File Coverage

blib/lib/Yancy/Controller/Yancy/MultiTenant.pm

Criterion	Covered	Total	%
statement	41	42	97.6
branch	11	14	78.5
condition	18	25	72.0
subroutine	7	7	100.0
pod	4	4	100.0
total	81	92	88.0

package Yancy::Controller::Yancy::MultiTenant;
our $VERSION = '1.086';
# ABSTRACT: A controller to show a user only their content

#pod =head1 SYNOPSIS
#pod
#pod     use Mojolicious::Lite;
#pod     plugin Yancy => {
#pod         schema => {
#pod             blog => {
#pod                 properties => {
#pod                     id => { type => 'integer' },
#pod                     user_id => { type => 'integer' },
#pod                     title => { type => 'string' },
#pod                     html => { type => 'string' },
#pod                 },
#pod             },
#pod         },
#pod     };
#pod
#pod     app->routes->get( '/user/:user_id' )->to(
#pod         'yancy-multi_tenant#list',
#pod         schema => 'blog',
#pod         template => 'index'
#pod     );
#pod
#pod     __DATA__
#pod     @@ index.html.ep
#pod     % for my $item ( @{ stash 'items' } ) {
#pod         <%= $item->{title} %>
#pod         <%== $item->{html} %>
#pod     % }
#pod
#pod =head1 DESCRIPTION
#pod
#pod This module contains routes to manage content owned by users. When paired
#pod with an authentication plugin like L, each user
#pod is allowed to manage their own content.
#pod
#pod This controller extends L to add filtering content
#pod by a user's ID.
#pod
#pod =head1 EXAMPLES
#pod
#pod To use this controller when the URL displays a username and the content
#pod uses an internal ID, you can use an C route to map the username
#pod in the path to the ID:
#pod
#pod     my $user_route = app->routes->under( '/:username', sub {
#pod         my ( $c ) = @_;
#pod         my $username = $c->stash( 'username' );
#pod         my @users = $c->yancy->list( user => { username => $username } );
#pod         if ( my $user = $users[0] ) {
#pod             $c->stash( user_id => $user->{id} );
#pod             return 1;
#pod         }
#pod         return $c->reply->not_found;
#pod     } );
#pod
#pod     # /:username - List blog posts
#pod     $user_route->get( '' )->to(
#pod         'yancy-multi_tenant#list',
#pod         schema => 'blog',
#pod         template => 'blog_list',
#pod     );
#pod     # /:username/:id/:slug - Get a single blog post
#pod     $user_route->get( '/:id/:slug' )->to(
#pod         'yancy-multi_tenant#get',
#pod         schema => 'blog',
#pod         template => 'blog_view',
#pod     );
#pod
#pod To build a website where content is only for the current logged-in user,
#pod combine this controller with an auth plugin like
#pod L. Use an C route to set the
#pod C from the current user.
#pod
#pod     app->yancy->plugin( 'Auth::Basic', {
#pod         route => any( '' ), # All routes require login
#pod         schema => 'user',
#pod         username_field => 'username',
#pod         password_digest => { type => 'SHA-1' },
#pod     } );
#pod
#pod     my $user_route = app->yancy->auth->route->under( '/', sub {
#pod         my ( $c ) = @_;
#pod         my $user = $c->yancy->auth->current_user;
#pod         $c->stash( user_id => $user->{id} );
#pod         return 1;
#pod     } );
#pod
#pod     # / - List todo items
#pod     $user_route->get( '' )->to(
#pod         'yancy-multi_tenant#list',
#pod         schema => 'todo_item',
#pod         template => 'todo_list',
#pod     );
#pod
#pod =head1 SEE ALSO
#pod
#pod L, L, L
#pod
#pod =cut

use Mojo::Base 'Yancy::Controller::Yancy';
use Yancy::Util qw( derp );

#pod =method list
#pod
#pod     $routes->get( '/:user_id' )->to(
#pod         'yancy-multi_tenant#list',
#pod         schema => $schema_name,
#pod         template => $template_name,
#pod     );
#pod
#pod This method is used to list content owned by the given user (specified
#pod in the C stash value).
#pod
#pod =head4 Input Stash
#pod
#pod This method extends L and adds the
#pod following configuration and stash values:
#pod
#pod =over
#pod
#pod =item user_id
#pod
#pod The ID of the user whose content should be listed. Required. Should
#pod match a value in the C.
#pod
#pod =item user_id_field
#pod
#pod The field in the item that holds the user ID. Defaults to C.
#pod
#pod =back
#pod
#pod =cut

sub list {
    my ( $c ) = @_;
    my $user_id = $c->stash( 'user_id' ) || die "User ID not defined in stash";
    $c->stash( filter => {
        %{ $c->_resolve_filter },
        $c->stash( 'user_id_field' ) // 'user_id' => $user_id,
    } );
    return $c->SUPER::list;
}

#pod =method get
#pod
#pod     $routes->get( '/:user_id/:id' )->to(
#pod         'yancy-multi_tenant#get',
#pod         schema => $schema_name,
#pod         template => $template_name,
#pod     );
#pod
#pod This method is used to show a single item owned by a user (given by the
#pod C stash value).
#pod
#pod =head4 Input Stash
#pod
#pod This method extends L and adds the
#pod following configuration and stash values:
#pod
#pod =over
#pod
#pod =item user_id
#pod
#pod The ID of the user whose content should be listed. Required. Should
#pod match a value in the C.
#pod
#pod =item user_id_field
#pod
#pod The field in the item that holds the user ID. Defaults to C.
#pod
#pod =back
#pod
#pod =cut

sub get {
    my ( $c ) = @_;
    return if !$c->_is_owned_by;
    return $c->SUPER::get;
}

#pod =method set
#pod
#pod     $routes->any( [ 'GET', 'POST' ] => '/:id/edit' )->to(
#pod         'yancy#set',
#pod         schema => $schema_name,
#pod         template => $template_name,
#pod     );
#pod
#pod     $routes->any( [ 'GET', 'POST' ] => '/create' )->to(
#pod         'yancy#set',
#pod         schema => $schema_name,
#pod         template => $template_name,
#pod         forward_to => $route_name,
#pod     );
#pod
#pod This route creates a new item or updates an existing item in
#pod a schema. If the user is making a C request, they will simply
#pod be shown the template. If the user is making a C or C
#pod request, the form parameters will be read, the data will be validated
#pod against L,
#pod and the user will either be shown the form again with the
#pod result of the form submission (success or failure) or the user will be
#pod forwarded to another place.
#pod
#pod This method does not authenticate users. User authentication and
#pod authorization should be performed by an auth plugin like
#pod L.
#pod
#pod =head4 Input Stash
#pod
#pod This method extends L and adds the
#pod following configuration and stash values:
#pod
#pod =over
#pod
#pod =item user_id
#pod
#pod The ID of the user whose content is being edited. Required. Will be
#pod set in the C.
#pod
#pod =item user_id_field
#pod
#pod The field in the item that holds the user ID. Defaults to C.
#pod This field will be filled in with the C stash value.
#pod
#pod =back
#pod
#pod =cut

sub set {
    my ( $c ) = @_;

    # Users are not allowed to edit content from other users
    my $id = $c->stash( 'id' );
    return if $id && !$c->_is_owned_by;

    if ( $c->req->method ne 'GET' ) {
        my $user_id_field = $c->stash( 'user_id_field' ) // 'user_id';
        my $user_id = $c->stash( 'user_id' );
        if ( eval { $c->req->json } ) {
            $c->req->json->{ $user_id_field } = $user_id;
        }
        else {
            $c->req->param( $user_id_field => $c->stash( 'user_id' ) );
        }
    }

    return $c->SUPER::set;
}

#pod =method delete
#pod
#pod     $routes->any( [ 'GET', 'POST' ], '/delete/:id' )->to(
#pod         'yancy#delete',
#pod         schema => $schema_name,
#pod         template => $template_name,
#pod         forward_to => $route_name,
#pod     );
#pod
#pod This route deletes an item from a schema. If the user is making
#pod a C request, they will simply be shown the template (which can be
#pod used to confirm the delete). If the user is making a C or C
#pod request, the item will be deleted and the user will either be shown the
#pod form again with the result of the form submission (success or failure)
#pod or the user will be forwarded to another place.
#pod
#pod This method does not authenticate users. User authentication and
#pod authorization should be performed by an auth plugin like
#pod L.
#pod
#pod =head4 Input Stash
#pod
#pod This method extends L and adds the
#pod following configuration and stash values:
#pod
#pod =over
#pod
#pod =item user_id
#pod
#pod The ID of the user whose content is being edited. Required. Will be
#pod set in the C.
#pod
#pod =item user_id_field
#pod
#pod The field in the item that holds the user ID. Defaults to C.
#pod This field will be filled in with the C stash value.
#pod
#pod =back
#pod
#pod =cut

sub delete {
    my ( $c ) = @_;
    return if !$c->_is_owned_by;
    return $c->SUPER::delete;
}

# =sub _is_owned_by
#
#   return if !_is_owned_by();
#
# Check that the currently-requested item is owned by the user_id in the
# stash. This uses the schema, id, user_id, and user_id_field stash
# values. user_id_field defaults to 'user_id'. All other fields are
# required and will throw an exception if missing.
sub _is_owned_by {
    my ( $c ) = @_;
    if ( $c->stash( 'collection' ) ) {
        derp '"collection" stash key is now "schema" in controller configuration';
    }
    my $schema_name = $c->stash( 'schema' ) || $c->stash( 'collection' )
        || die "Schema name not defined in stash";
    my $user_id = $c->stash( 'user_id' ) || die "User ID not defined in stash";
    my $schema = $c->yancy->schema( $schema_name );
    # XXX: The id_field stash is not documented and is only used by the
    # editor plugin API. We should make it so the editor API does not
    # need to use this anymore, and instead uses the x-id-field directly.
    my $id_field = $c->stash( 'id_field' ) // $schema->{'x-id-field'} // 'id';
    my $id = $c->stash( $id_field ) // die sprintf 'ID field "%s" not defined in stash', $id_field;
    my $user_id_field = $c->stash( 'user_id_field' ) // 'user_id';
    my $item = $c->yancy->backend->get( $schema_name => $id );
    if ( !$item || $item->{ $user_id_field } ne $user_id ) {
        $c->reply->not_found;
        return 0;
    }
    return 1;
}

1;

__END__