yes-read-api 2.7.0 → 2.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3619d601a3e567d6dc308faa9d760af33e029269ff7dd30438c64bfa1affd6c5
-  data.tar.gz: 7464d17fdad8e36279a4af428805e87e9a26373de50f9b17dc4b5681f89db160
+  metadata.gz: d82a315c34db2028b08ec928dfa762687832077a9f2b5c49bf06c937a7759b61
+  data.tar.gz: b604a4bb25010bcf7e3180197fc1caf0dcbba43191849bb0a6e9249c3837e87c
 SHA512:
-  metadata.gz: 96a9f8b748084398d5f3afd5b47418be939c77ae98bb934d547a9c1d03c2af07912007565c1783c40f3d165000d88badfb8a7ad6135f2f71230e0a86a3d90c32
-  data.tar.gz: 1f7601458da94700a014a21e69e839de0fdad2253ec5f254255d7874533325744b881479b75dd14b6da51aff525bd201376bbf5ca4dd6c01fcced5a3953dcc89
+  metadata.gz: 5c772d5d935448c0a1137f16ff5b0afe6aea61181cd28d46e01fc96cf42d6e7304d232456f04f94a44cd5b1f9d006ad59974e0a658ff30b580f38a04663c6e18
+  data.tar.gz: 70d305e7f80e9a542654f7472718e300a9da5e27370011b2c0f8d1a7e4c3c93da8aa514e72e420e088d299a94a690f6162687199a81de13dcd678e14ad0da740

data/app/controllers/yes/read/api/queries_controller.rb

@@ -7,11 +7,15 @@ module Yes
     module Api
       class QueriesController < ApplicationController
         before_action :authenticate_with_token
+        before_action :reject_ignored_filter_param
         before_action :validate_advanced_payload, only: :advanced
         before_action :process_own_filter, only: :call
 
         RETRY_AFTER_SECONDS = 1
-        IGNORED_FILTER_PARAM = { basic: :filter_definition, advanced: :filters }.freeze
+        FILTER_DEFINITION_REQUIRED = 'filter_definition is required for an advanced query'
+        FILTERS_IGNORED_BY_ADVANCED = 'filters is not applied by an advanced query, use filter_definition'
+        STORED_FILTER_WITHOUT_DEFINITION = 'the stored filter has no filter_definition'
+        FILTER_DEFINITION_IGNORED_BY_BASIC = 'filter_definition is not applied by a basic query, use filters'
 
         # Covers AuthenticationError raised outside #authenticate_with_token, e.g. by consumer
         # request authorizers, filters or serializers.
@@ -32,6 +36,8 @@ module Yes
         def call
           persisted_filter = filter(read_model_name).persisted_filter_scope.find_by(id: params[:filter_id]) if params[:filter_id].present?
 
+          return bad_request_response(STORED_FILTER_WITHOUT_DEFINITION) if without_definition?(persisted_filter)
+
           render json: response_json(persisted_filter:, filter_type: persisted_filter ? :advanced : :basic).to_json
         end
 
@@ -54,7 +60,7 @@ module Yes
         end
 
         def response_json(filter_type: :basic, persisted_filter: nil)
-          filter_options = applied_filter_options(persisted_filter:, filter_type:)
+          filter_options = applied_filter_options(persisted_filter:)
 
           request_authorizer.call(filter_options, auth_data)
 
@@ -67,17 +73,34 @@ module Yes
           serialize(paginated_records, filter_options)
         end
 
-        # The options the query is built from. They are what the request authorizer is handed too, so
-        # it never authorizes a parameter the query does not apply: a basic query applies `filters` and
-        # an advanced one `filter_definition`.
+        # The options the query is built from. They are what the request authorizer is handed too.
+        # A stored filter body replaces the request params and runs as an advanced query, which
+        # applies `filter_definition` only, so a `filters` key in the body is dropped.
         #
         # @param persisted_filter [#body, nil] stored filter whose body replaces the request params
-        # @param filter_type [Symbol] `:basic` or `:advanced`
-        # @return [Hash] the params without the key the filter type ignores
-        def applied_filter_options(persisted_filter:, filter_type:)
-          options = persisted_filter&.body&.deep_symbolize_keys&.merge(model: params[:model]) || params
+        # @return [Hash] the stored body (without `filters`) or the request params
+        def applied_filter_options(persisted_filter:)
+          return params unless persisted_filter
+
+          stored_filter_options(persisted_filter).except(:filters)
+        end
+
+        # An advanced query returns the unbounded base scope without a `filter_definition`.
+        #
+        # @param persisted_filter [#body, nil] stored filter
+        # @return [Boolean] whether a stored filter was found whose body has no `filter_definition`;
+        #   a body that is not a Hash (the jsonb column also holds nil, arrays, strings) has none
+        def without_definition?(persisted_filter)
+          return false if persisted_filter.blank?
+          return true unless persisted_filter.body.is_a?(Hash)
 
-          options.except(IGNORED_FILTER_PARAM.fetch(filter_type))
+          stored_filter_options(persisted_filter)[:filter_definition].blank?
+        end
+
+        # @param persisted_filter [#body] stored filter with a Hash body
+        # @return [Hash] its body with symbol keys and the requested model
+        def stored_filter_options(persisted_filter)
+          persisted_filter.body.deep_symbolize_keys.merge(model: params[:model])
         end
 
         def request_authorizer
@@ -162,9 +185,31 @@ module Yes
           )
         end
 
-        def validate_advanced_payload
-          return if params[:filter_definition].blank?
+        # Rejects a request that carries the filter parameter its query does not apply, or lacks the one
+        # it needs. Request authorizers pick what to check by which parameter is present, so a parameter
+        # the query silently ignores could be authorized without bounding the result. It runs as a
+        # before_action, so consumer actions of subclasses are covered too.
+        #
+        # @return [void]
+        def reject_ignored_filter_param
+          if request.post?
+            return bad_request_response(FILTER_DEFINITION_REQUIRED) if params[:filter_definition].blank?
+
+            bad_request_response(FILTERS_IGNORED_BY_ADVANCED) if params.key?(:filters)
+          elsif params.key?(:filter_definition)
+            bad_request_response(FILTER_DEFINITION_IGNORED_BY_BASIC)
+          end
+        end
+
+        # Renders a 400 with the reason the request is malformed.
+        #
+        # @param detail [String] why the request is rejected and what to send instead
+        # @return [void]
+        def bad_request_response(detail)
+          render(json: { title: 'Bad Request', detail: }.to_json, status: :bad_request)
+        end
 
+        def validate_advanced_payload
           validation_result = Yes::Read::Api::AdvancedFilterValidator.call(params)
           return if validation_result.success?
 

data/lib/yes/read/api/version.rb

@@ -3,7 +3,7 @@
 module Yes
   module Read
     module Api
-      VERSION = '2.7.0'
+      VERSION = '2.8.0'
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yes-read-api
 version: !ruby/object:Gem::Version
-  version: 2.7.0
+  version: 2.8.0
 platform: ruby
 authors:
 - Nico Ritsche