yaser/Dalan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Yaser
2026-08-13 19:56:46 +03:30
commit de1d57a67b
474 changed files with 43185 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
app/api/v2/admin/abilities.rb Normal file
View File

@@ -0,0 +1,17 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Admin functionality over abilities
class Abilities < Grape::API
namespace :abilities do
desc 'Get all roles and admin_permissions of barong cancan.'
get do
Ability.admin_permissions[current_user.role] || {}
end
end
end
end
end
end

61
app/api/v2/admin/activities.rb Normal file
View File

@@ -0,0 +1,61 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Admin functionality over activities table
class Activities < Grape::API
resource :activities do
helpers ::API::V2::NamedParams
helpers ::API::V2::Admin::NamedParams
helpers do
def permitted_search_params(params)
params[:range] = 'created'
params.slice(:action, :uid, :email, :topic, :from, :to, :range, :target_uid).merge(with_user: true, ordered: true)
end
end
desc 'Returns array of activities as paginated collection',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Admin::Entities::ActivityWithUser
params do
use :activity_attributes
use :timeperiod_filters
use :pagination_filters
end
get do
admin_authorize! :read, Activity
activities = API::V2::Queries::ActivityFilter.new(Activity.where(category: 'user')).call(permitted_search_params(params))
present paginate(activities), with: API::V2::Admin::Entities::ActivityWithUser
end
desc 'Returns array of activities as paginated collection',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Admin::Entities::AdminActivity
params do
use :activity_attributes
use :timeperiod_filters
use :pagination_filters
optional :target_uid,
type: { value: String, message: 'admin.activity.non_string_target_uid' }
optional :range,
type: String,
values: { value: -> (p){ %w[created].include?(p) }, message: 'admin.activity.invalid_range' },
default: 'created'
end
get '/admin' do
admin_authorize! :read, Activity
activities = API::V2::Queries::ActivityFilter.new(Activity.where(category: 'admin')).call(permitted_search_params(params))
present paginate(activities), with: API::V2::Admin::Entities::AdminActivity
end
end
end
end
end
end

41
app/api/v2/admin/api_keys.rb Normal file
View File

@@ -0,0 +1,41 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Admin functionality over user api keys
class APIKeys < Grape::API
resource :api_keys do
helpers ::API::V2::NamedParams
helpers ::API::V2::Admin::NamedParams
desc 'List all api keys for selected account.',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Entities::APIKey
params do
requires :uid, type: String, allow_blank: false, desc: 'user uniq id'
optional :ordering,
values: { value: -> (p){ %w[asc desc].include?(p) }, message: 'api_keys.ordering.invalid_ordering' },
default: 'asc',
desc: 'If set, returned values will be sorted in specific order, defaults to \'asc\'.'
optional :order_by,
values: { value: -> (p){ APIKey.new.attributes.keys.include?(p) }, message: 'api_keys.ordering.invalid_attribute' },
default: 'id',
desc: 'Name of the field, which result will be ordered by.'
use :pagination_filters
end
get do
admin_authorize! :read, APIKey
target_user = User.find_by(uid: params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
target_user.api_keys.order(params[:order_by] => params[:ordering]).tap { |q| present paginate(q), with: API::V2::Entities::APIKey, except: [:secret] }
end
end
end
end
end
end

62
app/api/v2/admin/base.rb Normal file
View File

@@ -0,0 +1,62 @@
# frozen_string_literal: true
require_dependency 'barong/middleware/jwt_authenticator'
module API::V2
module Admin
class Base < Grape::API
PREFIX = '/admin'
use Barong::Middleware::JWTAuthenticator, \
pubkey: Rails.configuration.x.keystore.public_key
cascade false
format :json
content_type :json, 'application/json'
default_format :json
helpers API::V2::Resource::Utils
do_not_route_options!
mount Admin::Users
mount Admin::APIKeys
mount Admin::Permissions
mount Admin::Activities
mount Admin::Metrics
mount Admin::Restrictions
mount Admin::Profiles
mount Admin::Levels
mount Admin::Abilities
add_swagger_documentation base_path: File.join(API::Base::PREFIX, API::V2::Base::API_VERSION, 'barong', PREFIX),
add_base_path: true,
mount_path: '/swagger',
api_version: API::V2::Base::API_VERSION,
doc_version: Barong::Application::GIT_TAG,
info: {
title: 'Barong',
description: 'RESTful AdminAPI for barong OAuth server'
},
security_definitions: {
'BearerToken': {
description: 'Bearer Token authentication',
type: 'basic',
name: 'Authorization',
in: 'header'
}
},
models: [
API::V2::Admin::Entities::ActivityWithUser,
API::V2::Admin::Entities::AdminActivity,
API::V2::Admin::Entities::Document,
API::V2::Admin::Entities::Phone,
API::V2::Admin::Entities::Profile,
API::V2::Admin::Entities::UserWithKYC,
API::V2::Admin::Entities::UserWithProfile,
API::V2::Entities::APIKey
]
end
end
end

49
app/api/v2/admin/entities/activity_with_user.rb Normal file
View File

@@ -0,0 +1,49 @@
# frozen_string_literal: true
module API::V2::Admin
module Entities
class ActivityWithUser < API::V2::Entities::Base
expose :user_ip,
documentation: {
type: 'String',
desc: 'User IP'
}
expose :user_agent,
documentation: {
type: 'String',
desc: 'User Browser Agent'
}
expose :topic,
documentation: {
type: 'String',
desc: 'Defined topic (session, adjustments) or general by default'
}
expose :action,
documentation: {
type: 'String',
desc: "API action: POST => 'create', PUT => 'update', GET => 'read', DELETE => 'delete', PATCH => 'update' or system if there is no match of HTTP method"
}
expose :result,
documentation: {
type: 'String',
desc: 'Status of API response: succeed, failed, denied'
}
expose :data,
documentation: {
type: 'String',
desc: 'Parameters which was sent to specific API endpoint'
}
expose :user, using: API::V2::Entities::User
with_options(format_with: :iso_timestamp) do
expose :created_at
end
end
end
end

50
app/api/v2/admin/entities/admin_activity.rb Normal file
View File

@@ -0,0 +1,50 @@
# frozen_string_literal: true
module API::V2::Admin
module Entities
class AdminActivity < API::V2::Entities::Base
expose :user_ip,
documentation: {
type: 'String',
desc: 'User IP'
}
expose :user_agent,
documentation: {
type: 'String',
desc: 'User Browser Agent'
}
expose :topic,
documentation: {
type: 'String',
desc: 'Defined topic (session, adjustments) or general by default'
}
expose :action,
documentation: {
type: 'String',
desc: "API action: POST => 'create', PUT => 'update', GET => 'read', DELETE => 'delete', PATCH => 'update' or system if there is no match of HTTP method"
}
expose :result,
documentation: {
type: 'String',
desc: 'Status of API response: succeed, failed, denied'
}
expose :data,
documentation: {
type: 'String',
desc: 'Parameters which was sent to specific API endpoint'
}
expose :user, as: :admin, using: API::V2::Entities::User
expose :target, as: :target, using: API::V2::Entities::User
with_options(format_with: :iso_timestamp) do
expose :created_at
end
end
end
end

15
app/api/v2/admin/entities/document.rb Normal file
View File

@@ -0,0 +1,15 @@
# frozen_string_literal: true
module API::V2
module Admin
module Entities
class Document < API::V2::Entities::Document
expose :doc_number,
documentation: {
type: 'String',
desc: 'document number: AB123123 type'
}
end
end
end
end

13
app/api/v2/admin/entities/phone.rb Normal file
View File

@@ -0,0 +1,13 @@
# frozen_string_literal: true
module API::V2::Admin
module Entities
class Phone < API::V2::Entities::Phone
expose :number,
documentation: {
type: 'String',
desc: 'Phone number'
}
end
end
end

32
app/api/v2/admin/entities/profile.rb Normal file
View File

@@ -0,0 +1,32 @@
# frozen_string_literal: true
module API::V2::Admin
module Entities
class Profile < API::V2::Entities::Profile
expose :first_name,
documentation: {
type: 'String',
desc: 'first name'
}
expose :last_name,
documentation: {
type: 'String',
desc: 'Last name'
}
expose :national_code,
documentation: {
type: 'String',
desc: 'National Code'
}
expose :dob,
documentation: {
type: 'Date',
desc: 'Birth date'
}
end
end
end

11
app/api/v2/admin/entities/user_with_kyc.rb Normal file
View File

@@ -0,0 +1,11 @@
# frozen_string_literal: true
module API::V2::Admin
module Entities
class UserWithKYC < API::V2::Entities::UserWithKYC
expose :profiles, using: Entities::Profile
# expose :phones, using: Entities::Phone
expose :documents, using: Entities::Document
end
end
end

9
app/api/v2/admin/entities/user_with_profile.rb Normal file
View File

@@ -0,0 +1,9 @@
# frozen_string_literal: true
module API::V2::Admin
module Entities
class UserWithProfile < API::V2::Entities::UserWithProfile
expose :profiles, using: Entities::Profile
end
end
end

52
app/api/v2/admin/levels.rb Normal file
View File

@@ -0,0 +1,52 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Admin functionality over levels table
class Levels < Grape::API
resource :levels do
desc 'Returns array of permissions as paginated collection',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Entities::Level
get do
admin_authorize! :read, Level
present ::Level.all, with: API::V2::Entities::Level
end
desc 'Change vip level',
failure: [
{ code: 400, message: 'Required params are empty' },
{ code: 401, message: 'Invalid bearer token' },
{ code: 422, message: 'Validation errors' }
],
success: API::V2::Entities::User
params do
requires :uid, type: String
requires :level,
values: { value: -> (p){ %w[2 3].include?(p) }, message: 'user.level.invalid' },
default: '3',
desc: 'change level from vip'
end
put do
admin_authorize! :update, Profile
target_user = User.find_by(uid: params[:uid])
return error!({ errors: ['admin.users.doesnt_exist'] }, 404) if target_user.nil?
error!({ errors: ['admin.superadmin_change'] }, 422) if target_user.superadmin? && !current_user.superadmin?
unless target_user.update(declared(params.except(:uid), include_missing: false))
code_error!(target_user.errors.details, 422)
end
present user, with: API::V2::Entities::User
end
end
end
end
end
end

50
app/api/v2/admin/metrics.rb Normal file
View File

@@ -0,0 +1,50 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Metrics functionality
class Metrics < Grape::API
helpers do
def permitted_search_params(params)
params.slice(:created_from, :created_to, :topic, :action, :result).merge(with_user: false)
end
end
resource :metrics do
desc 'Returns main statistic in the given time period',
failure: [
{ code: 401, message: 'Invalid bearer token' }
]
params do
optional :created_from
optional :created_to
end
get do
admin_authorize! :read, User
result = {}
signup = API::V2::Queries::ActivityFilter.new(Activity.all).call(
permitted_search_params(params.merge(topic: 'account', action: 'signup', result: 'succeed'))
)
sucessful_login = API::V2::Queries::ActivityFilter.new(Activity.all).call(
permitted_search_params(params.merge(topic: 'session', action: 'login', result: 'succeed'))
)
failed_login = API::V2::Queries::ActivityFilter.new(Activity.all).call(
permitted_search_params(params.merge(topic: 'session', action: 'login', result: 'failed'))
)
result[:signups] = signup.group('date(created_at)').size
result[:sucessful_logins] = sucessful_login.group('date(created_at)').size
result[:failed_logins] = failed_login.group('date(created_at)').size
result[:pending_applications] = Label.where({ key: 'document', value: 'pending', scope: 'private' }).count
present result
end
end
end
end
end
end

35
app/api/v2/admin/named_params.rb Normal file
View File

@@ -0,0 +1,35 @@
# frozen_string_literal: true
module API
module V2
module Admin
module NamedParams
extend ::Grape::API::Helpers
params :pagination_filters do
optional :page,
type: { value: Integer, message: 'non_integer_page' },
values: { value: -> (p){ p.try(:positive?) }, message: 'non_positive_page'},
default: 1,
desc: 'Page number (defaults to 1).'
optional :limit,
type: { value: Integer, message: 'non_integer_limit' },
values: { value: 1..100, message: 'invalid_limit' },
default: 100,
desc: 'Number of users per page (defaults to 100, maximum is 100).'
end
params :activity_attributes do
optional :topic,
type: { value: String, message: 'admin.activity.non_string_topic' }
optional :action,
type: { value: String, message: 'admin.activity.non_string_action' }
optional :uid,
type: { value: String, message: 'admin.activity.non_string_uid' }
optional :email,
type: { value: String, message: 'admin.activity.non_string_email' }
end
end
end
end
end

146
app/api/v2/admin/permissions.rb Normal file
View File

@@ -0,0 +1,146 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Admin functionality over permissions table
class Permissions < Grape::API
resource :permissions do
helpers ::API::V2::NamedParams
helpers do
def validate_params!(params)
unless %w(get post delete put head patch all).include?(params[:verb].downcase)
error!({ errors: ['admin.permissions.invalid_verb'] }, 422)
end
error!({ errors: ['admin.permissions.invalid_action'] }, 422) unless %w(accept drop audit).include?(params[:action].downcase)
end
end
desc 'Returns array of permissions as paginated collection',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Entities::Permission
params do
use :pagination_filters
end
get do
admin_authorize! :read, Permission
present paginate(Permission.all), with: API::V2::Entities::Permission
end
desc 'Create permission',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Permission was created' }
params do
requires :role,
type: String,
allow_blank: false
requires :verb,
type: String,
allow_blank: false
requires :path,
type: String,
allow_blank: false
requires :action,
type: String,
allow_blank: false
optional :topic,
type: String,
allow_blank: false
end
post do
admin_authorize! :create, Permission
validate_params!(params)
declared_params = declared(params, include_missing: false)
error!({ errors: ['admin.permission.role_doesnt_exist'] }, 422) if Permission.where(role: params[:role]).empty?
permission = Permission.new(declared_params)
code_error!(permission.errors.details, 422) unless permission.save
# clear cached permissions, so they will be freshly refetched on the next call to /auth
Rails.cache.delete('permissions')
status 200
end
desc 'Deletes permission',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Permission was deleted' }
params do
requires :id,
type: Integer,
allow_blank: false,
desc: 'permission id'
end
delete do
admin_authorize! :destroy, Permission
target_permission = Permission.find_by(id: params[:id])
error!({ errors: ['admin.permission.doesnt_exist'] }, 404) if target_permission.nil?
target_permission.destroy
# clear cached permissions, so they will be freshly refetched on the next call to /auth
Rails.cache.delete('permissions')
status 200
end
desc 'Update Permission',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Permission was updated' }
params do
requires :id,
type: Integer,
allow_blank: false,
desc: 'Permission id'
optional :role,
type: String,
allow_blank: false,
desc: 'permission field - role'
optional :verb,
type: String,
allow_blank: false,
desc: 'permission field - request verb'
optional :path,
type: String,
allow_blank: false,
desc: 'permission field - request path'
optional :action,
type: String,
allow_blank: false
optional :topic,
type: String,
allow_blank: false
end
put do
admin_authorize! :update, Permission
target_permission = Permission.find_by(id: params[:id])
error!({ errors: ['admin.permission.doesnt_exist'] }, 404) if target_permission.nil?
unless target_permission.update(declared(params, include_missing: false))
code_error!(target_permission.errors.details, 422)
end
# clear cached permissions, so they will be freshly refetched on the next call to /auth
Rails.cache.delete('permissions')
status 200
end
end
end
end
end
end

148
app/api/v2/admin/profiles.rb Normal file
View File

@@ -0,0 +1,148 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Admin functionality over profiles table
class Profiles < Grape::API
resource :profiles do
helpers ::API::V2::NamedParams
desc 'Return all profiles',
failure: [
{ code: 401, message: 'Invalid bearer token' },
],
success: API::V2::Admin::Entities::Profile
params do
use :pagination_filters
end
get do
admin_authorize! :read, Profile
present paginate(Profile.all), with: API::V2::Admin::Entities::Profile
end
desc "Verify user's profile",
failure: [
{ code: 400, message: 'Required params are empty' },
{ code: 401, message: 'Invalid bearer token' },
{ code: 422, message: 'Validation errors' }
],
success: API::V2::Admin::Entities::Profile
params do
requires :uid, type: String
requires :state, type: String
end
put do
admin_authorize! :update, Profile
target_profile = User.find_by(uid: params[:uid])&.submitted_profile
return error!({ errors: ['admin.profiles.doesnt_exist_or_not_editable'] }, 404) if target_profile.nil?
if target_profile.user.superadmin? && !current_user.superadmin?
error!({ errors: ['admin.profiles.superadmin_change'] }, 422)
end
if Barong::App.config.profile_double_verification && target_profile.author \
&& target_profile.author == current_user.uid && !BarongConfig.list['profile_verification_roles']&.include?(current_user.role)
error!({ errors: ['admin.profiles.second_admin_approval'] }, 422)
end
unless target_profile.update(declared(params.except(:uid), include_missing: false))
code_error!(target_profile.errors.details, 422)
end
present target_profile, with: API::V2::Admin::Entities::Profile
end
desc 'Create a profile for user',
failure: [
{ code: 400, message: 'Required params are empty' },
{ code: 401, message: 'Invalid bearer token' },
{ code: 422, message: 'Validation errors' }
],
success: API::V2::Admin::Entities::Profile
params do
requires :uid, type: String
optional :first_name, type: String
optional :last_name, type: String
optional :dob, type: Date
optional :address, type: String
optional :postcode, type: String
optional :city, type: String
optional :country, type: String
optional :metadata, type: String, desc: 'Any additional key: value pairs in json string format'
end
post do
target_user = User.find_by(uid: params[:uid])
declared_params = declared(params.except(:uid), include_missing: false)
declared_params.merge!(state: 'submitted', author: current_user.uid)
profile = target_user.profiles.create(declared_params)
code_error!(profile.errors.details, 422) if profile.errors.any?
present profile, with: API::V2::Admin::Entities::Profile
status 201
end
desc 'verifying labels by admin',
failure: [
{ code: 400, message: 'Required params are empty' },
{ code: 401, message: 'Invalid bearer token' },
{ code: 404, message: 'doesnt exist' },
{ code: 422, message: 'Validation errors' }
],
success: API::V2::Admin::Entities::Profile
params do
requires :user_uid, type: String
requires :label_key, type: String
requires :label_value, type: String
end
put '/label' do
admin_authorize! :update, Label
target_user = User.find_by(uid: params[:user_uid])
error!({ errors: ['admin.label.user_doesnt_exist'] }, 404) unless target_user
label = target_user.labels.find_by(key: params[:label_key])
error!({ errors: ['admin.label.label_doesnt_exist'] }, 404) unless label
label.update(value: params['label_value'])
code_error!(label.errors.details, 422) if label.errors.any?
# present label, with: API::V2::Admin::Entities::Profile
status 201
end
# bank info
resource :treasury do
desc 'Return list of treasuries',
failure: [
{ code: 401, message: 'Invalid bearer token' },
{ code: 404, message: 'User has no treasuries' }
],
success: API::V2::Entities::Treasury
params do
requires :user_uid, type: String
optional :kind, type: String
end
get '/list' do
target_user = User.find_by(uid: params[:user_uid])
error!({ errors: ['admin.treasury.user_doesnt_exist'] }, 404) unless target_user
treasury_list = target_user.treasuries
treasury_list = treasury_list.where(kind: params[:kind]) if params[:kind].present?
present treasury_list, with: API::V2::Entities::Treasury
end
end
end
end
end
end
end

177
app/api/v2/admin/restrictions.rb Normal file
View File

@@ -0,0 +1,177 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Admin functionality over restrictions table
class Restrictions < Grape::API
resource :restrictions do
helpers ::API::V2::NamedParams
desc 'Returns array of restrictions as a paginated collection',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Entities::Restriction
params do
optional :scope,
allow_blank: false,
values: { value: -> { Restriction::SCOPES }, message: 'admin.restriction.invalid_scope'}
optional :category,
allow_blank: false,
values: { value: -> { Restriction::CATEGORIES }, message: 'admin.restriction.invalid_category'}
optional :range,
type: String,
values: { value: ->(p) { %w[created updated].include?(p) }, message: 'admin.restriction.invalid_range' },
default: 'created'
use :pagination_filters
end
get do
admin_authorize! :read, Restriction
restrictions = Restriction.all
restrictions = params[:category] ? restrictions.where(category: params[:category]) : restrictions
restrictions = params[:scope] ? restrictions.where(scope: params[:scope]) : restrictions
restrictions = params[:to] ? restrictions.where("#{params[:range]}_at <= ?", Time.at(params[:to].to_i)) : restrictions
restrictions = params[:from] ? restrictions.where("#{params[:range]}_at >= ?", Time.at(params[:from].to_i)) : restrictions
present paginate(restrictions), with: API::V2::Entities::Restriction
end
desc 'Create whitelink',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Created whitelink' }
params do
optional :expire_time,
allow_blank: false,
default: 1,
values: { value: 1..30, message: 'invalid_expire' },
type: Integer,
desc: 'link will be active for (Time.now + expire_time in following range)'
optional :range,
allow_blank: false,
default: 'day',
values: { value: ->(p) { %w[day hour].include?(p) }, message: 'invalid_range' },
type: String,
desc: 'In combination with expire_time gives full controll over token expiration'
end
post '/whitelink' do
admin_authorize! :create, Restriction
whitelink_token = Digest::SHA256.hexdigest(SecureRandom.hex(10))
expires_in = params[:range] == 'day' ? params[:expire_time].days : params[:expire_time].hours
Rails.cache.write(whitelink_token, 'active', expires_in: expires_in)
response = { whitelink_token: whitelink_token }
present response
end
desc 'Create restriction',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Restriction was created' }
params do
requires :scope,
allow_blank: false,
values: { value: -> { Restriction::SCOPES }, message: 'admin.restriction.invalid_scope'}
requires :value,
allow_blank: false
requires :category,
type: String,
values: { value: -> { Restriction::CATEGORIES }, message: 'admin.restriction.invalid_category'},
allow_blank: false
optional :state,
default: 'enabled',
allow_blank: false,
values: { value: -> { Restriction::STATES }, message: 'admin.restriction.invalid_state' }
optional :code,
type: Integer,
allow_blank: false
end
post do
admin_authorize! :create, Restriction
restriction = Restriction.new(declared(params, include_missing: false))
code_error!(restriction.errors.details, 422) unless restriction.save
# clear cached restrictions, so they will be freshly refetched on the next call to /auth
Rails.cache.delete('restrictions')
status 200
end
desc 'Update restriction',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Restriction was updated' }
params do
requires :id,
type: Integer,
allow_blank: false,
desc: 'Restriction id'
optional :scope,
allow_blank: false,
values: { value: -> { Restriction::SCOPES }, message: 'admin.restriction.invalid_scope' }
optional :category,
type: String,
values: { value: -> { Restriction::CATEGORIES }, message: 'admin.restriction.invalid_category'},
allow_blank: false
optional :value,
allow_blank: false
optional :state,
allow_blank: false,
values: { value: -> { Restriction::STATES }, message: 'admin.restriction.invalid_state' }
optional :code,
type: Integer,
allow_blank: false
end
put do
admin_authorize! :update, Restriction
target_restriction = Restriction.find_by(id: params[:id])
error!({ errors: ['admin.restriction.doesnt_exist'] }, 404) if target_restriction.nil?
unless target_restriction.update(declared(params, include_missing: false))
code_error!(target_restriction.errors.details, 422)
end
# clear cached restrictions, so they will be freshly refetched on the next call to /auth
Rails.cache.delete('restrictions')
status 200
end
desc 'Delete restriction',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Restriction was deleted' }
params do
requires :id,
type: Integer,
allow_blank: false,
desc: 'Restriction id'
end
delete do
admin_authorize! :destroy, Restriction
target_restriction = Restriction.find_by(id: params[:id])
error!({ errors: ['admin.restriction.doesnt_exist'] }, 404) if target_restriction.nil?
target_restriction.destroy
# clear cached restrictions, so they will be freshly refetched on the next call to /auth
Rails.cache.delete('restrictions')
status 200
end
end
end
end
end
end

699
app/api/v2/admin/users.rb Normal file
View File

@@ -0,0 +1,699 @@
# frozen_string_literal: true
module API
module V2
module Admin
# Admin functionality over users table
class Users < Grape::API
resource :users do
helpers ::API::V2::NamedParams
helpers do
def permitted_search_params(params)
params.slice(:uid, :email, :role, :first_name, :last_name, :country, :level, :state, :from, :to, :range)
end
def search(field, value)
error!({ errors: ['admin.user.non_user_field'] }, 422) unless User.attribute_names.include?(field)
User.where("#{field}": value).order('email ASC')
end
end
desc 'Returns array of users as paginated collection',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Entities::User
params do
optional :extended,
type: { value: Boolean, message: 'admin.user.non_boolean_extended' },
default: false,
desc: 'When true endpoint returns full information about users'
optional :uid,
type: String
optional :email,
type: String
optional :role,
type: String
optional :country,
type: String
optional :level,
type: Integer
optional :state,
type: String
optional :range,
type: String,
values: { value: -> (p){ %w[created updated].include?(p) }, message: 'admin.user.invalid_range' },
default: 'created'
optional :ordering,
values: { value: -> (p){ %w[asc desc].include?(p) }, message: 'user.ordering.invalid_ordering' },
default: 'asc',
desc: 'If set, returned values will be sorted in specific order, defaults to \'asc\'.'
optional :order_by,
values: { value: -> (p){ User.new.attributes.keys.include?(p) }, message: 'user.ordering.invalid_attribute' },
default: 'id',
desc: 'Name of the field, which result will be ordered by.'
use :timeperiod_filters
use :pagination_filters
end
get do
admin_authorize! :read, User
entity = params[:extended] ? API::V2::Admin::Entities::UserWithProfile : API::V2::Entities::User
users = API::V2::Queries::UserFilter.new(User.all.order(params[:order_by] => params[:ordering])).call(params).uniq
present paginate(users), with: entity
end
desc 'Update user attributes',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'User attributes were updated' }
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
optional :state,
type: String,
allow_blank: false,
desc: 'user state'
optional :otp,
type: Boolean,
allow_blank: false,
desc: 'user 2fa status'
exactly_one_of :state, :otp, message: 'admin.user.one_of_state_otp'
end
post '/update' do
admin_authorize! :update, User
target_user = User.find_by_uid(params[:uid])
# Ruby Hash returns array on keys and values
update_param_key = params.except(:uid).keys.first
update_param_value = params.except(:uid).values.first
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
if target_user.superadmin? && !current_user.superadmin?
error!({ errors: ['admin.user.superadmin_change'] }, 422)
end
error!({ errors: ['admin.user.update_himself'] }, 422) if target_user.uid == current_user.uid
if update_param_key == 'otp' && update_param_value == true
error!({ errors: ['admin.user.enable_2fa'] }, 422)
end
if update_param_value == target_user[update_param_key]
error!({ errors: ["admin.user.#{update_param_key}_no_change"] }, 422)
end
unless target_user.update(update_param_key => update_param_value)
code_error!(target_user.errors.details, 422)
end
target_user.labels.find_by(key: :otp, scope: :private).delete if target_user.labels.find_by(key: :otp, scope: :private) && update_param_key == 'otp'
status 200
end
desc 'Update user role',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'User role was created' }
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
requires :role,
type: String,
allow_blank: false,
desc: 'user role'
end
post '/role' do
admin_authorize! :update, User
target_user = User.find_by_uid(params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
if target_user.superadmin? && !current_user.superadmin?
error!({ errors: ['admin.user.superadmin_change'] }, 422)
end
error!({ errors: ['admin.user.update_himself'] }, 422) if target_user.uid == current_user.uid
if params[:role] == target_user.role
error!({ errors: ["admin.user.role_no_change"] }, 422)
end
unless target_user.update(role: params[:role])
code_error!(target_user.errors.details, 422)
end
status 200
end
desc 'Update user attributes',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'User attributes were created' }
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
optional :email,
type: String,
allow_blank: false,
desc: 'User Email'
optional :state,
type: String,
allow_blank: false,
desc: 'user state'
optional :otp,
type: Boolean,
allow_blank: false,
desc: 'user 2fa status'
exactly_one_of :state, :otp, :email, message: 'admin.user.one_of_state_otp_email'
end
put do
admin_authorize! :update, User
target_user = User.find_by_uid(params[:uid])
# Ruby Hash returns array on keys and values
update_param_key = params.except(:uid).keys.first
update_param_value = params.except(:uid).values.first
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
if target_user.superadmin? && !current_user.superadmin?
error!({ errors: ['admin.user.superadmin_change'] }, 422)
end
error!({ errors: ['admin.user.update_himself'] }, 422) if target_user.uid == current_user.uid
if update_param_key == 'email' && !current_user.superadmin?
error!({ errors: ['superadmin.user.update_email'] }, 422)
end
if update_param_key == 'otp' && update_param_value == true
error!({ errors: ['admin.user.enable_2fa'] }, 422)
end
if update_param_value == target_user[update_param_key]
error!({ errors: ["admin.user.#{update_param_key}_no_change"] }, 422)
end
unless target_user.update(update_param_key => update_param_value)
code_error!(target_user.errors.details, 422)
end
target_user.labels.find_by(key: :otp, scope: :private).delete if target_user.labels.find_by(key: :otp, scope: :private) && update_param_key == 'otp'
status 200
end
desc 'Returns array of users with pending or replaced documents as paginated collection',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Entities::User
params do
optional :extended,
type: { value: Boolean, message: 'admin.user.non_boolean_extended' },
default: false,
desc: 'When true endpoint returns full information about users'
optional :uid,
type: String
optional :email,
type: String
optional :role,
type: String
optional :first_name,
type: String
optional :last_name,
type: String
optional :country,
type: String
optional :level,
type: Integer
optional :state,
type: String
optional :range,
type: String,
values: { value: ->(p) { %w[created updated].include?(p) }, message: 'admin.user.invalid_range' },
default: 'created'
use :timeperiod_filters
use :pagination_filters
end
get '/documents/pending' do
admin_authorize! :read, User
users_with_pending_or_replaced_docs = User.with_pending_or_replaced_docs.order('labels.updated_at ASC')
users = API::V2::Queries::UserFilter.new(users_with_pending_or_replaced_docs).call(params)
entity = params[:extended] ? API::V2::Admin::Entities::UserWithKYC : API::V2::Entities::User
present paginate(users), with: entity
end
desc 'Returns user documents',
failure: [
{ code: 400, message: 'Required params are empty' },
{ code: 401, message: 'Invalid bearer token' },
{ code: 404, message: 'doesnt exist' },
{ code: 422, message: 'Validation errors' }
],
success: API::V2::Entities::Document
params do
requires :user_uid, type: String
optional :doc_type, type: String
optional :doc_category, type: String
optional :doc_state, type: String
end
get '/documents' do
admin_authorize! :read, User
target_user = User.find_by(uid: params[:user_uid])
error!({ errors: ['admin.document.user_doesnt_exist'] }, 404) unless target_user
documents = target_user.documents
documents = documents.where(doc_type: params[:doc_type]) if params[:doc_type].present?
documents = documents.where(doc_category: params[:doc_category]) if params[:doc_category].present?
documents = documents.where(state: params[:doc_state]) if params[:doc_state].present?
error!({ errors: ['admin.document.document_doesnt_exist'] }, 404) unless documents
present documents, with: API::V2::Entities::Document
status 200
end
desc 'change documents by admin',
failure: [
{ code: 400, message: 'Required params are empty' },
{ code: 401, message: 'Invalid bearer token' },
{ code: 404, message: 'doesnt exist' },
{ code: 422, message: 'Validation errors' }
],
success: API::V2::Admin::Entities::Profile
params do
requires :user_uid, type: String
requires :doc_type, type: String
requires :doc_state, type: String
end
put '/documents' do
admin_authorize! :update, Document
target_user = User.find_by(uid: params[:user_uid])
error!({ errors: ['admin.document.user_doesnt_exist'] }, 404) unless target_user
document = target_user.documents.find_by(doc_type: params[:doc_type])
error!({ errors: ['admin.document.document_doesnt_exist'] }, 404) unless document
document.update(state: params['doc_state'])
code_error!(document.errors.details, 422) if document.errors.any?
present document, with: API::V2::Admin::Entities::Document
status 200
end
namespace :labels do
desc 'Returns existing labels keys and values',
failure: [
{ code: 401, message: 'Invalid bearer token' }
]
params do
end
get '/list' do
admin_authorize! :read, User
labels = Label.where(scope: 'private').group(:key, :value).size
present labels
end
desc 'Returns array of users as paginated collection',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Entities::User
params do
requires :key, type: String, desc: 'Label key'
requires :value, type: String, desc: 'Label value'
use :pagination_filters
end
get do
admin_authorize! :read, User
users = User.joins(:labels).where(labels: { key: params[:key], value: params[:value] })
present paginate(users), with: API::V2::Entities::User
end
desc 'Add label for user',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Label was created' }
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
requires :key,
type: String,
allow_blank: false,
desc: 'label key. [a-z0-9_-]+ should be used. Min - 3, max - 255 characters.'
requires :value,
type: String,
allow_blank: false,
desc: 'label value. [A-Za-z0-9_-] should be used. Min - 3, max - 255 characters.'
optional :description,
type: String,
allow_blank: false,
desc: 'label description. [A-Za-z0-9_-] should be used. max - 255 characters.'
optional :scope, type: String, desc: "Label scope: 'public' or 'private'. Default is public", allow_blank: false
end
post do
admin_authorize! :create, Label
declared_params = declared(params, include_missing: false)
target_user = User.find_by_uid(params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
if target_user.superadmin? && !current_user.superadmin?
error!({ errors: ['admin.user.superadmin_change'] }, 422)
end
declared_params[:user_id] = target_user.id
label = Label.new(declared_params.except(:uid))
code_error!(label.errors.details, 422) unless label.save
status 200
end
desc 'Update user label value',
failure: [
{ code: 400, message: 'Required params are empty' },
{ code: 401, message: 'Invalid bearer token' },
{ code: 404, message: 'Record is not found' },
{ code: 422, message: 'Validation errors' }
],
success: { code: 200, message: 'Label was updated' }
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
requires :key,
type: String,
allow_blank: false,
desc: 'Label key.'
requires :scope,
type: String,
allow_blank: false,
desc: 'label key. [a-z0-9_-]+ should be used. Min - 3, max - 255 characters.'
requires :value,
type: String,
allow_blank: false,
desc: 'Label value.'
optional :description,
type: String,
allow_blank: false,
desc: 'label description. [A-Za-z0-9_-] should be used. max - 255 characters.'
optional :replace,
type: { value: Boolean, message: 'admin.user.non_boolean_replace' },
default: true,
desc: 'When true label will be created if not exist'
end
post '/update' do
admin_authorize! :update, Label
declared_params = declared(params, include_missing: false)
target_user = User.find_by_uid(declared_params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
if target_user.superadmin? && !current_user.superadmin?
error!({ errors: ['admin.user.superadmin_change'] }, 422)
end
label = Label.find_by_key_and_user_id_and_scope(declared_params[:key], target_user.id, declared_params[:scope])
if label.nil?
if declared_params[:replace]
label = Label.create(
user_id: target_user.id,
key: declared_params[:key],
value: declared_params[:value],
scope: declared_params[:scope],
description: declared_params[:description]
)
else
error!({ errors: ['admin.label.doesnt_exist'] }, 404)
end
else
label.update({ value: params[:value], description: params[:description] })
end
code_error!(label.errors.details, 422) if label.errors.any?
status 200
end
desc 'Update user label scope',
failure: [
{ code: 400, message: 'Required params are empty' },
{ code: 401, message: 'Invalid bearer token' },
{ code: 404, message: 'Record is not found' },
{ code: 422, message: 'Validation errors' }
],
success: { code: 200, message: 'Label was updated' }
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
requires :key,
type: String,
allow_blank: false,
desc: 'Label key.'
requires :scope,
type: String,
allow_blank: false,
desc: 'label key. [a-z0-9_-]+ should be used. Min - 3, max - 255 characters.'
optional :description,
type: String,
allow_blank: false,
desc: 'label description. [A-Za-z0-9_-] should be used. max - 255 characters.'
requires :value,
type: String,
allow_blank: false,
desc: 'Label value.'
end
put do
admin_authorize! :update, Label
declared_params = declared(params, include_missing: false)
target_user = User.find_by_uid(declared_params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
if target_user.superadmin? && !current_user.superadmin?
error!({ errors: ['admin.user.superadmin_change'] }, 422)
end
label = Label.find_by_key_and_user_id_and_scope(declared_params[:key], target_user.id, declared_params[:scope])
error!({ errors: ['admin.label.doesnt_exist'] }, 404) if label.nil?
unless label.update({ value: params[:value], description: params[:description] }.compact)
code_error!(label.errors.details, 422)
end
status 200
end
desc 'Deletes label for user',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: { code: 200, message: 'Label was deleted' }
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
requires :key,
type: String,
allow_blank: false,
desc: 'label key. [a-z0-9_-]+ should be used. Min - 3, max - 255 characters.'
requires :scope,
type: String,
allow_blank: false,
desc: 'label key. [a-z0-9_-]+ should be used. Min - 3, max - 255 characters.'
end
delete do
admin_authorize! :destroy, Label
declared_params = declared(params, include_missing: false)
target_user = User.find_by_uid(params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
if target_user.superadmin? && !current_user.superadmin?
error!({ errors: ['admin.user.superadmin_change'] }, 422)
end
label = Label.find_by_key_and_user_id_and_scope(declared_params[:key], target_user.id, declared_params[:scope])
error!({ errors: ['admin.label.doesnt_exist'] }, 404) if label.nil?
label.destroy
status 200
end
end
desc 'Returns user info',
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Admin::Entities::UserWithKYC
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
end
get '/:uid' do
admin_authorize! :read, User
target_user = User.find_by_uid(params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
present target_user, with: API::V2::Admin::Entities::UserWithKYC
end
desc "Deletes user's data storage record",
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Admin::Entities::UserWithKYC
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
requires :title,
type: String,
allow_blank: false,
desc: 'data storage uniq title'
end
delete '/data_storage' do
admin_authorize! :destroy, User
target_user = User.find_by_uid(params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
storage = target_user.data_storages.find_by_title(params[:title])
error!({ errors: ['admin.storage.doesnt_exist'] }, 404) if storage.nil?
target_user.labels.find_by(key: storage.title, scope: 'private')
storage.destroy
present target_user, with: API::V2::Admin::Entities::UserWithKYC
end
namespace :comments do
desc "Adds new user's comment",
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Admin::Entities::UserWithKYC
params do
requires :uid,
type: String,
allow_blank: false,
desc: 'user uniq id'
requires :title,
type: String,
values: { value: -> (v){ v.length <= 64 }, message: 'admin.comments.title_too_long'},
allow_blank: false,
desc: 'comment uniq title'
requires :data,
type: String,
values: { value: -> (v){ v.length <= 65535 }, message: 'admin.comments.data_too_long'},
allow_blank: false,
desc: 'comment data'
end
post do
target_user = User.find_by_uid(params[:uid])
error!({ errors: ['admin.user.doesnt_exist'] }, 404) if target_user.nil?
comment = Comment.new(user_id: target_user.id,
data: params[:data],
title: params[:title],
author_uid: current_user[:uid])
code_error!(data_storage.errors.details, 422) unless comment.save
present target_user, with: API::V2::Admin::Entities::UserWithKYC
end
desc "Edit user's comment",
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Admin::Entities::UserWithKYC
params do
requires :id,
type: Integer,
desc: 'comment uniq id'
optional :title,
type: String,
values: { value: -> (v){ v.length <= 64 }, message: 'admin.comments.title_too_long'},
allow_blank: false,
desc: 'comment title'
optional :data,
type: String,
values: { value: -> (v){ v.length <= 65535 }, message: 'admin.comments.data_too_long'},
allow_blank: false,
desc: 'comment data'
end
put do
comment = Comment.find(params[:id])
error!({ errors: ['admin.comment.doesnt_exist'] }, 404) if comment.nil?
code_error!(comment.errors.details, 422) unless comment.update(params.slice(:data, :title))
present comment.user, with: API::V2::Admin::Entities::UserWithKYC
end
desc "Delete user's comment",
failure: [
{ code: 401, message: 'Invalid bearer token' }
],
success: API::V2::Admin::Entities::UserWithKYC
params do
requires :id,
type: Integer,
desc: 'comment uniq id'
end
delete do
comment = Comment.find(params[:id])
error!({ errors: ['admin.comment.doesnt_exist'] }, 404) if comment.nil?
code_error!(comment.errors.details, 422) unless comment.destroy
present comment.user, with: API::V2::Admin::Entities::UserWithKYC
end
end
end
end
end
end
end