wor-simple_crud 0.6.0 → 0.8.0

data/lib/simple_crud/simple_crud_controller.rb

@@ -4,6 +4,7 @@ require 'active_support/all'
 require_relative 'config'
 require_relative 'serializer'
 require_relative 'cache_helpers'
+require_relative 'relation_source'
 require_relative 'action_context'
 require_relative 'persistence_context'
 require_relative 'show_context'
@@ -32,16 +33,26 @@ module SimpleCrudController
   ### serializer: use a particular serializer (both each_serializer and serializer)
   ### html: render the action's ERB template instead of JSON (index/show/new/edit/create/update/destroy)
   ### finder: custom record lookup (Proc/lambda or Symbol) for :show/:update/:destroy/:edit
-  ### scope: custom index scope (Proc/lambda taking current_user and optional params), overrides policy_scope
+  ### scope: custom index scope for :index, overriding policy_scope. A Proc/lambda run with the
+  ###   controller as self (arity 0 no args, arity 1 the user, else user and params), or a Symbol
+  ###   naming a model class method taking (current_user, params)
   ### build: custom record builder (Proc/lambda) for :new/:create, invoked with the controller as self
+  ### owned_by: association on Config.user_method for the default finder/build/index-scope
+  ### parent: nested-route parent for the same defaults; exclusive with owned_by:
+  ### parent_association: parent association when it differs from the controller model's plural
+  ### notice:/alert: flash on the html: create/update/destroy success redirect / failure re-render
   ### raise_on_invalid: use strict create!/update! semantics instead of returning 422
   ### A block given to simple_crud_for renders explicitly: it receives the records for :index,
   ### the record for :show/:new/:edit, or the record and a saved flag for :create/:update/:destroy
+  ### An Array of actions declares several at once with the same options
   def simple_crud_for(method, parameters = {}, &block)
+    return method.each { |name| simple_crud_for(name, parameters.dup, &block) } if method.is_a?(Array)
+
     parameters[:block] = true if block
     parameters = parameters_with_defaults(parameters)
     klass = simple_crud_controller_model
     check_valid_method(method)
+    check_relation_source(parameters)
     check_policies(parameters)
     check_serializer(parameters)
     define_method(method, send("crud_lambda_for_#{method}", klass, parameters, &block))
@@ -62,18 +73,22 @@ module SimpleCrudController
   end
 
   def parameters_with_defaults(parameters)
-    defaults = {
-      authorize: true, paginate: true, authenticate: true, authenticate_headers: nil,
-      serializer: nil, serializer_options: nil, status: nil, after_persist: nil, html: false,
-      finder: nil, scope: nil, build: nil, raise_on_invalid: false
-    }
     defaults.merge(simple_crud_inherited_defaults).each do |key, value|
       parameters[key] = value unless parameters.key?(key)
     end
-    parameters[:authenticate_headers] = parameters[:authenticate] if parameters[:authenticate_headers].nil?
+    parameters[:authenticate_headers] ||= parameters[:authenticate]
     parameters
   end
 
+  def defaults
+    {
+      authorize: true, paginate: true, authenticate: true, authenticate_headers: nil,
+      serializer: nil, serializer_options: nil, status: nil, after_persist: nil, html: false,
+      finder: nil, scope: nil, build: nil, owned_by: nil, parent: nil, parent_association: nil,
+      notice: nil, alert: nil, raise_on_invalid: false
+    }
+  end
+
   def write_metadata(method, parameters)
     @simple_crud_metadata ||= {}
     @simple_crud_metadata[method] = parameters
@@ -87,6 +102,12 @@ module SimpleCrudController
     raise ArgumentError, 'invalid method' unless %i[show index create update destroy new edit].include? method
   end
 
+  def check_relation_source(parameters)
+    return unless parameters[:owned_by] && parameters[:parent]
+
+    raise ArgumentError, 'owned_by: and parent: are mutually exclusive, they both scope the same action'
+  end
+
   def check_policies(parameters)
     return if !parameters.key?(:authorize) || !parameters[:authorize]
 

data/lib/simple_crud/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SimpleCrud
-  VERSION = '0.6.0'
+  VERSION = '0.8.0'
 end

data/lib/spec/matchers/render_or_redirect.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+RSpec::Matchers.define :render_or_redirect do
+  match { |response| response.successful? || response.redirect? }
+
+  failure_message { |response| "expected a 2xx render or a redirect, got #{response.status}" }
+end

data/lib/spec/shared_examples/simple_crud_for_create.rb

@@ -53,7 +53,7 @@ RSpec.shared_examples 'simple crud for create' do
       end
     end
 
-    unless check_raise_on_invalid(:create)
+    if invalid_case?(:create)
       context 'when creating with invalid attributes' do
         include_context 'with authenticated user' if check_authenticate(:create)
 

data/lib/spec/shared_examples/simple_crud_for_create_with_block.rb

@@ -11,7 +11,7 @@ RSpec.shared_examples 'simple crud for create with block' do
       end
 
       it 'passes the saved record to the block' do
-        expect(response).to be_successful
+        expect(response).to render_or_redirect
       end
 
       it 'creates the record' do
@@ -19,7 +19,7 @@ RSpec.shared_examples 'simple crud for create with block' do
       end
     end
 
-    unless check_raise_on_invalid(:create)
+    if invalid_case?(:create)
       context 'when creating with invalid attributes' do
         include_context 'with authenticated user' if check_authenticate(:create)
 

data/lib/spec/shared_examples/simple_crud_for_create_with_build.rb

@@ -8,8 +8,14 @@ RSpec.shared_examples 'simple crud for create with build' do
       post :create, params: with_route_params(body_params(params_for(model_class))), format: format_param(:create)
     end
 
-    it 'creates the record owned by the current user' do
-      expect(model_class_object.last.public_send(owner_association)).to eq(current_user)
+    if owner_association
+      it 'creates the record owned by the current user' do
+        expect(model_class_object.last.public_send(owner_association)).to eq(current_user)
+      end
+    else
+      it 'creates the record through the hook' do
+        expect(model_class_object.count).to eq(1)
+      end
     end
   end
 end

data/lib/spec/shared_examples/simple_crud_for_destroy.rb

@@ -71,17 +71,19 @@ RSpec.shared_examples 'simple crud for destroy' do
       end
     end
 
-    context 'when ID is invalid' do
-      include_context 'with authenticated user' if check_authenticate(:destroy)
+    unless singular
+      context 'when ID is invalid' do
+        include_context 'with authenticated user' if check_authenticate(:destroy)
 
-      before do
-        model
-        delete :destroy, params: with_route_params(record_param(:destroy, nil, not_found: true)),
-                         format: format_param(:destroy)
-      end
+        before do
+          model
+          delete :destroy, params: with_route_params(record_param(:destroy, nil, not_found: true)),
+                           format: format_param(:destroy)
+        end
 
-      it 'responds with not found status' do
-        expect(response).to have_http_status(:not_found)
+        it 'responds with not found status' do
+          expect(response).to have_http_status(:not_found)
+        end
       end
     end
 

data/lib/spec/shared_examples/simple_crud_for_destroy_with_block.rb

@@ -11,7 +11,7 @@ RSpec.shared_examples 'simple crud for destroy with block' do
     end
 
     it 'passes the destroyed record to the block' do
-      expect(response).to be_successful
+      expect(response).to render_or_redirect
     end
 
     it 'destroys the record' do

data/lib/spec/shared_examples/simple_crud_for_edit.rb

@@ -41,38 +41,40 @@ RSpec.shared_examples 'simple crud for edit' do
 
       before do
         model
-        make_policies_succeed(:edit) if check_authorize(:edit)
+        make_policies_succeed(:edit, permissive: check_block(:edit)) if check_authorize(:edit)
         edit_request
       end
 
-      it 'responds with ok status' do
-        expect(response).to have_http_status(:ok)
-      end
-
       if check_block(:edit)
         it 'renders the asked model through the block' do
-          expect(response).to be_successful
+          expect(response).to render_or_redirect
         end
       elsif check_html(:edit)
         include_examples 'simple crud renders template', :edit
       else
+        it 'responds with ok status' do
+          expect(response).to have_http_status(:ok)
+        end
+
         it 'returns the asked model' do
           expect(response_body['id']).to eq(model.id)
         end
       end
     end
 
-    context 'when the model does not exist' do
-      include_context 'with authenticated user'
+    unless singular
+      context 'when the model does not exist' do
+        include_context 'with authenticated user'
 
-      let(:edit_params) { record_param(:edit, nil, not_found: true) }
+        let(:edit_params) { record_param(:edit, nil, not_found: true) }
 
-      before do
-        edit_request
-      end
+        before do
+          edit_request
+        end
 
-      it 'responds with not found status' do
-        expect(response).to have_http_status(:not_found)
+        it 'responds with not found status' do
+          expect(response).to have_http_status(:not_found)
+        end
       end
     end
   end

data/lib/spec/shared_examples/simple_crud_for_edit_with_block.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'simple crud for edit with block' do
+  describe 'GET #edit with a render block' do
+    include_context 'with authenticated user' if check_authenticate(:edit)
+
+    let!(:record) { model }
+
+    before do
+      make_policies_succeed(:edit, permissive: true) if check_authorize(:edit)
+      get :edit, params: with_route_params(record_param(:edit, record)), format: format_param(:edit)
+    end
+
+    if check_html(:edit)
+      include_examples 'simple crud renders template', :edit
+    else
+      it 'renders the record through the block' do
+        expect(response).to render_or_redirect
+      end
+    end
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_edit_with_finder.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'simple crud for edit with finder' do
+  describe 'GET #edit with a custom finder' do
+    include_context 'with authenticated user' if check_authenticate(:edit)
+
+    context 'when the model exists' do
+      before do
+        model
+        make_policies_succeed(:edit, permissive: check_block(:edit)) if check_authorize(:edit)
+        get :edit, params: with_route_params(finder_key => model.public_send(finder_key)),
+                   format: format_param(:edit)
+      end
+
+      if check_block(:edit)
+        it 'finds the asked model' do
+          expect(rendered_record.id).to eq(model.id)
+        end
+      elsif check_html(:edit)
+        include_examples 'simple crud renders template', :edit
+      else
+        it 'responds with ok status' do
+          expect(response).to have_http_status(:ok)
+        end
+
+        it 'returns the asked model' do
+          expect(response_body['id']).to eq(model.id)
+        end
+      end
+    end
+
+    include_examples 'simple crud not found with finder', :get, :edit
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_index_with_scope.rb

@@ -3,7 +3,14 @@
 RSpec.shared_examples 'simple crud for index with scope' do
   let(:request_params) { {} }
   let(:my_models) { create_records(model_class, 2, scoped_attributes) }
-  let(:other_models) { create_records(model_class, 3, other_scoped_attributes) }
+  let(:other_models) { create_records(model_class, 3, other_scoped_attributes) if other_scoped_attributes }
+  let(:listed_ids) do
+    if check_html(:index)
+      rendered_records.map(&:id)
+    else
+      (check_paginate(:index) ? response_body['page'] : response_body).map { |m| m['id'] }
+    end
+  end
 
   # Hooks stay inside this context so co-including the example never
   # authenticates or stubs policies for sibling examples.
@@ -16,17 +23,13 @@ RSpec.shared_examples 'simple crud for index with scope' do
       get :index, params: with_route_params(request_params), format: format_param(:index)
     end
 
-    if check_html(:index)
-      it 'returns only the assigned scoped records' do
-        expect(rendered_records.map(&:id)).to match_array(my_models.map(&:id))
-      end
-    elsif check_paginate(:index)
-      it 'returns only the paginated scoped records' do
-        expect(response_body['page'].map { |m| m['id'] }).to match_array(my_models.map(&:id))
-      end
-    else
-      it 'returns only the unpaginated scoped records' do
-        expect(response_body.map { |m| m['id'] }).to match_array(my_models.map(&:id))
+    it 'returns the scoped records' do
+      expect(listed_ids).to match_array(my_models.map(&:id))
+    end
+
+    if scoped_order
+      it 'returns the scoped records in order' do
+        expect(listed_ids).to eq(instance_exec(my_models, &scoped_order).map(&:id))
       end
     end
   end

data/lib/spec/shared_examples/simple_crud_for_nested_resource.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# For a parent: controller. The parent in route_params must match the record's owner_association.
+RSpec.shared_examples 'simple crud for nested resource' do
+  describe 'parent: scoping' do
+    include_context 'with authenticated user' if check_authenticate(:show)
+
+    it 'finds a record inside the parent' do
+      get :show, params: with_route_params(record_param(:show, model)), format: format_param(:show)
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'returns not found for a record outside the parent' do
+      outside = create_record(model_class, model_attributes.merge(owner_association => other_user))
+      get :show, params: with_route_params(record_param(:show, outside)), format: format_param(:show)
+
+      expect(response).to have_http_status(:not_found)
+    end
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_new_with_block.rb

@@ -5,7 +5,7 @@ RSpec.shared_examples 'simple crud for new with block' do
     include_context 'with authenticated user' if check_authenticate(:new)
 
     before do
-      make_policies_succeed(:new) if check_authorize(:new)
+      make_policies_succeed(:new, permissive: true) if check_authorize(:new)
       get :new, params: with_route_params({}), format: format_param(:new)
     end
 

data/lib/spec/shared_examples/simple_crud_for_new_with_build.rb

@@ -8,11 +8,17 @@ RSpec.shared_examples 'simple crud for new with build' do
       get :new, params: with_route_params({}), format: format_param(:new)
     end
 
-    it 'builds the record owned by the current user', :aggregate_failures do
-      if check_html(:new) || check_block(:new)
-        expect(rendered_record.public_send(owner_foreign_key)).to eq(current_user.id)
-      else
-        expect(response_body[owner_foreign_key.to_s]).to eq(current_user.id)
+    if owner_association
+      it 'builds the record owned by the current user', :aggregate_failures do
+        if check_html(:new) || check_block(:new)
+          expect(rendered_record.public_send(owner_foreign_key)).to eq(current_user.id)
+        else
+          expect(response_body[owner_foreign_key.to_s]).to eq(current_user.id)
+        end
+      end
+    else
+      it 'builds the record through the hook' do
+        expect(response).to be_successful
       end
     end
   end

data/lib/spec/shared_examples/simple_crud_for_owned_resource.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+# Include alongside the per-action examples for a controller using owned_by:.
+RSpec.shared_examples 'simple crud for owned resource' do
+  describe 'owned_by: scoping' do
+    include_context 'with authenticated user'
+
+    let!(:someone_elses_model) do
+      create_record(model_class, model_attributes.merge(owner_association => other_user))
+    end
+
+    it 'returns not found for a record owned by another user' do
+      get :show, params: with_route_params(record_param(:show, someone_elses_model)), format: format_param(:show)
+
+      expect(response).to have_http_status(:not_found)
+    end
+
+    context 'when updating a record owned by another user' do
+      let!(:original_value) { required_attribute && someone_elses_model.public_send(required_attribute) }
+
+      before do
+        params = with_route_params(record_param(:update, someone_elses_model)).merge(body_params(model_params))
+        patch :update, params: params, format: format_param(:update)
+      end
+
+      it 'responds with not found' do
+        expect(response).to have_http_status(:not_found)
+      end
+
+      if required_attribute
+        it 'leaves the record untouched' do
+          expect(someone_elses_model.reload.public_send(required_attribute)).to eq(original_value)
+        end
+      end
+    end
+
+    it 'attributes a created record to the current user regardless of the request', :aggregate_failures do
+      body = body_params(model_params.merge(owner_association => other_user.id))
+      post :create, params: with_route_params(body), format: format_param(:create)
+
+      expect(response).to have_http_status(check_status(:create) || :created)
+      expect(model_class_object.last.public_send(owner_association)).to eq(current_user)
+    end
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_show.rb

@@ -39,16 +39,18 @@ RSpec.shared_examples 'simple crud for show' do
       end
     end
 
-    describe 'when the model does not exist' do
-      include_context 'with authenticated user'
-      let(:show_params) { record_param(:show, nil, not_found: true) }
+    unless singular
+      describe 'when the model does not exist' do
+        include_context 'with authenticated user'
+        let(:show_params) { record_param(:show, nil, not_found: true) }
 
-      before do
-        show_request
-      end
+        before do
+          show_request
+        end
 
-      it 'responds with not found status' do
-        expect(response).to have_http_status(:not_found)
+        it 'responds with not found status' do
+          expect(response).to have_http_status(:not_found)
+        end
       end
     end
   end

data/lib/spec/shared_examples/simple_crud_for_show_with_block.rb

@@ -7,7 +7,7 @@ RSpec.shared_examples 'simple crud for show with block' do
     let!(:record) { model }
 
     before do
-      make_policies_succeed(:show) if check_authorize(:show)
+      make_policies_succeed(:show, permissive: true) if check_authorize(:show)
       get :show, params: with_route_params(record_param(:show, record)), format: format_param(:show)
     end
 

data/lib/spec/shared_examples/simple_crud_for_update.rb

@@ -61,24 +61,26 @@ RSpec.shared_examples 'simple crud for update' do
       end
     end
 
-    context 'when updating a model that doesn\'t exist' do
-      include_context 'with authenticated user'
+    unless singular
+      context 'when updating a model that doesn\'t exist' do
+        include_context 'with authenticated user'
 
-      before do
-        put :update, params: with_route_params(record_param(:update, nil, not_found: true)),
-                     format: format_param(:update)
-      end
+        before do
+          put :update, params: with_route_params(record_param(:update, nil, not_found: true)),
+                       format: format_param(:update)
+        end
 
-      it 'response with 404 status code' do
-        expect(response).to have_http_status(:not_found)
-      end
+        it 'response with 404 status code' do
+          expect(response).to have_http_status(:not_found)
+        end
 
-      it 'doesn\'t create an model' do
-        expect(model_class_object.count).to be 0
+        it 'doesn\'t create an model' do
+          expect(model_class_object.count).to be 0
+        end
       end
     end
 
-    unless check_raise_on_invalid(:update)
+    if invalid_case?(:update)
       context 'when updating with invalid attributes' do
         include_context 'with authenticated user' if check_authenticate(:update)
 

data/lib/spec/shared_examples/simple_crud_for_update_with_block.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'simple crud for update with block' do
+  describe 'PUT #update with a render block' do
+    include_context 'with authenticated user' if check_authenticate(:update)
+
+    let!(:record) { model }
+
+    context 'when successfully updating a record' do
+      before do
+        make_policies_succeed(:update, permissive: true) if check_authorize(:update)
+        put :update, params: with_route_params(body_params(model_params).merge(record_param(:update, record))),
+                     format: format_param(:update)
+      end
+
+      it 'passes the saved record to the block' do
+        expect(response).to render_or_redirect
+      end
+
+      it 'updates the record' do
+        expect(record.reload).to have_attributes(model_params)
+      end
+    end
+
+    if invalid_case?(:update)
+      context 'when updating with invalid attributes' do
+        before do
+          make_policies_succeed(:update, permissive: true) if check_authorize(:update)
+          put :update, params: with_route_params(body_params({ required_attribute => nil }.merge(owner_params))
+                                                         .merge(record_param(:update, record))),
+                       format: format_param(:update)
+        end
+
+        it 'does not change the record' do
+          expect(record.reload.public_send(required_attribute)).not_to be_nil
+        end
+      end
+    end
+  end
+end

data/lib/spec/shared_examples/simple_crud_for_update_with_finder.rb

@@ -5,8 +5,9 @@ RSpec.shared_examples 'simple crud for update with finder' do
     include_context 'with authenticated user' if check_authenticate(:update)
 
     context 'when successfully updating a model' do
+      let(:updated_attributes) { required_attribute ? { required_attribute => 'Updated' } : model_params }
       let(:update_params) do
-        with_route_params(body_params(required_attribute => 'Updated').merge(owner_params))
+        with_route_params(body_params(updated_attributes).merge(owner_params))
           .merge(finder_key => model.public_send(finder_key))
       end
 
@@ -15,13 +16,15 @@ RSpec.shared_examples 'simple crud for update with finder' do
         put :update, params: update_params, format: format_param(:update)
       end
 
-      it 'updates the model' do
-        expect(model.reload.public_send(required_attribute)).to eq('Updated')
+      if required_attribute
+        it 'updates the model' do
+          expect(model.reload.public_send(required_attribute)).to eq('Updated')
+        end
       end
 
       if check_block(:update)
         it 'passes the updated model to the block' do
-          expect(rendered_record.id).to eq(model.id)
+          expect(response).to render_or_redirect
         end
       elsif check_html(:update)
         it 'redirects to the updated record' do

data/lib/spec/shared_examples/simple_crud_not_found_with_finder.rb

@@ -1,14 +1,16 @@
 # frozen_string_literal: true
 
 RSpec.shared_examples 'simple crud not found with finder' do |http_method, action|
-  context 'when the model does not exist' do
-    before do
-      send(http_method, action, params: with_route_params(finder_key => "nonexistent-#{finder_key}"),
-                                format: format_param(action))
-    end
+  unless singular
+    context 'when the model does not exist' do
+      before do
+        send(http_method, action, params: with_route_params(finder_key => "nonexistent-#{finder_key}"),
+                                  format: format_param(action))
+      end
 
-    it 'responds with not found status' do
-      expect(response).to have_http_status(:not_found)
+      it 'responds with not found status' do
+        expect(response).to have_http_status(:not_found)
+      end
     end
   end
 end

data/spec/block_create_redirect/dummy_models_controller_spec.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe BlockCreateRedirect::DummyModelsController, type: :controller do
+  include_examples 'simple crud for create with block'
+
+  describe 'without a validated attribute', simple_crud: { required_attribute: nil } do
+    include_examples 'simple crud for create with block'
+  end
+end

data/spec/block_edit/dummy_models_controller_spec.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe BlockEdit::DummyModelsController, type: :controller do
+  include_examples 'simple crud for edit with block'
+end

data/spec/block_finder/dummy_models_controller_spec.rb

@@ -4,6 +4,8 @@ require 'spec_helper'
 
 describe BlockFinder::DummyModelsController, type: :controller do
   include_examples 'simple crud for edit'
+  include_examples 'simple crud for edit with finder'
+  include_examples 'simple crud for edit with block'
   include_examples 'simple crud for show with finder'
   include_examples 'simple crud for update with finder'
   include_examples 'simple crud for destroy with finder'

data/spec/block_policy_show/dummy_models_controller_spec.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe BlockPolicyShow::DummyModelsController, type: :controller do
+  include_examples 'simple crud for show with block'
+end