roda-rest_api 1.2 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 18243f3f83d51a37b30d2389674711bca46623ee
-  data.tar.gz: 7456b216acbc32c860eca0276365b4cf3604b519
+  metadata.gz: 42c73fcdd8dc133305e3e284ce92f28bd5385b65
+  data.tar.gz: 15e78dd9fc92f0908a1e03db07ed0b328ca88028
 SHA512:
-  metadata.gz: 0d3e364aec4f2ebe92bc00aecd821743c065df73e2ecb37f4ee87ba95a4a861762c483150152ce2fb2c9778abe937a2cdb8d260a8858f97afe547224c9d47e2e
-  data.tar.gz: 12f0e8021df214bf30b218a8864ee235e7d3b3251d53eaadf836ce54b40f7eff3a1e7a19d02cec9b04bbb0371bacf6d967177fdd58d2cd73c6ecdb1f37dd4959
+  metadata.gz: 3a0757b51b9020966a968300ea5a4917ce87fbb48ea6cdf6fdf23542cecb3f505f1055eb4897e1759305e5b5d613b1a5fd5cff4b71f1cec2c10e7bd5f8847279
+  data.tar.gz: 1dbe2aae5b951805f37f21b1bed5d29dbb78ba9d6bc92dfeeb0d08e8f88ca2225056da3e84c8a6dec6b180cb31728875f9c5fea2df644ed5e8ea217e97219640

data/lib/roda/plugins/rest_api.rb

@@ -60,6 +60,10 @@ class Roda
 				def routes(*routes)
 					@routes = routes
 				end
+				
+				def permit(*permitted)
+					@permitted = permitted
+				end
 					
 				def routes!
 					unless @routes
@@ -72,15 +76,57 @@ class Roda
 				def perform(method, id = nil)
 					begin
 						args = method === :save ? JSON.parse(@request.body) : @request.GET
-						args.merge!(@primary_key => id) if id
-						args.merge!(@parent_key => @captures[0]) if @captures
+						args = permitted_params(args)
+						args.merge!(@primary_key.to_sym => id) if id
+						args.merge!(@parent_key.to_sym => @captures[0]) if @captures
 						self.send(method).call(args)
 					rescue StandardError => e
 						raise if ENV['RACK_ENV'] == 'development'
 						@request.response.status = method === :save ? 422 : 404
 					end
 				end
-
+				
+				private
+				
+				def permitted_params(params, keypath = [])
+					permitted = nil
+					case params
+					when Hash
+						permitted = Hash.new
+						params.each_pair do |k,v|
+							keypath << k.to_sym
+							if permitted?(keypath)
+								value = permitted_params(v, keypath)
+								permitted[k.to_sym] = value if value
+							end
+							keypath.pop
+						end
+					else
+						permitted = params if permitted?(keypath)
+					end
+					permitted
+				end
+				
+				def permitted?(keypath)
+					return false unless @permitted
+					permitted = @permitted
+					find_key = ->(items, key){
+						items.find do |item|
+							case item
+							when Hash
+								!!item.keys.index(key)
+							when Symbol
+								item === key
+							end
+						end
+					}
+					keypath.each do |key|
+						found = find_key.call(permitted, key)
+						permitted = found.is_a?(Hash) ? found.values.flatten : []
+						return false unless found
+					end
+				end
+			
 			end
 			
 			module RequestMethods

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: roda-rest_api
 version: !ruby/object:Gem::Version
-  version: '1.2'
+  version: 1.2.1
 platform: ruby
 authors:
 - Michel Benevento