wor-simple_crud 0.3.0 → 0.4.0

data/lib/simple_crud/rspec/helpers/requests.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module SimpleCrud
+  module RSpec
+    module Helpers
+      # Request params and format helpers shared by every action example.
+      module Requests
+        # :unprocessable_entity was renamed :unprocessable_content in Rack 3.1.
+        # Resolve the current Rack's canonical symbol for 422.
+        def unprocessable_status
+          Rack::Utils::SYMBOL_TO_STATUS_CODE.invert[422]
+        end
+
+        def request_format(action)
+          check_html(action) ? :html : :json
+        end
+
+        # Extra params (e.g. a parent slug) added to every request, for nested
+        # resources like /projects/:project_slug/tasks.
+        def route_params
+          resolve(setting(:route_params))
+        end
+
+        def with_route_params(attrs)
+          route_params.merge(attrs)
+        end
+
+        # The params that identify a record for the given action, using the
+        # configured finder_key when the action has a custom finder.
+        def record_param(action, record, not_found: false)
+          key = check_finder(action) ? finder_key : :id
+          value = not_found ? "nonexistent-#{key}" : record.public_send(key)
+          { key => value }
+        end
+
+        # Wraps a request body under the model's strong-params key when
+        # params_key is configured (nested strong params), else passes it flat.
+        def body_params(attrs)
+          key = params_key
+          key ? { key => attrs } : attrs
+        end
+      end
+    end
+  end
+end

data/lib/simple_crud/rspec/helpers/settings.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module SimpleCrud
+  module RSpec
+    module Helpers
+      # Settings resolution: `simple_crud:` example-group metadata first,
+      # falling back to the app-wide SimpleCrud::RSpec::Config singleton.
+      module Settings
+        def config
+          SimpleCrud::RSpec::Config.instance
+        end
+
+        def simple_crud_settings
+          source = ::RSpec.current_example ? ::RSpec.current_example.metadata : metadata
+          source[:simple_crud] || {}
+        end
+
+        def setting(name)
+          simple_crud_settings.fetch(name) { config.public_send(name) }
+        end
+
+        def resolve(value)
+          value.is_a?(Proc) ? instance_exec(&value) : value
+        end
+
+        %i[owner_association required_attribute required_error finder_key params_key invalid_status
+           unauthenticated_status assert_html_template scoped_attributes other_scoped_attributes].each do |name|
+          define_method(name) { resolve(setting(name)) }
+        end
+
+        def created_record_check
+          setting(:created_record_check)
+        end
+
+        # Runs the block with a config setting temporarily overridden, restoring
+        # the original value afterwards (even if the block raises). Useful when
+        # a controller's spec needs a different setting than the app-wide default.
+        def with_config_override(setting, value)
+          config_instance = SimpleCrud::RSpec::Config.instance
+          original = config_instance.public_send(setting)
+          SimpleCrud::RSpec.configure { |c| c.public_send("#{setting}=", value) }
+          yield
+        ensure
+          SimpleCrud::RSpec.configure { |c| c.public_send("#{setting}=", original) }
+        end
+      end
+    end
+  end
+end

data/lib/simple_crud/rspec/helpers.rb

@@ -1,147 +1,25 @@
 # frozen_string_literal: true
 
+require_relative 'helpers/settings'
+require_relative 'helpers/controller_options'
+require_relative 'helpers/models'
+require_relative 'helpers/authentication'
+require_relative 'helpers/requests'
+require_relative 'helpers/policies'
+
 module SimpleCrud
   module RSpec
     # Helpers available to the shared examples (and to apps that include
-    # them). Everything app-specific is delegated to SimpleCrud::RSpec::Config
-    # so it can be overridden without editing the examples.
+    # them), composed from focused sub-modules: settings resolution,
+    # controller-option introspection, record building, authentication,
+    # request params and policy access.
     module Helpers
-      def config
-        SimpleCrud::RSpec::Config.instance
-      end
-
-      def get_option(method, option)
-        described_class.instance_variable_get(:@simple_crud_metadata)[method][option]
-      end
-
-      # :unprocessable_entity was renamed :unprocessable_content in Rack 3.1.
-      # Resolve the current Rack's canonical symbol for 422.
-      def unprocessable_status
-        Rack::Utils::SYMBOL_TO_STATUS_CODE.invert[422]
-      end
-
-      %i[paginate authorize authenticate serializer html finder scope build raise_on_invalid].each do |option|
-        define_method("check_#{option}") { |method| get_option(method, option) }
-      end
-
-      %i[owner_association required_attribute required_error finder_key params_key invalid_status
-         unauthenticated_status assert_html_template].each do |setting|
-        define_method(setting) { resolve(config.public_send(setting)) }
-      end
-
-      def model_class
-        described_class.to_s.split('::')
-                       .last.sub('Controller', '').singularize.underscore
-      end
-
-      def model_class_object
-        model_class.classify.constantize
-      end
-
-      def model
-        @model ||= create_record(model_class, model_attributes)
-      end
-
-      def model_attributes
-        association = resolve(config.owner_association)
-        association ? { association => current_user } : {}
-      end
-
-      def create_record(klass, attributes)
-        instance_exec(klass, attributes, &config.create_record)
-      end
-
-      def create_records(klass, count, attributes)
-        instance_exec(klass, count, attributes, &config.create_records)
-      end
-
-      def params_for(klass)
-        instance_exec(klass, &config.params_for)
-      end
-
-      def model_params
-        @model_params ||= params_for(model_class)
-      end
-
-      def current_user
-        @current_user ||= instance_exec(&config.current_user)
-      end
-
-      def authenticate_request
-        instance_exec(&config.authenticate)
-      end
-
-      def owner_foreign_key
-        :"#{owner_association}_id"
-      end
-
-      # The owner association attributed to current_user, if the model has one.
-      def owner_params
-        owner_association ? { owner_foreign_key => current_user.id } : {}
-      end
-
-      # Extra params (e.g. a parent slug) added to every request, for nested
-      # resources like /classrooms/:classroom_slug/assignments.
-      def route_params
-        resolve(config.route_params)
-      end
-
-      def with_route_params(attrs)
-        route_params.merge(attrs)
-      end
-
-      # The params that identify a record for the given action, using the
-      # configured finder_key when the action has a custom finder.
-      def record_param(action, record, not_found: false)
-        key = check_finder(action) ? finder_key : :id
-        value = not_found ? "nonexistent-#{key}" : record.public_send(key)
-        { key => value }
-      end
-
-      # Wraps a request body under the model's strong-params key when
-      # params_key is configured (nested strong params), else passes it flat.
-      def body_params(attrs)
-        key = params_key
-        key ? { key => attrs } : attrs
-      end
-
-      def policy_class_object
-        instance_exec(model_class_object, &config.policy_class)
-      end
-
-      def model_serializer
-        defined?(serializer) ? serializer : instance_exec(model, &config.serializer_class)
-      end
-
-      def make_policies_fail(method)
-        allow(policy_class_object).to receive(:new)
-          .and_return(instance_double(policy_class_object, "#{method}?" => false))
-      end
-
-      def make_policies_succeed(method)
-        allow(policy_class_object).to receive(:new)
-          .and_return(instance_double(policy_class_object, "#{method}?" => true))
-      end
-
-      def request_format(action)
-        check_html(action) ? :html : :json
-      end
-
-      def resolve(value)
-        value.is_a?(Proc) ? instance_exec(&value) : value
-      end
-
-      # Runs the block with a config setting temporarily overridden, restoring
-      # the original value afterwards (even if the block raises). Useful when
-      # a controller's spec needs a different setting than the app-wide default.
-      def with_config_override(setting, value)
-        config_instance = SimpleCrud::RSpec::Config.instance
-        original = config_instance.public_send(setting)
-        SimpleCrud::RSpec.configure { |c| c.public_send("#{setting}=", value) }
-        yield
-      ensure
-        SimpleCrud::RSpec.configure { |c| c.public_send("#{setting}=", original) }
-      end
+      include Settings
+      include ControllerOptions
+      include Models
+      include Authentication
+      include Requests
+      include Policies
     end
   end
 end

data/lib/simple_crud/rspec.rb

@@ -10,6 +10,7 @@ require_relative '../spec/shared_examples/simple_crud_for_index'
 require_relative '../spec/shared_examples/simple_crud_for_destroy'
 require_relative '../spec/shared_examples/simple_crud_for_create'
 require_relative '../spec/shared_examples/simple_crud_for_new'
+require_relative '../spec/shared_examples/simple_crud_for_edit'
 require_relative '../spec/shared_examples/unauthorized_when_not_logged_in'
 require_relative '../spec/shared_examples/simple_crud_renders_template'
 require_relative '../spec/shared_examples/simple_crud_without_authenticated_user'

data/lib/simple_crud/simple_crud_controller.rb

@@ -3,27 +3,30 @@
 require 'active_support/all'
 require_relative 'config'
 require_relative 'controller_helpers'
+require_relative 'action_lambdas'
 
 # Extended onto a controller for CRUD actions.
 module SimpleCrudController
   extend SimpleCrud::ControllerHelpers
-
-  cattr_accessor :params, :permitted
+  # Include, not extend: controllers gain these by extending SimpleCrudController.
+  include SimpleCrud::ActionLambdas
 
   # Possible options:
   ### authorize: check authorization via Config.authorization_adapter (Pundit by default)
   ### paginate: paginate the list via Config.pagination_adapter (wor-paginate by default)
-  ### authenticate: use devise to authenticate
+  ### authenticate: true calls authenticate_user! inside the action lambda; false skips it
+  ### authenticate_headers: whether shared examples set auth headers and run the unauthorized
+  ###   test (defaults to authenticate:); set independently when a base-controller before_action handles auth
   ### serializer: use a particular serializer (both each_serializer and serializer)
-  ### html: render the action's ERB template instead of JSON (index/show/new/create/update/destroy)
-  ### finder: custom record lookup (Proc/lambda or Symbol) for :show/:update/:destroy
+  ### html: render the action's ERB template instead of JSON (index/show/new/edit/create/update/destroy)
+  ### finder: custom record lookup (Proc/lambda or Symbol) for :show/:update/:destroy/:edit
   ### scope: custom index scope (Proc/lambda taking current_user and optional params), overrides policy_scope
   ### build: custom record builder (Proc/lambda) for :new/:create, invoked with the controller as self
   ### raise_on_invalid: use strict create!/update! semantics instead of returning 422
   ### A block given to simple_crud_for renders explicitly: it receives the records for :index,
-  ### the record for :show/:new, or the record and a saved flag for :create/:update/:destroy
+  ### the record for :show/:new/:edit, or the record and a saved flag for :create/:update/:destroy
   def simple_crud_for(method, parameters = {}, &block)
-    parameters[:html] = true if block && !parameters.key?(:html)
+    parameters[:block] = true if block
     parameters = parameters_with_defaults(parameters)
     klass = simple_crud_controller_model
     check_valid_method(method)
@@ -33,83 +36,34 @@ module SimpleCrudController
     write_metadata(method, parameters)
   end
 
-  def parameters_with_defaults(parameters)
-    defaults = {
-      authorize: true, paginate: true, authenticate: true, serializer: nil,
-      html: false, finder: nil, scope: nil, build: nil, raise_on_invalid: false
-    }
-    defaults.each { |key, value| parameters[key] = value unless parameters.key?(key) }
-    parameters
-  end
-
-  def write_metadata(method, parameters)
-    @simple_crud_metadata ||= {}
-    @simple_crud_metadata[method] = parameters
-  end
-
-  def crud_lambda_for_show(klass, parameters = {}, &block)
-    lambda do
-      authenticate_user! if parameters[:authenticate]
-      requested = SimpleCrudController.find_record(klass, self, parameters)
-
-      options = {}.merge(serializer: parameters[:serializer]).compact
-      SimpleCrudController.maybe_authorize(self, requested, parameters)
-      SimpleCrudController.render_show(self, requested, options, parameters, &block)
-    end
-  end
-
-  def crud_lambda_for_new(klass, parameters = {}, &block)
-    lambda do
-      authenticate_user! if parameters[:authenticate]
-      record = SimpleCrudController.build_record(self, klass, parameters)
-      SimpleCrudController.maybe_authorize(self, record, parameters)
-      SimpleCrudController.render_new(self, record, parameters, &block)
-    end
+  def simple_crud_defaults(options = {})
+    @simple_crud_defaults = simple_crud_inherited_defaults.merge(options)
   end
 
-  def crud_lambda_for_index(klass, parameters = {}, &block)
-    lambda do
-      authenticate_user! if parameters[:authenticate]
-      SimpleCrudController.maybe_authorize(self, klass.new, parameters)
-      options = {}.merge(each_serializer: parameters[:serializer]).compact
-      SimpleCrudController.render_index(self, klass, options, parameters, &block)
-    end
-  end
+  def simple_crud_inherited_defaults
+    ancestors.each do |ancestor|
+      next unless ancestor.instance_variable_defined?(:@simple_crud_defaults)
 
-  def crud_lambda_for_create(klass, parameters = {}, &block)
-    lambda do
-      authenticate_user! if parameters[:authenticate]
-      permitted_params = send("#{self.class.simple_crud_controller_model.to_s.underscore}_params")
-      record = SimpleCrudController.build_record(self, klass, parameters)
-      record.assign_attributes(permitted_params)
-      SimpleCrudController.maybe_authorize(self, record, parameters)
-      persist = ->(bang:) { bang ? record.save! : record.save }
-      options = { status: :created, failure_template: :new }
-      SimpleCrudController.save_and_render(self, record, parameters, options, persist, &block)
+      return ancestor.instance_variable_get(:@simple_crud_defaults)
     end
+    {}
   end
 
-  def crud_lambda_for_update(klass, parameters = {}, &block)
-    lambda do
-      authenticate_user! if parameters[:authenticate]
-      requested = SimpleCrudController.find_record(klass, self, parameters)
-      SimpleCrudController.maybe_authorize(self, requested, parameters)
-      permitted_params = send("#{self.class.simple_crud_controller_model.to_s.underscore}_params")
-      persist = ->(bang:) { bang ? requested.update!(permitted_params) : requested.update(permitted_params) }
-      options = { status: :ok, failure_template: :edit }
-      SimpleCrudController.save_and_render(self, requested, parameters, options, persist, &block)
+  def parameters_with_defaults(parameters)
+    defaults = {
+      authorize: true, paginate: true, authenticate: true, authenticate_headers: nil,
+      serializer: nil, html: false, finder: nil, scope: nil, build: nil, raise_on_invalid: false
+    }
+    defaults.merge(simple_crud_inherited_defaults).each do |key, value|
+      parameters[key] = value unless parameters.key?(key)
     end
+    parameters[:authenticate_headers] = parameters[:authenticate] if parameters[:authenticate_headers].nil?
+    parameters
   end
 
-  def crud_lambda_for_destroy(klass, parameters = {}, &block)
-    lambda do
-      authenticate_user! if parameters[:authenticate]
-      requested = SimpleCrudController.find_record(klass, self, parameters)
-      SimpleCrudController.maybe_authorize(self, requested, parameters)
-      options = { status: :ok, failure_template: :show, redirect: parameters[:redirect] || klass }
-      persist = ->(bang:) { bang ? requested.destroy! : requested.destroy }
-      SimpleCrudController.persist_and_render(self, requested, parameters, options, persist, &block)
-    end
+  def write_metadata(method, parameters)
+    @simple_crud_metadata ||= {}
+    @simple_crud_metadata[method] = parameters
   end
 
   def simple_crud_controller_model
@@ -117,7 +71,7 @@ module SimpleCrudController
   end
 
   def check_valid_method(method)
-    raise ArgumentError, 'invalid method' unless %i[show index create update destroy new].include? method
+    raise ArgumentError, 'invalid method' unless %i[show index create update destroy new edit].include? method
   end
 
   def check_policies(parameters)
@@ -130,11 +84,9 @@ module SimpleCrudController
   end
 
   def check_serializer(parameters)
-    return if parameters[:serializer].blank?
-
-    serializer_name = parameters[:serializer].to_s
-    return if Kernel.const_defined?(serializer_name)
+    name = parameters[:serializer].to_s
+    return if name.blank? || Kernel.const_defined?(name)
 
-    raise ArgumentError, "create a valid serializer with name #{serializer_name}"
+    raise ArgumentError, "create a valid serializer with name #{name}"
   end
 end

data/lib/simple_crud/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SimpleCrud
-  VERSION = '0.3.0'
+  VERSION = '0.4.0'
 end

data/lib/simple_crud.rb

@@ -2,6 +2,7 @@
 
 require_relative 'simple_crud/version'
 require_relative 'simple_crud/config'
+require_relative 'simple_crud/authorization/adapter'
 require_relative 'simple_crud/simple_crud_controller'
 
 # Simplified CRUD endpoints for Rails API controllers.

data/lib/spec/shared_examples/authorization_adapter_authorize.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'authorization adapter #authorize' do |record_class, denied_error|
+RSpec.shared_examples 'authorization adapter #authorize' do |record_class, denied_error|
   it 'passes for a record the adapter allows' do
     expect { adapter.authorize(controller, record_class.new(1)) }.not_to raise_error
   end

data/lib/spec/shared_examples/simple_crud_for_create.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for create' do
+RSpec.shared_examples 'simple crud for create' do
   describe 'POST #create' do
     context 'without authenticated user' do
       subject!(:req) do
@@ -47,8 +47,9 @@ shared_examples 'simple crud for create' do
         end
       end
 
-      it 'creates the record' do
+      it 'creates the record', :aggregate_failures do
         expect(model_class_object.count).to be 1
+        instance_exec(model_class_object.last, &created_record_check) if created_record_check
       end
     end
 
@@ -60,20 +61,22 @@ shared_examples 'simple crud for create' do
           post :create, params: with_route_params(body_params(owner_params)), format: request_format(:create)
         end
 
-        if check_html(:create)
-          include_examples 'simple crud renders template', :new, -> { invalid_status }
-        else
-          it 'responds with unprocessable entity' do
-            expect(response).to have_http_status(unprocessable_status)
-          end
+        unless check_block(:create)
+          if check_html(:create)
+            include_examples 'simple crud renders template', :new, -> { invalid_status }
+          else
+            it 'responds with unprocessable entity' do
+              expect(response).to have_http_status(unprocessable_status)
+            end
 
-          it 'returns the validation errors' do
-            expect(response_body['errors']).to include(required_error)
+            it 'returns the validation errors' do
+              expect(response_body['errors']).to include(required_error)
+            end
           end
+        end
 
-          it 'does not create a model' do
-            expect(model_class_object.count).to be 0
-          end
+        it 'does not create a model' do
+          expect(model_class_object.count).to be 0
         end
       end
     end

data/lib/spec/shared_examples/simple_crud_for_create_with_block.rb

@@ -1,18 +1,36 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for create with block' do
+RSpec.shared_examples 'simple crud for create with block' do
   describe 'POST #create with a render block' do
-    it 'passes the saved record to the block' do
-      post :create, params: with_route_params(body_params({ name: 'Blocked' }.merge(owner_params)))
+    context 'when successfully creating a record' do
+      include_context 'with authenticated user' if check_authenticate(:create)
+      let(:create_params) { model_params.merge(owner_params) }
 
-      expect(response.parsed_body).to include('saved' => true)
+      before do
+        post :create, params: with_route_params(body_params(create_params)), format: request_format(:create)
+      end
+
+      it 'passes the saved record to the block' do
+        expect(response).to be_successful
+      end
+
+      it 'creates the record' do
+        expect(model_class_object.count).to be 1
+      end
     end
 
-    it 'passes the failed record to the block', :aggregate_failures do
-      post :create, params: with_route_params(body_params(owner_params))
+    unless check_raise_on_invalid(:create)
+      context 'when creating with invalid attributes' do
+        include_context 'with authenticated user' if check_authenticate(:create)
+
+        before do
+          post :create, params: with_route_params(body_params(owner_params)), format: request_format(:create)
+        end
 
-      expect(response).to have_http_status(422)
-      expect(response.parsed_body).to include('saved' => false)
+        it 'does not create a model' do
+          expect(model_class_object.count).to be 0
+        end
+      end
     end
   end
 end

data/lib/spec/shared_examples/simple_crud_for_create_with_build.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for create with build' do
+RSpec.shared_examples 'simple crud for create with build' do
   describe 'POST #create with a build hook' do
-    include_context 'with authenticated user'
+    include_context 'with authenticated user' if check_authenticate(:create)
 
     before do
-      post :create, params: with_route_params(body_params({ name: 'Built' }))
+      post :create, params: with_route_params(body_params(params_for(model_class))), format: request_format(:create)
     end
 
     it 'creates the record owned by the current user' do

data/lib/spec/shared_examples/simple_crud_for_destroy.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for destroy' do
+RSpec.shared_examples 'simple crud for destroy' do
   describe 'DELETE #destroy' do
     context 'without authenticated user' do
       subject!(:req) do
@@ -46,6 +46,31 @@ shared_examples 'simple crud for destroy' do
       end
     end
 
+    context 'when destroying fails' do
+      include_context 'with authenticated user' if check_authenticate(:destroy)
+
+      before do
+        model
+        allow(model).to receive(:destroy).and_return(false)
+        allow(SimpleCrudController).to receive(:find_record).and_return(model)
+        delete :destroy, params: with_route_params(record_param(:destroy, model)), format: request_format(:destroy)
+      end
+
+      it 'keeps the record' do
+        expect(model_class_object.exists?(model.id)).to be true
+      end
+
+      unless check_block(:destroy) || check_raise_on_invalid(:destroy)
+        if check_html(:destroy)
+          include_examples 'simple crud renders template', :show
+        else
+          it 'responds with unprocessable entity' do
+            expect(response).to have_http_status(unprocessable_status)
+          end
+        end
+      end
+    end
+
     context 'when ID is invalid' do
       include_context 'with authenticated user' if check_authenticate(:destroy)
 

data/lib/spec/shared_examples/simple_crud_for_destroy_with_block.rb

@@ -1,13 +1,21 @@
 # frozen_string_literal: true
 
-shared_examples 'simple crud for destroy with block' do
+RSpec.shared_examples 'simple crud for destroy with block' do
   describe 'DELETE #destroy with a render block' do
+    include_context 'with authenticated user' if check_authenticate(:destroy)
+
     let!(:record) { model }
 
-    before { delete :destroy, params: with_route_params({ id: record.id }) }
+    before do
+      delete :destroy, params: with_route_params(record_param(:destroy, record)), format: request_format(:destroy)
+    end
 
     it 'passes the destroyed record to the block' do
-      expect(response.parsed_body).to eq('destroyed' => true)
+      expect(response).to be_successful
+    end
+
+    it 'destroys the record' do
+      expect(model_class_object.exists?(record.id)).to be false
     end
   end
 end