BigW Consortium Gitlab

notes.rb 5.31 KB
Newer Older
1
module API
2
  class Notes < Grape::API
3 4
    include PaginationParams

5 6
    before { authenticate! }

7
    NOTEABLE_TYPES = [Issue, MergeRequest, Snippet].freeze
8

9 10 11
    params do
      requires :id, type: String, desc: 'The ID of a project'
    end
12
    resource :projects, requirements: { id: %r{[^/]+} } do
13 14
      NOTEABLE_TYPES.each do |noteable_type|
        noteables_str = noteable_type.to_s.underscore.pluralize
15 16 17 18 19 20

        desc 'Get a list of project +noteable+ notes' do
          success Entities::Note
        end
        params do
          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
21
          use :pagination
22 23
        end
        get ":id/#{noteables_str}/:noteable_id/notes" do
24
          noteable = find_project_noteable(noteables_str, params[:noteable_id])
25 26

          if can?(current_user, noteable_read_ability_name(noteable), noteable)
27 28 29 30 31 32 33 34 35
            # We exclude notes that are cross-references and that cannot be viewed
            # by the current user. By doing this exclusion at this level and not
            # at the DB query level (which we cannot in that case), the current
            # page can have less elements than :per_page even if
            # there's more than one page.
            notes =
              # paginate() only works with a relation. This could lead to a
              # mismatch between the pagination headers info and the actual notes
              # array returned, but this is really a edge-case.
36 37
              paginate(noteable.notes)
              .reject { |n| n.cross_reference_not_visible_for?(current_user) }
38 39
            present notes, with: Entities::Note
          else
40
            not_found!("Notes")
41
          end
42
        end
Nihad Abbasov committed
43

44 45 46 47 48 49 50 51
        desc 'Get a single +noteable+ note' do
          success Entities::Note
        end
        params do
          requires :note_id, type: Integer, desc: 'The ID of a note'
          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
        end
        get ":id/#{noteables_str}/:noteable_id/notes/:note_id" do
52
          noteable = find_project_noteable(noteables_str, params[:noteable_id])
53 54
          note = noteable.notes.find(params[:note_id])
          can_read_note = can?(current_user, noteable_read_ability_name(noteable), noteable) && !note.cross_reference_not_visible_for?(current_user)
55

56
          if can_read_note
57
            present note, with: Entities::Note
58 59
          else
            not_found!("Note")
60
          end
Nihad Abbasov committed
61
        end
Nihad Abbasov committed
62

63 64 65 66 67 68 69 70 71
        desc 'Create a new +noteable+ note' do
          success Entities::Note
        end
        params do
          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
          requires :body, type: String, desc: 'The content of a note'
          optional :created_at, type: String, desc: 'The creation date of the note'
        end
        post ":id/#{noteables_str}/:noteable_id/notes" do
72 73
          noteable = find_project_noteable(noteables_str, params[:noteable_id])

74
          opts = {
75 76
            note: params[:body],
            noteable_type: noteables_str.classify,
77
            noteable_id: noteable.id
78 79
          }

80
          if can?(current_user, noteable_read_ability_name(noteable), noteable)
81
            if params[:created_at] && (current_user.admin? || user_project.owner == current_user)
82 83
              opts[:created_at] = params[:created_at]
            end
Nihad Abbasov committed
84

85 86 87
            note = ::Notes::CreateService.new(user_project, current_user, opts).execute

            if note.valid?
88
              present note, with: Entities.const_get(note.class.name)
89 90 91
            else
              not_found!("Note #{note.errors.messages}")
            end
92
          else
93
            not_found!("Note")
Nihad Abbasov committed
94 95
          end
        end
96

97 98 99 100 101 102 103 104 105
        desc 'Update an existing +noteable+ note' do
          success Entities::Note
        end
        params do
          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
          requires :note_id, type: Integer, desc: 'The ID of a note'
          requires :body, type: String, desc: 'The content of a note'
        end
        put ":id/#{noteables_str}/:noteable_id/notes/:note_id" do
106 107 108
          note = user_project.notes.find(params[:note_id])

          authorize! :admin_note, note
109 110

          opts = {
111
            note: params[:body]
112 113
          }

114
          note = ::Notes::UpdateService.new(user_project, current_user, opts).execute(note)
115

116 117
          if note.valid?
            present note, with: Entities::Note
118
          else
119
            render_api_error!("Failed to save note #{note.errors.messages}", 400)
120 121 122
          end
        end

123 124 125 126 127 128 129 130
        desc 'Delete a +noteable+ note' do
          success Entities::Note
        end
        params do
          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
          requires :note_id, type: Integer, desc: 'The ID of a note'
        end
        delete ":id/#{noteables_str}/:noteable_id/notes/:note_id" do
131 132
          note = user_project.notes.find(params[:note_id])
          authorize! :admin_note, note
133

Dmitriy Zaporozhets committed
134
          status 204
135
          ::Notes::DestroyService.new(user_project, current_user).execute(note)
136
        end
137 138
      end
    end
139 140

    helpers do
141 142 143 144
      def find_project_noteable(noteables_str, noteable_id)
        public_send("find_project_#{noteables_str.singularize}", noteable_id)
      end

145
      def noteable_read_ability_name(noteable)
146
        "read_#{noteable.class.to_s.underscore}".to_sym
147 148
      end
    end
149 150
  end
end