Contents

module Scrivito

class WebserviceController < ActionController::Base
  rescue_from ClientError do |exception|
    render json: {error: exception.message}, status: exception.http_code
  end

  before_filter :merge_correctly_parsed_json_params
  before_filter :authorize

  private

  def authorize
    render_forbidden unless allow_access?
  end

  def editing_context
    request.env[EditingContextMiddleware::ENVKEY] || EditingContext.new
  end

  def scrivito_user
    editing_context.editor
  end

  # If +true+, allow access to ObjsController, else deny access.
  # See {Scrivito::Configuration.editing_auth} for details.
  # @return [Bool]
  def allow_access?
    !!scrivito_user
  end

  # Workaround for https://github.com/rails/rails/issues/8832
  def merge_correctly_parsed_json_params
    if request.format.json?
      body = request.body.read
      request.body.rewind
      params.merge!(ActiveSupport::JSON.decode(body)) if body.present?
    end
  end

  def can_user_access_workspace?(verb, workspace)
    scrivito_user.can?(verb, workspace)
  end

  def authorize_workspace_access(verb, workspace)
    can_user_access_workspace?(verb, workspace) ? yield : render_forbidden
  end

  def render_forbidden
    render text: 'Forbidden', status: 403
  end

  def render_empty_json
    render json: {}
  end
end

end

Version data entries

2 entries across 2 versions & 1 rubygems

Version	Path
scrivito_sdk-0.18.1	app/controllers/scrivito/webservice_controller.rb
scrivito_sdk-0.18.0	app/controllers/scrivito/webservice_controller.rb