schema_based_api 2.1.13 → 2.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f239cdd4d05888e49c24e79d16ad1b4a4393c88b4d814ec25e4ceacf420a6345
-  data.tar.gz: 16e577996622c20a25a3c2ba880741d7dcb0886cae85c1c20c969c598a6d8def
+  metadata.gz: 8471d0089a6858a8fc54493fcd2e1d10ec3cf82d021ed347645dc999c1e0ec5e
+  data.tar.gz: cfac408c1ffdff059610eaa98aa40e093705c74f74953f886abb792f622c2ac4
 SHA512:
-  metadata.gz: 85373c1c2e55ef4228e7b44fc47fe4e4ecfb29eab5bda478b58c0570cbd66660a6c44bd560286121320c26ce4d5d69d4839a875c8d6c0293c276eec6601ac738
-  data.tar.gz: 0ffc2453dc4644534e2382fc69f1a33dfad2a45527a85e2921e89bfe094c75d063d45ede997ac36196cdcc0a47c89da15227eee1a6bdeddde11257f22201722b
+  metadata.gz: 1695890938108ed0b87b9334c945bd6277a9784934ef6c9bab9a5def8d82aac2a49fb1f2cd649f67aeec2425b226a24767413418999ab745a3d1e822e8222646
+  data.tar.gz: ad5835d2ff8a1fcd14cb4b4e49400401cab586283d874c6fe83c54c1c0a40f68574aa089bef8116041a3287d1f65d9da873a08e641f4fd414bf1df66f3404065

data/README.md

@@ -1,28 +1,25 @@
-# SchemaBasedApi
-I've always been a interested in effortless, no-fuss, conventions' based development, DRYness, and pragmatic programming, I've always thought that at this point of the technology evolution, we need not to configure too much to have our software run, and have the software adapt to data layers, from there build up automatically the APIs, visualizations etc. This is a first step to have a schema driven API, based on the data it has to serve, it also gives, thanks to meta programming, an insight on the actual schema, the translations available and the DSL which can change the way the data is presented, leading to a strong base for automatically build of UIs consuming the API (react, vue, angular based PWAs, maybe! ;-) ).
+# Schema Based Api
+I've always been interested in effortless, no-fuss, conventions' based development, DRYness, and pragmatic programming, I've always thought that at this point of the technology evolution, we need not to configure too much to have our software run, having the software adapt to data layers and from there building up APIs, visualizations, etc. in an automatic way. This is a first step to have a schema driven API or better model drive, based on the underlining database, the data it has to serve and some sane dafults, or conventions. This effort also gives, thanks to meta programming, an insight on the actual schema, via the info API, the translations available and the DSL which can change the way the data is presented, leading to a strong base for automatica built of UIs consuming the API (react, vue, angular based PWAs, maybe! ;-) ).
 
-Doing this means also narrowing a bit the scope of the tools, taking decisions, at least for the first iteratons of the project, so, this works well if the data is relational, so this is a convention taken as a prerequisite (postgres, mysql, mssql, etc.).
+Doing this means also narrowing a bit the scope of the tools, taking decisions, at least for the first implementations and versions of this engine, so, this works well if the data is relational, this is a prerequisite (postgres, mysql, mssql, etc.).
 
 # Goal
 
-To have a comprehensive and meaningful API right out of the box by just creating migrations in your rails app.
+To have a comprehensive and meaningful API right out of the box by just creating migrations in your rails app or engine.
 
 # v2?
 
-Yes, the [v1](https://github.com/gabrieletassoni/thecore_api) was were it all started, many ideas are ported from there, but it was too coupled with thecore's rails_admin UI, making it impossible to create an UI-less, API only application, out of the box and directly from the DB schema, with all the bells and whistles I needed (mainly self adapting, data and schema driven API functionalities).
+Yes, this is the second version of such an effort and you can note it from the api calls, which are all under the ```/api/v2``` namespace the [/api/v1](https://github.com/gabrieletassoni/thecore_api) one, was were it all started, many ideas are ported from there, such as the generation of the automatic model based crud actions, as well as custom actions definitions and all the things that make also this gem useful for my daily job were already in place, but it was too coupled with [thecore](https://github.com/gabrieletassoni/thecore)'s [rails_admin](https://github.com/sferik/rails_admin) UI, making it impossible to create a complete UI-less, API only application, out of the box and directly based of the DB schema, with all the bells and whistles I needed (mainly self adapting, data and schema driven API functionalities).
+So it all began again, making a better thecore_api gem into this schema_based_api gem, more polished, more functional and self contained.
 
 # Standards Used
 
-* [JWT](https://medium.com/@billy.sf.cheng/a-rails-6-application-part-1-api-1ee5ccf7ed01) for authentication.
+* [JWT](https://github.com/jwt/ruby-jwt) for authentication.
 * [CanCanCan](https://github.com/CanCanCommunity/cancancan) for authorization.
 * [Active Hash Relation](https://github.com/kollegorna/active_hash_relation) for DSL.
 * [Ransack](https://github.com/activerecord-hackery/ransack) query engine for complex searches going beyond CRUD's listing scope.
 * Catch all routing rule to add basic crud operations to any AR model in the app.
 
-# TODO
-
-* Integrate Authorization within ```GET info/schema``` requests in order to send to the client just the models for which a user has authorization.
-
 ## Usage
 How to use my plugin.
 
@@ -53,11 +50,15 @@ This will setup a User model, Role model and the HABTM table between the two.
 Then, if you fire up your ```rails server``` you can already get a jwt and perform different operations.
 The default admin user created during the migration step has a randomly generated password you can find in a .passwords file in the root of your project, that's the initial password, in production you can replace that one, but for testing it proved handy to have it promptly available.
 
-If you want to manually test the API using [Insomnia](https://insomnia.rest/)
+## Testing
+
+If you want to manually test the API using [Insomnia](https://insomnia.rest/) I will publish in the repository the export for the chained requests I'm using.
+In the next few days, I'll publish also the rspec tests.
 
 ## References
 THanks to all these people for ideas:
 
+* [Billy Cheng](https://medium.com/@billy.sf.cheng/a-rails-6-application-part-1-api-1ee5ccf7ed01) For a way to have a nice and clean implementation of the JWT on top of Devise.
 * [Daniel](https://medium.com/@tdaniel/passing-refreshed-jwts-from-rails-api-using-headers-859f1cfe88e9) For a smart way to manage token expiration.
 
 ## License

data/app/commands/authenticate_user.rb

@@ -1,7 +1,7 @@
 class AuthenticateUser
     class AccessDenied < StandardError
         def message
-            "Cannot authenticate user."
+            "AuthenticationError"
         end
     end
     prepend SimpleCommand

data/app/controllers/api/v2/application_controller.rb

@@ -17,82 +17,15 @@ class Api::V2::ApplicationController < ActionController::API
         request.parameters
     end
     
-    # TODO: Remove when not needed
-    # def dispatcher
-    #     # This method is only valid for ActiveRecords
-    #     # For any other model-less controller, the actions must be 
-    #     # defined in the route, and must exist in the controller definition.
-    #     # So, if it's not an activerecord, the find model makes no sense at all.
-    #     path = params[:path].split("/")
-    #     # Default convention for the requests: :controller/:id/:custom_action
-    #     # or :controller/:custom_action.
-    #     # With the ID as an Integer
-    #     # TODO: Extend to understand nested resources maybe testing if the 
-    #     # third param is a AR model, that can have an ID, etc..
-    #     controller = path.first
-    #     id = path.second
-    #     custom_action = path.third
-    #     # managing 
-    #     if request.get?
-    #         if id.blank?
-    #             # @page = params[:page]
-    #             # @per = params[:per]
-    #             # @pages_info = params[:pages_info]
-    #             # @count = params[:count]
-    #             # @query = params[:q]
-    #             index
-    #         elsif id.to_i.zero?
-    #             # String, so it's a custom action I must find in the @model (as a singleton method)
-    #             # GET :controller/:custom_action
-    #             return not_found! unless @model.respond_to?(id)
-    #             return render json: MultiJson.dump(@model.send(id, params)), status: 200
-    #         elsif !id.to_i.zero? && custom_action.blank?
-    #             # Integer, so it's an ID, I must show it
-    #             @record_id =  id.to_i
-    #             find_record
-    #             show
-    #         elsif !id.to_i.zero? && !custom_action.blank?
-    #             # GET :controller/:id/:custom_action
-    #             return not_found! unless @model.respond_to?(custom_action)
-    #             return render json: MultiJson.dump(@model.send(custom_action, id.to_i, params)), status: 200
-    #         end
-    #     elsif request.post?
-    #         if id.blank?
-    #             # @params = params
-    #             create
-    #         elsif id.to_i.zero?
-    #             # POST :controller/:custom_action
-    #             return not_found! unless @model.respond_to?(id)
-    #             return render json: MultiJson.dump(@model.send(id, params)), status: 200
-    #         end
-    #     elsif request.put?
-    #         if !id.to_i.zero? && custom_action.blank?
-    #             # @params = params
-    #             # Rails.logger.debug "IL SECONDO è ID in PUT? #{path.second.inspect}"
-    #             # find_record path.second.to_i
-    #             @record_id =  id.to_i
-    #             find_record
-    #             update
-    #         elsif !id.to_i.zero? && !custom_action.blank?
-    #             # PUT :controller/:id/:custom_action
-    #             # puts "ANOTHER SECOND AND THIRD"
-    #             return not_found! unless @model.respond_to?(custom_action)
-    #             return render json: MultiJson.dump(@model.send(custom_action, id.to_i, params)), status: 200
-    #         end
-    #     elsif request.delete?
-    #         # Rails.logger.debug "IL SECONDO è ID in delete? #{path.second.inspect}"
-    #         # find_record path.second.to_i
-    #         @record_id =  id.to_i
-    #         find_record
-    #         destroy
-    #     end
-    # end
-    
     # GET :controller/
     def index
         authorize! :index, @model
-        # Rails.logger.debug params.inspect
-        # find the records
+
+        # Custom Action
+        status, result = check_for_custom_action
+        return render json: result, status: 200 if status == true
+
+        # Normal Index Action with Ransack querying
         @q = (@model.column_names.include?("user_id") ? @model.where(user_id: current_user.id) : @model).ransack(@query.presence|| params[:q])
         @records_all = @q.result(distinct: true)
         page = (@page.presence || params[:page])
@@ -119,7 +52,13 @@ class Api::V2::ApplicationController < ActionController::API
     end
     
     def show
-        authorize! :show, @record
+        authorize! :show, @record_id
+
+        # Custom Show Action
+        status, result = check_for_custom_action
+        return render json: result, status: 200 if status == true
+
+        # Normal Show
         result = @record.to_json(json_attrs)
         render json: result, status: 200
     end
@@ -127,32 +66,60 @@ class Api::V2::ApplicationController < ActionController::API
     def create
         @record = @model.new(@body)
         authorize! :create, @record
+
+        # Custom Action
+        status, result = check_for_custom_action
+        return render json: result, status: 200 if status == true
+
+        # Normal Create Action
         @record.user_id = current_user.id if @model.column_names.include? "user_id"
-        
         @record.save!
-        
         render json: @record.to_json(json_attrs), status: 201
     end
     
     def update
         authorize! :update, @record
+
+        # Custom Action
+        status, result = check_for_custom_action
+        return render json: result, status: 200 if status == true
+
+        # Normal Update Action
         @record.update_attributes!(@body)
-        
         render json: @record.to_json(json_attrs), status: 200
     end
     
     def destroy
         authorize! :destroy, @record
+
+        # Custom Action
+        status, result = check_for_custom_action
+        return render json: result, status: 200 if status == true
+
+        # Normal Destroy Action
         return api_error(status: 500) unless @record.destroy
         head :ok
     end
     
     private
+
+    def check_for_custom_action
+        ## CUSTOM ACTION
+        # [GET|PUT|POST|DELETE] :controller?do=:custom_action
+        # or
+        # [GET|PUT|POST|DELETE] :controller/:id?do=:custom_action
+        unless params[:do].blank?
+            raise NoMethodError unless @model.respond_to?(params[:do])
+            return true, MultiJson.dump(params[:id].blank? ? @model.send(params[:do], params) : @model.send(params[:do], params[:id].to_i, params))
+        end
+        # if it's here there is no custom action in the request querystring
+        return false
+    end
     
     def authenticate_request
         @current_user = AuthorizeApiRequest.call(request.headers).result
         return unauthenticated! unless @current_user
-        current_user = @current_user
+        params[:current_user] = current_user = @current_user
         # Now every time the user fires off a successful GET request, 
         # a new token is generated and passed to them, and the clock resets.
         response.headers['Token'] = JsonWebToken.encode(user_id: current_user.id)

data/app/controllers/api/v2/authentication_controller.rb

@@ -6,9 +6,7 @@ class Api::V2::AuthenticationController < ActionController::API
         
         if command.success?
             response.headers['Token'] = command.result
-            render json: { message: ["Login successful!"] }
-        else
-            render json: { error: command.errors }, status: :unauthorized
+            head :ok
         end
     end
     

data/lib/concerns/api_exception_management.rb

@@ -10,34 +10,25 @@ module ApiExceptionManagement
         rescue_from ActiveRecord::RecordInvalid, with: :invalid!
         rescue_from ActiveRecord::RecordNotFound, with: :not_found!
         
-        def unauthenticated! exception = StandardError.new
+        def unauthenticated! exception = AuthenticateUser::AccessDenied.new
             response.headers['WWW-Authenticate'] = "Token realm=Application"
-            api_error status: 401, errors: [I18n.t("api.errors.bad_credentials", default: "Bad Credentials"), exception.message]
+            return api_error status: 401, errors: exception.message
         end
         
-        def unauthorized! exception = StandardError.new
-            api_error status: 403, errors: [I18n.t("api.errors.unauthorized", default: "Unauthorized"), exception.message]
-            return
+        def unauthorized! exception = CanCan::AccessDenied.new
+            return api_error status: 403, errors: exception.message
         end
         
         def not_found! exception = StandardError.new
-            return api_error(status: 404, errors: [I18n.t("api.errors.not_found", default: "Not Found"), exception.message])
-        end
-        
-        def name_error!
-            api_error(status: 501, errors: [I18n.t("api.errors.name_error", default: "Name Error")])
-        end
-        
-        def no_method_error!
-            api_error(status: 501, errors: [I18n.t("api.errors.no_method_error", default: "No Method Error")])
+            return api_error status: 404, errors: exception.message
         end
         
         def invalid! exception = StandardError.new
-            api_error status: 422, errors: exception.record.errors
+            return api_error status: 422, errors: exception.record.errors 
         end
         
         def fivehundred! exception = StandardError.new
-            api_error status: 500, errors: [I18n.t("api.errors.fivehundred", default: "Internal Server Error"), exception.message]
+            return api_error status: 500, errors: exception.message
         end
         
         def api_error(status: 500, errors: [])

data/lib/schema_based_api/version.rb

@@ -1,3 +1,3 @@
 module SchemaBasedApi
-  VERSION = '2.1.13'
+  VERSION = '2.1.14'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: schema_based_api
 version: !ruby/object:Gem::Version
-  version: 2.1.13
+  version: 2.1.14
 platform: ruby
 authors:
 - Gabriele Tassoni
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-04-17 00:00:00.000000000 Z
+date: 2020-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -205,7 +205,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
 summary: Convention based RoR engine which uses DB schema introspection to create