lib/api_authorization.rb
# Filter the request params to know wether or not a user has
# the right to push a certain value as a parameter.
#
# example:
#
# allowed_params = { anno: [2019] }
# will remove from the params if the params hash contain a key :anno
# with a value which is not 2019
#
# @params [Action::Parameters]
# @return [Action::Parameters] without the disallowed key/values.
Filter the request params to know wether or not a user has
the right to push a certain value as a parameter.



allowed_params = { anno: [2019] }
will remove from the params if the params hash contain a key :anno
with a value which is not 2019
Filter the request params to know wether or not a user has the right to push a certain value as a parameter . allowed_params = { anno : [ 2019 ] } will remove from the params if the params hash contain a key : anno with a value which is not 2019
def check_allowed_params(params, controller, action)
      roles = current_user.try(:permissions)
      return params if roles.find { |role| role.try(:name).try(:downcase) == 'superadmin' }
      rules = roles.where('controller = ? AND action = ? AND allowed_params IS NOT NULL', controller, action)
      return params if rules.nil? || rules.empty?
      rules.each do |rule|
        next if rule.allowed_params.nil?
        rule.allowed_params.each do |k, v|
          puts " key: #{k}, value: #{v}"
          params.delete(k) unless Array(v).include?(params[k]) || v == params[k]
        end
      end
      params
    end
def check_allowed_params ( params , controller , action ) roles = current_user . try ( :permissions ) return params if roles . find { | role | role . try ( :name ) . try ( :downcase ) == 'superadmin' } rules = roles . where ( 'controller = ? AND action = ? AND allowed_params IS NOT NULL' , controller , action ) return params if rules . nil? || rules . empty? rules . each do | rule | next if rule . allowed_params . nil? rule . allowed_params . each do | k , v | puts " key: #{k}, value: #{v}" params . delete ( k ) unless Array ( v ) . include? ( params [ k ] ) || v == params [ k ] end end params end
Filter the request params to know wether or not a user has
the right to push a certain value as a parameter.
Filter the request params to know wether or not a user has the right to push a certain value as a parameter .
# puts "####### ruleS => #{rule.allowed_params.inspect}"
without the disallowed key/values.
without the disallowed key / values .
Action::Parameters
params
controller
action
params
None