# # == MasterView Admin Controller # # The MasterviewController is a Rails controller that you can enable # in your Rails application to provide administrative operations # for the MasterView template engine. # # To enable or disable the admin controller, use the # MasterView::Configuration setting +enable_admin_pages+ # to enable or disable its availability in your # config/masterview/settngs.rb or a suitable environment # settings file, according to your intended usage: # # config.enable_admin_pages = true # # When enabled, the MasterView admin controller is accessable # in your application at the address: # # http://yourapp.foo/masterview # # The controller places its stylesheets in a +masterview+ subdirectory # in your rails stylesheets directory (app/stylesheets/masterview). # # The MasterView admin controller is primarily a developer facility; # it is not generally appropriate for end-users of your rails application. # If you enable this facility in your production environment, # you should consider restricting access to authorized users. # #-- # ISSUE: we need to work through scenario of how mv admin controller fits # into overall scheme of one's rails application. How/when would developer # integrate stylesheets and layout into their overal app look? # How/when would access restriction actually be hooked up? # Standard technique is to do something along the lines of using # a before_filter which invokes things like :check_authentication # and :check_authorization services in the app framework # (or, say, predicate can_access? or has_permission? or...]. # But... this whole area of user authentication and authorization # has no specific conventions in the Rails ecosystem yet, # so we really can't make any assumptions yet about any particular # approach that MasterviewController itself could hook into. # We'll have to leave this as an exercise for the user and give # them tips on how to make it happen. # [DJL 17-Jun-2006] #++ # class MasterviewController < ApplicationController before_filter :check_authorization, :except => [ :access_not_allowed ] ENABLE_ADMIN_LAYOUT = false #:nodoc: #UNDER CONSTRUCTION - fine idea, but doesn't work yet [DJL 03-Jun-2006] # Describe the MasterView configuration option settings def configuration if ENABLE_ADMIN_LAYOUT smart_render_with_layout('masterview/admin/configuration', 'masterview_admin') else #ugly, but keep this version aint_got_no_layout_backstop = '
We\'re sorry, but the page you have requested is only available to authorized users.
', :status => 500 end protected # Default implementation of authorization check # to restrict access to administrative services def allow_access? # a more general solution might look something like: # current_user && user_has_perm?('mv-admin') # backstop: only allow for developer testing on local machine local_request? end # Check that the current user has authorization to access admin operations def check_authorization if ! allow_access? redirect_to :action => :access_not_allowed end end private # checks app path first for views and files, then falls back to files in MV def find_path(path) local_path = File.join(RAILS_ROOT, path) mv_path = File.join(File.dirname(__FILE__), '../..', path) working_path = (File.exist?(local_path)) ? local_path : mv_path end # render local template file if exists otherwise render file from mv def smart_render(short_path) local_path = File.join(RAILS_ROOT, 'app/views', short_path)+'.rhtml' if File.exist?(local_path) render :template => short_path else mv_path = File.join(File.dirname(__FILE__), '../../app/views', short_path)+'.rhtml' MasterView::Log.debug { 'mv_path='+mv_path } render :file => mv_path end end # render local template file if exists otherwise render file from mv def smart_render_with_layout(short_path, layout) #:nodoc: #UNDER CONSTRUCTION #DOESN'T WORK YET - we get the right path, but need a way into template rendering # (usual path through rails bolts in assumption of app/views rel path) # [DJL 03-Jul-2006] local_path = File.join(RAILS_ROOT, 'app/views', short_path)+'.rhtml' if File.exist?(local_path) render :template => short_path, :layout => smart_layout_path(layout) else mv_path = File.join(File.dirname(__FILE__), '../../app/views', short_path)+'.rhtml' MasterView::Log.debug { 'mv_path='+mv_path } render :file => mv_path, :layout => smart_layout_path(layout) end end def smart_layout_path(short_path) #:nodoc: #UNDER CONSTRUCTION local_path = File.join(RAILS_ROOT, 'app/views/layouts', short_path)+'.rhtml' if File.exist?(local_path) short_path else mv_layouts_dir_path = File.expand_path( File.join(File.dirname(__FILE__), '../../app/views/layouts') ) mv_path = File.join(mv_layouts_dir_path, short_path)+'.rhtml' if File.exist?(mv_path) MasterView::Log.debug { 'admin layout mv_path='+mv_path } else MasterView::Log.error { '***BAD ADMIN PAGE LAYOUT REF: mv_path='+mv_path } end mv_path end end end