X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/e8f81804c24307b6702b1897c80b4be832254454..59f750a109a706d29862530dc3d282db75736d38:/services/api/app/controllers/application_controller.rb diff --git a/services/api/app/controllers/application_controller.rb b/services/api/app/controllers/application_controller.rb index f83cd3428f..762bbd9c1c 100644 --- a/services/api/app/controllers/application_controller.rb +++ b/services/api/app/controllers/application_controller.rb @@ -1,13 +1,30 @@ +module ApiTemplateOverride + def allowed_to_render?(fieldset, field, model, options) + if options[:select] + return options[:select].include? field.to_s + end + super + end +end + +class ActsAsApi::ApiTemplate + prepend ApiTemplateOverride +end + +require 'load_param' +require 'record_filters' + class ApplicationController < ActionController::Base include CurrentApiClient include ThemesForRails::ActionController - - ERROR_ACTIONS = [:render_error, :render_not_found] + include LoadParam + include RecordFilters respond_to :json protect_from_forgery - around_filter :thread_with_auth_info, except: ERROR_ACTIONS + ERROR_ACTIONS = [:render_error, :render_not_found] + before_filter :respond_with_json_by_default before_filter :remote_ip before_filter :load_read_auths @@ -16,9 +33,9 @@ class ApplicationController < ActionController::Base before_filter :catch_redirect_hint before_filter(:find_object_by_uuid, except: [:index, :create] + ERROR_ACTIONS) - before_filter :load_limit_offset_order_params, only: [:index, :owned_items] - before_filter :load_where_param, only: [:index, :owned_items] - before_filter :load_filters_param, only: [:index, :owned_items] + before_filter :load_limit_offset_order_params, only: [:index, :contents] + before_filter :load_where_param, only: [:index, :contents] + before_filter :load_filters_param, only: [:index, :contents] before_filter :find_objects_for_index, :only => :index before_filter :reload_object_before_update, :only => :update before_filter(:render_404_if_no_object, @@ -28,10 +45,27 @@ class ApplicationController < ActionController::Base attr_accessor :resource_attrs - DEFAULT_LIMIT = 100 + begin + rescue_from(Exception, + ArvadosModel::PermissionDeniedError, + :with => :render_error) + rescue_from(ActiveRecord::RecordNotFound, + ActionController::RoutingError, + ActionController::UnknownController, + AbstractController::ActionNotFound, + :with => :render_not_found) + end + + def default_url_options + if Rails.configuration.host + {:host => Rails.configuration.host} + else + {} + end + end def index - @objects.uniq!(&:id) + @objects.uniq!(&:id) if @select.nil? or @select.include? "id" if params[:eager] and params[:eager] != '0' and params[:eager] != 0 and params[:eager] != '' @objects.each(&:eager_load_associations) end @@ -39,12 +73,53 @@ class ApplicationController < ActionController::Base end def show - render json: @object.as_api_response + render json: @object.as_api_response(nil, select: @select) end def create @object = model_class.new resource_attrs - @object.save! + retry_save = true + + if @object.respond_to? :name and params[:ensure_unique_name] + # Record the original name. See below. + name_stem = @object.name + counter = 1 + end + + while retry_save + begin + retry_save = false + @object.save! + rescue ActiveRecord::RecordNotUnique => rn + # Dig into the error to determine if it is specifically calling out a + # (owner_uuid, name) uniqueness violation. In this specific case, and + # the client requested a unique name with ensure_unique_name==true, + # update the name field and try to save again. Loop as necessary to + # discover a unique name. It is necessary to handle name choosing at + # this level (as opposed to the client) to ensure that record creation + # never fails due to a race condition. + if rn.original_exception.is_a? PG::UniqueViolation + # Unfortunately ActiveRecord doesn't abstract out any of the + # necessary information to figure out if this the error is actually + # the specific case where we want to apply the ensure_unique_name + # behavior, so the following code is specialized to Postgres. + err = rn.original_exception + detail = err.result.error_field(PG::Result::PG_DIAG_MESSAGE_DETAIL) + if /^Key \(owner_uuid, name\)=\([a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{15}, .*?\) already exists\./.match detail + logger.error "params[:ensure_unique_name] is #{params[:ensure_unique_name]}" + if params[:ensure_unique_name] + counter += 1 + @object.uuid = nil + @object.name = "#{name_stem} (#{counter})" + retry_save = true + end + end + end + if not retry_save + raise + end + end + end show end @@ -61,75 +136,6 @@ class ApplicationController < ActionController::Base show end - def self._owned_items_requires_parameters - _index_requires_parameters. - merge({ - include_linked: { - type: 'boolean', required: false, default: false - }, - }) - end - - def owned_items - all_objects = [] - all_available = 0 - - # Trick apply_where_limit_order_params into applying suitable - # per-table values. *_all are the real ones we'll apply to the - # aggregate set. - limit_all = @limit - offset_all = @offset - @orders = [] - - ArvadosModel.descendants. - reject(&:abstract_class?). - sort_by(&:to_s). - each do |klass| - case klass.to_s - # We might expect klass==Link etc. here, but we would be - # disappointed: when Rails reloads model classes, we get two - # distinct classes called Link which do not equal each - # other. But we can still rely on klass.to_s to be "Link". - when 'ApiClientAuthorization' - # Do not want. - else - @objects = klass.readable_by(*@read_users) - cond_sql = "#{klass.table_name}.owner_uuid = ?" - cond_params = [@object.uuid] - if params[:include_linked] - @objects = @objects. - joins("LEFT JOIN links mng_links"\ - " ON mng_links.link_class=#{klass.sanitize 'permission'}"\ - " AND mng_links.name=#{klass.sanitize 'can_manage'}"\ - " AND mng_links.tail_uuid=#{klass.sanitize @object.uuid}"\ - " AND mng_links.head_uuid=#{klass.table_name}.uuid") - cond_sql += " OR mng_links.uuid IS NOT NULL" - end - @objects = @objects.where(cond_sql, *cond_params).order(:uuid) - @limit = limit_all - all_objects.count - apply_where_limit_order_params - items_available = @objects. - except(:limit).except(:offset). - count(:id, distinct: true) - all_available += items_available - @offset = [@offset - items_available, 0].max - - all_objects += @objects.to_a - end - end - @objects = all_objects || [] - @object_list = { - :kind => "arvados#objectList", - :etag => "", - :self_link => "", - :offset => offset_all, - :limit => limit_all, - :items_available => all_available, - :items => @objects.as_api_response(nil) - } - render json: @object_list - end - def catch_redirect_hint if !current_user if params.has_key?('redirect_to') then @@ -138,21 +144,6 @@ class ApplicationController < ActionController::Base end end - begin - rescue_from Exception, - :with => :render_error - rescue_from ActiveRecord::RecordNotFound, - :with => :render_not_found - rescue_from ActionController::RoutingError, - :with => :render_not_found - rescue_from ActionController::UnknownController, - :with => :render_not_found - rescue_from AbstractController::ActionNotFound, - :with => :render_not_found - rescue_from ArvadosModel::PermissionDeniedError, - :with => :render_error - end - def render_404_if_no_object render_not_found "Object not found" if !@object end @@ -162,91 +153,35 @@ class ApplicationController < ActionController::Base if e.respond_to? :backtrace and e.backtrace logger.error e.backtrace.collect { |x| x + "\n" }.join('') end - if @object and @object.errors and @object.errors.full_messages and not @object.errors.full_messages.empty? + if (@object.respond_to? :errors and + @object.errors.andand.full_messages.andand.any?) errors = @object.errors.full_messages + logger.error errors.inspect else errors = [e.inspect] end status = e.respond_to?(:http_status) ? e.http_status : 422 - render json: { errors: errors }, status: status + send_error(*errors, status: status) end def render_not_found(e=ActionController::RoutingError.new("Path not found")) logger.error e.inspect - render json: { errors: ["Path not found"] }, status: 404 + send_error("Path not found", status: 404) end protected - def load_where_param - if params[:where].nil? or params[:where] == "" - @where = {} - elsif params[:where].is_a? Hash - @where = params[:where] - elsif params[:where].is_a? String - begin - @where = Oj.load(params[:where]) - raise unless @where.is_a? Hash - rescue - raise ArgumentError.new("Could not parse \"where\" param as an object") - end - end - @where = @where.with_indifferent_access - end - - def load_filters_param - @filters ||= [] - if params[:filters].is_a? Array - @filters += params[:filters] - elsif params[:filters].is_a? String and !params[:filters].empty? - begin - f = Oj.load params[:filters] - raise unless f.is_a? Array - @filters += f - rescue - raise ArgumentError.new("Could not parse \"filters\" param as an array") - end - end - end - - def default_orders - ["#{table_name}.modified_at desc"] - end - - def load_limit_offset_order_params - if params[:limit] - unless params[:limit].to_s.match(/^\d+$/) - raise ArgumentError.new("Invalid value for limit parameter") - end - @limit = params[:limit].to_i + def send_error(*args) + if args.last.is_a? Hash + err = args.pop else - @limit = DEFAULT_LIMIT - end - - if params[:offset] - unless params[:offset].to_s.match(/^\d+$/) - raise ArgumentError.new("Invalid value for offset parameter") - end - @offset = params[:offset].to_i - else - @offset = 0 - end - - @orders = [] - if params[:order] - params[:order].split(',').each do |order| - attr, direction = order.strip.split " " - direction ||= 'asc' - if attr.match /^[a-z][_a-z0-9]+$/ and - model_class.columns.collect(&:name).index(attr) and - ['asc','desc'].index direction.downcase - @orders << "#{table_name}.#{attr} #{direction.downcase}" - end - end - end - if @orders.empty? - @orders = default_orders + err = {} end + err[:errors] ||= args + err[:error_token] = [Time.now.utc.to_i, "%08x" % rand(16 ** 8)].join("+") + status = err.delete(:status) || 422 + logger.error "Error #{err[:error_token]}: #{status}" + render json: err, status: status end def find_objects_for_index @@ -254,64 +189,19 @@ class ApplicationController < ActionController::Base apply_where_limit_order_params end - def apply_where_limit_order_params - ar_table_name = @objects.table_name - if @filters.is_a? Array and @filters.any? - cond_out = [] - param_out = [] - @filters.each do |filter| - attr, operator, operand = filter - if !filter.is_a? Array - raise ArgumentError.new("Invalid element in filters array: #{filter.inspect} is not an array") - elsif !operator.is_a? String - raise ArgumentError.new("Invalid operator '#{operator}' (#{operator.class}) in filter") - elsif !model_class.searchable_columns(operator).index attr.to_s - raise ArgumentError.new("Invalid attribute '#{attr}' in filter") - end - case operator.downcase - when '=', '<', '<=', '>', '>=', 'like' - if operand.is_a? String - cond_out << "#{ar_table_name}.#{attr} #{operator} ?" - if (# any operator that operates on value rather than - # representation: - operator.match(/[<=>]/) and - model_class.attribute_column(attr).type == :datetime) - operand = Time.parse operand - end - param_out << operand - elsif operand.nil? and operator == '=' - cond_out << "#{ar_table_name}.#{attr} is null" - else - raise ArgumentError.new("Invalid operand type '#{operand.class}' "\ - "for '#{operator}' operator in filters") - end - when 'in' - if operand.is_a? Array - cond_out << "#{ar_table_name}.#{attr} IN (?)" - param_out << operand - else - raise ArgumentError.new("Invalid operand type '#{operand.class}' "\ - "for '#{operator}' operator in filters") - end - when 'is_a' - operand = [operand] unless operand.is_a? Array - cond = [] - operand.each do |op| - cl = ArvadosModel::kind_class op - if cl - cond << "#{ar_table_name}.#{attr} like ?" - param_out << cl.uuid_like_pattern - else - cond << "1=0" - end - end - cond_out << cond.join(' OR ') - end - end - if cond_out.any? - @objects = @objects.where(cond_out.join(' AND '), *param_out) - end + def apply_filters model_class=nil + model_class ||= self.model_class + ft = record_filters @filters, model_class + if ft[:cond_out].any? + @objects = @objects.where('(' + ft[:cond_out].join(') AND (') + ')', + *ft[:param_out]) end + end + + def apply_where_limit_order_params *args + apply_filters *args + + ar_table_name = @objects.table_name if @where.is_a? Hash and @where.any? conditions = ['1=1'] @where.each do |attr,value| @@ -365,9 +255,30 @@ class ApplicationController < ActionController::Base end end + if @select + unless action_name.in? %w(create update destroy) + # Map attribute names in @select to real column names, resolve + # those to fully-qualified SQL column names, and pass the + # resulting string to the select method. + api_column_map = model_class.attributes_required_columns + columns_list = @select. + flat_map { |attr| api_column_map[attr] }. + uniq. + map { |s| "#{table_name}.#{ActiveRecord::Base.connection.quote_column_name s}" } + @objects = @objects.select(columns_list.join(", ")) + end + + # This information helps clients understand what they're seeing + # (Workbench always expects it), but they can't select it explicitly + # because it's not an SQL column. Always add it. + # (This is harmless, given that clients can deduce what they're + # looking at by the returned UUID anyway.) + @select |= ["kind"] + end @objects = @objects.order(@orders.join ", ") if @orders.any? @objects = @objects.limit(@limit) @objects = @objects.offset(@offset) + @objects = @objects.uniq(@distinct) if not @distinct.nil? end def resource_attrs @@ -416,12 +327,8 @@ class ApplicationController < ActionController::Base def require_login if not current_user respond_to do |format| - format.json { - render :json => { errors: ['Not logged in'] }.to_json, status: 401 - } - format.html { - redirect_to '/auth/joshid' - } + format.json { send_error("Not logged in", status: 401) } + format.html { redirect_to '/auth/joshid' } end false end @@ -429,76 +336,19 @@ class ApplicationController < ActionController::Base def admin_required unless current_user and current_user.is_admin - render :json => { errors: ['Forbidden'] }.to_json, status: 403 + send_error("Forbidden", status: 403) end end def require_auth_scope if @read_auths.empty? if require_login != false - render :json => { errors: ['Forbidden'] }.to_json, status: 403 + send_error("Forbidden", status: 403) end false end end - def thread_with_auth_info - Thread.current[:request_starttime] = Time.now - Thread.current[:api_url_base] = root_url.sub(/\/$/,'') + '/arvados/v1' - begin - user = nil - api_client = nil - api_client_auth = nil - supplied_token = - params[:api_token] || - params[:oauth_token] || - request.headers["Authorization"].andand.match(/OAuth2 ([a-z0-9]+)/).andand[1] - if supplied_token - api_client_auth = ApiClientAuthorization. - includes(:api_client, :user). - where('api_token=? and (expires_at is null or expires_at > CURRENT_TIMESTAMP)', supplied_token). - first - if api_client_auth.andand.user - session[:user_id] = api_client_auth.user.id - session[:api_client_uuid] = api_client_auth.api_client.andand.uuid - session[:api_client_authorization_id] = api_client_auth.id - user = api_client_auth.user - api_client = api_client_auth.api_client - else - # Token seems valid, but points to a non-existent (deleted?) user. - api_client_auth = nil - end - elsif session[:user_id] - user = User.find(session[:user_id]) rescue nil - api_client = ApiClient. - where('uuid=?',session[:api_client_uuid]). - first rescue nil - if session[:api_client_authorization_id] then - api_client_auth = ApiClientAuthorization. - find session[:api_client_authorization_id] - end - end - Thread.current[:api_client_ip_address] = remote_ip - Thread.current[:api_client_authorization] = api_client_auth - Thread.current[:api_client_uuid] = api_client.andand.uuid - Thread.current[:api_client] = api_client - Thread.current[:user] = user - if api_client_auth - api_client_auth.last_used_at = Time.now - api_client_auth.last_used_by_ip_address = remote_ip - api_client_auth.save validate: false - end - yield - ensure - Thread.current[:api_client_ip_address] = nil - Thread.current[:api_client_authorization] = nil - Thread.current[:api_client_uuid] = nil - Thread.current[:api_client] = nil - Thread.current[:user] = nil - end - end - # /Authentication - def respond_with_json_by_default html_index = request.accepts.index(Mime::HTML) if html_index.nil? or request.accepts[0...html_index].include?(Mime::JSON) @@ -579,7 +429,7 @@ class ApplicationController < ActionController::Base :self_link => "", :offset => @offset, :limit => @limit, - :items => @objects.as_api_response(nil) + :items => @objects.as_api_response(nil, {select: @select}) } if @objects.respond_to? :except @object_list[:items_available] = @objects. @@ -604,7 +454,9 @@ class ApplicationController < ActionController::Base { filters: { type: 'array', required: false }, where: { type: 'object', required: false }, - order: { type: 'string', required: false }, + order: { type: 'array', required: false }, + select: { type: 'array', required: false }, + distinct: { type: 'boolean', required: false }, limit: { type: 'integer', required: false, default: DEFAULT_LIMIT }, offset: { type: 'integer', required: false, default: 0 }, }