a8b7f6eea4
* Use proper auth chain before checking parameters * Refactor AnalyticsController * Add a bunch of test and rewrite reactions counts with a single query * Add tests for follows totals * Use round and add more refactoring * Add tests to group by day to fallback during refactoring * Use group by to calculate comments count by day * Use group by to calculate follows count by day * Use group by to calculate reactions stats by day * Use group by to calculate page_views stats by day * Move calculations per day back in the cached block * Add a few comments and a little bit of refactoring * Add indexes (concurrently) for analytics * Make tests more time robust * Use a date range cache related to the requesting user or org * Freezing time in UTC should help when tests are ran on time zones over the day line * Remove explicit returns * Page title is escaped, guard against that * Move Analytics service spec in the proper place
69 lines
2.1 KiB
Ruby
69 lines
2.1 KiB
Ruby
class Api::V0::ApiController < ApplicationController
|
|
def cors_set_access_control_headers
|
|
headers["Access-Control-Allow-Origin"] = "*"
|
|
headers["Access-Control-Allow-Methods"] = "POST, GET, PUT, DELETE, OPTIONS"
|
|
headers["Access-Control-Allow-Headers"] = "Origin, Content-Type, Accept, Authorization, Token"
|
|
headers["Access-Control-Max-Age"] = "1728000"
|
|
end
|
|
|
|
def cors_preflight_check
|
|
return unless request.method == "OPTIONS"
|
|
|
|
headers["Access-Control-Allow-Origin"] = "*"
|
|
headers["Access-Control-Allow-Methods"] = "POST, GET, PUT, DELETE, OPTIONS"
|
|
headers["Access-Control-Allow-Headers"] = "X-Requested-With, X-Prototype-Version, Token"
|
|
headers["Access-Control-Max-Age"] = "1728000"
|
|
|
|
render text: "", content_type: "text/plain"
|
|
end
|
|
|
|
rescue_from ActionController::ParameterMissing do |exc|
|
|
error_unprocessable_entity(exc.message)
|
|
end
|
|
|
|
rescue_from ActiveRecord::RecordInvalid do |exc|
|
|
error_unprocessable_entity(exc.message)
|
|
end
|
|
|
|
rescue_from ActiveRecord::RecordNotFound do |_exc|
|
|
error_not_found
|
|
end
|
|
|
|
protected
|
|
|
|
def error_unprocessable_entity(message)
|
|
render json: { error: message, status: 422 }, status: :unprocessable_entity
|
|
end
|
|
|
|
def error_unauthorized
|
|
render json: { error: "unauthorized", status: 401 }, status: :unauthorized
|
|
end
|
|
|
|
def error_not_found
|
|
render json: { error: "not found", status: 404 }, status: :not_found
|
|
end
|
|
|
|
def authenticate_with_api_key_or_current_user
|
|
if request.headers["api-key"]
|
|
authenticate_with_api_key
|
|
else
|
|
@user = current_user
|
|
end
|
|
end
|
|
|
|
def authenticate_with_api_key
|
|
api_key = request.headers["api-key"]
|
|
return error_unauthorized unless api_key
|
|
|
|
api_secret = ApiSecret.includes(:user).find_by(secret: api_key)
|
|
return error_unauthorized unless api_secret
|
|
|
|
# guard against timing attacks
|
|
# see <https://www.slideshare.net/NickMalcolm/timing-attacks-and-ruby-on-rails>
|
|
if ActiveSupport::SecurityUtils.secure_compare(api_secret.secret, api_key)
|
|
@user = api_secret.user
|
|
else
|
|
error_unauthorized
|
|
end
|
|
end
|
|
end
|