Ooops. Added missing access control to changeset controller.

[rails.git] / app / controllers / node_controller.rb

diff --git a/app/controllers/node_controller.rb b/app/controllers/node_controller.rb
index 62e680388471203ad94b1a2100ce041e8b446276..9763be5d46597e8fa5b868769010a53d6dc4708f 100644 (file)
--- a/app/controllers/node_controller.rb
+++ b/app/controllers/node_controller.rb
@@ -11,24 +11,21 @@ class NodeController < ApplicationController
 
   # Create a node from XML.
   def create
-    if request.put?
-      node = Node.from_xml(request.raw_post, true)
-      # FIXME remove debug
-      logger.debug request.raw_post
-      logger.debug node
-
-      if node
-        node.version = 0
-        #node.changeset_id = node.changeset
-        node.visible = true
-        node.save_with_history!
+    begin
+      if request.put?
+        node = Node.from_xml(request.raw_post, true)
 
-        render :text => node.id.to_s, :content_type => "text/plain"
+        if node
+          node.create_with_history @user
+          render :text => node.id.to_s, :content_type => "text/plain"
+        else
+          render :nothing => true, :status => :bad_request
+        end
       else
-        render :nothing => true, :status => :bad_request
+        render :nothing => true, :status => :method_not_allowed
       end
-    else
-      render :nothing => true, :status => :method_not_allowed
+    rescue OSM::APIError => ex
+      render ex.render_opts
     end
   end
 
@@ -47,21 +44,6 @@ class NodeController < ApplicationController
     end
   end
   
-  # Dump a specific version of the node based on the given params[:id] and params[:version]
-  def version
-    begin
-      node = Node.find(:first, :conditions => { :id => params[:id], :version => params[:version] } )
-      if node.visible
-        response.headers['Last-Modified'] = node.timestamp.rfc822
-        render :text => node.to_xml.to_s, :content_type => "text/xml"
-      else
-        render :nothing => true, :status => :gone
-      end
-    rescue ActiveRecord::RecordNotFound
-      render :nothing => true, :status => :not_found
-    end
-  end
-
   # Update a node from given XML
   def update
     begin
@@ -74,29 +56,24 @@ class NodeController < ApplicationController
       else
         render :nothing => true, :status => :bad_request
       end
-    rescue OSM::APIVersionMismatchError => ex
-      render :text => "Version mismatch: Provided " + ex.provided.to_s +
-        ", server had: " + ex.latest.to_s, :status => :bad_request
+    rescue OSM::APIError => ex
+      render ex.render_opts
     rescue ActiveRecord::RecordNotFound
       render :nothing => true, :status => :not_found
     end
   end
 
-  # Delete a node. Doesn't actually delete it, but retains its history in a wiki-like way.
-  # FIXME remove all the fricking SQL
+  # Delete a node. Doesn't actually delete it, but retains its history 
+  # in a wiki-like way. We therefore treat it like an update, so the delete
+  # method returns the new version number.
   def delete
     begin
       node = Node.find(params[:id])
       new_node = Node.from_xml(request.raw_post)
-      # FIXME we no longer care about the user, (or maybe we want to check
-      # that the user of the changeset is the same user as is making this
-      # little change?) we really care about the 
-      # changeset which must be open, and that the version that we have been
-      # given is the one that is currently stored in the database
       
       if new_node and new_node.id == node.id
-        node.delete_with_history(new_node, @user)
-        render :nothing => true
+        node.delete_with_history!(new_node, @user)
+        render :text => node.version.to_s, :content_type => "text/plain"
       else
         render :nothing => true, :status => :bad_request
       end