rolemodel-rails 2.3.2 → 2.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5716bd65624ca07d0abd2474a843f44406de11938b3f5be4046f64a35ee13e7b
-  data.tar.gz: 657b71bf0a3f1b2ccc7a82c80f027686c929c7a1b5d3622bd39a5cfc81471c45
+  metadata.gz: ab7ce13bbc4227eedf045d0ce216b341049445daab3856f6b1d435f9799ffb53
+  data.tar.gz: 5e5ce9316bd729ad8dd3bacf21d849aa274d9c870768fd6d7866f5cb2ae093bf
 SHA512:
-  metadata.gz: 5954774b2b8bc6772424debb798c8ee2f868f4d20b315a9029b08b0974b77804e1dfb041f243720b21b7506a80598ab58feec39b0083e72323b5162079505eb5
-  data.tar.gz: 7ca723dafff67deac08f8553a67e3ffdea5c6300922584c2ae5db8a0e24114f60c9a10a83cadedaa47a0815a733d429c3064794371227c9568e5535480b3dc39
+  metadata.gz: 74101aeb24869c8e84b1bb645573df9b95e97dfaf79d8c0d4d5980efafe46c64f414b9afded5511a9f4ae8bf0ee2339074e841710f08ba8314d996bd27a847db
+  data.tar.gz: 6438c65a802314259eaa3c0ebe8cdd94301e95f3dc5a1e82c1809f2285c219f731953da1b1bfe45ac5c877273a958b7ba5cd17f6052d4500dd12302590f194c4

data/README.md

@@ -69,7 +69,6 @@ bin/rails g
 
 * [Core Setup](./lib/generators/rolemodel/core_setup)
 * [Github](./lib/generators/rolemodel/github)
-* [Semaphore](./lib/generators/rolemodel/semaphore)
 * [Heroku](./lib/generators/rolemodel/heroku)
 * [Readme](./lib/generators/rolemodel/readme)
 * [Webpack](./lib/generators/rolemodel/webpack)
@@ -219,6 +218,98 @@ DRY_RUN=true rake users:dev[_,bob@example.com]
 #=>    -> 0.0000s
 ```
 
+### `Rolemodel::ResourceFor::ControllerExtension`
+
+Provides the private `resource_for` utility method to all controller classes throughout your app. Use it in conjunction with Routing concerns.
+
+#### The Problem It Solves
+
+Apps accumulate resources that hang off many different parents. Good examples include `comments`, `reports`, `duplications`.
+
+The naive approach involves many namespaced controllers that all do the same thing but with a different parent resource, or adding several non-restful actions to each parent controller.
+
+The following example illustrates a better pattern.
+
+##### Routing
+
+Declare the child resource inside a route concern and pass the parent's class name as a route default using `parent_resource`:
+
+```ruby
+concern :commentable do
+  resources :comments, commentable_type: parent_resource.name.classify
+end
+
+concern :reportable do
+  resources :generated_reports, only: %i[show create], reportable_type: parent_resource.name.classify
+end
+
+shallow do
+  resources :accounts do
+    resources :estimates, concerns: %i[commentable reportable] do
+      resources :widgets, concerns: %i[commentable reportable]
+    end
+  end
+end
+```
+
+##### Controller
+
+One controller serves every parent:
+
+```ruby
+class CommentsController < ApplicationController
+  before_action :set_commentable, only: %i[index new create]
+  before_action :set_comment, except: %i[index new create]
+
+  def create
+    # ...
+  end
+
+  private
+
+  def set_commentable
+    @commentable = resource_for(:commentable_type) # pass in the symbol specified in your routing concern.
+  end
+end
+```
+
+Under `shallow: true`, only the collection actions (`index`, `new`, `create`) carry the parent id — hence the `only:`/`except:` split above. Member actions find the child directly by `params[:id]` and reach the parent through its own association.
+
+`resource_for` returns the record itself, so it composes with authorization and presentation:
+
+```ruby
+def set_resource
+  @resource = authorize resource_for(:resource_type)
+end
+```
+
+#### Guarding User-Supplied Types
+
+Route defaults are merged into `params` last, so a route-supplied type cannot be overridden by a query string or request body. If a type ever arrives from user input instead, allowlist it before calling `resource_for` — `safe_constantize` will happily resolve any constant in the app:
+
+```ruby
+REPORT_CONTEXTS = %w[Accessory Estimate PartProxy Tank].freeze
+
+before_action :verify_context_type, :set_context, only: %i[create]
+
+private
+
+def verify_context_type
+  return if REPORT_CONTEXTS.include?(params[:context_type])
+
+  redirect_back_or_to root_url, alert: 'Invalid Request'
+end
+```
+
+Doing this even for route-supplied types is cheap insurance: it documents which parents the controller actually supports and fails loudly when a new route wires up a parent the controller cannot handle.
+
+#### Notes
+
+* Raises `ActiveRecord::RecordNotFound` when the id does not resolve, which Rails renders as a 404 — the same behavior as any other `find`.
+* `safe_constantize` returns `nil` for an unknown constant, producing a `NoMethodError`; allowlisting avoids that.
+* The class name is demodulized when deriving the id param, so `Reporting::Tank` looks for `params[:tank_id]`.
+* Included via `ActiveSupport.on_load(:action_controller_base)`, so `ActionController::API` controllers do not get it.
+
 ## Development
 
 Install the versions of Node and Ruby specified in `.node-version` and `.ruby-version` on your machine. https://asdf-vm.com/ is a great tool for managing language versions. Then run `corepack enable` to activate the Yarn 4+ version pinned by each project's `packageManager` field.

data/lib/generators/rolemodel/README.md

@@ -13,7 +13,6 @@
 * [Optics](./optics)
 * [README](./readme)
 * [SaaS](./saas)
-* [Semaphore](./semaphore)
 * [SimpleForm](./simple_form)
 * [Slim](./slim)
 * [SoftDestroyable](./soft_destroyable)

data/lib/generators/rolemodel/all_generator.rb

@@ -4,7 +4,6 @@ module Rolemodel
 
     def run_all_the_generators
       generate 'rolemodel:github'
-      generate 'rolemodel:semaphore'
       generate 'rolemodel:heroku'
       generate 'rolemodel:readme'
       generate 'rolemodel:webpack'

data/lib/rolemodel/engine.rb

@@ -3,9 +3,16 @@
 module Rolemodel
   class Engine < ::Rails::Engine
     require_relative 'generator_base'
+    require_relative 'resource_for/controller_extension'
 
     generators do
       require 'generators/rolemodel/all_generator'
     end
+
+    initializer 'rolemodel.action_controller' do
+      ActiveSupport.on_load(:action_controller_base) do
+        include Rolemodel::ResourceFor::ControllerExtension
+      end
+    end
   end
 end

data/lib/rolemodel/resource_for/controller_extension.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Rolemodel
+  module ResourceFor
+    module ControllerExtension
+      extend ActiveSupport::Concern
+
+      private
+
+      def resource_for(type_symbol)
+        params[type_symbol].safe_constantize.find(params[params[type_symbol].foreign_key])
+      end
+    end
+  end
+end

data/lib/rolemodel/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rolemodel
-  VERSION = '2.3.2'
+  VERSION = '2.4.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rolemodel-rails
 version: !ruby/object:Gem::Version
-  version: 2.3.2
+  version: 2.4.1
 platform: ruby
 authors:
 - RoleModel Software Inc
@@ -436,6 +436,7 @@ files:
 - lib/rolemodel/optics/phosphor_icon_builder.rb
 - lib/rolemodel/optics/tabler_icon_builder.rb
 - lib/rolemodel/replace_content_helper.rb
+- lib/rolemodel/resource_for/controller_extension.rb
 - lib/rolemodel/utility.rb
 - lib/rolemodel/utility/task_tools.rb
 - lib/rolemodel/version.rb