From f5e2a8a4227de1e49598843294b7a5e3d82e273f Mon Sep 17 00:00:00 2001
From: Cédric Bonhomme <cedric@cedricbonhomme.org>
Date: Tue, 19 Apr 2016 12:46:08 +0200
Subject: Test preprocessors with Flask-Restless.

---
 src/bootstrap.py                 |  4 ++++
 src/web/views/__init__.py        |  4 ++--
 src/web/views/api/v3/__init__.py |  3 +++
 src/web/views/api/v3/article.py  |  9 +++++++++
 src/web/views/api/v3/common.py   | 16 ++++++++++++++++
 5 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 src/web/views/api/v3/article.py
 create mode 100644 src/web/views/api/v3/common.py

(limited to 'src')

diff --git a/src/bootstrap.py b/src/bootstrap.py
index 6d76d58f..2c5f9951 100644
--- a/src/bootstrap.py
+++ b/src/bootstrap.py
@@ -6,6 +6,7 @@
 import os
 import conf
 import logging
+import flask.ext.restless
 from urllib.parse import urlsplit
 
 def set_logging(log_path, log_level=logging.INFO,
@@ -51,6 +52,9 @@ if not application.config['SECURITY_PASSWORD_SALT']:
 
 db = SQLAlchemy(application)
 
+# Create the Flask-Restless API manager.
+manager = flask.ext.restless.APIManager(application, flask_sqlalchemy_db=db)
+
 def populate_g():
     from flask import g
     g.db = db
diff --git a/src/web/views/__init__.py b/src/web/views/__init__.py
index 4af8975b..1ca5c473 100644
--- a/src/web/views/__init__.py
+++ b/src/web/views/__init__.py
@@ -1,4 +1,4 @@
-from web.views.api import v2
+from web.views.api import v2, v3
 from web.views import views, home, session_mgmt
 from web.views.article import article_bp, articles_bp
 from web.views.feed import feed_bp, feeds_bp
@@ -7,7 +7,7 @@ from web.views.icon import icon_bp
 from web.views.admin import admin_bp
 from web.views.user import user_bp, users_bp
 
-__all__ = ['views', 'home', 'session_mgmt', 'v2',
+__all__ = ['views', 'home', 'session_mgmt', 'v2', 'v3',
            'article_bp', 'articles_bp', 'feed_bp', 'feeds_bp',
            'category_bp', 'categories_bp', 'icon_bp',
            'admin_bp', 'user_bp', 'users_bp']
diff --git a/src/web/views/api/v3/__init__.py b/src/web/views/api/v3/__init__.py
index e69de29b..76aa1f19 100644
--- a/src/web/views/api/v3/__init__.py
+++ b/src/web/views/api/v3/__init__.py
@@ -0,0 +1,3 @@
+from web.views.api.v3 import article
+
+__all__ = ['article']
diff --git a/src/web/views/api/v3/article.py b/src/web/views/api/v3/article.py
new file mode 100644
index 00000000..2f276170
--- /dev/null
+++ b/src/web/views/api/v3/article.py
@@ -0,0 +1,9 @@
+from web import models
+from bootstrap import application, manager
+from web.views.api.v3.common import check_auth
+
+
+blueprint_article = manager.create_api_blueprint(models.Article,
+                        methods=['GET', 'POST', 'PUT', 'DELETE'],
+                        preprocessors=dict(GET_SINGLE=[check_auth]))
+application.register_blueprint(blueprint_article)
diff --git a/src/web/views/api/v3/common.py b/src/web/views/api/v3/common.py
new file mode 100644
index 00000000..f5bd2dea
--- /dev/null
+++ b/src/web/views/api/v3/common.py
@@ -0,0 +1,16 @@
+from flask.ext.login import current_user
+from web.controllers import ArticleController
+
+
+def is_authorized_to_modify(user, obj):
+    return user.id == obj.user_id
+
+
+def check_auth(instance_id=None, **kw):
+    # Check if the user is authorized to modify the specified
+    # instance of the model.
+    contr = ArticleController(current_user.id)
+    article = contr.get(id=instance_id)
+    if not is_authorized_to_modify(current_user, article):
+        raise ProcessingException(description='Not Authorized',
+                                  code=401)
-- 
cgit