1 class ApplicationController < ActionController::Base
3 around_filter :thread_with_api_token, :except => [:render_exception, :render_not_found]
4 before_filter :find_object_by_uuid, :except => [:index, :render_exception, :render_not_found]
6 unless Rails.application.config.consider_all_requests_local
8 :with => :render_exception
9 rescue_from ActiveRecord::RecordNotFound,
10 :with => :render_not_found
11 rescue_from ActionController::RoutingError,
12 :with => :render_not_found
13 rescue_from ActionController::UnknownController,
14 :with => :render_not_found
15 rescue_from ActionController::UnknownAction,
16 :with => :render_not_found
19 def unprocessable(message=nil)
21 @errors << message if message
22 render_error status: 422
25 def render_error(opts)
27 f.html { render opts.merge(controller: 'application', action: 'error') }
28 f.json { render opts.merge(json: {success: false, errors: @errors}) }
32 def render_exception(e)
33 logger.error e.inspect
34 logger.error e.backtrace.collect { |x| x + "\n" }.join('') if e.backtrace
35 if @object and @object.errors and @object.errors.full_messages
36 @errors = @object.errors.full_messages
40 self.render_error status: 422
43 def render_not_found(e=ActionController::RoutingError.new("Path not found"))
44 logger.error e.inspect
45 @errors = ["Path not found"]
46 self.render_error status: 404
51 @objects ||= model_class.all
53 f.json { render json: @objects }
60 return render_not_found("object not found")
63 f.json { render json: @object }
69 @object = model_class.new
73 if @object.update_attributes params[@object.class.to_s.underscore.singularize.to_sym]
76 self.render_error status: 422
81 @object ||= model_class.new params[model_class.to_s.singularize.to_sym]
88 redirect_to(params[:return_to] || :back)
90 self.render_error status: 422
95 if Thread.current[:arvados_api_token]
96 @current_user ||= User.current
98 logger.error "No API token in Thread"
106 controller_name.classify.constantize
109 def find_object_by_uuid
110 if params[:id] and params[:id].match /\D/
111 params[:uuid] = params.delete :id
113 @object = model_class.where(uuid: params[:uuid]).first
116 def thread_with_api_token
118 try_redirect_to_login = true
119 if params[:api_token]
120 try_redirect_to_login = false
121 Thread.current[:arvados_api_token] = params[:api_token]
122 # Before copying the token into session[], do a simple API
123 # call to verify its authenticity.
125 session[:arvados_api_token] = params[:api_token]
126 if !request.format.json? and request.method == 'GET'
127 # Repeat this request with api_token in the (new) session
128 # cookie instead of the query string. This prevents API
129 # tokens from appearing in (and being inadvisedly copied
130 # and pasted from) browser Location bars.
131 redirect_to request.fullpath.sub(%r{([&\?]api_token=)[^&\?]*}, '')
136 @errors = ['Invalid API token']
137 self.render_error status: 401
139 elsif session[:arvados_api_token]
140 # In this case, the token must have already verified at some
141 # point, but it might have been revoked since. We'll try
142 # using it, and catch the exception if it doesn't work.
143 try_redirect_to_login = false
144 Thread.current[:arvados_api_token] = session[:arvados_api_token]
147 rescue ArvadosApiClient::NotLoggedInException
148 try_redirect_to_login = true
151 logger.debug "session is #{session.inspect}"
153 if try_redirect_to_login
156 if request.method == 'GET'
157 redirect_to $arvados_api_client.arvados_login_url(return_to: request.url)
159 flash[:error] = "Either you are not logged in, or your session has timed out. I can't automatically log you in and re-attempt this request."
164 @errors = ['You do not seem to be logged in. You did not supply an API token with this request, and your session (if any) has timed out.']
165 self.render_error status: 422
170 # Remove token in case this Thread is used for anything else.
171 Thread.current[:arvados_api_token] = nil
177 Link.where(uuid: 'just-verifying-my-api-token')
179 rescue ArvadosApiClient::NotLoggedInException
184 def ensure_current_user_is_admin
185 unless current_user and current_user.is_admin
186 @errors = ['Permission denied']
187 self.render_error status: 401