wor-simple_crud 0.2.1 → 0.3.0

data/lib/simple_crud/rspec/helpers.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+module SimpleCrud
+  module RSpec
+    # Helpers available to the shared examples (and to apps that include
+    # them). Everything app-specific is delegated to SimpleCrud::RSpec::Config
+    # so it can be overridden without editing the examples.
+    module Helpers
+      def config
+        SimpleCrud::RSpec::Config.instance
+      end
+
+      def get_option(method, option)
+        described_class.instance_variable_get(:@simple_crud_metadata)[method][option]
+      end
+
+      # :unprocessable_entity was renamed :unprocessable_content in Rack 3.1.
+      # Resolve the current Rack's canonical symbol for 422.
+      def unprocessable_status
+        Rack::Utils::SYMBOL_TO_STATUS_CODE.invert[422]
+      end
+
+      %i[paginate authorize authenticate serializer html finder scope build raise_on_invalid].each do |option|
+        define_method("check_#{option}") { |method| get_option(method, option) }
+      end
+
+      %i[owner_association required_attribute required_error finder_key params_key invalid_status
+         unauthenticated_status assert_html_template].each do |setting|
+        define_method(setting) { resolve(config.public_send(setting)) }
+      end
+
+      def model_class
+        described_class.to_s.split('::')
+                       .last.sub('Controller', '').singularize.underscore
+      end
+
+      def model_class_object
+        model_class.classify.constantize
+      end
+
+      def model
+        @model ||= create_record(model_class, model_attributes)
+      end
+
+      def model_attributes
+        association = resolve(config.owner_association)
+        association ? { association => current_user } : {}
+      end
+
+      def create_record(klass, attributes)
+        instance_exec(klass, attributes, &config.create_record)
+      end
+
+      def create_records(klass, count, attributes)
+        instance_exec(klass, count, attributes, &config.create_records)
+      end
+
+      def params_for(klass)
+        instance_exec(klass, &config.params_for)
+      end
+
+      def model_params
+        @model_params ||= params_for(model_class)
+      end
+
+      def current_user
+        @current_user ||= instance_exec(&config.current_user)
+      end
+
+      def authenticate_request
+        instance_exec(&config.authenticate)
+      end
+
+      def owner_foreign_key
+        :"#{owner_association}_id"
+      end
+
+      # The owner association attributed to current_user, if the model has one.
+      def owner_params
+        owner_association ? { owner_foreign_key => current_user.id } : {}
+      end
+
+      # Extra params (e.g. a parent slug) added to every request, for nested
+      # resources like /classrooms/:classroom_slug/assignments.
+      def route_params
+        resolve(config.route_params)
+      end
+
+      def with_route_params(attrs)
+        route_params.merge(attrs)
+      end
+
+      # The params that identify a record for the given action, using the
+      # configured finder_key when the action has a custom finder.
+      def record_param(action, record, not_found: false)
+        key = check_finder(action) ? finder_key : :id
+        value = not_found ? "nonexistent-#{key}" : record.public_send(key)
+        { key => value }
+      end
+
+      # Wraps a request body under the model's strong-params key when
+      # params_key is configured (nested strong params), else passes it flat.
+      def body_params(attrs)
+        key = params_key
+        key ? { key => attrs } : attrs
+      end
+
+      def policy_class_object
+        instance_exec(model_class_object, &config.policy_class)
+      end
+
+      def model_serializer
+        defined?(serializer) ? serializer : instance_exec(model, &config.serializer_class)
+      end
+
+      def make_policies_fail(method)
+        allow(policy_class_object).to receive(:new)
+          .and_return(instance_double(policy_class_object, "#{method}?" => false))
+      end
+
+      def make_policies_succeed(method)
+        allow(policy_class_object).to receive(:new)
+          .and_return(instance_double(policy_class_object, "#{method}?" => true))
+      end
+
+      def request_format(action)
+        check_html(action) ? :html : :json
+      end
+
+      def resolve(value)
+        value.is_a?(Proc) ? instance_exec(&value) : value
+      end
+
+      # Runs the block with a config setting temporarily overridden, restoring
+      # the original value afterwards (even if the block raises). Useful when
+      # a controller's spec needs a different setting than the app-wide default.
+      def with_config_override(setting, value)
+        config_instance = SimpleCrud::RSpec::Config.instance
+        original = config_instance.public_send(setting)
+        SimpleCrud::RSpec.configure { |c| c.public_send("#{setting}=", value) }
+        yield
+      ensure
+        SimpleCrud::RSpec.configure { |c| c.public_send("#{setting}=", original) }
+      end
+    end
+  end
+end

data/lib/simple_crud/rspec.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'rspec/config'
+require_relative 'rspec/helpers'
 require_relative '../spec/response_helper'
 require_relative '../spec/shared_contexts/authenticate_user'
 require_relative '../spec/shared_examples/simple_crud_for_update'
@@ -7,5 +9,37 @@ require_relative '../spec/shared_examples/simple_crud_for_show'
 require_relative '../spec/shared_examples/simple_crud_for_index'
 require_relative '../spec/shared_examples/simple_crud_for_destroy'
 require_relative '../spec/shared_examples/simple_crud_for_create'
+require_relative '../spec/shared_examples/simple_crud_for_new'
 require_relative '../spec/shared_examples/unauthorized_when_not_logged_in'
+require_relative '../spec/shared_examples/simple_crud_renders_template'
+require_relative '../spec/shared_examples/simple_crud_without_authenticated_user'
+require_relative '../spec/shared_examples/simple_crud_when_not_authorized'
+require_relative '../spec/shared_examples/simple_crud_for_index_with_block'
+require_relative '../spec/shared_examples/simple_crud_for_index_with_scope'
+require_relative '../spec/shared_examples/simple_crud_for_show_with_block'
+require_relative '../spec/shared_examples/simple_crud_for_new_with_block'
+require_relative '../spec/shared_examples/simple_crud_for_create_with_block'
+require_relative '../spec/shared_examples/simple_crud_for_destroy_with_block'
+require_relative '../spec/shared_examples/simple_crud_for_show_with_finder'
+require_relative '../spec/shared_examples/simple_crud_for_update_with_finder'
+require_relative '../spec/shared_examples/simple_crud_for_destroy_with_finder'
+require_relative '../spec/shared_examples/simple_crud_not_found_with_finder'
+require_relative '../spec/shared_examples/simple_crud_for_new_with_build'
+require_relative '../spec/shared_examples/simple_crud_for_create_with_build'
+require_relative '../spec/shared_examples/authorization_adapter_authorize'
 require_relative '../spec/matchers/have_been_serialized_with'
+
+module SimpleCrud
+  # Opt-in wiring for the shared examples: see .install!
+  module RSpec
+    # Opt-in wiring: call from your spec support after requiring this file.
+    # extend wires definition-time helpers (check_html...), include runtime ones (model...).
+    def self.install!
+      ::RSpec.configure do |config|
+        config.extend Helpers
+        config.include Helpers
+        config.include Response::JSONParser, type: :controller
+      end
+    end
+  end
+end

data/lib/simple_crud/simple_crud_controller.rb

@@ -2,9 +2,12 @@
 
 require 'active_support/all'
 require_relative 'config'
+require_relative 'controller_helpers'
 
 # Extended onto a controller for CRUD actions.
 module SimpleCrudController
+  extend SimpleCrud::ControllerHelpers
+
   cattr_accessor :params, :permitted
 
   # Possible options:
@@ -12,21 +15,30 @@ module SimpleCrudController
   ### paginate: paginate the list via Config.pagination_adapter (wor-paginate by default)
   ### authenticate: use devise to authenticate
   ### serializer: use a particular serializer (both each_serializer and serializer)
-  def simple_crud_for(method, parameters = {})
+  ### html: render the action's ERB template instead of JSON (index/show/new/create/update/destroy)
+  ### finder: custom record lookup (Proc/lambda or Symbol) for :show/:update/:destroy
+  ### scope: custom index scope (Proc/lambda taking current_user and optional params), overrides policy_scope
+  ### build: custom record builder (Proc/lambda) for :new/:create, invoked with the controller as self
+  ### raise_on_invalid: use strict create!/update! semantics instead of returning 422
+  ### A block given to simple_crud_for renders explicitly: it receives the records for :index,
+  ### the record for :show/:new, or the record and a saved flag for :create/:update/:destroy
+  def simple_crud_for(method, parameters = {}, &block)
+    parameters[:html] = true if block && !parameters.key?(:html)
     parameters = parameters_with_defaults(parameters)
     klass = simple_crud_controller_model
     check_valid_method(method)
     check_policies(parameters)
     check_serializer(parameters)
-    define_method(method, send("crud_lambda_for_#{method}", klass, parameters))
+    define_method(method, send("crud_lambda_for_#{method}", klass, parameters, &block))
     write_metadata(method, parameters)
   end
 
   def parameters_with_defaults(parameters)
-    defaults = { authorize: true, paginate: true, authenticate: true, serializer: nil }
-    defaults.each do |key, value|
-      parameters[key] = value unless parameters.key?(key)
-    end
+    defaults = {
+      authorize: true, paginate: true, authenticate: true, serializer: nil,
+      html: false, finder: nil, scope: nil, build: nil, raise_on_invalid: false
+    }
+    defaults.each { |key, value| parameters[key] = value unless parameters.key?(key) }
     parameters
   end
 
@@ -35,65 +47,68 @@ module SimpleCrudController
     @simple_crud_metadata[method] = parameters
   end
 
-  def self.maybe_authorize(controller, record, parameters)
-    return unless parameters[:authorize] && parameters[:authenticate]
-
-    SimpleCrud::Config.authorization_adapter.authorize(controller, record)
-  end
-
-  def crud_lambda_for_show(klass, parameters = {})
+  def crud_lambda_for_show(klass, parameters = {}, &block)
     lambda do
       authenticate_user! if parameters[:authenticate]
-      requested = klass.find(params[:id])
+      requested = SimpleCrudController.find_record(klass, self, parameters)
 
       options = {}.merge(serializer: parameters[:serializer]).compact
       SimpleCrudController.maybe_authorize(self, requested, parameters)
-      render({ json: requested }.merge(options))
+      SimpleCrudController.render_show(self, requested, options, parameters, &block)
     end
   end
 
-  def crud_lambda_for_index(klass, parameters = {})
+  def crud_lambda_for_new(klass, parameters = {}, &block)
     lambda do
       authenticate_user! if parameters[:authenticate]
-      SimpleCrudController.maybe_authorize(self, klass.new, parameters)
-      options = {}.merge(each_serializer: parameters[:serializer]).compact
-      SimpleCrudController.render_index(self, klass, options, parameters)
+      record = SimpleCrudController.build_record(self, klass, parameters)
+      SimpleCrudController.maybe_authorize(self, record, parameters)
+      SimpleCrudController.render_new(self, record, parameters, &block)
     end
   end
 
-  def self.render_index(controller, klass, options, parameters)
-    if parameters[:paginate]
-      SimpleCrud::Config.pagination_adapter.paginate(controller, klass, options)
-    else
-      controller.render({ json: klass.all }.merge(options))
+  def crud_lambda_for_index(klass, parameters = {}, &block)
+    lambda do
+      authenticate_user! if parameters[:authenticate]
+      SimpleCrudController.maybe_authorize(self, klass.new, parameters)
+      options = {}.merge(each_serializer: parameters[:serializer]).compact
+      SimpleCrudController.render_index(self, klass, options, parameters, &block)
     end
   end
 
-  def crud_lambda_for_create(klass, parameters = {})
+  def crud_lambda_for_create(klass, parameters = {}, &block)
     lambda do
       authenticate_user! if parameters[:authenticate]
       permitted_params = send("#{self.class.simple_crud_controller_model.to_s.underscore}_params")
-      SimpleCrudController.maybe_authorize(self, klass.new(permitted_params), parameters)
-      render json: klass.create!(permitted_params), status: :created
+      record = SimpleCrudController.build_record(self, klass, parameters)
+      record.assign_attributes(permitted_params)
+      SimpleCrudController.maybe_authorize(self, record, parameters)
+      persist = ->(bang:) { bang ? record.save! : record.save }
+      options = { status: :created, failure_template: :new }
+      SimpleCrudController.save_and_render(self, record, parameters, options, persist, &block)
     end
   end
 
-  def crud_lambda_for_update(klass, parameters = {})
+  def crud_lambda_for_update(klass, parameters = {}, &block)
     lambda do
       authenticate_user! if parameters[:authenticate]
-      requested = klass.find(params[:id])
+      requested = SimpleCrudController.find_record(klass, self, parameters)
       SimpleCrudController.maybe_authorize(self, requested, parameters)
       permitted_params = send("#{self.class.simple_crud_controller_model.to_s.underscore}_params")
-      render json: requested.update!(permitted_params)
+      persist = ->(bang:) { bang ? requested.update!(permitted_params) : requested.update(permitted_params) }
+      options = { status: :ok, failure_template: :edit }
+      SimpleCrudController.save_and_render(self, requested, parameters, options, persist, &block)
     end
   end
 
-  def crud_lambda_for_destroy(klass, parameters = {})
+  def crud_lambda_for_destroy(klass, parameters = {}, &block)
     lambda do
       authenticate_user! if parameters[:authenticate]
-      requested = klass.find(params[:id])
+      requested = SimpleCrudController.find_record(klass, self, parameters)
       SimpleCrudController.maybe_authorize(self, requested, parameters)
-      render json: klass.find(params[:id]).destroy
+      options = { status: :ok, failure_template: :show, redirect: parameters[:redirect] || klass }
+      persist = ->(bang:) { bang ? requested.destroy! : requested.destroy }
+      SimpleCrudController.persist_and_render(self, requested, parameters, options, persist, &block)
     end
   end
 
@@ -102,7 +117,7 @@ module SimpleCrudController
   end
 
   def check_valid_method(method)
-    throw 'invalid method' unless %i[show index create update destroy].include? method
+    raise ArgumentError, 'invalid method' unless %i[show index create update destroy new].include? method
   end
 
   def check_policies(parameters)
@@ -111,7 +126,7 @@ module SimpleCrudController
     model = simple_crud_controller_model
     return if SimpleCrud::Config.authorization_adapter.policy_defined?(model)
 
-    throw "no authorization policy configured for #{model}"
+    raise ArgumentError, "no authorization policy configured for #{model}"
   end
 
   def check_serializer(parameters)
@@ -120,6 +135,6 @@ module SimpleCrudController
     serializer_name = parameters[:serializer].to_s
     return if Kernel.const_defined?(serializer_name)
 
-    throw "create a valid serializer with name #{serializer_name}"
+    raise ArgumentError, "create a valid serializer with name #{serializer_name}"
   end
 end

data/lib/simple_crud/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SimpleCrud
-  VERSION = '0.2.1'
+  VERSION = '0.3.0'
 end

data/lib/spec/shared_contexts/authenticate_user.rb

@@ -1,11 +1,5 @@
 # frozen_string_literal: true
 
 RSpec.shared_context 'with authenticated user' do
-  let(:current_user) { create(:user) }
-
-  before do
-    headers = { 'Accept' => 'application/json', 'Content-Type' => 'application/json' }
-    auth_headers = Devise::JWT::TestHelpers.auth_headers(headers, current_user)
-    request.headers.merge!(auth_headers)
-  end
+  before { authenticate_request }
 end

data/lib/spec/shared_examples/authorization_adapter_authorize.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+shared_examples 'authorization adapter #authorize' do |record_class, denied_error|
+  it 'passes for a record the adapter allows' do
+    expect { adapter.authorize(controller, record_class.new(1)) }.not_to raise_error
+  end
+
+  it 'raises for a record the adapter denies' do
+    expect { adapter.authorize(controller, record_class.new(2)) }.to raise_error(denied_error)
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_create.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require_relative 'helpers'
-
 shared_examples 'simple crud for create' do
   describe 'POST #create' do
     context 'without authenticated user' do
-      subject!(:req) { post :create, params: attributes_for(model_class) }
+      subject!(:req) do
+        post :create, params: with_route_params(body_params(params_for(model_class))), format: request_format(:create)
+      end
 
       include_examples 'unauthorized when not logged in' if check_authenticate(:create)
     end
@@ -16,7 +16,7 @@ shared_examples 'simple crud for create' do
 
         before do
           make_policies_fail(:create)
-          post :create, params: model_params
+          post :create, params: with_route_params(body_params(model_params)), format: request_format(:create)
         end
 
         it 'fails with forbidden' do
@@ -27,22 +27,54 @@ shared_examples 'simple crud for create' do
 
     context 'when successfully creating an article' do
       include_context 'with authenticated user' if check_authenticate(:create)
-      let(:create_params) { model_params.merge(user_id: current_user.id) }
+      let(:create_params) { model_params.merge(owner_params) }
 
       before do
-        post :create, params: create_params
+        post :create, params: with_route_params(body_params(create_params)), format: request_format(:create)
       end
 
-      it 'response with 200 status code' do
-        expect(response).to have_http_status(:created)
+      if check_html(:create)
+        it 'redirects to the created record' do
+          expect(response).to have_http_status(:found)
+        end
+      else
+        it 'response with 201 status code' do
+          expect(response).to have_http_status(:created)
+        end
+
+        it 'creates an article with valid attributes' do
+          expect(model_class_object.last).to have_attributes(create_params)
+        end
       end
 
-      it 'creates an article' do
+      it 'creates the record' do
         expect(model_class_object.count).to be 1
       end
+    end
 
-      it 'creates an article with valid attributes' do
-        expect(model_class_object.last).to have_attributes(create_params)
+    unless check_raise_on_invalid(:create)
+      context 'when creating with invalid attributes' do
+        include_context 'with authenticated user' if check_authenticate(:create)
+
+        before do
+          post :create, params: with_route_params(body_params(owner_params)), format: request_format(:create)
+        end
+
+        if check_html(:create)
+          include_examples 'simple crud renders template', :new, -> { invalid_status }
+        else
+          it 'responds with unprocessable entity' do
+            expect(response).to have_http_status(unprocessable_status)
+          end
+
+          it 'returns the validation errors' do
+            expect(response_body['errors']).to include(required_error)
+          end
+
+          it 'does not create a model' do
+            expect(model_class_object.count).to be 0
+          end
+        end
       end
     end
   end

data/lib/spec/shared_examples/simple_crud_for_create_with_block.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+shared_examples 'simple crud for create with block' do
+  describe 'POST #create with a render block' do
+    it 'passes the saved record to the block' do
+      post :create, params: with_route_params(body_params({ name: 'Blocked' }.merge(owner_params)))
+
+      expect(response.parsed_body).to include('saved' => true)
+    end
+
+    it 'passes the failed record to the block', :aggregate_failures do
+      post :create, params: with_route_params(body_params(owner_params))
+
+      expect(response).to have_http_status(422)
+      expect(response.parsed_body).to include('saved' => false)
+    end
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_create_with_build.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+shared_examples 'simple crud for create with build' do
+  describe 'POST #create with a build hook' do
+    include_context 'with authenticated user'
+
+    before do
+      post :create, params: with_route_params(body_params({ name: 'Built' }))
+    end
+
+    it 'creates the record owned by the current user' do
+      expect(model_class_object.last.public_send(owner_association)).to eq(current_user)
+    end
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_destroy.rb

@@ -3,7 +3,10 @@
 shared_examples 'simple crud for destroy' do
   describe 'DELETE #destroy' do
     context 'without authenticated user' do
-      subject!(:req) { delete :destroy, params: { id: 1 } }
+      subject!(:req) do
+        delete :destroy, params: with_route_params(record_param(:destroy, nil, not_found: true)),
+                         format: request_format(:destroy)
+      end
 
       include_examples 'unauthorized when not logged in' if check_authenticate(:destroy)
     end
@@ -14,7 +17,7 @@ shared_examples 'simple crud for destroy' do
 
         before do
           make_policies_fail(:destroy)
-          delete :destroy, params: { id: model.id }
+          delete :destroy, params: with_route_params(record_param(:destroy, model)), format: request_format(:destroy)
         end
 
         it 'fails with forbidden' do
@@ -28,11 +31,18 @@ shared_examples 'simple crud for destroy' do
 
       before do
         model
-        delete :destroy, params: { id: model.id }
+        delete :destroy, params: with_route_params(record_param(:destroy, model)), format: request_format(:destroy)
       end
 
-      it 'response with 200 status code' do
-        expect(response).to have_http_status(:ok)
+      if check_html(:destroy)
+        it 'redirects to the collection and destroys the record', :aggregate_failures do
+          expect(response).to have_http_status(:found)
+          expect(model_class_object.exists?(model.id)).to be false
+        end
+      else
+        it 'response with 200 status code' do
+          expect(response).to have_http_status(:ok)
+        end
       end
     end
 
@@ -41,7 +51,8 @@ shared_examples 'simple crud for destroy' do
 
       before do
         model
-        delete :destroy, params: { id: model.id + 13 }
+        delete :destroy, params: with_route_params(record_param(:destroy, nil, not_found: true)),
+                         format: request_format(:destroy)
       end
 
       it 'responds with not found status' do
@@ -56,10 +67,10 @@ shared_examples 'simple crud for destroy' do
         before do
           model
           make_policies_fail(:destroy)
-          delete :destroy, params: { id: model.id }
+          delete :destroy, params: with_route_params(record_param(:destroy, model)), format: request_format(:destroy)
         end
 
-        it 'response with 200 status code' do
+        it 'responds with forbidden status' do
           expect(response).to have_http_status(:forbidden)
         end
       end

data/lib/spec/shared_examples/simple_crud_for_destroy_with_block.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+shared_examples 'simple crud for destroy with block' do
+  describe 'DELETE #destroy with a render block' do
+    let!(:record) { model }
+
+    before { delete :destroy, params: with_route_params({ id: record.id }) }
+
+    it 'passes the destroyed record to the block' do
+      expect(response.parsed_body).to eq('destroyed' => true)
+    end
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_destroy_with_finder.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+shared_examples 'simple crud for destroy with finder' do
+  describe 'DELETE #destroy with a custom finder' do
+    include_context 'with authenticated user'
+
+    context 'when the model exists' do
+      before do
+        model
+        delete :destroy, params: with_route_params(finder_key => model.public_send(finder_key))
+      end
+
+      it 'responds with ok status' do
+        expect(response).to have_http_status(:ok)
+      end
+
+      it 'destroys the model' do
+        expect(model_class_object.exists?(model.id)).to be false
+      end
+    end
+
+    include_examples 'simple crud not found with finder', :delete, :destroy
+  end
+end