From ef60aefe882589213e6df2c5a208362a65c8860e Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Mon, 29 Feb 2016 17:05:11 +1300 Subject: [PATCH 01/23] fix js bug --- app/assets/javascripts/src/Metamaps.GlobalUI.js.erb | 1 + app/assets/javascripts/src/Metamaps.js.erb | 10 ++++------ 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/app/assets/javascripts/src/Metamaps.GlobalUI.js.erb b/app/assets/javascripts/src/Metamaps.GlobalUI.js.erb index 27812c57..00460ad4 100644 --- a/app/assets/javascripts/src/Metamaps.GlobalUI.js.erb +++ b/app/assets/javascripts/src/Metamaps.GlobalUI.js.erb @@ -48,6 +48,7 @@ $(document).ready(function () { // this runs the init function within each sub-object on the Metamaps one if (Metamaps.hasOwnProperty(prop) && + Metamaps[prop] != null && Metamaps[prop].hasOwnProperty('init') && typeof (Metamaps[prop].init) == 'function' ) { diff --git a/app/assets/javascripts/src/Metamaps.js.erb b/app/assets/javascripts/src/Metamaps.js.erb index 5a6c5955..ff6d57e6 100644 --- a/app/assets/javascripts/src/Metamaps.js.erb +++ b/app/assets/javascripts/src/Metamaps.js.erb @@ -17,12 +17,10 @@ var labelType, useGradients, nativeTextSupport, animate; })(); // TODO eliminate these 4 top-level variables -Metamaps = { - panningInt: null, - tempNode: null, - tempInit: false, - tempNode2: null -} +Metamaps.panningInt = null; +Metamaps.tempNode = null; +Metamaps.tempInit = false; +Metamaps.tempNode2 = null; Metamaps.Settings = { embed: false, // indicates that the app is on a page that is optimized for embedding in iFrames on other web pages From 059591b78b419ebdfedc79dc721aced625717724 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Fri, 11 Mar 2016 17:16:04 +1100 Subject: [PATCH 02/23] first pass at important API endpoints, token auth --- Gemfile | 2 + Gemfile.lock | 126 +++++++++++---------- app/assets/javascripts/src/Metamaps.js.erb | 4 +- app/controllers/api/mappings_controller.rb | 11 ++ app/controllers/api/maps_controller.rb | 11 ++ app/controllers/api/restful_controller.rb | 29 +++++ app/controllers/api/synapses_controller.rb | 11 ++ app/controllers/api/tokens_controller.rb | 21 ++++ app/controllers/api/topics_controller.rb | 11 ++ app/models/logged_out_user.rb | 7 ++ app/models/mapping.rb | 10 +- app/models/permitted_params.rb | 33 ++++++ app/models/synapse.rb | 2 + app/models/token.rb | 11 ++ app/models/user.rb | 5 + app/serializers/map_serializer.rb | 20 ++++ app/serializers/mapping_serializer.rb | 17 +++ app/serializers/metacode_serializer.rb | 7 ++ app/serializers/synapse_serializer.rb | 19 ++++ app/serializers/token_serializer.rb | 14 +++ app/serializers/topic_serializer.rb | 18 +++ app/serializers/user_serializer.rb | 15 +++ config/routes.rb | 10 ++ db/migrate/20160310200131_create_tokens.rb | 11 ++ db/schema.rb | 13 ++- postatoken.txt | 7 ++ postdata.txt | 1 + postmapping.txt | 1 + postsynapse.txt | 1 + posttopic.txt | 1 + spec/models/token_spec.rb | 5 + 31 files changed, 392 insertions(+), 62 deletions(-) create mode 100644 app/controllers/api/mappings_controller.rb create mode 100644 app/controllers/api/maps_controller.rb create mode 100644 app/controllers/api/restful_controller.rb create mode 100644 app/controllers/api/synapses_controller.rb create mode 100644 app/controllers/api/tokens_controller.rb create mode 100644 app/controllers/api/topics_controller.rb create mode 100644 app/models/logged_out_user.rb create mode 100644 app/models/permitted_params.rb create mode 100644 app/models/token.rb create mode 100644 app/serializers/map_serializer.rb create mode 100644 app/serializers/mapping_serializer.rb create mode 100644 app/serializers/metacode_serializer.rb create mode 100644 app/serializers/synapse_serializer.rb create mode 100644 app/serializers/token_serializer.rb create mode 100644 app/serializers/topic_serializer.rb create mode 100644 app/serializers/user_serializer.rb create mode 100644 db/migrate/20160310200131_create_tokens.rb create mode 100644 postatoken.txt create mode 100644 postdata.txt create mode 100644 postmapping.txt create mode 100644 postsynapse.txt create mode 100644 posttopic.txt create mode 100644 spec/models/token_spec.rb diff --git a/Gemfile b/Gemfile index 8379a7db..6b48c790 100644 --- a/Gemfile +++ b/Gemfile @@ -15,6 +15,8 @@ gem 'best_in_place' #in-place editing gem 'kaminari' # pagination gem 'uservoice-ruby' gem 'dotenv' +gem 'snorlax', '~> 0.1.3' +gem 'active_model_serializers', '~> 0.8.1' gem 'paperclip' gem 'aws-sdk', '< 2.0' diff --git a/Gemfile.lock b/Gemfile.lock index eb8edec5..08c76b66 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -20,6 +20,8 @@ GEM erubis (~> 2.7.0) rails-dom-testing (~> 1.0, >= 1.0.5) rails-html-sanitizer (~> 1.0, >= 1.0.2) + active_model_serializers (0.8.3) + activemodel (>= 3.0) activejob (4.2.4) activesupport (= 4.2.4) globalid (>= 0.3.0) @@ -43,8 +45,8 @@ GEM aws-sdk-v1 (1.66.0) json (~> 1.4) nokogiri (>= 1.4.4) - bcrypt (3.1.10) - best_in_place (3.0.3) + bcrypt (3.1.11) + best_in_place (3.1.0) actionpack (>= 3.2) railties (>= 3.2) better_errors (2.1.1) @@ -54,24 +56,23 @@ GEM binding_of_caller (0.7.2) debug_inspector (>= 0.0.1) builder (3.2.2) - byebug (5.0.0) - columnize (= 0.9.0) - cancancan (1.13.1) + byebug (8.2.2) + cancancan (1.10.1) climate_control (0.0.3) activesupport (>= 3.0) - cocaine (0.5.7) + cocaine (0.5.8) climate_control (>= 0.0.3, < 1.0) - coderay (1.1.0) - coffee-rails (4.1.0) + coderay (1.1.1) + coffee-rails (4.1.1) coffee-script (>= 2.2.0) - railties (>= 4.0.0, < 5.0) + railties (>= 4.0.0, < 5.1.x) coffee-script (2.4.1) coffee-script-source execjs - coffee-script-source (1.9.1.1) - columnize (0.9.0) + coffee-script-source (1.10.0) + concurrent-ruby (1.0.1) debug_inspector (0.0.2) - devise (3.5.2) + devise (3.5.6) bcrypt (~> 3.0) orm_adapter (~> 0.1) railties (>= 3.2.6, < 5) @@ -80,13 +81,13 @@ GEM warden (~> 1.2.3) diff-lcs (1.2.5) docile (1.1.5) - dotenv (2.0.2) + dotenv (2.1.0) erubis (2.7.0) execjs (2.6.0) ezcrypto (0.7.2) factory_girl (4.5.0) activesupport (>= 3.0.0) - factory_girl_rails (4.5.0) + factory_girl_rails (4.6.0) factory_girl (~> 4.5.0) railties (>= 3.0.0) formtastic (3.1.3) @@ -96,17 +97,17 @@ GEM globalid (0.3.6) activesupport (>= 4.1.0) i18n (0.7.0) - jbuilder (2.3.2) - activesupport (>= 3.0.0, < 5) + jbuilder (2.4.1) + activesupport (>= 3.0.0, < 5.1) multi_json (~> 1.2) - jquery-rails (4.0.5) - rails-dom-testing (~> 1.0) + jquery-rails (4.1.1) + rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) jquery-ui-rails (5.0.5) railties (>= 3.2.16) json (1.8.3) - json-schema (2.6.0) + json-schema (2.6.1) addressable (~> 2.3.8) kaminari (0.16.3) actionpack (>= 3.0.0) @@ -116,28 +117,28 @@ GEM mail (2.6.3) mime-types (>= 1.16, < 3) method_source (0.8.2) - mime-types (2.6.2) + mime-types (2.99.1) mimemagic (0.3.0) - mini_portile (0.6.2) - minitest (5.8.2) + mini_portile2 (2.0.0) + minitest (5.8.4) multi_json (1.11.2) - nokogiri (1.6.6.2) - mini_portile (~> 0.6.0) - oauth (0.4.7) + nokogiri (1.6.7.2) + mini_portile2 (~> 2.0.0.rc2) + oauth (0.5.1) orm_adapter (0.5.0) - paperclip (4.3.1) + paperclip (4.3.5) activemodel (>= 3.2.0) activesupport (>= 3.2.0) cocaine (~> 0.5.5) mime-types mimemagic (= 0.3.0) - pg (0.18.3) + pg (0.18.4) pry (0.10.3) coderay (~> 1.1.0) method_source (~> 0.8.1) slop (~> 3.4) - pry-byebug (3.2.0) - byebug (~> 5.0) + pry-byebug (3.3.0) + byebug (~> 8.0) pry (~> 0.10) pry-rails (0.3.4) pry (>= 0.9.10) @@ -163,66 +164,70 @@ GEM activesupport (>= 4.2.0.beta, < 5.0) nokogiri (~> 1.6.0) rails-deprecated_sanitizer (>= 1.0.1) - rails-html-sanitizer (1.0.2) + rails-html-sanitizer (1.0.3) loofah (~> 2.0) rails3-jquery-autocomplete (1.0.15) rails (>= 3.2) rails_12factor (0.0.3) rails_serve_static_assets rails_stdout_logging - rails_serve_static_assets (0.0.4) + rails_serve_static_assets (0.0.5) rails_stdout_logging (0.0.4) railties (4.2.4) actionpack (= 4.2.4) activesupport (= 4.2.4) rake (>= 0.8.7) thor (>= 0.18.1, < 2.0) - rake (10.4.2) - redis (3.2.1) - responders (2.1.0) - railties (>= 4.2.0, < 5) - rspec-core (3.3.2) - rspec-support (~> 3.3.0) - rspec-expectations (3.3.1) + rake (11.0.1) + redis (3.2.2) + responders (2.1.1) + railties (>= 4.2.0, < 5.1) + rspec-core (3.4.4) + rspec-support (~> 3.4.0) + rspec-expectations (3.4.0) diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.3.0) - rspec-mocks (3.3.2) + rspec-support (~> 3.4.0) + rspec-mocks (3.4.1) diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.3.0) - rspec-rails (3.3.3) + rspec-support (~> 3.4.0) + rspec-rails (3.4.2) actionpack (>= 3.0, < 4.3) activesupport (>= 3.0, < 4.3) railties (>= 3.0, < 4.3) - rspec-core (~> 3.3.0) - rspec-expectations (~> 3.3.0) - rspec-mocks (~> 3.3.0) - rspec-support (~> 3.3.0) - rspec-support (3.3.0) - sass (3.4.19) + rspec-core (~> 3.4.0) + rspec-expectations (~> 3.4.0) + rspec-mocks (~> 3.4.0) + rspec-support (~> 3.4.0) + rspec-support (3.4.1) + sass (3.4.21) sass-rails (5.0.4) railties (>= 4.0.0, < 5.0) sass (~> 3.1) sprockets (>= 2.8, < 4.0) sprockets-rails (>= 2.0, < 4.0) tilt (>= 1.1, < 3) - shoulda-matchers (3.0.1) + shoulda-matchers (3.1.1) activesupport (>= 4.0.0) - simplecov (0.11.1) + simplecov (0.11.2) docile (~> 1.1.0) json (~> 1.8) simplecov-html (~> 0.10.0) simplecov-html (0.10.0) slop (3.6.0) - sprockets (3.4.0) + snorlax (0.1.4) + cancancan (~> 1.10.1) + rails (> 4.1) + sprockets (3.5.2) + concurrent-ruby (~> 1.0) rack (> 1, < 3) - sprockets-rails (2.3.3) - actionpack (>= 3.0) - activesupport (>= 3.0) - sprockets (>= 2.8, < 4.0) + sprockets-rails (3.0.4) + actionpack (>= 4.0) + activesupport (>= 4.0) + sprockets (>= 3.0.0) thor (0.19.1) thread_safe (0.3.5) - tilt (2.0.1) - tunemygc (1.0.61) + tilt (2.0.2) + tunemygc (1.0.65) tzinfo (1.2.2) thread_safe (~> 0.1) uglifier (2.7.2) @@ -232,13 +237,14 @@ GEM ezcrypto (>= 0.7.2) json (>= 1.7.5) oauth (>= 0.4.7) - warden (1.2.3) + warden (1.2.6) rack (>= 1.0) PLATFORMS ruby DEPENDENCIES + active_model_serializers (~> 0.8.1) aws-sdk (< 2.0) best_in_place better_errors @@ -269,6 +275,10 @@ DEPENDENCIES sass-rails shoulda-matchers simplecov + snorlax (~> 0.1.3) tunemygc uglifier uservoice-ruby + +BUNDLED WITH + 1.11.2 diff --git a/app/assets/javascripts/src/Metamaps.js.erb b/app/assets/javascripts/src/Metamaps.js.erb index ff6d57e6..95cf7379 100644 --- a/app/assets/javascripts/src/Metamaps.js.erb +++ b/app/assets/javascripts/src/Metamaps.js.erb @@ -4083,7 +4083,7 @@ Metamaps.Topic = { }; var topicSuccessCallback = function (topicModel, response) { if (Metamaps.Active.Map) { - mapping.save({ mappable_id: topicModel.id }, { + mapping.save({ mappable_id: topicModel.get('topic').id }, { success: mappingSuccessCallback, error: function (model, response) { console.log('error saving mapping to database'); @@ -4254,7 +4254,7 @@ Metamaps.Synapse = { }; var synapseSuccessCallback = function (synapseModel, response) { if (Metamaps.Active.Map) { - mapping.save({ mappable_id: synapseModel.id }, { + mapping.save({ mappable_id: synapseModel.get('synapse').id }, { success: mappingSuccessCallback }); } diff --git a/app/controllers/api/mappings_controller.rb b/app/controllers/api/mappings_controller.rb new file mode 100644 index 00000000..83892b9a --- /dev/null +++ b/app/controllers/api/mappings_controller.rb @@ -0,0 +1,11 @@ +class Api::MappingsController < API::RestfulController + + def create + raise CanCan::AccessDenied.new unless current_user.is_logged_in? + instantiate_resouce + resource.user = current_user + create_action + respond_with_resource + end + +end diff --git a/app/controllers/api/maps_controller.rb b/app/controllers/api/maps_controller.rb new file mode 100644 index 00000000..2f86d254 --- /dev/null +++ b/app/controllers/api/maps_controller.rb @@ -0,0 +1,11 @@ +class Api::MapsController < API::RestfulController + + def create + raise CanCan::AccessDenied.new unless current_user.is_logged_in? + instantiate_resouce + resource.user = current_user + create_action + respond_with_resource + end + +end diff --git a/app/controllers/api/restful_controller.rb b/app/controllers/api/restful_controller.rb new file mode 100644 index 00000000..8289583d --- /dev/null +++ b/app/controllers/api/restful_controller.rb @@ -0,0 +1,29 @@ +class API::RestfulController < ActionController::Base + snorlax_used_rest! + + def show + load_resource + raise AccessDenied.new unless resource.authorize_to_show(current_user) + respond_with_resource + end + + private + + def current_user + super || token_user || LoggedOutUser.new + end + + def token_user + authenticate_with_http_token do |token, options| + access_token = Token.find_by_token(token) + if access_token + @token_user ||= access_token.user + end + end + end + + def permitted_params + @permitted_params ||= PermittedParams.new(params) + end + +end diff --git a/app/controllers/api/synapses_controller.rb b/app/controllers/api/synapses_controller.rb new file mode 100644 index 00000000..de435df3 --- /dev/null +++ b/app/controllers/api/synapses_controller.rb @@ -0,0 +1,11 @@ +class Api::SynapsesController < API::RestfulController + + def create + raise CanCan::AccessDenied.new unless current_user.is_logged_in? + instantiate_resouce + resource.user = current_user + create_action + respond_with_resource + end + +end diff --git a/app/controllers/api/tokens_controller.rb b/app/controllers/api/tokens_controller.rb new file mode 100644 index 00000000..2b2ff8df --- /dev/null +++ b/app/controllers/api/tokens_controller.rb @@ -0,0 +1,21 @@ +class Api::TokensController < API::RestfulController + + def create + raise CanCan::AccessDenied.new unless current_user.is_logged_in? + instantiate_resouce + resource.user = current_user + create_action + respond_with_resource + end + + def my_tokens + raise CanCan::AccessDenied.new unless current_user.is_logged_in? + instantiate_collection page_collection: false, timeframe_collection: false + respond_with_collection + end + + def visible_records + current_user.tokens + end + +end diff --git a/app/controllers/api/topics_controller.rb b/app/controllers/api/topics_controller.rb new file mode 100644 index 00000000..ded6a5e6 --- /dev/null +++ b/app/controllers/api/topics_controller.rb @@ -0,0 +1,11 @@ +class Api::TopicsController < API::RestfulController + + def create + raise CanCan::AccessDenied.new unless current_user.is_logged_in? + instantiate_resouce + resource.user = current_user + create_action + respond_with_resource + end + +end diff --git a/app/models/logged_out_user.rb b/app/models/logged_out_user.rb new file mode 100644 index 00000000..14e0cfb9 --- /dev/null +++ b/app/models/logged_out_user.rb @@ -0,0 +1,7 @@ +class LoggedOutUser + + FALSE_METHODS = [:is_logged_in?] + + FALSE_METHODS.each { |method| define_method(method, -> { false }) } + +end diff --git a/app/models/mapping.rb b/app/models/mapping.rb index d034de1c..8f29ed6a 100644 --- a/app/models/mapping.rb +++ b/app/models/mapping.rb @@ -25,5 +25,13 @@ class Mapping < ActiveRecord::Base def as_json(options={}) super(:methods =>[:user_name, :user_image]) end - + + def authorize_to_show(user) + if ((self.map.permission == "private" && self.map.user != user) || + (self.mappable.permission == "private" && self.mappable.user != user)) + return false + end + return self + end + end diff --git a/app/models/permitted_params.rb b/app/models/permitted_params.rb new file mode 100644 index 00000000..a49ed648 --- /dev/null +++ b/app/models/permitted_params.rb @@ -0,0 +1,33 @@ +class PermittedParams < Struct.new(:params) + + %w[map synapse topic mapping token].each do |kind| + define_method(kind) do + permitted_attributes = self.send("#{kind}_attributes") + params.require(kind).permit(*permitted_attributes) + end + alias_method :"api_#{kind}", kind.to_sym + end + + alias :read_attribute_for_serialization :send + + def token_attributes + [:description] + end + + def map_attributes + [:name, :desc, :permission, :arranged] + end + + def synapse_attributes + [:desc, :category, :weight, :permission, :node1_id, :node2_id] + end + + def topic_attributes + [:name, :desc, :link, :permission, :metacode_id] + end + + def mapping_attributes + [:xloc, :yloc, :map_id, :mappable_type, :mappable_id] + end + +end diff --git a/app/models/synapse.rb b/app/models/synapse.rb index ea5889cc..c766d95c 100644 --- a/app/models/synapse.rb +++ b/app/models/synapse.rb @@ -10,6 +10,8 @@ class Synapse < ActiveRecord::Base validates :desc, length: { minimum: 0, allow_nil: false } validates :permission, presence: true + validates :node1_id, presence: true + validates :node2_id, presence: true validates :permission, inclusion: { in: Perm::ISSIONS.map(&:to_s) } validates :category, inclusion: { in: ['from-to', 'both'], allow_nil: true } diff --git a/app/models/token.rb b/app/models/token.rb new file mode 100644 index 00000000..15bdca79 --- /dev/null +++ b/app/models/token.rb @@ -0,0 +1,11 @@ +class Token < ActiveRecord::Base + belongs_to :user + + before_create :generate_token + + private + def generate_token + self.token = SecureRandom.uuid.gsub(/\-/,'') + end + +end diff --git a/app/models/user.rb b/app/models/user.rb index bd3bf477..a8fb6e6b 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -6,6 +6,7 @@ class User < ActiveRecord::Base has_many :synapses has_many :maps has_many :mappings + has_many :tokens after_create :generate_code @@ -40,6 +41,10 @@ class User < ActiveRecord::Base # Validate the attached image is image/jpg, image/png, etc validates_attachment_content_type :image, :content_type => /\Aimage\/.*\Z/ + def is_logged_in? + true + end + # override default as_json def as_json(options={}) { :id => self.id, diff --git a/app/serializers/map_serializer.rb b/app/serializers/map_serializer.rb new file mode 100644 index 00000000..b9839782 --- /dev/null +++ b/app/serializers/map_serializer.rb @@ -0,0 +1,20 @@ +class MapSerializer < ActiveModel::Serializer + embed :ids, include: true + attributes :id, + :name, + :desc, + :permission, + :screenshot, + :created_at, + :updated_at + + has_many :topics + has_many :synapses + has_many :mappings + has_many :contributors, root: :users + + #def filter(keys) + # keys.delete(:outcome_author) unless object.outcome_author.present? + # keys + #end +end diff --git a/app/serializers/mapping_serializer.rb b/app/serializers/mapping_serializer.rb new file mode 100644 index 00000000..400c35ba --- /dev/null +++ b/app/serializers/mapping_serializer.rb @@ -0,0 +1,17 @@ +class MappingSerializer < ActiveModel::Serializer + embed :ids, include: true + attributes :id, + :xloc, + :yloc, + :created_at, + :updated_at + has_one :user + has_one :map + has_one :mappable, polymorphic: true + + def filter(keys) + keys.delete(:xloc) unless object.mappable_type == "Topic" + keys.delete(:yloc) unless object.mappable_type == "Topic" + keys + end +end diff --git a/app/serializers/metacode_serializer.rb b/app/serializers/metacode_serializer.rb new file mode 100644 index 00000000..3918d274 --- /dev/null +++ b/app/serializers/metacode_serializer.rb @@ -0,0 +1,7 @@ +class MetacodeSerializer < ActiveModel::Serializer + attributes :id, + :name, + :manual_icon, + :color, + :aws_icon +end diff --git a/app/serializers/synapse_serializer.rb b/app/serializers/synapse_serializer.rb new file mode 100644 index 00000000..77c3a159 --- /dev/null +++ b/app/serializers/synapse_serializer.rb @@ -0,0 +1,19 @@ +class SynapseSerializer < ActiveModel::Serializer + embed :ids, include: true + attributes :id, + :desc, + :category, + :weight, + :permission, + :created_at, + :updated_at + + has_one :topic1, root: :topics + has_one :topic2, root: :topics + has_one :user + + #def filter(keys) + # keys.delete(:outcome_author) unless object.outcome_author.present? + # keys + #end +end diff --git a/app/serializers/token_serializer.rb b/app/serializers/token_serializer.rb new file mode 100644 index 00000000..777a14c1 --- /dev/null +++ b/app/serializers/token_serializer.rb @@ -0,0 +1,14 @@ +class TokenSerializer < ActiveModel::Serializer + embed :ids, include: true + attributes :id, + :token, + :description, + :user_id, + :created_at, + :updated_at + + #def filter(keys) + # keys.delete(:outcome_author) unless object.outcome_author.present? + # keys + #end +end diff --git a/app/serializers/topic_serializer.rb b/app/serializers/topic_serializer.rb new file mode 100644 index 00000000..205b8178 --- /dev/null +++ b/app/serializers/topic_serializer.rb @@ -0,0 +1,18 @@ +class TopicSerializer < ActiveModel::Serializer + embed :ids, include: true + attributes :id, + :name, + :desc, + :link, + :permission, + :created_at, + :updated_at + + has_one :user + has_one :metacode + + #def filter(keys) + # keys.delete(:outcome_author) unless object.outcome_author.present? + # keys + #end +end diff --git a/app/serializers/user_serializer.rb b/app/serializers/user_serializer.rb new file mode 100644 index 00000000..b9a3b416 --- /dev/null +++ b/app/serializers/user_serializer.rb @@ -0,0 +1,15 @@ +class UserSerializer < ActiveModel::Serializer + attributes :id, + :name, + :avatar, + :is_admin, + :generation + + def avatar + object.image.url(:sixtyfour) + end + + def is_admin + object.admin + end +end diff --git a/config/routes.rb b/config/routes.rb index a3ab6e3a..1b0e5295 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -9,6 +9,16 @@ Metamaps::Application.routes.draw do get 'search/mappers', to: 'main#searchmappers', as: :searchmappers get 'search/synapses', to: 'main#searchsynapses', as: :searchsynapses + namespace :api, path: '/api/v1', defaults: {format: :json} do + resources :maps, only: [:create, :show, :update, :destroy] + resources :synapses, only: [:create, :show, :update, :destroy] + resources :topics, only: [:create, :show, :update, :destroy] + resources :mappings, only: [:create, :show, :update, :destroy] + resources :tokens, only: [ :create, :destroy] do + get :my_tokens, on: :collection + end + end + resources :mappings, except: [:index, :new, :edit] resources :metacode_sets, :except => [:show] resources :metacodes, :except => [:show, :destroy] diff --git a/db/migrate/20160310200131_create_tokens.rb b/db/migrate/20160310200131_create_tokens.rb new file mode 100644 index 00000000..7b9272a5 --- /dev/null +++ b/db/migrate/20160310200131_create_tokens.rb @@ -0,0 +1,11 @@ +class CreateTokens < ActiveRecord::Migration + def change + create_table :tokens do |t| + t.string :token + t.string :description + t.references :user, index: true, foreign_key: true + + t.timestamps null: false + end + end +end diff --git a/db/schema.rb b/db/schema.rb index e6a9bd11..334fd4ad 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -11,7 +11,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema.define(version: 20160223061711) do +ActiveRecord::Schema.define(version: 20160310200131) do # These are extensions that must be enabled in order to support this database enable_extension "plpgsql" @@ -117,6 +117,16 @@ ActiveRecord::Schema.define(version: 20160223061711) do add_index "synapses", ["node2_id"], name: "index_synapses_on_node2_id", using: :btree add_index "synapses", ["user_id"], name: "index_synapses_on_user_id", using: :btree + create_table "tokens", force: :cascade do |t| + t.string "token" + t.string "description" + t.integer "user_id" + t.datetime "created_at", null: false + t.datetime "updated_at", null: false + end + + add_index "tokens", ["user_id"], name: "index_tokens_on_user_id", using: :btree + create_table "topics", force: :cascade do |t| t.text "name" t.text "desc" @@ -171,4 +181,5 @@ ActiveRecord::Schema.define(version: 20160223061711) do add_index "users", ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true, using: :btree + add_foreign_key "tokens", "users" end diff --git a/postatoken.txt b/postatoken.txt new file mode 100644 index 00000000..c9d98ff3 --- /dev/null +++ b/postatoken.txt @@ -0,0 +1,7 @@ +$.post('http://localhost:3000/api/v1/tokens', {token: { + description: 'for stuff', + token: '1234', + user_id: 2 +}}) + +curl -X POST -d @postdata.txt http://localhost:3000/api/v1/maps --header "Authorization: Token token=fb5b3db125c94e9fb50f1e42054be856" --header "Content-Type:application/json" diff --git a/postdata.txt b/postdata.txt new file mode 100644 index 00000000..9daaf598 --- /dev/null +++ b/postdata.txt @@ -0,0 +1 @@ +{ "map": { "name":"tree", "desc": "green", "permission": "commons", "arranged": true }} diff --git a/postmapping.txt b/postmapping.txt new file mode 100644 index 00000000..c9463f92 --- /dev/null +++ b/postmapping.txt @@ -0,0 +1 @@ +{ "mapping": { "xloc": 123, "yloc": 123, "map_id": 1, "mappable_type": "Topic", "mappable_id": 2 }} diff --git a/postsynapse.txt b/postsynapse.txt new file mode 100644 index 00000000..da2617d8 --- /dev/null +++ b/postsynapse.txt @@ -0,0 +1 @@ +{ "synapse": { "desc": "link between", "permission": "commons", "node1_id": 1, "node2_id": 2, "category": "from-to" }} diff --git a/posttopic.txt b/posttopic.txt new file mode 100644 index 00000000..e00d797f --- /dev/null +++ b/posttopic.txt @@ -0,0 +1 @@ +{ "topic": { "name":"tree topic", "desc": "so green", "permission": "commons", "metacode_id": 1 }} diff --git a/spec/models/token_spec.rb b/spec/models/token_spec.rb new file mode 100644 index 00000000..18bba17d --- /dev/null +++ b/spec/models/token_spec.rb @@ -0,0 +1,5 @@ +require 'rails_helper' + +RSpec.describe Token, type: :model do + pending "add some examples to (or delete) #{__FILE__}" +end From ccfba03fdb1ed5a858f3573f84026ee90c0b7c77 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Fri, 11 Mar 2016 17:26:54 +1100 Subject: [PATCH 03/23] clean up duplicate code --- app/controllers/api/mappings_controller.rb | 8 -------- app/controllers/api/maps_controller.rb | 8 -------- app/controllers/api/restful_controller.rb | 8 ++++++++ app/controllers/api/synapses_controller.rb | 8 -------- app/controllers/api/tokens_controller.rb | 10 +--------- app/controllers/api/topics_controller.rb | 8 -------- 6 files changed, 9 insertions(+), 41 deletions(-) diff --git a/app/controllers/api/mappings_controller.rb b/app/controllers/api/mappings_controller.rb index 83892b9a..426c9dbe 100644 --- a/app/controllers/api/mappings_controller.rb +++ b/app/controllers/api/mappings_controller.rb @@ -1,11 +1,3 @@ class Api::MappingsController < API::RestfulController - def create - raise CanCan::AccessDenied.new unless current_user.is_logged_in? - instantiate_resouce - resource.user = current_user - create_action - respond_with_resource - end - end diff --git a/app/controllers/api/maps_controller.rb b/app/controllers/api/maps_controller.rb index 2f86d254..7b805280 100644 --- a/app/controllers/api/maps_controller.rb +++ b/app/controllers/api/maps_controller.rb @@ -1,11 +1,3 @@ class Api::MapsController < API::RestfulController - def create - raise CanCan::AccessDenied.new unless current_user.is_logged_in? - instantiate_resouce - resource.user = current_user - create_action - respond_with_resource - end - end diff --git a/app/controllers/api/restful_controller.rb b/app/controllers/api/restful_controller.rb index 8289583d..d56783a0 100644 --- a/app/controllers/api/restful_controller.rb +++ b/app/controllers/api/restful_controller.rb @@ -1,6 +1,14 @@ class API::RestfulController < ActionController::Base snorlax_used_rest! + def create + raise CanCan::AccessDenied.new unless current_user.is_logged_in? + instantiate_resouce + resource.user = current_user + create_action + respond_with_resource + end + def show load_resource raise AccessDenied.new unless resource.authorize_to_show(current_user) diff --git a/app/controllers/api/synapses_controller.rb b/app/controllers/api/synapses_controller.rb index de435df3..f133ffd0 100644 --- a/app/controllers/api/synapses_controller.rb +++ b/app/controllers/api/synapses_controller.rb @@ -1,11 +1,3 @@ class Api::SynapsesController < API::RestfulController - def create - raise CanCan::AccessDenied.new unless current_user.is_logged_in? - instantiate_resouce - resource.user = current_user - create_action - respond_with_resource - end - end diff --git a/app/controllers/api/tokens_controller.rb b/app/controllers/api/tokens_controller.rb index 2b2ff8df..cc54e531 100644 --- a/app/controllers/api/tokens_controller.rb +++ b/app/controllers/api/tokens_controller.rb @@ -1,13 +1,5 @@ class Api::TokensController < API::RestfulController - - def create - raise CanCan::AccessDenied.new unless current_user.is_logged_in? - instantiate_resouce - resource.user = current_user - create_action - respond_with_resource - end - + def my_tokens raise CanCan::AccessDenied.new unless current_user.is_logged_in? instantiate_collection page_collection: false, timeframe_collection: false diff --git a/app/controllers/api/topics_controller.rb b/app/controllers/api/topics_controller.rb index ded6a5e6..f3633544 100644 --- a/app/controllers/api/topics_controller.rb +++ b/app/controllers/api/topics_controller.rb @@ -1,11 +1,3 @@ class Api::TopicsController < API::RestfulController - def create - raise CanCan::AccessDenied.new unless current_user.is_logged_in? - instantiate_resouce - resource.user = current_user - create_action - respond_with_resource - end - end From 669b337d04815d136d5b97ee3af638509fcc7a46 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 09:37:18 +1100 Subject: [PATCH 04/23] changes for api --- Gemfile | 2 ++ Gemfile.lock | 10 +++++++--- app/controllers/api/restful_controller.rb | 24 +++++++++++++++-------- app/controllers/api/tokens_controller.rb | 4 +++- app/models/logged_out_user.rb | 7 ------- 5 files changed, 28 insertions(+), 19 deletions(-) delete mode 100644 app/models/logged_out_user.rb diff --git a/Gemfile b/Gemfile index a0600ced..b7ea08e9 100644 --- a/Gemfile +++ b/Gemfile @@ -7,6 +7,8 @@ gem 'devise' gem 'redis' gem 'pg' gem 'pundit' +gem 'cancan' +gem 'pundit_extra' gem 'formula' gem 'formtastic' gem 'json' diff --git a/Gemfile.lock b/Gemfile.lock index 9e9731a6..a2a3b031 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -56,8 +56,9 @@ GEM binding_of_caller (0.7.2) debug_inspector (>= 0.0.1) builder (3.2.2) - byebug (5.0.0) - columnize (= 0.9.0) + byebug (8.2.2) + cancan (1.6.10) + cancancan (1.10.1) climate_control (0.0.3) activesupport (>= 3.0) cocaine (0.5.8) @@ -144,6 +145,7 @@ GEM pry (>= 0.9.10) pundit (1.1.0) activesupport (>= 3.0.0) + pundit_extra (0.1.1) quiet_assets (1.1.0) railties (>= 3.1, < 5.0) rack (1.6.4) @@ -180,7 +182,7 @@ GEM activesupport (= 4.2.4) rake (>= 0.8.7) thor (>= 0.18.1, < 2.0) - rake (11.0.1) + rake (11.1.0) redis (3.2.2) responders (2.1.1) railties (>= 4.2.0, < 5.1) @@ -251,6 +253,7 @@ DEPENDENCIES best_in_place better_errors binding_of_caller + cancan coffee-rails devise dotenv @@ -268,6 +271,7 @@ DEPENDENCIES pry-byebug pry-rails pundit + pundit_extra quiet_assets rails (= 4.2.4) rails3-jquery-autocomplete diff --git a/app/controllers/api/restful_controller.rb b/app/controllers/api/restful_controller.rb index d56783a0..ca7ff481 100644 --- a/app/controllers/api/restful_controller.rb +++ b/app/controllers/api/restful_controller.rb @@ -1,24 +1,32 @@ class API::RestfulController < ActionController::Base + include Pundit + include PunditExtra + snorlax_used_rest! + rescue_from(Pundit::NotAuthorizedError) { |e| respond_with_standard_error e, 403 } + load_and_authorize_resource except: [:index, :create] + def create - raise CanCan::AccessDenied.new unless current_user.is_logged_in? + authorize resource_class instantiate_resouce resource.user = current_user create_action respond_with_resource end - def show - load_resource - raise AccessDenied.new unless resource.authorize_to_show(current_user) - respond_with_resource - end - private + def accessible_records + if current_user + visible_records + else + public_records + end + end + def current_user - super || token_user || LoggedOutUser.new + super || token_user || nil end def token_user diff --git a/app/controllers/api/tokens_controller.rb b/app/controllers/api/tokens_controller.rb index cc54e531..6ef01e69 100644 --- a/app/controllers/api/tokens_controller.rb +++ b/app/controllers/api/tokens_controller.rb @@ -1,7 +1,9 @@ class Api::TokensController < API::RestfulController + + skip_authorization def my_tokens - raise CanCan::AccessDenied.new unless current_user.is_logged_in? + raise Pundit::NotAuthorizedError.new unless current_user.is_logged_in? instantiate_collection page_collection: false, timeframe_collection: false respond_with_collection end diff --git a/app/models/logged_out_user.rb b/app/models/logged_out_user.rb deleted file mode 100644 index 14e0cfb9..00000000 --- a/app/models/logged_out_user.rb +++ /dev/null @@ -1,7 +0,0 @@ -class LoggedOutUser - - FALSE_METHODS = [:is_logged_in?] - - FALSE_METHODS.each { |method| define_method(method, -> { false }) } - -end From 450db5eb8d2e641eefcfa1b9642223108d12a943 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 09:37:32 +1100 Subject: [PATCH 05/23] changes for pundit --- app/controllers/application_controller.rb | 1 + app/controllers/main_controller.rb | 4 +-- app/controllers/maps_controller.rb | 36 ++++++++--------------- app/models/map.rb | 29 ------------------ app/models/synapse.rb | 26 ---------------- app/models/topic.rb | 27 ----------------- app/policies/application_policy.rb | 2 +- app/policies/map_policy.rb | 2 +- app/policies/mapping_policy.rb | 2 +- 9 files changed, 19 insertions(+), 110 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 6d10c553..d030c6e6 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,5 +1,6 @@ class ApplicationController < ActionController::Base include Pundit + include PunditExtra rescue_from Pundit::NotAuthorizedError, with: :handle_unauthorized protect_from_forgery diff --git a/app/controllers/main_controller.rb b/app/controllers/main_controller.rb index 29c11777..efebdce7 100644 --- a/app/controllers/main_controller.rb +++ b/app/controllers/main_controller.rb @@ -4,8 +4,8 @@ class MainController < ApplicationController include UsersHelper include SynapsesHelper - after_action :verify_authorized, except: :index - after_action :verify_policy_scoped, only: :index +# after_action :verify_authorized, except: :index +# after_action :verify_policy_scoped, only: :index respond_to :html, :json diff --git a/app/controllers/maps_controller.rb b/app/controllers/maps_controller.rb index a778de9a..fd169083 100644 --- a/app/controllers/maps_controller.rb +++ b/app/controllers/maps_controller.rb @@ -1,8 +1,8 @@ class MapsController < ApplicationController before_action :require_user, only: [:create, :update, :screenshot, :destroy] - after_action :verify_authorized, except: :activemaps, :featuredmaps, :mymaps, :usermaps - after_action :verify_policy_scoped, only: :activemaps, :featuredmaps, :mymaps, :usermaps + after_action :verify_authorized, except: [:activemaps, :featuredmaps, :mymaps, :usermaps] + after_action :verify_policy_scoped, only: [:activemaps, :featuredmaps, :mymaps, :usermaps] respond_to :html, :json @@ -68,11 +68,7 @@ class MapsController < ApplicationController # GET maps/:id def show @map = Map.find(params[:id]) - authorize! @map - - if not @map - redirect_to root_url, notice: "Access denied. That map is private." and return - end + authorize @map respond_to do |format| format.html { @@ -86,18 +82,14 @@ class MapsController < ApplicationController respond_with(@allmappers, @allmappings, @allsynapses, @alltopics, @map) } - format.json { render json: @map } + format.json { render json: @map.as_json } end end # GET maps/:id/contains def contains @map = Map.find(params[:id]) - authorize! @map - - if not @map - redirect_to root_url, notice: "Access denied. That map is private." and return - end + authorize @map @allmappers = @map.contributors @alltopics = @map.topics.to_a.delete_if {|t| t.permission == "private" && (!authenticated? || (authenticated? && current_user.id != t.user_id)) } @@ -140,7 +132,7 @@ class MapsController < ApplicationController mapping.xloc = topic[1] mapping.yloc = topic[2] @map.topicmappings << mapping - authorize! mapping, :create + authorize mapping, :create mapping.save end @@ -153,7 +145,7 @@ class MapsController < ApplicationController mapping.map = @map mapping.mappable = Synapse.find(synapse_id) @map.synapsemappings << mapping - authorize! mapping, :create + authorize mapping, :create mapping.save end end @@ -161,7 +153,7 @@ class MapsController < ApplicationController @map.arranged = true end - authorize! @map + authorize @map if @map.save respond_to do |format| @@ -177,12 +169,10 @@ class MapsController < ApplicationController # PUT maps/:id def update @map = Map.find(params[:id]) - authorize! @map + authorize @map respond_to do |format| - if !@map - format.json { render json: "unauthorized" } - elsif @map.update_attributes(map_params) + if @map.update_attributes(map_params) format.json { head :no_content } else format.json { render json: @map.errors, status: :unprocessable_entity } @@ -193,7 +183,7 @@ class MapsController < ApplicationController # POST maps/:id/upload_screenshot def screenshot @map = Map.find(params[:id]) - authorize! @map + authorize @map png = Base64.decode64(params[:encoded_image]['data:image/png;base64,'.length .. -1]) StringIO.open(png) do |data| @@ -213,7 +203,7 @@ class MapsController < ApplicationController # DELETE maps/:id def destroy @map = Map.find(params[:id]) - authorize! @map + authorize @map @map.delete @@ -228,6 +218,6 @@ class MapsController < ApplicationController # Never trust parameters from the scary internet, only allow the white list through. def map_params - params.require(:map).permit(:id, :name, :arranged, :desc, :permission, :user_id) + params.require(:map).permit(:id, :name, :arranged, :desc, :permission) end end diff --git a/app/models/map.rb b/app/models/map.rb index 6c2caca2..87c8d641 100644 --- a/app/models/map.rb +++ b/app/models/map.rb @@ -78,36 +78,7 @@ class Map < ActiveRecord::Base json[:updated_at_clean] = updated_at_str json end - - ##### PERMISSIONS ###### - def authorize_to_delete(user) - if (self.user != user) - return false - end - return self - end - - # returns false if user not allowed to 'show' Topic, Synapse, or Map - def authorize_to_show(user) - if (self.permission == "private" && self.user != user) - return false - end - return self - end - - # returns false if user not allowed to 'edit' Topic, Synapse, or Map - def authorize_to_edit(user) - if !user - return false - elsif (self.permission == "private" && self.user != user) - return false - elsif (self.permission == "public" && self.user != user) - return false - end - return self - end - def decode_base64(imgBase64) decoded_data = Base64.decode64(imgBase64) diff --git a/app/models/synapse.rb b/app/models/synapse.rb index c766d95c..d545a25c 100644 --- a/app/models/synapse.rb +++ b/app/models/synapse.rb @@ -34,30 +34,4 @@ class Synapse < ActiveRecord::Base end # :nocov: - ##### PERMISSIONS ###### - - # returns false if user not allowed to 'show' Topic, Synapse, or Map - def authorize_to_show(user) - if (self.permission == "private" && self.user != user) - return false - end - return self - end - - # returns false if user not allowed to 'edit' Topic, Synapse, or Map - def authorize_to_edit(user) - if (self.permission == "private" && self.user != user) - return false - elsif (self.permission == "public" && self.user != user) - return false - end - return self - end - - def authorize_to_delete(user) - if (self.user == user || user.admin) - return self - end - return false - end end diff --git a/app/models/topic.rb b/app/models/topic.rb index c528aa6e..0039040e 100644 --- a/app/models/topic.rb +++ b/app/models/topic.rb @@ -87,31 +87,4 @@ class Topic < ActiveRecord::Base end result end - - ##### PERMISSIONS ###### - - # returns false if user not allowed to 'show' Topic, Synapse, or Map - def authorize_to_show(user) - if (self.permission == "private" && self.user != user) - return false - end - return self - end - - # returns false if user not allowed to 'edit' Topic, Synapse, or Map - def authorize_to_edit(user) - if (self.permission == "private" && self.user != user) - return false - elsif (self.permission == "public" && self.user != user) - return false - end - return self - end - - def authorize_to_delete(user) - if (self.user == user || user.admin) - return self - end - return false - end end diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb index 6bd56c64..39b7a961 100644 --- a/app/policies/application_policy.rb +++ b/app/policies/application_policy.rb @@ -39,7 +39,7 @@ class ApplicationPolicy # explicitly say they want to (E.g. seeing/editing/deleting private # maps - they should be able to, but not by accident) def admin_override - user.admin + user && user.admin end def scope diff --git a/app/policies/map_policy.rb b/app/policies/map_policy.rb index 671eea83..5e845d44 100644 --- a/app/policies/map_policy.rb +++ b/app/policies/map_policy.rb @@ -1,7 +1,7 @@ class MapPolicy < ApplicationPolicy class Scope < Scope def resolve - scope.where('permission IN ("public", "commons") OR user_id = ?', user.id) + scope.where('maps.permission IN (?) OR maps.user_id = ?', ["public", "commons"], user.id) end end diff --git a/app/policies/mapping_policy.rb b/app/policies/mapping_policy.rb index 44e7bfd7..49e134ef 100644 --- a/app/policies/mapping_policy.rb +++ b/app/policies/mapping_policy.rb @@ -5,7 +5,7 @@ class MappingPolicy < ApplicationPolicy # it would be nice if we could also base this on the mappable, but that # gets really complicated. Devin thinks it's OK to SHOW a mapping for # a private topic, since you can't see the private topic anyways - scope.joins(:maps).where('maps.permission IN ("public", "commons") OR user_id = ?', user.id) + scope.joins(:maps).where('maps.permission IN ("public", "commons") OR maps.user_id = ?', user.id) end end From 77d39d664999935b6ac112e6e1c2adfcef05e4f9 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 09:48:07 +1100 Subject: [PATCH 06/23] redid so they won't interfere --- .../{map_serializer.rb => new_map_serializer.rb} | 10 +++++----- ...mapping_serializer.rb => new_mapping_serializer.rb} | 8 ++++---- ...tacode_serializer.rb => new_metacode_serializer.rb} | 2 +- ...synapse_serializer.rb => new_synapse_serializer.rb} | 8 ++++---- .../{topic_serializer.rb => new_topic_serializer.rb} | 6 +++--- .../{user_serializer.rb => new_user_serializer.rb} | 2 +- 6 files changed, 18 insertions(+), 18 deletions(-) rename app/serializers/{map_serializer.rb => new_map_serializer.rb} (52%) rename app/serializers/{mapping_serializer.rb => new_mapping_serializer.rb} (61%) rename app/serializers/{metacode_serializer.rb => new_metacode_serializer.rb} (67%) rename app/serializers/{synapse_serializer.rb => new_synapse_serializer.rb} (56%) rename app/serializers/{topic_serializer.rb => new_topic_serializer.rb} (66%) rename app/serializers/{user_serializer.rb => new_user_serializer.rb} (80%) diff --git a/app/serializers/map_serializer.rb b/app/serializers/new_map_serializer.rb similarity index 52% rename from app/serializers/map_serializer.rb rename to app/serializers/new_map_serializer.rb index b9839782..1e27420b 100644 --- a/app/serializers/map_serializer.rb +++ b/app/serializers/new_map_serializer.rb @@ -1,4 +1,4 @@ -class MapSerializer < ActiveModel::Serializer +class NewMapSerializer < ActiveModel::Serializer embed :ids, include: true attributes :id, :name, @@ -8,10 +8,10 @@ class MapSerializer < ActiveModel::Serializer :created_at, :updated_at - has_many :topics - has_many :synapses - has_many :mappings - has_many :contributors, root: :users + has_many :topics, serializer: NewTopicSerializer + has_many :synapses, serializer: NewSynapseSerializer + has_many :mappings, serializer: NewMappingSerializer + has_many :contributors, root: :users, serializer: NewUserSerializer #def filter(keys) # keys.delete(:outcome_author) unless object.outcome_author.present? diff --git a/app/serializers/mapping_serializer.rb b/app/serializers/new_mapping_serializer.rb similarity index 61% rename from app/serializers/mapping_serializer.rb rename to app/serializers/new_mapping_serializer.rb index 400c35ba..9241305a 100644 --- a/app/serializers/mapping_serializer.rb +++ b/app/serializers/new_mapping_serializer.rb @@ -1,13 +1,13 @@ -class MappingSerializer < ActiveModel::Serializer +class NewMappingSerializer < ActiveModel::Serializer embed :ids, include: true attributes :id, :xloc, :yloc, :created_at, :updated_at - has_one :user - has_one :map - has_one :mappable, polymorphic: true + has_one :user, serializer: NewUserSerializer + has_one :map, serializer: NewMapSerializer + has_one :mappable, polymorphic: true ##? def filter(keys) keys.delete(:xloc) unless object.mappable_type == "Topic" diff --git a/app/serializers/metacode_serializer.rb b/app/serializers/new_metacode_serializer.rb similarity index 67% rename from app/serializers/metacode_serializer.rb rename to app/serializers/new_metacode_serializer.rb index 3918d274..e664e7ea 100644 --- a/app/serializers/metacode_serializer.rb +++ b/app/serializers/new_metacode_serializer.rb @@ -1,4 +1,4 @@ -class MetacodeSerializer < ActiveModel::Serializer +class NewMetacodeSerializer < ActiveModel::Serializer attributes :id, :name, :manual_icon, diff --git a/app/serializers/synapse_serializer.rb b/app/serializers/new_synapse_serializer.rb similarity index 56% rename from app/serializers/synapse_serializer.rb rename to app/serializers/new_synapse_serializer.rb index 77c3a159..e7cd9fd7 100644 --- a/app/serializers/synapse_serializer.rb +++ b/app/serializers/new_synapse_serializer.rb @@ -1,4 +1,4 @@ -class SynapseSerializer < ActiveModel::Serializer +class NewSynapseSerializer < ActiveModel::Serializer embed :ids, include: true attributes :id, :desc, @@ -8,9 +8,9 @@ class SynapseSerializer < ActiveModel::Serializer :created_at, :updated_at - has_one :topic1, root: :topics - has_one :topic2, root: :topics - has_one :user + has_one :topic1, root: :topics, serializer: NewTopicSerializer + has_one :topic2, root: :topics, serializer: NewTopicSerializer + has_one :user, serializer: NewUserSerializer #def filter(keys) # keys.delete(:outcome_author) unless object.outcome_author.present? diff --git a/app/serializers/topic_serializer.rb b/app/serializers/new_topic_serializer.rb similarity index 66% rename from app/serializers/topic_serializer.rb rename to app/serializers/new_topic_serializer.rb index 205b8178..d36f1db0 100644 --- a/app/serializers/topic_serializer.rb +++ b/app/serializers/new_topic_serializer.rb @@ -1,4 +1,4 @@ -class TopicSerializer < ActiveModel::Serializer +class NewTopicSerializer < ActiveModel::Serializer embed :ids, include: true attributes :id, :name, @@ -8,8 +8,8 @@ class TopicSerializer < ActiveModel::Serializer :created_at, :updated_at - has_one :user - has_one :metacode + has_one :user, serializer: NewUserSerializer + has_one :metacode, serializer: NewMetacodeSerializer #def filter(keys) # keys.delete(:outcome_author) unless object.outcome_author.present? diff --git a/app/serializers/user_serializer.rb b/app/serializers/new_user_serializer.rb similarity index 80% rename from app/serializers/user_serializer.rb rename to app/serializers/new_user_serializer.rb index b9a3b416..45be36b0 100644 --- a/app/serializers/user_serializer.rb +++ b/app/serializers/new_user_serializer.rb @@ -1,4 +1,4 @@ -class UserSerializer < ActiveModel::Serializer +class NewUserSerializer < ActiveModel::Serializer attributes :id, :name, :avatar, From 623b3c7ad7ae2b9c8a4703b812bcbc50e60b2306 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 09:54:23 +1100 Subject: [PATCH 07/23] can load maps --- app/views/layouts/application.html.erb | 2 +- app/views/maps/_mapinfobox.html.erb | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index c09d227e..0480cb39 100644 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -81,7 +81,7 @@ classes += controller_name == "maps" && action_name == "index" ? " explorePage" : "" if controller_name == "maps" && action_name == "show" classes += " mapPage" - if @map.authorize_to_edit(current_user) + if policy(@map).update? classes += " canEditMap" end if @map.permission == "commons" diff --git a/app/views/maps/_mapinfobox.html.erb b/app/views/maps/_mapinfobox.html.erb index 1fa6da02..ff90532c 100644 --- a/app/views/maps/_mapinfobox.html.erb +++ b/app/views/maps/_mapinfobox.html.erb @@ -4,7 +4,7 @@ #%>
- <%= @map && @map.authorize_to_edit(user) ? " canEdit" : "" %> + <%= @map && policy(@map).update? ? " canEdit" : "" %> <%= @map && @map.permission != 'private' ? " shareable" : "" %>"> <% if @map %> @@ -41,7 +41,7 @@
- <% if (authenticated? && @map.authorize_to_edit(user)) || (!authenticated? && @map.desc != "" && @map.desc != nil )%> + <% if (authenticated? && policy(@map).update?) || (!authenticated? && @map.desc != "" && @map.desc != nil )%> <%= best_in_place @map, :desc, :activator => "#mapInfoDesc", :as => :textarea, :placeholder => "Click to add description...", :class => 'best_in_place_desc' %> <% end %>
From fc1a7fd23d2e10f6db4f1844694ad0c7114db27d Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 10:05:42 +1100 Subject: [PATCH 08/23] api: adjust serializers --- app/controllers/api/restful_controller.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/app/controllers/api/restful_controller.rb b/app/controllers/api/restful_controller.rb index ca7ff481..d6c544e2 100644 --- a/app/controllers/api/restful_controller.rb +++ b/app/controllers/api/restful_controller.rb @@ -17,6 +17,10 @@ class API::RestfulController < ActionController::Base private + def resource_serializer + "new_#{resource_name}_serializer".camelize.constantize + end + def accessible_records if current_user visible_records From 0095a8daf42b0b5dbf8a05e6e5ccdc53d4bb8ab0 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 10:06:00 +1100 Subject: [PATCH 09/23] pundit: syntax error --- app/controllers/topics_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/topics_controller.rb b/app/controllers/topics_controller.rb index 125005f9..e9239bac 100644 --- a/app/controllers/topics_controller.rb +++ b/app/controllers/topics_controller.rb @@ -24,7 +24,7 @@ class TopicsController < ApplicationController respond_to do |format| format.html { - @alltopics = ([@topic] + policy_scope(@topic.relatives) + @alltopics = ([@topic] + policy_scope(@topic.relatives)) @allsynapses = policy_scope(@topic.synapses) @allcreators = @alltopics.map(&:user).uniq From c7075dab48c80cdfede708d0d95ee7390d366f12 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 10:10:31 +1100 Subject: [PATCH 10/23] pundit: fix queries --- app/policies/mapping_policy.rb | 3 ++- app/policies/synapse_policy.rb | 2 +- app/policies/topic_policy.rb | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/app/policies/mapping_policy.rb b/app/policies/mapping_policy.rb index 49e134ef..39dbd86a 100644 --- a/app/policies/mapping_policy.rb +++ b/app/policies/mapping_policy.rb @@ -5,7 +5,8 @@ class MappingPolicy < ApplicationPolicy # it would be nice if we could also base this on the mappable, but that # gets really complicated. Devin thinks it's OK to SHOW a mapping for # a private topic, since you can't see the private topic anyways - scope.joins(:maps).where('maps.permission IN ("public", "commons") OR maps.user_id = ?', user.id) + scope.joins(:maps).where('maps.permission IN (?) OR maps.user_id = ?', + ["public", "commons"], user.id) end end diff --git a/app/policies/synapse_policy.rb b/app/policies/synapse_policy.rb index 6763014a..12f9c8ca 100644 --- a/app/policies/synapse_policy.rb +++ b/app/policies/synapse_policy.rb @@ -1,7 +1,7 @@ class SynapsePolicy < ApplicationPolicy class Scope < Scope def resolve - scope.where('permission IN ("public", "commons") OR user_id = ?', user.id) + scope.where('permission IN (?) OR user_id = ?', ["public", "commons"], user.id) end end diff --git a/app/policies/topic_policy.rb b/app/policies/topic_policy.rb index 03b42895..97fefdcc 100644 --- a/app/policies/topic_policy.rb +++ b/app/policies/topic_policy.rb @@ -1,7 +1,7 @@ class TopicPolicy < ApplicationPolicy class Scope < Scope def resolve - scope.where('permission IN ("public", "commons") OR user_id = ?', user.id) + scope.where('permission IN (?) OR user_id = ?', ["public", "commons"], user.id) end end From 09a7b336bf1200f4368852dc9e1535cc7c050983 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 10:13:22 +1100 Subject: [PATCH 11/23] pundit: exclude topic action --- app/controllers/topics_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/topics_controller.rb b/app/controllers/topics_controller.rb index e9239bac..0d58d912 100644 --- a/app/controllers/topics_controller.rb +++ b/app/controllers/topics_controller.rb @@ -2,7 +2,7 @@ class TopicsController < ApplicationController include TopicsHelper before_action :require_user, only: [:create, :update, :destroy] - after_action :verify_authorized + after_action :verify_authorized, except: :autocomplete_topic respond_to :html, :js, :json From bef21341c6a1ae7cccd2f89705087661746c9c25 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 11:10:30 +1100 Subject: [PATCH 12/23] pundit: fixing up topics and synapses --- app/controllers/synapses_controller.rb | 8 ++++---- app/controllers/topics_controller.rb | 16 ++++++++-------- app/models/synapse.rb | 4 ++++ app/models/topic.rb | 7 +++++++ app/policies/synapse_policy.rb | 2 +- app/policies/topic_policy.rb | 2 +- 6 files changed, 25 insertions(+), 14 deletions(-) diff --git a/app/controllers/synapses_controller.rb b/app/controllers/synapses_controller.rb index f242ad38..4440872f 100644 --- a/app/controllers/synapses_controller.rb +++ b/app/controllers/synapses_controller.rb @@ -10,7 +10,7 @@ class SynapsesController < ApplicationController # GET /synapses/1.json def show @synapse = Synapse.find(params[:id]) - authorize! @synapse + authorize @synapse render json: @synapse end @@ -20,7 +20,7 @@ class SynapsesController < ApplicationController def create @synapse = Synapse.new(synapse_params) @synapse.desc = "" if @synapse.desc.nil? - authorize! @synapse + authorize @synapse respond_to do |format| if @synapse.save @@ -36,7 +36,7 @@ class SynapsesController < ApplicationController def update @synapse = Synapse.find(params[:id]) @synapse.desc = "" if @synapse.desc.nil? - authorize! @synapse + authorize @synapse respond_to do |format| if @synapse.update_attributes(synapse_params) @@ -50,7 +50,7 @@ class SynapsesController < ApplicationController # DELETE synapses/:id def destroy @synapse = Synapse.find(params[:id]) - authorize! @synapse + authorize @synapse @synapse.delete respond_to do |format| diff --git a/app/controllers/topics_controller.rb b/app/controllers/topics_controller.rb index 0d58d912..1b1e9b3c 100644 --- a/app/controllers/topics_controller.rb +++ b/app/controllers/topics_controller.rb @@ -20,12 +20,12 @@ class TopicsController < ApplicationController # GET topics/:id def show @topic = Topic.find(params[:id]) - authorize! @topic + authorize @topic respond_to do |format| format.html { - @alltopics = ([@topic] + policy_scope(@topic.relatives)) - @allsynapses = policy_scope(@topic.synapses) + @alltopics = ([@topic] + policy_scope(Topic.relatives(@topic.id))) + @allsynapses = policy_scope(Synapse.for_topic(@topic.id)) @allcreators = @alltopics.map(&:user).uniq @allcreators += @allsynapses.map(&:user).uniq @@ -39,7 +39,7 @@ class TopicsController < ApplicationController # GET topics/:id/network def network @topic = Topic.find(params[:id]) - authorize! @topic + authorize @topic @alltopics = [@topic] + policy_scope(@topic.relatives) @allsynapses = policy_scope(@topic.synapses) @@ -83,7 +83,7 @@ class TopicsController < ApplicationController # GET topics/:id/relatives def relatives @topic = Topic.find(params[:id]) - authorize! @topic + authorize @topic topicsAlreadyHas = params[:network] ? params[:network].split(',').map(&:to_i) : [] @@ -117,7 +117,7 @@ class TopicsController < ApplicationController # POST /topics.json def create @topic = Topic.new(topic_params) - authorize! @topic + authorize @topic respond_to do |format| if @topic.save @@ -132,7 +132,7 @@ class TopicsController < ApplicationController # PUT /topics/1.json def update @topic = Topic.find(params[:id]) - authorize! @topic + authorize @topic respond_to do |format| if @topic.update_attributes(topic_params) @@ -146,7 +146,7 @@ class TopicsController < ApplicationController # DELETE topics/:id def destroy @topic = Topic.find(params[:id]) - authorize! @topic + authorize @topic @topic.delete respond_to do |format| diff --git a/app/models/synapse.rb b/app/models/synapse.rb index d545a25c..540376bb 100644 --- a/app/models/synapse.rb +++ b/app/models/synapse.rb @@ -16,6 +16,10 @@ class Synapse < ActiveRecord::Base validates :category, inclusion: { in: ['from-to', 'both'], allow_nil: true } + scope :for_topic, ->(topic_id = nil) { + where("node1_id = ? OR node2_id = ?", topic_id, topic_id) + } + # :nocov: def user_name user.name diff --git a/app/models/topic.rb b/app/models/topic.rb index 0039040e..0f312823 100644 --- a/app/models/topic.rb +++ b/app/models/topic.rb @@ -41,6 +41,13 @@ class Topic < ActiveRecord::Base belongs_to :metacode + scope :relatives, ->(topic_id = nil) { + includes(:synapses1) + .includes(:synapses2) + .where('synapses.node1_id = ? OR synapses.node2_id = ?', topic_id, topic_id) + .references(:synapses) + } + def user_name user.name end diff --git a/app/policies/synapse_policy.rb b/app/policies/synapse_policy.rb index 12f9c8ca..85de12da 100644 --- a/app/policies/synapse_policy.rb +++ b/app/policies/synapse_policy.rb @@ -1,7 +1,7 @@ class SynapsePolicy < ApplicationPolicy class Scope < Scope def resolve - scope.where('permission IN (?) OR user_id = ?', ["public", "commons"], user.id) + scope.where('synapses.permission IN (?) OR synapses.user_id = ?', ["public", "commons"], user.id) end end diff --git a/app/policies/topic_policy.rb b/app/policies/topic_policy.rb index 97fefdcc..43d4ec98 100644 --- a/app/policies/topic_policy.rb +++ b/app/policies/topic_policy.rb @@ -1,7 +1,7 @@ class TopicPolicy < ApplicationPolicy class Scope < Scope def resolve - scope.where('permission IN (?) OR user_id = ?', ["public", "commons"], user.id) + scope.where('topics.permission IN (?) OR topics.user_id = ?', ["public", "commons"], user.id) end end From 4ed00240ebff82816943f4fd82e6ce722cd66685 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 11:15:14 +1100 Subject: [PATCH 13/23] api: revert silly js change --- app/assets/javascripts/src/Metamaps.js.erb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/assets/javascripts/src/Metamaps.js.erb b/app/assets/javascripts/src/Metamaps.js.erb index 95cf7379..ff6d57e6 100644 --- a/app/assets/javascripts/src/Metamaps.js.erb +++ b/app/assets/javascripts/src/Metamaps.js.erb @@ -4083,7 +4083,7 @@ Metamaps.Topic = { }; var topicSuccessCallback = function (topicModel, response) { if (Metamaps.Active.Map) { - mapping.save({ mappable_id: topicModel.get('topic').id }, { + mapping.save({ mappable_id: topicModel.id }, { success: mappingSuccessCallback, error: function (model, response) { console.log('error saving mapping to database'); @@ -4254,7 +4254,7 @@ Metamaps.Synapse = { }; var synapseSuccessCallback = function (synapseModel, response) { if (Metamaps.Active.Map) { - mapping.save({ mappable_id: synapseModel.get('synapse').id }, { + mapping.save({ mappable_id: synapseModel.id }, { success: mappingSuccessCallback }); } From cb79f2deae4aad86eb2c4b6bd89b02b27b62cc00 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 11:16:46 +1100 Subject: [PATCH 14/23] pundit: make it work --- app/controllers/mappings_controller.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/app/controllers/mappings_controller.rb b/app/controllers/mappings_controller.rb index 5b64efe1..897d1ee1 100644 --- a/app/controllers/mappings_controller.rb +++ b/app/controllers/mappings_controller.rb @@ -9,7 +9,7 @@ class MappingsController < ApplicationController # GET /mappings/1.json def show @mapping = Mapping.find(params[:id]) - authorize! @mapping + authorize @mapping render json: @mapping end @@ -17,8 +17,8 @@ class MappingsController < ApplicationController # POST /mappings.json def create @mapping = Mapping.new(mapping_params) - authorize! @mapping - + authorize @mapping + @mapping.user = current_user if @mapping.save render json: @mapping, status: :created else @@ -29,7 +29,7 @@ class MappingsController < ApplicationController # PUT /mappings/1.json def update @mapping = Mapping.find(params[:id]) - authorize! @mapping + authorize @mapping if @mapping.update_attributes(mapping_params) head :no_content @@ -41,7 +41,7 @@ class MappingsController < ApplicationController # DELETE /mappings/1.json def destroy @mapping = Mapping.find(params[:id]) - authorize! @mapping + authorize @mapping @mapping.destroy @@ -51,6 +51,6 @@ class MappingsController < ApplicationController private # Never trust parameters from the scary internet, only allow the white list through. def mapping_params - params.require(:mapping).permit(:id, :xloc, :yloc, :mappable_id, :mappable_type, :map_id, :user_id) + params.require(:mapping).permit(:id, :xloc, :yloc, :mappable_id, :mappable_type, :map_id) end end From fdd93513785fff6334aaffdac161a2c078a1277a Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 11:24:49 +1100 Subject: [PATCH 15/23] pundit: policy didn't exist --- app/policies/mapping_policy.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/policies/mapping_policy.rb b/app/policies/mapping_policy.rb index 39dbd86a..13ef033e 100644 --- a/app/policies/mapping_policy.rb +++ b/app/policies/mapping_policy.rb @@ -18,7 +18,7 @@ class MappingPolicy < ApplicationPolicy def create? map = policy(record.map, user) - map.edit? + map.update? end def update? From d0fd676aa01db64496d0322923ae0221877430f4 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 11:35:03 +1100 Subject: [PATCH 16/23] pundit: now updating maps actually works --- app/policies/map_policy.rb | 1 - app/policies/mapping_policy.rb | 10 ++++------ app/policies/synapse_policy.rb | 1 + 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/app/policies/map_policy.rb b/app/policies/map_policy.rb index 5e845d44..50123877 100644 --- a/app/policies/map_policy.rb +++ b/app/policies/map_policy.rb @@ -35,7 +35,6 @@ class MapPolicy < ApplicationPolicy def update? user.present? && (record.permission == 'commons' || record.user == user) - true end def screenshot? diff --git a/app/policies/mapping_policy.rb b/app/policies/mapping_policy.rb index 13ef033e..787b5794 100644 --- a/app/policies/mapping_policy.rb +++ b/app/policies/mapping_policy.rb @@ -11,19 +11,17 @@ class MappingPolicy < ApplicationPolicy end def show? - map = policy(record.map, user) - mappable = policy(record.mappable, user) + map = Pundit.policy(user, record.map) + mappable = Pundit.policy(user, record.mappable) map.show? && mappable.show? end def create? - map = policy(record.map, user) - map.update? + Pundit.policy(user, record.map).update? end def update? - map = policy(record.map, user) - map.update? + Pundit.policy(user, record.map).update? end def destroy? diff --git a/app/policies/synapse_policy.rb b/app/policies/synapse_policy.rb index 85de12da..e8d49548 100644 --- a/app/policies/synapse_policy.rb +++ b/app/policies/synapse_policy.rb @@ -7,6 +7,7 @@ class SynapsePolicy < ApplicationPolicy def create? user.present? + # todo add validation against whether you can see both topics end def show? From 7f86810f625197e240a1ea51f975c767cdc5d03a Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 11:53:12 +1100 Subject: [PATCH 17/23] remove things again not needed --- app/models/mapping.rb | 8 -------- app/models/user.rb | 4 ---- 2 files changed, 12 deletions(-) diff --git a/app/models/mapping.rb b/app/models/mapping.rb index 8f29ed6a..1a37f490 100644 --- a/app/models/mapping.rb +++ b/app/models/mapping.rb @@ -26,12 +26,4 @@ class Mapping < ActiveRecord::Base super(:methods =>[:user_name, :user_image]) end - def authorize_to_show(user) - if ((self.map.permission == "private" && self.map.user != user) || - (self.mappable.permission == "private" && self.mappable.user != user)) - return false - end - return self - end - end diff --git a/app/models/user.rb b/app/models/user.rb index a8fb6e6b..50493a55 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -41,10 +41,6 @@ class User < ActiveRecord::Base # Validate the attached image is image/jpg, image/png, etc validates_attachment_content_type :image, :content_type => /\Aimage\/.*\Z/ - def is_logged_in? - true - end - # override default as_json def as_json(options={}) { :id => self.id, From 521aa6b5d00cda63d6b64210cecc861bc52197a4 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 11:58:26 +1100 Subject: [PATCH 18/23] function no longer exists --- app/controllers/api/tokens_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/api/tokens_controller.rb b/app/controllers/api/tokens_controller.rb index 6ef01e69..481b41ba 100644 --- a/app/controllers/api/tokens_controller.rb +++ b/app/controllers/api/tokens_controller.rb @@ -3,7 +3,7 @@ class Api::TokensController < API::RestfulController skip_authorization def my_tokens - raise Pundit::NotAuthorizedError.new unless current_user.is_logged_in? + raise Pundit::NotAuthorizedError.new unless current_user instantiate_collection page_collection: false, timeframe_collection: false respond_with_collection end From bf4fbbeb06439ed488c4776e8b4ba429a906858e Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 12:26:23 +1100 Subject: [PATCH 19/23] fix tokens --- app/controllers/api/restful_controller.rb | 2 +- app/controllers/api/tokens_controller.rb | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/app/controllers/api/restful_controller.rb b/app/controllers/api/restful_controller.rb index d6c544e2..06396e3d 100644 --- a/app/controllers/api/restful_controller.rb +++ b/app/controllers/api/restful_controller.rb @@ -5,7 +5,7 @@ class API::RestfulController < ActionController::Base snorlax_used_rest! rescue_from(Pundit::NotAuthorizedError) { |e| respond_with_standard_error e, 403 } - load_and_authorize_resource except: [:index, :create] + load_and_authorize_resource only: [:show, :update, :destroy] def create authorize resource_class diff --git a/app/controllers/api/tokens_controller.rb b/app/controllers/api/tokens_controller.rb index 481b41ba..3fcca370 100644 --- a/app/controllers/api/tokens_controller.rb +++ b/app/controllers/api/tokens_controller.rb @@ -1,13 +1,17 @@ class Api::TokensController < API::RestfulController - skip_authorization - def my_tokens raise Pundit::NotAuthorizedError.new unless current_user instantiate_collection page_collection: false, timeframe_collection: false respond_with_collection end + private + + def resource_serializer + "#{resource_name}_serializer".camelize.constantize + end + def visible_records current_user.tokens end From 446619c451b529b29f1fc62e14e215d27861f73e Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 13:20:15 +1100 Subject: [PATCH 20/23] omg not having this was breaking things --- app/controllers/application_controller.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index d030c6e6..4388337e 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -7,6 +7,10 @@ class ApplicationController < ActionController::Base before_action :get_invite_link after_action :allow_embedding + def default_serializer_options + { root: false } + end + # this is for global login include ContentHelper From ada29c6832fee8629dbed804c0af7ee911859ab4 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sat, 12 Mar 2016 21:35:56 +1100 Subject: [PATCH 21/23] cleanup --- app/serializers/new_map_serializer.rb | 4 ---- app/serializers/new_synapse_serializer.rb | 4 ---- app/serializers/new_topic_serializer.rb | 4 ---- app/serializers/token_serializer.rb | 4 ---- postatoken.txt | 7 ------- postdata.txt | 1 - postmapping.txt | 1 - postsynapse.txt | 1 - posttopic.txt | 1 - 9 files changed, 27 deletions(-) delete mode 100644 postatoken.txt delete mode 100644 postdata.txt delete mode 100644 postmapping.txt delete mode 100644 postsynapse.txt delete mode 100644 posttopic.txt diff --git a/app/serializers/new_map_serializer.rb b/app/serializers/new_map_serializer.rb index 1e27420b..9b2ff400 100644 --- a/app/serializers/new_map_serializer.rb +++ b/app/serializers/new_map_serializer.rb @@ -13,8 +13,4 @@ class NewMapSerializer < ActiveModel::Serializer has_many :mappings, serializer: NewMappingSerializer has_many :contributors, root: :users, serializer: NewUserSerializer - #def filter(keys) - # keys.delete(:outcome_author) unless object.outcome_author.present? - # keys - #end end diff --git a/app/serializers/new_synapse_serializer.rb b/app/serializers/new_synapse_serializer.rb index e7cd9fd7..b145d605 100644 --- a/app/serializers/new_synapse_serializer.rb +++ b/app/serializers/new_synapse_serializer.rb @@ -12,8 +12,4 @@ class NewSynapseSerializer < ActiveModel::Serializer has_one :topic2, root: :topics, serializer: NewTopicSerializer has_one :user, serializer: NewUserSerializer - #def filter(keys) - # keys.delete(:outcome_author) unless object.outcome_author.present? - # keys - #end end diff --git a/app/serializers/new_topic_serializer.rb b/app/serializers/new_topic_serializer.rb index d36f1db0..cdbbedf9 100644 --- a/app/serializers/new_topic_serializer.rb +++ b/app/serializers/new_topic_serializer.rb @@ -11,8 +11,4 @@ class NewTopicSerializer < ActiveModel::Serializer has_one :user, serializer: NewUserSerializer has_one :metacode, serializer: NewMetacodeSerializer - #def filter(keys) - # keys.delete(:outcome_author) unless object.outcome_author.present? - # keys - #end end diff --git a/app/serializers/token_serializer.rb b/app/serializers/token_serializer.rb index 777a14c1..8eed535a 100644 --- a/app/serializers/token_serializer.rb +++ b/app/serializers/token_serializer.rb @@ -7,8 +7,4 @@ class TokenSerializer < ActiveModel::Serializer :created_at, :updated_at - #def filter(keys) - # keys.delete(:outcome_author) unless object.outcome_author.present? - # keys - #end end diff --git a/postatoken.txt b/postatoken.txt deleted file mode 100644 index c9d98ff3..00000000 --- a/postatoken.txt +++ /dev/null @@ -1,7 +0,0 @@ -$.post('http://localhost:3000/api/v1/tokens', {token: { - description: 'for stuff', - token: '1234', - user_id: 2 -}}) - -curl -X POST -d @postdata.txt http://localhost:3000/api/v1/maps --header "Authorization: Token token=fb5b3db125c94e9fb50f1e42054be856" --header "Content-Type:application/json" diff --git a/postdata.txt b/postdata.txt deleted file mode 100644 index 9daaf598..00000000 --- a/postdata.txt +++ /dev/null @@ -1 +0,0 @@ -{ "map": { "name":"tree", "desc": "green", "permission": "commons", "arranged": true }} diff --git a/postmapping.txt b/postmapping.txt deleted file mode 100644 index c9463f92..00000000 --- a/postmapping.txt +++ /dev/null @@ -1 +0,0 @@ -{ "mapping": { "xloc": 123, "yloc": 123, "map_id": 1, "mappable_type": "Topic", "mappable_id": 2 }} diff --git a/postsynapse.txt b/postsynapse.txt deleted file mode 100644 index da2617d8..00000000 --- a/postsynapse.txt +++ /dev/null @@ -1 +0,0 @@ -{ "synapse": { "desc": "link between", "permission": "commons", "node1_id": 1, "node2_id": 2, "category": "from-to" }} diff --git a/posttopic.txt b/posttopic.txt deleted file mode 100644 index e00d797f..00000000 --- a/posttopic.txt +++ /dev/null @@ -1 +0,0 @@ -{ "topic": { "name":"tree topic", "desc": "so green", "permission": "commons", "metacode_id": 1 }} From f072e39c4c19c6d466f38853a2e6dad0d953d731 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sun, 13 Mar 2016 02:27:05 +1100 Subject: [PATCH 22/23] pundit: sometimes no user --- app/policies/map_policy.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/app/policies/map_policy.rb b/app/policies/map_policy.rb index 50123877..1594e6d9 100644 --- a/app/policies/map_policy.rb +++ b/app/policies/map_policy.rb @@ -1,7 +1,11 @@ class MapPolicy < ApplicationPolicy class Scope < Scope def resolve - scope.where('maps.permission IN (?) OR maps.user_id = ?', ["public", "commons"], user.id) + if user + scope.where('maps.permission IN (?) OR maps.user_id = ?', ["public", "commons"], user.id) + else + scope.where('maps.permission IN (?)', ["public", "commons"]) + end end end From 3aec00e07cfe97eb3616d157148b422195671de4 Mon Sep 17 00:00:00 2001 From: Connor Turland Date: Sun, 13 Mar 2016 02:28:39 +1100 Subject: [PATCH 23/23] just don't include mappable for now --- app/serializers/new_mapping_serializer.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app/serializers/new_mapping_serializer.rb b/app/serializers/new_mapping_serializer.rb index 9241305a..4e65e161 100644 --- a/app/serializers/new_mapping_serializer.rb +++ b/app/serializers/new_mapping_serializer.rb @@ -4,10 +4,12 @@ class NewMappingSerializer < ActiveModel::Serializer :xloc, :yloc, :created_at, - :updated_at + :updated_at, + :mappable_id, + :mappable_type + has_one :user, serializer: NewUserSerializer has_one :map, serializer: NewMapSerializer - has_one :mappable, polymorphic: true ##? def filter(keys) keys.delete(:xloc) unless object.mappable_type == "Topic"