diff --git a/app/controllers/account/join_codes_controller.rb b/app/controllers/account/join_codes_controller.rb index 3df9552db..e7306308b 100644 --- a/app/controllers/account/join_codes_controller.rb +++ b/app/controllers/account/join_codes_controller.rb @@ -1,5 +1,5 @@ class Account::JoinCodesController < ApplicationController - wrap_parameters :account_join_code + wrap_parameters :account_join_code, include: %i[ usage_limit ] before_action :set_join_code before_action :ensure_admin, only: %i[ update destroy ] diff --git a/app/controllers/account/settings_controller.rb b/app/controllers/account/settings_controller.rb index 6201ca656..47036d606 100644 --- a/app/controllers/account/settings_controller.rb +++ b/app/controllers/account/settings_controller.rb @@ -1,5 +1,5 @@ class Account::SettingsController < ApplicationController - wrap_parameters :account + wrap_parameters :account, include: %i[ name ] before_action :ensure_admin, only: :update before_action :set_account diff --git a/app/controllers/boards/columns_controller.rb b/app/controllers/boards/columns_controller.rb index a3cf867ea..d0bd13c55 100644 --- a/app/controllers/boards/columns_controller.rb +++ b/app/controllers/boards/columns_controller.rb @@ -1,4 +1,6 @@ class Boards::ColumnsController < ApplicationController + wrap_parameters :column, include: %i[ name color ] + include BoardScoped before_action :set_column, only: %i[ show update destroy ] diff --git a/app/controllers/boards_controller.rb b/app/controllers/boards_controller.rb index 8e63455f9..3d5485f1f 100644 --- a/app/controllers/boards_controller.rb +++ b/app/controllers/boards_controller.rb @@ -1,4 +1,6 @@ class BoardsController < ApplicationController + wrap_parameters :board, include: %i[ name all_access auto_postpone_period_in_days public_description ] + include FilterScoped before_action :set_board, except: %i[ index new create ] diff --git a/app/controllers/cards/comments/reactions_controller.rb b/app/controllers/cards/comments/reactions_controller.rb index 32ca9f2f8..d6b202bb3 100644 --- a/app/controllers/cards/comments/reactions_controller.rb +++ b/app/controllers/cards/comments/reactions_controller.rb @@ -1,4 +1,6 @@ class Cards::Comments::ReactionsController < ApplicationController + wrap_parameters :reaction, include: %i[ content ] + include CardScoped before_action :set_comment diff --git a/app/controllers/cards/reactions_controller.rb b/app/controllers/cards/reactions_controller.rb index 4f19a1c64..aedb4194f 100644 --- a/app/controllers/cards/reactions_controller.rb +++ b/app/controllers/cards/reactions_controller.rb @@ -1,4 +1,6 @@ class Cards::ReactionsController < ApplicationController + wrap_parameters :reaction, include: %i[ content ] + include CardScoped before_action :set_reactable diff --git a/app/controllers/cards/steps_controller.rb b/app/controllers/cards/steps_controller.rb index 387dd8e23..4843da232 100644 --- a/app/controllers/cards/steps_controller.rb +++ b/app/controllers/cards/steps_controller.rb @@ -1,4 +1,6 @@ class Cards::StepsController < ApplicationController + wrap_parameters :step, include: %i[ content completed ] + include CardScoped before_action :set_step, only: %i[ show edit update destroy ] diff --git a/app/controllers/cards_controller.rb b/app/controllers/cards_controller.rb index 482d2ff78..015ecda1f 100644 --- a/app/controllers/cards_controller.rb +++ b/app/controllers/cards_controller.rb @@ -1,4 +1,6 @@ class CardsController < ApplicationController + wrap_parameters :card, include: %i[ title description image created_at last_active_at ] + include FilterScoped before_action :set_board, only: %i[ create ] diff --git a/app/controllers/my/access_tokens_controller.rb b/app/controllers/my/access_tokens_controller.rb index c9fcf38c3..dc7e9826a 100644 --- a/app/controllers/my/access_tokens_controller.rb +++ b/app/controllers/my/access_tokens_controller.rb @@ -1,4 +1,6 @@ class My::AccessTokensController < ApplicationController + wrap_parameters :access_token, include: %i[ description permission ] + skip_before_action :require_account def index diff --git a/app/controllers/notifications/settings_controller.rb b/app/controllers/notifications/settings_controller.rb index 252abec2e..a7ae3d8a6 100644 --- a/app/controllers/notifications/settings_controller.rb +++ b/app/controllers/notifications/settings_controller.rb @@ -1,5 +1,5 @@ class Notifications::SettingsController < ApplicationController - wrap_parameters :user_settings + wrap_parameters :user_settings, include: %i[ bundle_email_frequency ] before_action :set_settings diff --git a/app/controllers/signups/completions_controller.rb b/app/controllers/signups/completions_controller.rb index de3d81b63..5c2d9568c 100644 --- a/app/controllers/signups/completions_controller.rb +++ b/app/controllers/signups/completions_controller.rb @@ -1,4 +1,6 @@ class Signups::CompletionsController < ApplicationController + wrap_parameters :signup, include: %i[ full_name ] + layout "public" disallow_account_scope diff --git a/app/controllers/signups_controller.rb b/app/controllers/signups_controller.rb index 56614158f..cf43724f1 100644 --- a/app/controllers/signups_controller.rb +++ b/app/controllers/signups_controller.rb @@ -1,4 +1,6 @@ class SignupsController < ApplicationController + wrap_parameters :signup, include: %i[ email_address ] + disallow_account_scope allow_unauthenticated_access rate_limit to: 10, within: 3.minutes, only: :create, with: -> { redirect_to new_signup_path, alert: "Try again later." } diff --git a/app/controllers/users/joins_controller.rb b/app/controllers/users/joins_controller.rb index 6baa888ae..bbcb039e6 100644 --- a/app/controllers/users/joins_controller.rb +++ b/app/controllers/users/joins_controller.rb @@ -1,4 +1,6 @@ class Users::JoinsController < ApplicationController + wrap_parameters :user, include: %i[ name avatar ] + layout "public" def new diff --git a/app/controllers/users/push_subscriptions_controller.rb b/app/controllers/users/push_subscriptions_controller.rb index 91b47264c..c52b89541 100644 --- a/app/controllers/users/push_subscriptions_controller.rb +++ b/app/controllers/users/push_subscriptions_controller.rb @@ -1,4 +1,6 @@ class Users::PushSubscriptionsController < ApplicationController + wrap_parameters :push_subscription, include: %i[ endpoint p256dh_key auth_key ] + before_action :set_push_subscriptions def index diff --git a/app/controllers/users/roles_controller.rb b/app/controllers/users/roles_controller.rb index fb11d4e08..61c3262ed 100644 --- a/app/controllers/users/roles_controller.rb +++ b/app/controllers/users/roles_controller.rb @@ -1,5 +1,5 @@ class Users::RolesController < ApplicationController - wrap_parameters :user + wrap_parameters :user, include: %i[ role ] before_action :set_user before_action :ensure_permission_to_administer_user diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 7062b85e5..fdc528d3e 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -1,4 +1,6 @@ class UsersController < ApplicationController + wrap_parameters :user, include: %i[ name avatar ] + before_action :set_user, except: %i[ index ] before_action :ensure_permission_to_change_user, only: %i[ update destroy ] diff --git a/app/controllers/webhooks_controller.rb b/app/controllers/webhooks_controller.rb index 584c2dc7a..ab29badaa 100644 --- a/app/controllers/webhooks_controller.rb +++ b/app/controllers/webhooks_controller.rb @@ -1,4 +1,6 @@ class WebhooksController < ApplicationController + wrap_parameters :webhook, include: %i[ name url subscribed_actions ] + include BoardScoped before_action :ensure_admin diff --git a/test/controllers/api/flat_json_params_test.rb b/test/controllers/api/flat_json_params_test.rb index 22c51c365..84c4667b4 100644 --- a/test/controllers/api/flat_json_params_test.rb +++ b/test/controllers/api/flat_json_params_test.rb @@ -62,6 +62,189 @@ class FlatJsonParamsTest < ActionDispatch::IntegrationTest assert_response :created end + test "create card with flat JSON" do + assert_difference -> { Card.count }, +1 do + post board_cards_path(boards(:writebook)), + params: { title: "Flat card", description: "

Flat description

" }, + as: :json + end + + assert_response :created + card = Card.last + assert_equal "Flat card", card.title + assert_equal "Flat description", card.description.to_plain_text + end + + test "update card with flat JSON" do + card = cards(:logo) + + put card_path(card), + params: { title: "Flat update", description: "

Updated flat

" }, + as: :json + + assert_response :success + card.reload + assert_equal "Flat update", card.title + assert_equal "Updated flat", card.description.to_plain_text + end + + test "create board with flat JSON" do + assert_difference -> { Board.count }, +1 do + post boards_path, params: { name: "Flat board" }, as: :json + end + + assert_response :created + assert_equal "Flat board", Board.last.name + end + + test "update board with flat JSON" do + board = boards(:writebook) + + put board_path(board), + params: { name: "Flat board", auto_postpone_period_in_days: 7, public_description: "

Flat public desc

" }, + as: :json + + assert_response :no_content + board.reload + assert_equal "Flat board", board.name + assert_equal 7.days, board.entropy.auto_postpone_period + assert_equal "Flat public desc", board.public_description.to_plain_text + end + + test "create column with flat JSON" do + board = boards(:writebook) + + assert_difference -> { board.columns.count }, +1 do + post board_columns_path(board), params: { name: "Flat Column" }, as: :json + end + + assert_response :created + assert_equal "Flat Column", Column.last.name + end + + test "update column with flat JSON" do + column = columns(:writebook_in_progress) + + put board_column_path(column.board, column), params: { name: "Flat Updated" }, as: :json + + assert_response :no_content + assert_equal "Flat Updated", column.reload.name + end + + test "create step with flat JSON" do + card = cards(:logo) + + assert_difference -> { card.steps.count }, +1 do + post card_steps_path(card), params: { content: "Flat step" }, as: :json + end + + assert_response :created + assert_equal "Flat step", Step.last.content + end + + test "update step with flat JSON" do + card = cards(:logo) + step = card.steps.create!(content: "Original") + + put card_step_path(card, step), params: { content: "Flat updated" }, as: :json + + assert_response :success + assert_equal "Flat updated", step.reload.content + end + + test "create card reaction with flat JSON" do + card = cards(:logo) + + assert_difference -> { card.reactions.count }, +1 do + post card_reactions_path(card), params: { content: "🎉" }, as: :json + end + + assert_response :created + end + + test "create comment reaction with flat JSON" do + comment = comments(:logo_agreement_kevin) + + assert_difference -> { comment.reactions.count }, +1 do + post card_comment_reactions_path(comment.card, comment), params: { content: "👍" }, as: :json + end + + assert_response :created + end + + test "create access token with flat JSON" do + assert_difference -> { identities(:kevin).access_tokens.count }, +1 do + post my_access_tokens_path, params: { description: "Flat token", permission: "read" }, as: :json + end + + assert_response :created + assert_equal "Flat token", @response.parsed_body["description"] + end + + test "update user with flat JSON" do + put user_path(users(:david)), params: { name: "Flat Name" }, as: :json + + assert_response :no_content + assert_equal "Flat Name", users(:david).reload.name + end + + test "create webhook with flat JSON" do + board = boards(:writebook) + + assert_difference -> { Webhook.count }, +1 do + post board_webhooks_path(board), + params: { name: "Flat Webhook", url: "https://example.com/flat", subscribed_actions: [ "card_published" ] }, + as: :json + end + + assert_response :created + assert_equal "Flat Webhook", Webhook.last.name + end + + test "update webhook with flat JSON" do + webhook = webhooks(:active) + + patch board_webhook_path(webhook.board, webhook), + params: { name: "Flat Updated", subscribed_actions: [ "card_published" ] }, + as: :json + + assert_response :success + assert_equal "Flat Updated", webhook.reload.name + end + + test "create signup with flat JSON" do + sign_out + email = "flatjson-#{SecureRandom.hex(6)}@example.com" + + untenanted do + assert_difference -> { Identity.count }, +1 do + post signup_path, params: { email_address: email }, as: :json + end + end + end + + test "complete signup with flat JSON" do + signup = Signup.new(email_address: "flatjson-#{SecureRandom.hex(6)}@example.com", full_name: "Flat User") + signup.create_identity || raise("Failed to create identity") + logout_and_sign_in_as signup.identity + + untenanted do + assert_difference -> { Account.count }, +1 do + post signup_completion_path, params: { full_name: "Flat JSON User" }, as: :json + end + end + + assert_response :created + end + + test "update user via join with flat JSON" do + logout_and_sign_in_as :david + + post users_joins_path, params: { name: "Flat Join" }, as: :json + + assert_equal "Flat Join", users(:david).reload.name + end + private def stub_dns_resolution(*ips) dns_mock = mock("dns")