rolemodel-rails 2.3.2 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5716bd65624ca07d0abd2474a843f44406de11938b3f5be4046f64a35ee13e7b
-  data.tar.gz: 657b71bf0a3f1b2ccc7a82c80f027686c929c7a1b5d3622bd39a5cfc81471c45
+  metadata.gz: 41af565ee256cafc1b08a53dcdce9bf029e1503d8a368d2e946bb4bebec284a2
+  data.tar.gz: f7247392ea0c87346ba0915d14506852f34ced3380331905e7e9209f4b2436d7
 SHA512:
-  metadata.gz: 5954774b2b8bc6772424debb798c8ee2f868f4d20b315a9029b08b0974b77804e1dfb041f243720b21b7506a80598ab58feec39b0083e72323b5162079505eb5
-  data.tar.gz: 7ca723dafff67deac08f8553a67e3ffdea5c6300922584c2ae5db8a0e24114f60c9a10a83cadedaa47a0815a733d429c3064794371227c9568e5535480b3dc39
+  metadata.gz: f5fe95adeb421eb88bf8c04e9630b6c688403237fd09b68b4185391254430d12161cd3de74cceabda0b11680a56ee2848fba273b2070a3bc36b7a5ce3701b29d
+  data.tar.gz: 89343467c51120526e7ef218d3037fdeb920b75ab846ba5c09a45464897e6484db0532d70d66bf9a3d3477d3d2c13bf34197fe432fd980ff47ad1d6ca50ef058

data/README.md

@@ -219,6 +219,98 @@ DRY_RUN=true rake users:dev[_,bob@example.com]
 #=>    -> 0.0000s
 ```
 
+### `Rolemodel::ResourceFor::ControllerExtension`
+
+Provides the private `resource_for` utility method to all controller classes throughout your app. Use it in conjunction with Routing concerns.
+
+#### The Problem It Solves
+
+Apps accumulate resources that hang off many different parents. Good examples include `comments`, `reports`, `duplications`.
+
+The naive approach involves many namespaced controllers that all do the same thing but with a different parent resource, or adding several non-restful actions to each parent controller.
+
+The following example illustrates a better pattern.
+
+##### Routing
+
+Declare the child resource inside a route concern and pass the parent's class name as a route default using `parent_resource`:
+
+```ruby
+concern :commentable do
+  resources :comments, commentable_type: parent_resource.name.classify
+end
+
+concern :reportable do
+  resources :generated_reports, only: %i[show create], reportable_type: parent_resource.name.classify
+end
+
+shallow do
+  resources :accounts do
+    resources :estimates, concerns: %i[commentable reportable] do
+      resources :widgets, concerns: %i[commentable reportable]
+    end
+  end
+end
+```
+
+##### Controller
+
+One controller serves every parent:
+
+```ruby
+class CommentsController < ApplicationController
+  before_action :set_commentable, only: %i[index new create]
+  before_action :set_comment, except: %i[index new create]
+
+  def create
+    # ...
+  end
+
+  private
+
+  def set_commentable
+    @commentable = resource_for(:commentable_type) # pass in the symbol specified in your routing concern.
+  end
+end
+```
+
+Under `shallow: true`, only the collection actions (`index`, `new`, `create`) carry the parent id — hence the `only:`/`except:` split above. Member actions find the child directly by `params[:id]` and reach the parent through its own association.
+
+`resource_for` returns the record itself, so it composes with authorization and presentation:
+
+```ruby
+def set_resource
+  @resource = authorize resource_for(:resource_type)
+end
+```
+
+#### Guarding User-Supplied Types
+
+Route defaults are merged into `params` last, so a route-supplied type cannot be overridden by a query string or request body. If a type ever arrives from user input instead, allowlist it before calling `resource_for` — `safe_constantize` will happily resolve any constant in the app:
+
+```ruby
+REPORT_CONTEXTS = %w[Accessory Estimate PartProxy Tank].freeze
+
+before_action :verify_context_type, :set_context, only: %i[create]
+
+private
+
+def verify_context_type
+  return if REPORT_CONTEXTS.include?(params[:context_type])
+
+  redirect_back_or_to root_url, alert: 'Invalid Request'
+end
+```
+
+Doing this even for route-supplied types is cheap insurance: it documents which parents the controller actually supports and fails loudly when a new route wires up a parent the controller cannot handle.
+
+#### Notes
+
+* Raises `ActiveRecord::RecordNotFound` when the id does not resolve, which Rails renders as a 404 — the same behavior as any other `find`.
+* `safe_constantize` returns `nil` for an unknown constant, producing a `NoMethodError`; allowlisting avoids that.
+* The class name is demodulized when deriving the id param, so `Reporting::Tank` looks for `params[:tank_id]`.
+* Included via `ActiveSupport.on_load(:action_controller_base)`, so `ActionController::API` controllers do not get it.
+
 ## Development
 
 Install the versions of Node and Ruby specified in `.node-version` and `.ruby-version` on your machine. https://asdf-vm.com/ is a great tool for managing language versions. Then run `corepack enable` to activate the Yarn 4+ version pinned by each project's `packageManager` field.

data/lib/rolemodel/engine.rb

@@ -3,9 +3,16 @@
 module Rolemodel
   class Engine < ::Rails::Engine
     require_relative 'generator_base'
+    require_relative 'resource_for/controller_extension'
 
     generators do
       require 'generators/rolemodel/all_generator'
     end
+
+    initializer 'rolemodel.action_controller' do
+      ActiveSupport.on_load(:action_controller_base) do
+        include Rolemodel::ResourceFor::ControllerExtension
+      end
+    end
   end
 end

data/lib/rolemodel/resource_for/controller_extension.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Rolemodel
+  module ResourceFor
+    module ControllerExtension
+      extend ActiveSupport::Concern
+
+      private
+
+      def resource_for(type_symbol)
+        params[type_symbol].safe_constantize.find(params[params[type_symbol].foreign_key])
+      end
+    end
+  end
+end

data/lib/rolemodel/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rolemodel
-  VERSION = '2.3.2'
+  VERSION = '2.4.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rolemodel-rails
 version: !ruby/object:Gem::Version
-  version: 2.3.2
+  version: 2.4.0
 platform: ruby
 authors:
 - RoleModel Software Inc
@@ -436,6 +436,7 @@ files:
 - lib/rolemodel/optics/phosphor_icon_builder.rb
 - lib/rolemodel/optics/tabler_icon_builder.rb
 - lib/rolemodel/replace_content_helper.rb
+- lib/rolemodel/resource_for/controller_extension.rb
 - lib/rolemodel/utility.rb
 - lib/rolemodel/utility/task_tools.rb
 - lib/rolemodel/version.rb