30496619839

Committed 29 Jul 2026 10:31PM UTC coverage: 94.29% (+2.3%) from 91.975%

Build # 30496619839

Build Type

Pull #40

github

Committed by

gregschmit

Commit Message

Preserve propagated class-attribute values after local set.

A `propagate { self.x = ... }` followed by a plain `self.x = ...`
clobbered the propagated getter, since both were defined on the same
singleton class. Descendants then had no `super` to reach and fell back
to the default instead of the propagated value.

Store propagated values (and the default baseline) in a per-class module
included in the singleton class, keeping local assignments on the
singleton class itself. A local getter now supers into the module rather
than overwriting it, and descendants keep inheriting the propagated
value. `super` resolves dynamically, so a propagate that happens after an
earlier local override still reaches descendants.

Strengthen the regression test to assert the descendant still sees the
propagated value, not merely that it differs from the local one.

Pull Request Pull Request #40: v2

Coverage Stats

209 of 214 new or added lines in 8 files covered. (97.66%)

1 existing line in 1 file now uncovered.

1222 of 1296 relevant lines covered (94.29%)

335.93 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

91.67

/lib/rest_framework/controller.rb

# This module provides the common functionality for all REST controllers. The implementation is
# split across several files under `controller/` for readability; each of those files reopens this
# module rather than defining a separate submodule.
module RESTFramework::Controller
  RRF_BASE_CONFIG = {
    singular: nil,

    # Options related to metadata and display.
    title: nil,
    description: nil,
    version: nil,
    inflect_acronyms: RESTFramework.config.inflect_acronyms,
    openapi_include_children: false,

    # Options related to models.
    model: nil,
    recordset: nil,

    # Bulk configuration.
    #
    # When `bulk` is truthy, it enables the default bulk behavior (`:default`), which is per-record
    # processing (e.g., `create` for each record). When `bulk` is set to `:raw`, it enables single
    # SQL query behavior (e.g., `insert_all` for bulk create) which skips validations/callbacks.
    bulk: false,
    bulk_partial: false,
    bulk_partial_query_param: "bulk_partial".freeze,
    bulk_allow_mode_override: false,
    bulk_mode_query_param: "bulk_mode".freeze,
    bulk_max_size: nil,
    bulk_max_raw_size: nil,

    # Configuring record fields.
    fields: nil,
    field_config: nil,
    read_only_fields: RESTFramework.config.read_only_fields,
    write_only_fields: RESTFramework.config.write_only_fields,
    hidden_fields: nil,

    # Finding records.
    find_by_fields: nil,
    find_by_query_param: "find_by".freeze,

    # What should be included/excluded from default fields.
    exclude_associations: false,

    # Handling request body parameters.
    allowed_parameters: nil,

    # Options for the default native serializer.
    native_serializer_config: nil,
    native_serializer_singular_config: nil,
    native_serializer_plural_config: nil,
    native_serializer_only_query_param: "only".freeze,
    native_serializer_except_query_param: "except".freeze,
    native_serializer_include_query_param: "include".freeze,
    native_serializer_exclude_query_param: "exclude".freeze,
    native_serializer_associations_limit: 5,
    native_serializer_associations_limit_max: 10,
    native_serializer_associations_limit_query_param: "associations_limit".freeze,
    native_serializer_include_associations_count: false,

    # Options for filtering, ordering, and searching.
    filter_backends: [
      RESTFramework::QueryFilter,
      RESTFramework::OrderingFilter,
      RESTFramework::SearchFilter,
    ].freeze,
    filter_recordset_before_find: true,
    filter_fields: nil,
    ordering_fields: nil,
    ordering_query_param: "ordering".freeze,
    ordering_no_reorder: false,
    search_fields: nil,
    search_query_param: "search".freeze,
    search_ilike: false,
    ransack_options: nil,
    ransack_query_param: "q".freeze,
    ransack_distinct: true,
    ransack_distinct_query_param: "distinct".freeze,

    # Options for association assignment.
    permit_id_assignment: true,
    permit_nested_attributes_assignment: true,

    # Option for `recordset.create` vs `Model.create` behavior.
    create_from_recordset: true,

    # Options related to serialization.
    rescue_unknown_format_with: :json,
    serializer_class: nil,
    serialize_to_json: true,
    serialize_to_xml: true,

    # Options related to pagination. Pagination is on by default (page-number based) with a capped
    # page size, so responses are bounded out of the box; set `paginator_class = nil` to disable.
    paginator_class: RESTFramework::PageNumberPaginator,
    page_size: 20,
    page_query_param: "page".freeze,
    page_size_query_param: "page_size".freeze,
    max_page_size: 40,

    # Option to disable serializer adapters by default, mainly introduced because Active Model
    # Serializers will do things like serialize `[]` into `{"":[]}`.
    disable_adapters_by_default: true,

    # Custom integrations (reduces serializer performance due to method calls).
    enable_action_text: false,
    enable_active_storage: false,
  }

  # Exceptions to be rescued and handled by returning a reasonable error response.
  RRF_RESCUED_EXCEPTIONS = [
    RESTFramework::InvalidBulkParametersError,
    RESTFramework::BulkRecordErrorsError,
  ].freeze
  RRF_RESCUED_RAILS_EXCEPTIONS = [
    ActionController::ParameterMissing,
    ActionController::UnpermittedParameters,
    ActionDispatch::Http::Parameters::ParseError,
    ActiveRecord::AssociationTypeMismatch,
    ActiveRecord::NotNullViolation,
    ActiveRecord::RecordNotFound,
    ActiveRecord::RecordInvalid,
    ActiveRecord::RecordNotSaved,
    ActiveRecord::RecordNotDestroyed,
    ActiveRecord::RecordNotUnique,
    ActiveRecord::StatementInvalid,
    ActiveModel::UnknownAttributeError,
  ].freeze

  # Anchored regex with non-greedy content_type match to prevent over-matching on malicious input.
  RRF_BASE64_REGEX = /\Adata:([^;]*);base64,(.*)\z/m
  RRF_BASE64_TRANSLATE = ->(field, value) {
    return value unless RRF_BASE64_REGEX.match?(value)

    _, content_type, payload = value.match(RRF_BASE64_REGEX).to_a
    {
      io: StringIO.new(Base64.decode64(payload)),
      content_type: content_type,
      filename: "file_#{field}#{Rack::Mime::MIME_TYPES.invert[content_type]}",
    }
  }
  RRF_ACTIVESTORAGE_KEYS = [ :io, :content_type, :filename, :identify, :key ]

  module ClassMethods
    IGNORE_VALIDATORS_WITH_KEYS = [ :if, :unless ].freeze

    # Thread-local key toggled by `propagate` while its block runs.
    RRF_PROPAGATING_KEY = :rrf_propagating

    # Define one or more class-level configuration attributes. Assignments are **local by default**:
    #
    #   self.x = value               # applies to this controller ONLY; descendants don't inherit it
    #   propagate { self.x = value } # applies to this controller AND all descendants
    #
    # This gives a single, uniform rule (an assignment is local unless wrapped in `propagate`), so
    # there's no per-attribute "does this inherit?" knowledge to carry around. Values are stored in
    # closures on redefined singleton methods (the same mechanism as `class_attribute`), never in
    # instance variables, so there is exactly one interface for configuration: the setter.
    #
    # Only singleton (class-level) methods are defined, so config never leaks to controller
    # instances (which would risk colliding with action methods).
    def rrf_class_attribute(*names, default: nil)
      names.each do |name|
        # Propagating baseline: every controller sees the default until it's overridden. This lives
        # in the propagated module (see `rrf_propagated_module`) rather than directly on the
        # singleton class, so a local assignment can coexist with it via `super`.
        rrf_propagated_module.define_method(name) { default }

        # Parity with `class_attribute`, which also defines a predicate.
        singleton_class.define_method("#{name}?") { !!public_send(name) }

        singleton_class.define_method("#{name}=") do |value|
          if Thread.current[RRF_PROPAGATING_KEY]
            # Propagate: descendants inherit this getter via the module in the singleton chain. It's
            # kept separate from any local getter (defined directly on the singleton class) so a
            # subsequent local assignment doesn't clobber the value propagated to descendants.
            rrf_propagated_module.define_method(name) { value }
          else
            # Local: `value` for this class only; descendants fall back through `super` to the
            # nearest propagated ancestor value, or the default.
            klass = self
            singleton_class.define_method(name) do
              if equal?(klass)
                value
              elsif defined?(super)
                super()
              else
                default
              end
            end
          end
        end
      end
    end

    # The per-class module holding this class's propagated attribute getters (and the default
    # baseline). It's included into the singleton class so descendants inherit propagated values
    # through the singleton-class chain, while local assignments—defined directly on the singleton
    # class—take precedence for the class itself and can `super()` back into this module. Created
    # lazily and memoized per class (instance variables aren't inherited, so each class gets its
    # own).
    def rrf_propagated_module
      @rrf_propagated_module ||= Module.new.tap { |mod| singleton_class.include(mod) }
    end

    # Run a block in which configuration setters (`self.x = value`) propagate to descendant
    # controllers instead of applying locally. Use this on a shared base controller for settings you
    # want every subclass to inherit:
    #
    #   propagate do
    #     self.paginator_class = RESTFramework::PageNumberPaginator
    #     self.page_size = 30
    #   end
    def propagate
      previous = Thread.current[RRF_PROPAGATING_KEY]
      Thread.current[RRF_PROPAGATING_KEY] = true
      yield
    ensure
      Thread.current[RRF_PROPAGATING_KEY] = previous
    end

    # By default, this is the name of the controller class, titleized and with any custom inflection
    # acronyms applied.
    def get_title
      self.title || RESTFramework::Utils.inflect(
        self.name.demodulize.chomp("Controller").titleize(keep_id_suffix: true),
        self.inflect_acronyms,
      )
    end

    # Get a label from a field/column name, titleized and inflected.
    def label_for(s)
      default_title = RESTFramework::Utils.inflect(
        s.to_s.titleize(keep_id_suffix: true), self.inflect_acronyms
      )
      self.model&.human_attribute_name(s, default: default_title) || default_title
    end

    # Get the available fields. Fallback to this controller's model columns, or an empty array. This
    # should always return an array of strings.
    def get_fields(input_fields: nil)
      input_fields ||= self.fields

      # If fields is a hash, then parse it.
      if input_fields.is_a?(Hash)
        return RESTFramework::Utils.parse_fields_hash(
          input_fields,
          self.model,
          exclude_associations: self.exclude_associations,
          action_text: self.enable_action_text,
          active_storage: self.enable_active_storage,
        )
      elsif !input_fields
        # Otherwise, if fields is nil, then fallback to columns.
        return self.model ? RESTFramework::Utils.fields_for(
          self.model,
          exclude_associations: self.exclude_associations,
          action_text: self.enable_action_text,
          active_storage: self.enable_active_storage,
        ) : []
      elsif input_fields
        input_fields = input_fields.map(&:to_s)
      end

      input_fields
    end

    # Get a full field configuration, including defaults and inferred values.
    def field_configuration
      return @field_configuration if @field_configuration

      field_config = self.field_config&.with_indifferent_access || {}
      columns = self.model.columns_hash
      column_defaults = self.model.column_defaults
      reflections = self.model.reflections
      attributes = self.model._default_attributes
      readonly_attributes = self.model.readonly_attributes
      read_only_fields = self.read_only_fields&.map(&:to_s)&.to_set || Set[]
      write_only_fields = self.write_only_fields&.map(&:to_s)&.to_set || Set[]
      hidden_fields = self.hidden_fields&.map(&:to_s)&.to_set || Set[]
      rich_text_association_names = self.model.reflect_on_all_associations(:has_one)
        .collect(&:name)
        .select { |n| n.to_s.start_with?("rich_text_") }
      attachment_reflections = self.model.attachment_reflections

      @field_configuration = self.get_fields.map { |f|
        cfg = field_config[f]&.dup || {}
        cfg[:label] ||= self.label_for(f)

        # Annotate primary key.
        if self.model.primary_key == f
          cfg[:primary_key] = true

          unless cfg.key?(:read_only)
            cfg[:read_only] = true
          end
        end

        # Annotate field mutability and display properties.
        cfg[:read_only] = true if f.in?(readonly_attributes) || f.in?(read_only_fields)
        cfg[:write_only] = true if f.in?(write_only_fields)
        cfg[:hidden] = true if f.in?(hidden_fields)

        # Raise warnings on some bad combinations of properties.
        if cfg[:write_only]
          if cfg[:read_only]
            Rails.logger.warn("RRF: `#{f}` write_only conflicts with read_only.")
          end

          if cfg[:hidden]
            Rails.logger.warn("RRF: `#{f}` write_only implies hidden.")
          end

          if cfg[:hidden_from_index]
            Rails.logger.warn("RRF: `#{f}` write_only implies hidden_from_index.")
          end
        end

        # Annotate column data.
        if column = columns[f]
          cfg[:kind] = "column"
          cfg[:type] ||= column.type
          cfg[:required] = true unless column.null
        end

        # Add default values from the model's schema.
        if cfg[:default].nil? && (column_default = column_defaults[f])
          cfg[:default] = column_default
        end

        # Add metadata from the model's attributes hash.
        if attributes.key?(f) && attribute = attributes[f]
          if cfg[:default].nil? && default = attribute.value_before_type_cast
            cfg[:default] = default
          end
          cfg[:kind] ||= "attribute"

          # Get any type information from the attribute.
          if type = attribute.type
            cfg[:type] ||= type.type if type.type

            # Get enum variants.
            if type.is_a?(ActiveRecord::Enum::EnumType)
              cfg[:enum_variants] = type.send(:mapping)

              # TranslateEnum Integration:
              translate_method = "translated_#{f.pluralize}"
              if self.model.respond_to?(translate_method)
                cfg[:enum_translations] = self.model.send(translate_method)
              end
            end
          end
        end

        # Get association metadata.
        if ref = reflections[f]
          cfg[:kind] = "association"

          # Determine sub-fields for associations.
          if ref.polymorphic?
            ref_columns = {}
          else
            ref_columns = ref.klass.columns_hash
          end
          cfg[:sub_fields] ||= RESTFramework::Utils.sub_fields_for(ref)
          cfg[:sub_fields] = cfg[:sub_fields].map(&:to_s)

          # Very basic metadata about sub-fields.
          cfg[:sub_fields_metadata] = cfg[:sub_fields].map { |sf|
            v = {}

            if ref_columns[sf]
              v[:kind] = "column"
            else
              v[:kind] = "method"
            end

            next [ sf, v ]
          }.to_h.compact.presence

          # Determine if we render id/ids fields. Unfortunately, `has_one` does not provide this
          # interface.
          if self.permit_id_assignment && id_field = RESTFramework::Utils.id_field_for(f, ref)
            cfg[:id_field] = id_field
          end

          # Determine if we render nested attributes options.
          if self.permit_nested_attributes_assignment && (
            nested_opts = self.model.nested_attributes_options[f.to_sym].presence
          )
            cfg[:nested_attributes_options] = { field: "#{f}_attributes", **nested_opts }
          end

          begin
            cfg[:association_pk] = ref.active_record_primary_key
          rescue ActiveRecord::UnknownPrimaryKey
          end

          cfg[:reflection] = ref
        end

        # Determine if this is an ActionText "rich text".
        if :"rich_text_#{f}".in?(rich_text_association_names)
          cfg[:kind] = "rich_text"
        end

        # Determine if this is an ActiveStorage attachment.
        if ref = attachment_reflections[f]
          cfg[:kind] = "attachment"
          cfg[:attachment_type] = ref.macro
        end

        # Determine if this is just a method.
        if !cfg[:kind] && self.model.method_defined?(f)
          cfg[:kind] = "method"
          cfg[:read_only] = true if cfg[:read_only].nil?
        end

        # Collect validator options into a hash on their type, while also updating `required` based
        # on any presence validators.
        self.model.validators_on(f).each do |validator|
          kind = validator.kind
          options = validator.options

          # Reject validator if it includes keys like `:if` and `:unless` because those are
          # conditionally applied in a way that is not feasible to communicate via the API.
          next if IGNORE_VALIDATORS_WITH_KEYS.any? { |k| options.key?(k) }

          # Update `required` if we find a presence validator.
          cfg[:required] = true if kind == :presence

          # Resolve procs (and lambdas), and symbols for certain arguments.
          if options[:in].is_a?(Proc)
            options = options.merge(in: options[:in].call)
          elsif options[:in].is_a?(Symbol)
            options = options.merge(in: self.model.send(options[:in]))
          end

          cfg[:validators] ||= {}
          cfg[:validators][kind] ||= []
          cfg[:validators][kind] << options
        end

        next [ f, cfg ]
      }.to_h.compact.with_indifferent_access
    end
  end

  def self.included(base)
    return unless base.is_a?(Class)

    base.extend(ClassMethods)

    # By default, the layout should be set to `rest_framework`.
    base.layout("rest_framework")

    # Materialize config with `rrf_class_attribute` (local by default) rather than `class_attribute`
    # (always inherited).
    RRF_BASE_CONFIG.each do |a, default|
      next if base.respond_to?(a)

      base.rrf_class_attribute(a, default: default)
    end

    # Skip CSRF since this is an API.
    begin
      base.skip_before_action(:verify_authenticity_token)
    rescue ArgumentError
      # The callback may not exist if forgery protection isn't enabled; this is expected.
      nil
    end

    # Handle exceptions.
    base.rescue_from(*RRF_RESCUED_EXCEPTIONS, with: :rrf_error_handler)
    base.rescue_from(*RRF_RESCUED_RAILS_EXCEPTIONS, with: :rrf_error_handler)
  end

  def get_serializer_class
    self.class.serializer_class || RESTFramework::NativeSerializer
  end

  # Serialize the given data using the `serializer_class`.
  def serialize(data, **kwargs)
    RESTFramework::Utils.wrap_ams(self.get_serializer_class).new(
      data, controller: self, **kwargs
    ).serialize
  end

  def rrf_error_handler(e)
    status = case e
    when ActiveRecord::RecordNotFound
      404
    when RESTFramework::BulkRecordErrorsError
      422
    else
      400
    end

    render_api(
      {
        message: e.message,
        errors: e.try(:record).try(:errors),
        exception: RESTFramework.config.show_backtrace ? e.full_message : nil,
      }.compact,
      status: status,
    )
  end

  def route_groups
    @route_groups ||= RESTFramework::Utils.get_routes(Rails.application.routes, request)
  end

  # Render a browsable API for `html` format, along with basic `json`/`xml` formats, and with
  # support or passing custom `kwargs` to the underlying `render` calls.
  def render_api(payload, **kwargs)
    html_kwargs = kwargs.delete(:html_kwargs) || {}
    json_kwargs = kwargs.delete(:json_kwargs) || {}
    xml_kwargs = kwargs.delete(:xml_kwargs) || {}

    # Raise helpful error if payload is nil. Usually this happens when a record is not found (e.g.,
    # when passing something like `User.find_by(id: some_id)` to `render_api`). The caller should
    # actually be calling `find_by!` to raise ActiveRecord::RecordNotFound and allowing the REST
    # framework to catch this error and return an appropriate error response.
    if payload.nil?
      raise RESTFramework::NilPassedToRenderAPIError
    end

    # If `payload` is an `ActiveRecord::Relation` or `ActiveRecord::Base`, then serialize it.
    if payload.is_a?(ActiveRecord::Base) || payload.is_a?(ActiveRecord::Relation)
      payload = self.serialize(payload)
    end

    # Do not use any adapters by default, if configured.
    if self.class.disable_adapters_by_default && !kwargs.key?(:adapter)
      kwargs[:adapter] = nil
    end

    # Flag to track if we had to rescue unknown format.
    already_rescued_unknown_format = false

    begin
      respond_to do |format|
        if payload == ""
          format.json { head(kwargs[:status] || :no_content) } if self.class.serialize_to_json
          format.xml { head(kwargs[:status] || :no_content) } if self.class.serialize_to_xml
        else
          format.json {
            render(json: payload, **kwargs.merge(json_kwargs))
          } if self.class.serialize_to_json
          format.xml {
            render(xml: payload, **kwargs.merge(xml_kwargs))
          } if self.class.serialize_to_xml
          # TODO: possibly support more formats here if supported?
        end
        format.html {
          @payload = payload
          if payload == ""
            @json_payload = "" if self.class.serialize_to_json
            @xml_payload = "" if self.class.serialize_to_xml
          else
            @json_payload = payload.to_json if self.class.serialize_to_json
            @xml_payload = payload.to_xml if self.class.serialize_to_xml
          end
          @title ||= self.class.get_title
          @description ||= self.class.description
          self.route_groups
          begin
            render(**kwargs.merge(html_kwargs))
          rescue ActionView::MissingTemplate
            # A view is not required, so just use `html: ""`.
            render(html: "", layout: true, **kwargs.merge(html_kwargs))
          end
        }
      end
    rescue ActionController::UnknownFormat
      if !already_rescued_unknown_format && rescue_format = self.class.rescue_unknown_format_with
        request.format = rescue_format
        already_rescued_unknown_format = true
        retry
      else
        raise
      end
    end
  end

  def options
    render_api(self.openapi_document)
  end

  def get_fields
    self.class.get_fields(input_fields: self.class.fields)
  end

  # Get a hash of strong parameters for the current action.
  def get_allowed_parameters
    return @_get_allowed_parameters if defined?(@_get_allowed_parameters)

    @_get_allowed_parameters = self.class.allowed_parameters
    return @_get_allowed_parameters if @_get_allowed_parameters

    # Assemble strong parameters.
    variations = []
    hash_variations = {}
    reflections = self.class.model.reflections
    @_get_allowed_parameters = self.get_fields.map { |f|
      f = f.to_s
      config = self.class.field_configuration[f]

      # ActionText Integration:
      if self.class.enable_action_text && reflections.key?("rich_text_#{f}")
        next f
      end

      # ActiveStorage Integration: `has_one_attached`
      if self.class.enable_active_storage && reflections.key?("#{f}_attachment")
        hash_variations[f] = RRF_ACTIVESTORAGE_KEYS
        next f
      end

      # ActiveStorage Integration: `has_many_attached`
      if self.class.enable_active_storage && reflections.key?("#{f}_attachments")
        hash_variations[f] = RRF_ACTIVESTORAGE_KEYS
        next nil
      end

      if config[:reflection]
        # Add `_id`/`_ids` variations for associations.
        if id_field = config[:id_field]
          if id_field.ends_with?("_ids")
            hash_variations[id_field] = []
          else
            variations << id_field
          end
        end

        # Add `_attributes` variations for associations.
        # TODO: Consider adjusting this based on `nested_attributes_options`.
        if self.class.permit_nested_attributes_assignment
          hash_variations["#{f}_attributes"] = (
            config[:sub_fields] + [ "_destroy" ]
          )
        end

        # Associations are not allowed to be submitted in their bare form (if they are submitted
        # that way, they will be translated to either id/ids or nested attributes assignment).
        next nil
      end

      next f
    }.compact
    @_get_allowed_parameters += variations
    @_get_allowed_parameters << hash_variations

    @_get_allowed_parameters
  end

  # Use strong parameters to filter the request body.
  def get_body_params(bulk_action: nil)
    data = self.request.request_parameters
    pk = self.class.model&.primary_key
    allowed_params = self.get_allowed_parameters

    # Before we filter the data, dynamically dispatch association assignment to either the id/ids
    # assignment ActiveRecord API or the nested assignment ActiveRecord API. Note that there is no
    # need to check for `permit_id_assignment` or `permit_nested_attributes_assignment` here, since
    # that is enforced by strong parameters generated by `get_allowed_parameters`.
    if !bulk_action && self.class.model
      self.class.model.reflections.each do |name, ref|
        if payload = data[name]
          if payload.is_a?(Hash) || (payload.is_a?(Array) && payload.all? { |x| x.is_a?(Hash) })
            # Assume nested attributes assignment.
            attributes_key = "#{name}_attributes"
            data[attributes_key] = data.delete(name) unless data[attributes_key]
          elsif id_field = RESTFramework::Utils.id_field_for(name, ref)
            # Assume id/ids assignment.
            data[id_field] = data.delete(name) unless data[id_field]
          end
        end
      end
    end

    # ActiveStorage Integration: Translate base64 encoded attachments to upload objects.
    #
    # rubocop:disable Layout/LineLength
    #
    # Example base64 images (red, green, and blue squares):
    #   data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAFUlEQVR42mP8z8BQz0AEYBxVSF+FABJADveWkH6oAAAAAElFTkSuQmCC
    #   data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAFUlEQVR42mNk+M9Qz0AEYBxVSF+FAAhKDveksOjmAAAAAElFTkSuQmCC
    #   data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAFUlEQVR42mNkYPhfz0AEYBxVSF+FAP5FDvcfRYWgAAAAAElFTkSuQmCC
    #
    # rubocop:enable Layout/LineLength
    has_many_attached_scalar_data = {}
    if !bulk_action && self.class.enable_active_storage && self.class.model
      self.class.model.attachment_reflections.keys.each do |k|
        if data[k].is_a?(Array)
          data[k] = data[k].map { |v|
            if v.is_a?(String)
              v = RRF_BASE64_TRANSLATE.call(k, v)

              # Remember scalars because Rails strong params will remove it.
              if v.is_a?(String)
                has_many_attached_scalar_data[k] ||= []
                has_many_attached_scalar_data[k] << v
              end
            elsif v.is_a?(Hash)
              if v[:io].is_a?(String)
                v[:io] = StringIO.new(Base64.decode64(v[:io]))
              end
            end

            next v
          }
        elsif data[k].is_a?(Hash)
          if data[k][:io].is_a?(String)
            data[k][:io] = StringIO.new(Base64.decode64(data[k][:io]))
          end
        elsif data[k].is_a?(String)
          data[k] = RRF_BASE64_TRANSLATE.call(k, data[k])
        end
      end
    end

    # Filter the request body with strong params. If `bulk` is true, then we apply allowed
    # parameters to the `_json` key of the request body.
    body_params = if allowed_params == true
      ActionController::Parameters.new(data).permit!
    elsif bulk_action
      if bulk_action == :create
        ActionController::Parameters.new(data).permit({ _json: allowed_params })
      elsif bulk_action == :update
        ActionController::Parameters.new(data).permit({ _json: allowed_params + [ pk ] })
      elsif bulk_action == :destroy
        ActionController::Parameters.new(data).permit({ _json: [] })
      else
        raise ArgumentError, "Invalid bulk action: #{bulk_action}"
      end
    else
      ActionController::Parameters.new(data).permit(*allowed_params)
    end

    # ActiveStorage Integration: Workaround for Rails strong params not allowing you to permit an
    # array containing a mix of scalars and hashes. This is needed for `has_many_attached`, because
    # API consumers must be able to provide scalar `signed_id` values for existing attachments along
    # with hashes for new attachments. It's worth mentioning that base64 scalars are converted to
    # hashes that conform to the ActiveStorage API.
    has_many_attached_scalar_data.each do |k, v|
      body_params[k].unshift(*v)
    end

    # Filter read-only fields. For bulk actions the permitted structure is `{ _json: [...] }`, so we
    # strip read-only keys from each element rather than the top-level hash (whose only key is
    # `_json`). Bulk update keeps the primary key, which it needs to locate each record.
    if bulk_action
      keep = bulk_action == :update ? [ pk.to_s ] : []
      body_params[:_json]&.each do |element|
        next unless element.is_a?(ActionController::Parameters)

        self._rrf_strip_read_only_fields(element, keep: keep)
      end
    else
      self._rrf_strip_read_only_fields(body_params)
    end

    body_params
  end
  alias_method :get_create_params, :get_body_params
  alias_method :get_update_params, :get_body_params
  alias_method :get_destroy_params, :get_body_params

  # Remove read-only fields from a permitted params hash in place. `keep` lists field names to
  # preserve even when read-only (e.g. the primary key on bulk update, used to locate records).
  def _rrf_strip_read_only_fields(params, keep: [])
    params.delete_if do |f, _|
      next false if f.in?(keep)

      cfg = self.class.field_configuration[f]
      cfg && cfg[:read_only]
    end
  end

  # Get the set of records this controller has access to.
  def get_recordset
    return self.class.recordset if self.class.recordset

    # If there is a model, return that model's default scope (all records by default).
    if self.class.model
      return self.class.model.all
    end

    nil
  end

  # Filter the recordset and return records this request has access to.
  def get_records
    data = self.get_recordset

    @records ||= self.class.filter_backends&.reduce(data) { |d, filter|
      filter.new(controller: self).filter_data(d)
    } || data
  end

  # Get a single record by primary key or another column, if allowed.
  def get_record
    return @record if @record

    find_by_key = self.class.model.primary_key
    is_pk = true

    # Find by another column if it's permitted.
    if find_by_param = self.class.find_by_query_param.presence
      if find_by = request.query_parameters[find_by_param].presence
        find_by_fields = (
          self.class.find_by_fields&.map(&:to_s) || self.class.model.columns_hash.keys
        )

        # A `find_by` was explicitly requested, so it must be a permitted field.
        raise ActiveRecord::RecordNotFound unless find_by.in?(find_by_fields)

        is_pk = false unless find_by_key == find_by
        find_by_key = find_by
      end
    end

    # Get the recordset, filtering if configured.
    collection = if self.class.filter_recordset_before_find
      self.get_records
    else
      self.get_recordset
    end

    # Return the record. Route key is always `:id` by Rails' convention.
    if is_pk
      @record = collection.find(request.path_parameters[:id])
    else
      @record = collection.find_by!(find_by_key => request.path_parameters[:id])
    end
  end

  # Determine what collection to call `create` on.
  def create_from
    if self.class.create_from_recordset
      # Create with any properties inherited from the recordset. We exclude any `select` clauses
      # in case model callbacks need to call `count` on this collection, which typically raises a
      # SQL `SyntaxError`.
      self.get_recordset.except(:select)
    else
      # Otherwise, perform a "bare" insert_all.
      self.class.model
    end
  end
end

require_relative "controller/actions"
require_relative "controller/bulk"
require_relative "controller/crud"
require_relative "controller/openapi"

gregschmit / rails-rest-framework / 30496619839

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous