Skip to content

Commit

Permalink
adds getting of specified resource
Browse files Browse the repository at this point in the history
  • Loading branch information
LeFnord committed Sep 8, 2016
1 parent 3e855dd commit 56fdf50
Show file tree
Hide file tree
Showing 3 changed files with 37 additions and 20 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

#### Features

* [#501](https://github.com/ruby-grape/grape-swagger/pull/501): Adds getting of a specified resource for Rake Tasks - [@LeFnord](https://github.com/LeFnord).
* [#500](https://github.com/ruby-grape/grape-swagger/pull/500): Adds Rake tasks to get and validate OAPI/Swagger documentation - [@LeFnord](https://github.com/LeFnord).
* [#493](https://github.com/ruby-grape/grape-swagger/pull/493): Swagger UI endpoint authorization. - [@texpert](https://github.com/texpert).
* [#492](https://github.com/ruby-grape/grape/pull/492): Define security requirements on endpoint methods - [@tomregelink](https://github.com/tomregelink).
Expand Down
27 changes: 16 additions & 11 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -803,10 +803,10 @@ end
The Swagger UI on Grape could be secured from unauthorized access using any middleware, which provides certain methods:
- a *before* method to be run in the Grape controller for authorization purpose;
- a *before* method to be run in the Grape controller for authorization purpose;
- some guard method, which could receive as argument a string or an array of authorization scopes;
- a method which processes and returns the access token received in the HTTP request headers (usually in the 'HTTP_AUTHORIZATION' header).
Below are some examples of securing the Swagger UI on Grape installed along with Ruby on Rails:
- The WineBouncer and Doorkeeper gems are used in the examples;
Expand All @@ -828,9 +828,9 @@ This is how to configure the grape_swagger documentation:
The guard method should inject the Security Requirement Object into the endpoint's route settings (see Grape::DSL::Settings.route_setting method).

The 'oauth2 false' added to swagger_documentation is making the main Swagger endpoint protected with OAuth, i.e. it
The 'oauth2 false' added to swagger_documentation is making the main Swagger endpoint protected with OAuth, i.e. it
is retreiving the access_token from the HTTP request, but the 'false' scope is for skipping authorization and showing
the UI for everyone. If the scope would be set to something else, like 'oauth2 admin', for example, than the UI
the UI for everyone. If the scope would be set to something else, like 'oauth2 admin', for example, than the UI
wouldn't be displayed at all to unauthorized users.
Further on, the guard could be used, where necessary, for endpoint access protection. Put it prior to the endpoint's method:
Expand All @@ -841,20 +841,20 @@ Further on, the guard could be used, where necessary, for endpoint access protec
get do
render_users
end
oauth2 'admin'
post do
User.create!...
end
end
```

And, finally, if you want to not only restrict the access, but to completely hide the endpoint from unauthorized
And, finally, if you want to not only restrict the access, but to completely hide the endpoint from unauthorized
users, you could pass a lambda to the :hidden key of a endpoint's description:
```ruby
not_admins = lambda { |token=nil| token.nil? || !User.find(token.resource_owner_id).admin? }
resource :users do
desc 'Create user', hidden: not_admins
oauth2 'admin'
Expand All @@ -864,8 +864,8 @@ users, you could pass a lambda to the :hidden key of a endpoint's description:
end
```
The lambda is checking whether the user is authenticated (if not, the token is nil by default), and has the admin
role - only admins can see this endpoint.
The lambda is checking whether the user is authenticated (if not, the token is nil by default), and has the admin
role - only admins can see this endpoint.
<a name="md_usage" />
## Markdown in Detail
Expand Down Expand Up @@ -1122,15 +1122,20 @@ GrapeSwagger::Rake::OapiTasks.new(::Api::Base)
```
rake oapi:fetch
rake oapi:fetch store=true # writes to swagger_doc.json
params:
- store={ true | file_name } – save as JSON (optional)
- resource=resource_name – get only for this one (optional)
```
#### OpenApi/Swagger Validation
**requires**: `npm` and `swagger-cli` to be installed
```
rake oapi:validate
params:
- resource=resource_name – get only for this one (optional)
```
Expand Down
29 changes: 20 additions & 9 deletions lib/grape-swagger/rake/oapi_tasks.rb
Original file line number Diff line number Diff line change
Expand Up @@ -29,16 +29,22 @@ def define_tasks
#
# get swagger/OpenAPI documentation
def fetch
desc 'generates OpenApi documentation (`store=true`, stores to FS)'
desc 'generates OpenApi documentation …
params (usage: key=value):
store – save as JSON file, default: false (optional)
resource - if given only for that it would be generated (optional)'
task fetch: :environment do
make_request
ENV['store'] ? File.write(file, @oapi) : print(@oapi)

save_to_file? ? File.write(file, @oapi) : print(@oapi)
end
end

# validates swagger/OpenAPI documentation
def validate
desc 'validates the generated OpenApi file'
desc 'validates the generated OpenApi file …
params (usage: key=value):
resource - if given only for that it would be generated (optional)'
task validate: :environment do
ENV['store'] = 'true'
::Rake::Task['oapi:fetch'].invoke
Expand All @@ -59,19 +65,24 @@ def make_request
JSON.parse(
last_response.body, symolize_names: true
)
)
) + "\n"
end

def url_for
oapi_route = api_class.routes[-2]
url = '/swagger_doc'
url = "/#{oapi_route.version}#{url}" if oapi_route.version
url = "/#{oapi_route.prefix}#{url}" if oapi_route.prefix
url
path = oapi_route.pattern.origin
path.sub!(':version', oapi_route.version.to_s)

[path, ENV['resource']].join('/').chomp('/')
end

def save_to_file?
ENV['store'] && JSON.parse(@oapi).keys.first != 'error'
end

def file
File.join(Dir.getwd, 'swagger_doc.json')
name = ENV['store'] == 'true' || ENV['store'].blank? ? 'swagger_doc.json' : ENV['store']
File.join(Dir.getwd, name)
end

def app
Expand Down

0 comments on commit 56fdf50

Please sign in to comment.