responder_controller 0.1.3 → 0.2.0

data/CHANGELOG

@@ -1,3 +1,7 @@
+*ResponderController 0.1.3*
+
+* Render BadScopes as 400s, not 422s
+
 *ResponderController 0.1.2*
 
 * If a requested scope errors out, raise a BadScope exception.  Tell rails (if present) to render these as 422s.

data/README.rdoc

@@ -40,6 +40,20 @@ This is me abstracting more for my own apps.  If it's handy for you, go nuts.
     serves_model :user
   end
 
+=== Forbid a certain scope
+
+  class PostsController < ApplicationController
+    include ResponderController
+    serves_scopes :except => :authored_by # asking for it will 403
+  end
+
+=== Or use a white list instead
+
+  class PostsController < ApplicationController
+    include ResponderController
+    serves_scopes :only => :recent
+  end
+
 === Serve resources in a namespace:
 
   class PostsController < ApplicationController

data/VERSION

@@ -1 +1 @@
-0.1.3
+0.2.0

data/lib/responder_controller.rb

@@ -3,7 +3,20 @@ require 'active_support/core_ext/string/inflections'
 require 'active_support/core_ext/module/delegation'
 
 module ResponderController
-  class BadScope < StandardError
+  # Root of scope-related exceptions.
+  class ScopeError < StandardError
+  end
+
+  # Raised when an active record scope itself raises an exception.
+  #
+  # If this exception bubbles up, rails will render it as a 400.
+  class BadScope < ScopeError
+  end
+
+  # Raised when attempting to call a scope forbidden by ClassMethods.serves_scopes.
+  #
+  # If this exception bubbles up, rails will render it as a 403.
+  class ForbiddenScope < ScopeError
   end
 
   def self.included(mod)
@@ -11,10 +24,11 @@ module ResponderController
     mod.send :include, InstanceMethods
     mod.send :include, Actions
 
-    # Uncaught BadScope exceptions become 400s
-    if defined? ActionDispatch
-      ActionDispatch::ShowExceptions.rescue_responses[BadScope.name] = :bad_request
-    end
+    # Declare http statuses to return for uncaught scope errors.
+    ActionDispatch::ShowExceptions.rescue_responses.update({
+      BadScope.name => :bad_request,
+      ForbiddenScope.name => :forbidden
+    }) if defined? ActionDispatch
   end
 
   # Configure how the controller finds and serves models of what flavor.
@@ -39,6 +53,33 @@ module ResponderController
       @model_class_name = model_class_name.to_s
     end
 
+    # Declare what active record scopes to allow or forbid to requests.
+    #
+    # .serves_scopes follows the regular :only/:except form:  white-listed scopes are passed by
+    # name as <tt>:only => [:allowed, :scopes]</tt> or <tt>:only => :just_one</tt>.  Similarly,
+    # black-listed ones are passed under <tt>:except</tt>.
+    #
+    # If a white-list is passed, all other requested scopes (i.e. scopes named by query parameters)
+    # will be denied, raising <tt>ForbiddenScope</tt>.  If a black-list is passed, only they will
+    # raise the exception.
+    def serves_scopes(options = nil)
+      @serves_scopes ||= {}
+
+      if options
+        raise TypeError unless options.is_a? Hash
+
+        new_keys = @serves_scopes.keys | options.keys
+        unless new_keys == [:only] or new_keys == [:except]
+          raise ArgumentError.new("serves_scopes takes exactly one of :only and :except")
+        end
+
+        @serves_scopes[options.keys.first] ||= []
+        @serves_scopes[options.keys.first].concat [*options.values.first]
+      end
+
+      @serves_scopes
+    end
+
     # Declare leading arguments ("responder context") for +respond_with+ calls.
     #
     # +respond_with+ creates urls from models.  To avoid strongly coupling models to a url
@@ -102,7 +143,7 @@ module ResponderController
 
       parent_name_parts = parent_model_class_name.split('/')
       parent_modules = parent_name_parts[0...-1].collect(&:to_sym)
-      parent_id = "#{parent_name_parts.last}_id".to_sym
+      parent_id = "#{parent_name_parts.last}_id".to_sym # TODO: primary key
 
       scope do |query|
         query.where parent_id => params[parent_id]
@@ -117,7 +158,8 @@ module ResponderController
 
   # Instance methods that support the Actions module.
   module InstanceMethods
-    delegate :model_class_name, :model_class, :scopes, :responds_within, :to => "self.class"
+    delegate :model_class_name, :model_class, :scopes, :responds_within, :serves_scopes,
+      :to => "self.class"
 
     # Apply scopes to the given query.
     #
@@ -141,9 +183,12 @@ module ResponderController
         end
       end
 
-      scopes_from_request = (model_class.scopes.keys & params.keys.collect { |k| k.to_sym })
-      query = scopes_from_request.inject(query) do |query, scope|
-        query.send scope, *params[scope.to_s] rescue raise BadScope.new
+      requested = (model_class.scopes.keys & params.keys.collect { |k| k.to_sym })
+      raise ForbiddenScope if serves_scopes[:only] && (requested - serves_scopes[:only]).any?
+      raise ForbiddenScope if serves_scopes[:except] && (requested & serves_scopes[:except]).any?
+
+      query = requested.inject(query) do |query, scope|
+        query.send scope, *params[scope.to_s] rescue raise BadScope
       end
 
       query

data/responder_controller.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{responder_controller}
-  s.version = "0.1.3"
+  s.version = "0.2.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Phil Smith"]
-  s.date = %q{2010-05-19}
+  s.date = %q{2010-05-21}
   s.description = %q{Responders make crud controllers tiny, this wraps the rest.}
   s.email = %q{phil.h.smith@gmail.com}
   s.extra_rdoc_files = [

data/spec/responder_controller_spec.rb

@@ -205,6 +205,76 @@ describe "ResponderController" do
     end
   end
 
+  describe '.serves_scopes' do
+    before :each do
+      @controller = PostsController.new
+      @controller.params['commented_on_by'] = 'you'
+    end
+
+    it 'can specify a white list of active record scopes to serve' do
+      PostsController.serves_scopes :only => [:recent, :authored_by, :published_after]
+      lambda do
+        @controller.scope @query
+      end.should raise_error(ResponderController::ForbiddenScope)
+    end
+
+    it 'can specify just one scope to white list' do
+      PostsController.serves_scopes :only => :recent
+      lambda do
+        @controller.scope @query
+      end.should raise_error(ResponderController::ForbiddenScope)
+    end
+
+    it 'can specify a black list of active record scopes to deny' do
+      PostsController.serves_scopes :except => [:commented_on_by, :unpublished]
+      lambda do
+        @controller.scope @query
+      end.should raise_error(ResponderController::ForbiddenScope)
+    end
+
+    it 'can specify just one scope to black list' do
+      PostsController.serves_scopes :except => :commented_on_by
+      lambda do
+        @controller.scope @query
+      end.should raise_error(ResponderController::ForbiddenScope)
+    end
+
+    it 'whines if passed anything other than a hash' do
+      lambda do
+        PostsController.serves_scopes 'cupcakes!'
+      end.should raise_error TypeError
+    end
+
+    it 'whines about keys other than :only and :except' do
+      lambda do
+        PostsController.serves_scopes 'only' => :recent
+      end.should raise_error ArgumentError
+    end
+
+    it 'whines when both :only and :except are passed' do
+      lambda do
+        PostsController.serves_scopes :only => :recent, :except => :commented_on_by
+      end.should raise_error ArgumentError
+    end
+
+    it 'whines if both :only and :except are passed between different calls' do
+      PostsController.serves_scopes :only => :recent
+      lambda do
+        PostsController.serves_scopes :except => :commented_on_by
+      end.should raise_error ArgumentError
+    end
+
+    it 'accumulates scopes passed over multiple calls' do
+      PostsController.serves_scopes :only => :recent
+      PostsController.serves_scopes :only => :authored_by
+      PostsController.serves_scopes[:only].should == [:recent, :authored_by]
+    end
+
+    after :each do
+      PostsController.serves_scopes.clear # clean up
+    end
+  end
+
   describe '#find_models' do
     it 'is #scope #model_class.scoped' do
       controller = PostsController.new

metadata

@@ -4,9 +4,9 @@ version: !ruby/object:Gem::Version
   prerelease: false
   segments: 
   - 0
-  - 1
-  - 3
-  version: 0.1.3
+  - 2
+  - 0
+  version: 0.2.0
 platform: ruby
 authors: 
 - Phil Smith
@@ -14,7 +14,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-05-19 00:00:00 -07:00
+date: 2010-05-21 00:00:00 -07:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency