From 71f1554212620cd0078bb04b0e666e0cbf4eb95c Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Mon, 11 Oct 2010 23:09:27 +0100 Subject: [PATCH 1/1] Make trace API a proper CRUD API like other object types --- app/controllers/trace_controller.rb | 64 +++++++++++---- app/models/trace.rb | 46 +++++++++++ config/routes.rb | 9 +- test/fixtures/gpx_files.yml | 19 ++++- test/functional/trace_controller_test.rb | 100 ++++++++++++++++++++--- 5 files changed, 203 insertions(+), 35 deletions(-) diff --git a/app/controllers/trace_controller.rb b/app/controllers/trace_controller.rb index 989d5d5a0..2cd3117dd 100644 --- a/app/controllers/trace_controller.rb +++ b/app/controllers/trace_controller.rb @@ -4,22 +4,22 @@ class TraceController < ApplicationController before_filter :authorize_web before_filter :set_locale before_filter :require_user, :only => [:mine, :create, :edit, :delete] - before_filter :authorize, :only => [:api_details, :api_data, :api_create] - before_filter :check_database_readable, :except => [:api_details, :api_data, :api_create] - before_filter :check_database_writable, :only => [:create, :edit, :delete] - before_filter :check_api_readable, :only => [:api_details, :api_data] - before_filter :check_api_writable, :only => [:api_create] - before_filter :require_allow_read_gpx, :only => [:api_details, :api_data] - before_filter :require_allow_write_gpx, :only => [:api_create] + before_filter :authorize, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data] + before_filter :check_database_readable, :except => [:api_read, :api_data] + before_filter :check_database_writable, :only => [:create, :edit, :delete, :api_create, :api_update, :api_delete] + before_filter :check_api_readable, :only => [:api_read, :api_data] + before_filter :check_api_writable, :only => [:api_create, :api_update, :api_delete] + before_filter :require_allow_read_gpx, :only => [:api_read, :api_data] + before_filter :require_allow_write_gpx, :only => [:api_create, :api_update, :api_delete] before_filter :offline_warning, :only => [:mine, :view] - before_filter :offline_redirect, :only => [:create, :edit, :delete, :data, :api_data, :api_create] - around_filter :api_call_handle_error, :only => [:api_details, :api_data, :api_create] + before_filter :offline_redirect, :only => [:create, :edit, :delete, :data, :api_create, :api_delete, :api_data] + around_filter :api_call_handle_error, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data] caches_action :list, :unless => :logged_in?, :layout => false caches_action :view, :layout => false caches_action :georss, :layout => true - cache_sweeper :trace_sweeper, :only => [:create, :edit, :delete, :api_create], :unless => STATUS == :database_offline - cache_sweeper :tracetag_sweeper, :only => [:create, :edit, :delete, :api_create], :unless => STATUS == :database_offline + cache_sweeper :trace_sweeper, :only => [:create, :edit, :delete, :api_create, :api_update, :api_delete], :unless => STATUS == :database_offline + cache_sweeper :tracetag_sweeper, :only => [:create, :edit, :delete, :api_create, :api_update, :api_delete], :unless => STATUS == :database_offline # Counts and selects pages of GPX traces for various criteria (by user, tags, public etc.). # target_user - if set, specifies the user to fetch traces for. if not set will fetch all traces @@ -280,16 +280,48 @@ class TraceController < ApplicationController render :nothing => true, :status => :not_found end - def api_details - trace = Trace.find(params[:id]) + def api_read + trace = Trace.find(params[:id], :conditions => { :visible => true }) if trace.public? or trace.user == @user render :text => trace.to_xml.to_s, :content_type => "text/xml" else render :nothing => true, :status => :forbidden end - rescue ActiveRecord::RecordNotFound - render :nothing => true, :status => :not_found + end + + def api_update + trace = Trace.find(params[:id], :conditions => { :visible => true }) + + if trace.user == @user + new_trace = Trace.from_xml(request.raw_post) + + unless new_trace and new_trace.id == trace.id + raise OSM::APIBadUserInput.new("The id in the url (#{trace.id}) is not the same as provided in the xml (#{new_trace.id})") + end + + trace.description = new_trace.description + trace.tags = new_trace.tags + trace.visibility = new_trace.visibility + trace.save! + + render :nothing => true, :status => :ok + else + render :nothing => true, :status => :forbidden + end + end + + def api_delete + trace = Trace.find(params[:id], :conditions => { :visible => true }) + + if trace.user == @user + trace.visible = false + trace.save! + + render :nothing => true, :status => :ok + else + render :nothing => true, :status => :forbidden + end end def api_data @@ -304,8 +336,6 @@ class TraceController < ApplicationController else render :nothing => true, :status => :forbidden end - rescue ActiveRecord::RecordNotFound - render :nothing => true, :status => :not_found end def api_create diff --git a/app/models/trace.rb b/app/models/trace.rb index 39ecb416a..582c7285c 100644 --- a/app/models/trace.rb +++ b/app/models/trace.rb @@ -169,6 +169,52 @@ class Trace < ActiveRecord::Base return el1 end + # Read in xml as text and return it's Node object representation + def self.from_xml(xml, create=false) + begin + p = XML::Parser.string(xml) + doc = p.parse + + doc.find('//osm/gpx_file').each do |pt| + return Trace.from_xml_node(pt, create) + end + + raise OSM::APIBadXMLError.new("trace", xml, "XML doesn't contain an osm/gpx_file element.") + rescue LibXML::XML::Error, ArgumentError => ex + raise OSM::APIBadXMLError.new("trace", xml, ex.message) + end + end + + def self.from_xml_node(pt, create=false) + trace = Trace.new + + raise OSM::APIBadXMLError.new("trace", pt, "visibility missing") if pt['visibility'].nil? + trace.visibility = pt['visibility'] + + unless create + raise OSM::APIBadXMLError.new("trace", pt, "ID is required when updating.") if pt['id'].nil? + trace.id = pt['id'].to_i + # .to_i will return 0 if there is no number that can be parsed. + # We want to make sure that there is no id with zero anyway + raise OSM::APIBadUserInput.new("ID of trace cannot be zero when updating.") if trace.id == 0 + end + + # We don't care about the time, as it is explicitly set on create/update/delete + # We don't care about the visibility as it is implicit based on the action + # and set manually before the actual delete + trace.visible = true + + description = pt.find('description').first + raise OSM::APIBadXMLError.new("trace", pt, "description missing") if description.nil? + trace.description = description.content + + pt.find('tag').each do |tag| + trace.tags.build(:tag => tag.content) + end + + return trace + end + def xml_file # TODO *nix specific, could do to work on windows... would be functionally inferior though - check for '.gz' filetype = `/usr/bin/file -bz #{trace_name}`.chomp diff --git a/config/routes.rb b/config/routes.rb index 825413ff3..56a59a207 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -62,9 +62,12 @@ ActionController::Routing::Routes.draw do |map| map.connect "api/#{API_VERSION}/user/gpx_files", :controller => 'user', :action => 'api_gpx_files' map.connect "api/#{API_VERSION}/gpx/create", :controller => 'trace', :action => 'api_create' - map.connect "api/#{API_VERSION}/gpx/:id/details", :controller => 'trace', :action => 'api_details' - map.connect "api/#{API_VERSION}/gpx/:id/data", :controller => 'trace', :action => 'api_data' - map.connect "api/#{API_VERSION}/gpx/:id/data.:format", :controller => 'trace', :action => 'api_data' + map.connect "api/#{API_VERSION}/gpx/:id", :controller => 'trace', :action => 'api_read', :id => /\d+/, :conditions => { :method => :get } + map.connect "api/#{API_VERSION}/gpx/:id", :controller => 'trace', :action => 'api_update', :id => /\d+/, :conditions => { :method => :put } + map.connect "api/#{API_VERSION}/gpx/:id", :controller => 'trace', :action => 'api_delete', :id => /\d+/, :conditions => { :method => :delete } + map.connect "api/#{API_VERSION}/gpx/:id/details", :controller => 'trace', :action => 'api_read', :id => /\d+/ + map.connect "api/#{API_VERSION}/gpx/:id/data", :controller => 'trace', :action => 'api_data', :id => /\d+/ + map.connect "api/#{API_VERSION}/gpx/:id/data.:format", :controller => 'trace', :action => 'api_data', :id => /\d+/ # AMF (ActionScript) API diff --git a/test/fixtures/gpx_files.yml b/test/fixtures/gpx_files.yml index 08616bd99..6e082d24d 100644 --- a/test/fixtures/gpx_files.yml +++ b/test/fixtures/gpx_files.yml @@ -14,7 +14,7 @@ public_trace_file: anon_trace_file: id: 2 user_id: 2 - visible: false + visible: true name: Private Trace.gpx size: 123 latitude: 51.3 @@ -27,7 +27,7 @@ anon_trace_file: trackable_trace_file: id: 3 user_id: 2 - visible: false + visible: true name: Trackable Trace.gpx size: 123 latitude: 51.51 @@ -40,7 +40,7 @@ trackable_trace_file: identifiable_trace_file: id: 4 user_id: 2 - visible: false + visible: true name: Identifiable Trace.gpx size: 123 latitude: 51.512 @@ -49,3 +49,16 @@ identifiable_trace_file: visibility: "identifiable" description: This trace shows trksegs, timestamps and user details. inserted: true + +deleted_trace_file: + id: 5 + user_id: 2 + visible: false + name: Deleted Trace.gpx + size: 123 + latitude: 51.512 + longitude: 0.142 + timestamp: "2009-07-30 17:48:34" + visibility: "public" + description: This is a trace that has been deleted. + inserted: true diff --git a/test/functional/trace_controller_test.rb b/test/functional/trace_controller_test.rb index eb8e675b0..812143c81 100644 --- a/test/functional/trace_controller_test.rb +++ b/test/functional/trace_controller_test.rb @@ -4,7 +4,6 @@ class TraceControllerTest < ActionController::TestCase fixtures :users, :gpx_files set_fixture_class :gpx_files => 'Trace' - # Check that the list of changesets is displayed def test_list get :list @@ -39,48 +38,125 @@ class TraceControllerTest < ActionController::TestCase end # Check getting a specific trace through the api - def test_api_details + def test_api_read # First with no auth - get :api_details, :id => gpx_files(:public_trace_file).id + get :api_read, :id => gpx_files(:public_trace_file).id assert_response :unauthorized # Now with some other user, which should work since the trace is public basic_authorization(users(:public_user).display_name, "test") - get :api_details, :id => gpx_files(:public_trace_file).id + get :api_read, :id => gpx_files(:public_trace_file).id assert_response :success # And finally we should be able to do it with the owner of the trace basic_authorization(users(:normal_user).display_name, "test") - get :api_details, :id => gpx_files(:public_trace_file).id + get :api_read, :id => gpx_files(:public_trace_file).id assert_response :success end # Check an anoymous trace can't be specifically fetched by another user - def test_api_details_anon + def test_api_read_anon # Furst with no auth - get :api_details, :id => gpx_files(:anon_trace_file).id + get :api_read, :id => gpx_files(:anon_trace_file).id assert_response :unauthorized # Now try with another user, which shouldn't work since the trace is anon basic_authorization(users(:normal_user).display_name, "test") - get :api_details, :id => gpx_files(:anon_trace_file).id + get :api_read, :id => gpx_files(:anon_trace_file).id assert_response :forbidden # And finally we should be able to get the trace details with the trace owner basic_authorization(users(:public_user).display_name, "test") - get :api_details, :id => gpx_files(:anon_trace_file).id + get :api_read, :id => gpx_files(:anon_trace_file).id assert_response :success end # Check the api details for a trace that doesn't exist - def test_api_details_not_found + def test_api_read_not_found # Try first with no auth, as it should requure it - get :api_details, :id => 0 + get :api_read, :id => 0 assert_response :unauthorized # Login, and try again basic_authorization(users(:public_user).display_name, "test") - get :api_details, :id => 0 + get :api_read, :id => 0 + assert_response :not_found + + # Now try a trace which did exist but has been deleted + basic_authorization(users(:public_user).display_name, "test") + get :api_read, :id => 5 + assert_response :not_found + end + + # Check updating a trace through the api + def test_api_update + # First with no auth + content gpx_files(:public_trace_file).to_xml + put :api_update, :id => gpx_files(:public_trace_file).id + assert_response :unauthorized + + # Now with some other user, which should fail + basic_authorization(users(:public_user).display_name, "test") + content gpx_files(:public_trace_file).to_xml + put :api_update, :id => gpx_files(:public_trace_file).id + assert_response :forbidden + + # Now with a trace which doesn't exist + basic_authorization(users(:public_user).display_name, "test") + content gpx_files(:public_trace_file).to_xml + put :api_update, :id => 0 + assert_response :not_found + + # Now with a trace which did exist but has been deleted + basic_authorization(users(:public_user).display_name, "test") + content gpx_files(:deleted_trace_file).to_xml + put :api_update, :id => gpx_files(:deleted_trace_file).id + assert_response :not_found + + # Now try an update with the wrong ID + basic_authorization(users(:normal_user).display_name, "test") + content gpx_files(:anon_trace_file).to_xml + put :api_update, :id => gpx_files(:public_trace_file).id + assert_response :bad_request, + "should not be able to update a trace with a different ID from the XML" + + # And finally try an update that should work + basic_authorization(users(:normal_user).display_name, "test") + t = gpx_files(:public_trace_file) + t.description = "Changed description" + t.visibility = "private" + content t.to_xml + put :api_update, :id => t.id + assert_response :success + nt = Trace.find(t.id) + assert_equal nt.description, t.description + assert_equal nt.visibility, t.visibility + end + + # Check deleting a trace through the api + def test_api_delete + # First with no auth + delete :api_delete, :id => gpx_files(:public_trace_file).id + assert_response :unauthorized + + # Now with some other user, which should fail + basic_authorization(users(:public_user).display_name, "test") + delete :api_delete, :id => gpx_files(:public_trace_file).id + assert_response :forbidden + + # Now with a trace which doesn't exist + basic_authorization(users(:public_user).display_name, "test") + delete :api_delete, :id => 0 + assert_response :not_found + + # And finally we should be able to do it with the owner of the trace + basic_authorization(users(:normal_user).display_name, "test") + delete :api_delete, :id => gpx_files(:public_trace_file).id + assert_response :success + + # Try it a second time, which should fail + basic_authorization(users(:normal_user).display_name, "test") + delete :api_delete, :id => gpx_files(:public_trace_file).id assert_response :not_found end end -- 2.43.2