflection.polymorphic?
+
+          acc[key] = reflection.klass
+
+          acc.merge(build_models_index(reflection.klass, value))
+        end
+      end
+
+      # @param string_path [String]
+      # @return [Hash]
+      def build_hash_from_string_path(string_path)
+        string_path.split(',').reduce({}) do |accumulator, path|
+          hash = {}
+
+          path.split('.').reduce(hash) do |acc, part|
+            acc_hash = {}
+
+            acc[part] = acc_hash
+
+            acc_hash
+          end
+
+          accumulator.deep_merge(hash)
+        end
+      end
+
+      # @param params [Hash]
+      # @return [Boolean]
+      def limit_zero_params?(params)
+        params.dig(:page, :limit).yield_self { |limit| limit.present? && limit.to_i.zero? }
+      end
     end
   end
 end

data/lib/motor/api_query/filter.rb

@@ -4,6 +4,7 @@ module Motor
   module ApiQuery
     module Filter
       LIKE_FILTER_VALUE_REGEXP = /\A%?(.*?)%?\z/.freeze
+      DISTINCT_DESTRICTED_COLUMN_TYPES = %i[json point].freeze
 
       module_function
 
@@ -12,7 +13,10 @@ module Motor
 
         normalized_params = normalize_params(Array.wrap(params))
 
-        rel.filter(normalized_params).distinct
+        rel = rel.filter(normalized_params)
+        rel = rel.distinct if can_apply_distinct?(rel)
+
+        rel
       end
 
       def normalize_params(params)
@@ -47,6 +51,12 @@ module Motor
         end
       end
 
+      def can_apply_distinct?(rel)
+        rel.columns.none? do |column|
+          DISTINCT_DESTRICTED_COLUMN_TYPES.include?(column.type)
+        end
+      end
+
       def normalize_action(action, value)
         case action
         when 'includes'

data/lib/motor/assets.rb

@@ -8,10 +8,19 @@ module Motor
     MANIFEST_PATH = ASSETS_PATH.join('manifest.json')
     DEV_SERVER_URL = 'http://localhost:9090/'
 
+    CACHE_STORE =
+      if Rails.env.production?
+        ActiveSupport::Cache::MemoryStore.new(size: 5.megabytes)
+      else
+        ActiveSupport::Cache::NullStore.new
+      end
+
     module_function
 
     def manifest
-      JSON.parse(MANIFEST_PATH.read)
+      CACHE_STORE.fetch('manifest') do
+        JSON.parse(MANIFEST_PATH.read)
+      end
     end
 
     def icons

data/lib/motor/build_schema.rb

@@ -58,9 +58,10 @@ module Motor
 
     module_function
 
-    def call(cache_keys = {})
+    def call(cache_keys = {}, current_ability = nil)
       schema = LoadFromRails.call
       schema = MergeSchemaConfigs.call(schema, cache_keys)
+      schema = ApplyPermissions.call(schema, current_ability) if current_ability
 
       ReorderSchema.call(schema, cache_keys)
     end
@@ -75,4 +76,5 @@ require_relative './build_schema/find_icon'
 require_relative './build_schema/persist_resource_configs'
 require_relative './build_schema/reorder_schema'
 require_relative './build_schema/merge_schema_configs'
+require_relative './build_schema/apply_permissions'
 require_relative './build_schema/utils'

data/lib/motor/build_schema/active_storage_attachment_schema.rb

@@ -5,6 +5,7 @@ module Motor
     ACTIVE_STORAGE_ATTACHMENT_SCHEMA = {
       name: 'active_storage/attachment',
       slug: 'active_storage__attachments',
+      class_name: 'ActiveStorage::Attachment',
       table_name: 'active_storage_attachments',
       primary_key: 'id',
       display_name: 'Attachments',

data/lib/motor/build_schema/apply_permissions.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Motor
+  module BuildSchema
+    module ApplyPermissions
+      module_function
+
+      def call(schema, ability)
+        schema.map do |model|
+          klass = model[:class_name].constantize
+
+          next unless ability.can?(:read, klass)
+
+          model[:associations] = filter_associations(model[:associations], ability)
+          model[:columns] = filter_columns(klass, model[:columns], ability)
+          model[:actions] = filter_actions(klass, model[:actions], ability)
+
+          model
+        end.compact
+      end
+
+      def filter_associations(associations, ability)
+        associations.select do |assoc|
+          ability.can?(:read, assoc[:model_name].classify.constantize)
+        end
+      end
+
+      def filter_columns(model, columns, ability)
+        columns.map do |column|
+          next unless ability.can?(:read, model, column[:name])
+
+          next if column.dig(:reference, :model_name).present? &&
+                  !ability.can?(:read, column[:reference][:model_name].classify.constantize)
+
+          unless ability.can?(:update, model, column[:name])
+            column = column.merge(access_type: BuildSchema::ColumnAccessTypes::READ_ONLY)
+          end
+
+          column
+        end.compact
+      end
+
+      def filter_actions(model, actions, ability)
+        actions.select do |action|
+          ability.can?(action[:name].to_sym, model)
+        end
+      end
+    end
+  end
+end