diff --git a/Gemfile b/Gemfile index c9423e923..68ee169bd 100644 --- a/Gemfile +++ b/Gemfile @@ -22,6 +22,7 @@ gem 'perform_later', '~> 1.3.0' # should be after resque_mailer gem 'russian', '~> 0.6.0' gem 'highline', '~> 1.6.11' gem 'state_machine' +gem 'redis-rails' gem 'grack', :git => 'git://github.com/rdblue/grack.git', :require => 'git_http' gem "grit", :git => 'git://github.com/warpc/grit.git' #, :path => '~/Sites/code/grit' diff --git a/Gemfile.lock b/Gemfile.lock index dfe789d3c..f6f5b6836 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -289,8 +289,24 @@ GEM json (~> 1.4) redcarpet (2.2.2) redis (3.0.3) + redis-actionpack (3.2.3) + actionpack (~> 3.2.3) + redis-rack (~> 1.4.0) + redis-store (~> 1.1.0) + redis-activesupport (3.2.3) + activesupport (~> 3.2.3) + redis-store (~> 1.1.0) redis-namespace (1.2.1) redis (~> 3.0.0) + redis-rack (1.4.2) + rack (~> 1.4.1) + redis-store (~> 1.1.0) + redis-rails (3.2.3) + redis-actionpack (~> 3.2.3) + redis-activesupport (~> 3.2.3) + redis-store (~> 1.1.0) + redis-store (1.1.3) + redis (>= 2.2.0) redisk (0.2.2) redis (>= 0.1.1) redis-namespace (>= 0.1.0) @@ -453,6 +469,7 @@ DEPENDENCIES rdiscount redcarpet (~> 2.2.2) redhillonrails_core! + redis-rails resque (~> 1.21.0) resque-status (~> 0.3.3) resque_mailer (~> 2.1.0) diff --git a/app/controllers/api/v1/platforms_controller.rb b/app/controllers/api/v1/platforms_controller.rb index 864bedac8..a61637635 100644 --- a/app/controllers/api/v1/platforms_controller.rb +++ b/app/controllers/api/v1/platforms_controller.rb @@ -7,30 +7,38 @@ class Api::V1::PlatformsController < Api::V1::BaseController load_and_authorize_resource :except => :allowed def allowed - platform_name = (params[:path] || '').gsub(/^[\/]+/, '') - .match(/^(#{Platform::NAME_PATTERN}\/|#{Platform::NAME_PATTERN}$)/) - render(:nothing => true) && return unless platform_name - platform_name = platform_name[0].gsub(/\//, '') + # platform_name = (params[:path] || '').gsub(/^[\/]+/, '') + # .match(/^(#{Platform::NAME_PATTERN}\/|#{Platform::NAME_PATTERN}$)/) - platform = Platform.find_by_name platform_name - render(:nothing => true, :status => 403) && return unless platform - render(:nothing => true) && return unless platform.hidden? - - if request.authorization.present? - token, pass = *ActionController::HttpAuthentication::Basic::user_name_and_password(request) - else - render(:nothing => true, :status => 403) && return - end - - render(:nothing => true) && return if platform.tokens.by_active.where(:authentication_token => token).exists? - - user = User.find_by_authentication_token token - @current_ability, @current_user = nil, user - if user && can?(:show, platform) + if Platform.allowed?(params[:path] || '', request) render :nothing => true else render :nothing => true, :status => 403 end + + + # render(:nothing => true) && return unless platform_name + # platform_name = platform_name[0].gsub(/\//, '') + + # platform = Platform.find_by_name platform_name + # render(:nothing => true, :status => 403) && return unless platform + # render(:nothing => true) && return unless platform.hidden? + + # if request.authorization.present? + # token, pass = *ActionController::HttpAuthentication::Basic::user_name_and_password(request) + # else + # render(:nothing => true, :status => 403) && return + # end + + # render(:nothing => true) && return if platform.tokens.by_active.where(:authentication_token => token).exists? + + # user = User.find_by_authentication_token token + # @current_ability, @current_user = nil, user + # if user && can?(:show, platform) + # render :nothing => true + # else + # render :nothing => true, :status => 403 + # end end def index diff --git a/app/models/platform.rb b/app/models/platform.rb index 154821aba..e83cb931b 100644 --- a/app/models/platform.rb +++ b/app/models/platform.rb @@ -177,6 +177,35 @@ class Platform < ActiveRecord::Base EventLog.current_controller.request.host_with_port rescue ::Rosa::Application.config.action_mailer.default_url_options[:host] end + # Checks access rights to platform and caching for 1 day. + def self.allowed?(path, request) + platform_name = path.gsub(/^[\/]+/, '') + .match(/^(#{NAME_PATTERN}\/|#{NAME_PATTERN}$)/) + + return true unless platform_name + platform_name = platform_name[0].gsub(/\//, '') + + if request.authorization.present? + token, pass = *ActionController::HttpAuthentication::Basic::user_name_and_password(request) + end + + Rails.cache.fetch([platform_name, token, :platform_allowed], :expires_in => 2.minutes) do + platform = Platform.find_by_name platform_name + next false unless platform + next true unless platform.hidden? + next false unless token + next true if platform.tokens.by_active.where(:authentication_token => token).exists? + + user = User.find_by_authentication_token token + current_ability = Ability.new(user) + if user && current_ability.can?(:show, platform) + true + else + false + end + end + end + protected def create_directory diff --git a/config/environments/development.rb b/config/environments/development.rb index facbb837e..19e0e30c5 100644 --- a/config/environments/development.rb +++ b/config/environments/development.rb @@ -24,6 +24,8 @@ Rosa::Application.configure do # since you don't have to restart the webserver when you make code changes. config.cache_classes = false + config.cache_store = :redis_store, "redis://localhost:6379/0/cache", { expires_in: 10.minutes } + # Log error messages when you accidentally call methods on nil. config.whiny_nils = true diff --git a/config/environments/production.rb b/config/environments/production.rb index f3d908503..5c854d023 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -27,6 +27,7 @@ Rosa::Application.configure do # Use a different cache store in production # config.cache_store = :mem_cache_store + config.cache_store = :redis_store, "redis://localhost:6379/0/cache", { expires_in: 10.minutes } # Disable Rails's static asset server # In production, Apache or nginx will already do this diff --git a/spec/controllers/api/v1/platforms_controller_spec.rb b/spec/controllers/api/v1/platforms_controller_spec.rb index 7b5c36ed3..85f04a74b 100644 --- a/spec/controllers/api/v1/platforms_controller_spec.rb +++ b/spec/controllers/api/v1/platforms_controller_spec.rb @@ -249,6 +249,7 @@ describe Api::V1::PlatformsController do context 'perform allowed action' do + before { stub_redis } it 'ensures that status 200 if platform empty' do get :allowed response.status.should == 200