103 lines
3.4 KiB
Ruby
103 lines
3.4 KiB
Ruby
module Api
|
|
module V0
|
|
class ArticlesController < ApiController
|
|
respond_to :json
|
|
|
|
before_action :authenticate_with_api_key_or_current_user!, only: %i[create update]
|
|
before_action :authenticate!, only: :me
|
|
before_action -> { doorkeeper_authorize! :public }, only: %w[index show], if: -> { doorkeeper_token }
|
|
|
|
before_action :set_cache_control_headers, only: [:index]
|
|
caches_action :show,
|
|
cache_path: proc { |c| c.params.permit! },
|
|
expires_in: 5.minutes
|
|
|
|
before_action :cors_preflight_check
|
|
after_action :cors_set_access_control_headers
|
|
|
|
# skip CSRF checks for create and update
|
|
skip_before_action :verify_authenticity_token, only: %i[create update]
|
|
|
|
def index
|
|
@articles = ArticleApiIndexService.new(params).get
|
|
|
|
key_headers = [
|
|
"articles_api",
|
|
params[:tag],
|
|
params[:page],
|
|
params[:username],
|
|
params[:signature],
|
|
params[:state],
|
|
params[:collection_id],
|
|
]
|
|
set_surrogate_key_header key_headers.join("_")
|
|
end
|
|
|
|
def show
|
|
@article = Article.published.includes(:user).find(params[:id]).decorate
|
|
end
|
|
|
|
def create
|
|
@article = Articles::Creator.call(@user, article_params)
|
|
if @article.persisted?
|
|
render "show", status: :created, location: @article.url
|
|
else
|
|
message = @article.errors.full_messages.join(", ")
|
|
render json: { error: message, status: 422 }, status: :unprocessable_entity
|
|
end
|
|
end
|
|
|
|
def update
|
|
@article = Articles::Updater.call(@user, params[:id], article_params)
|
|
render "show", status: :ok
|
|
end
|
|
|
|
def me
|
|
doorkeeper_scope = %w[unpublished all].include?(params[:status]) ? :read_articles : :public
|
|
doorkeeper_authorize! doorkeeper_scope if doorkeeper_token
|
|
|
|
per_page = (params[:per_page] || 30).to_i
|
|
num = [per_page, 1000].min
|
|
|
|
@articles = case params[:status]
|
|
when "published"
|
|
@user.articles.published
|
|
when "unpublished"
|
|
@user.articles.unpublished
|
|
when "all"
|
|
@user.articles
|
|
else
|
|
@user.articles.published
|
|
end
|
|
|
|
@articles = @articles.
|
|
includes(:organization).
|
|
order(published_at: :desc, created_at: :desc).
|
|
page(params[:page]).
|
|
per(num).
|
|
decorate
|
|
end
|
|
|
|
private
|
|
|
|
def article_params
|
|
allowed_params = [
|
|
:title, :body_markdown, :published, :series,
|
|
:main_image, :canonical_url, :description, tags: []
|
|
]
|
|
allowed_params << :organization_id if params["article"]["organization_id"] && allowed_to_change_org_id?
|
|
params.require(:article).permit(allowed_params)
|
|
end
|
|
|
|
def allowed_to_change_org_id?
|
|
potential_user = @article&.user || @user
|
|
if @article.nil? || OrganizationMembership.exists?(user: potential_user, organization_id: params["article"]["organization_id"])
|
|
OrganizationMembership.exists?(user: potential_user, organization_id: params["article"]["organization_id"])
|
|
elsif potential_user == @user
|
|
potential_user.org_admin?(params["article"]["organization_id"]) ||
|
|
@user.any_admin?
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|