Simplify deny_access handling

Now that we have all api controllers inheriting from a common base,
it's easier to override the deny_access handler without having to
switch between both.

Fixes #2064

diff --git a/app/controllers/api/capabilities_controller.rb b/app/controllers/api/capabilities_controller.rb
index 68968d107c3a0fc2e447ca560b4bab7d0e5acdc9..7f91557f85849b74bf749daf590dbe77aa3f582d 100644 (file)
--- a/app/controllers/api/capabilities_controller.rb
+++ b/app/controllers/api/capabilities_controller.rb
@@ -1,7 +1,5 @@
 module Api
   class CapabilitiesController < ApiController
 module Api
   class CapabilitiesController < ApiController

-    before_action :api_deny_access_handler
-

     authorize_resource :class => false
 
     around_action :api_call_handle_error, :api_call_timeout
     authorize_resource :class => false
 
     around_action :api_call_handle_error, :api_call_timeout

diff --git a/app/controllers/api/changes_controller.rb b/app/controllers/api/changes_controller.rb
index 97ddc176348b3319351350ebe8efaa2325b279d1..7170e15622468037a6c2a210d7cdce6e7091e36c 100644 (file)
--- a/app/controllers/api/changes_controller.rb
+++ b/app/controllers/api/changes_controller.rb
@@ -1,7 +1,5 @@
 module Api
   class ChangesController < ApiController
 module Api
   class ChangesController < ApiController

-    before_action :api_deny_access_handler
-

     authorize_resource :class => false
 
     before_action :check_api_readable
     authorize_resource :class => false
 
     before_action :check_api_readable

diff --git a/app/controllers/api/changeset_comments_controller.rb b/app/controllers/api/changeset_comments_controller.rb
index db90dcbe3f3c88e00916a5aca3df9eea762e3bb6..21c854139c9bf9d684183461650be60af8c9ee12 100644 (file)
--- a/app/controllers/api/changeset_comments_controller.rb
+++ b/app/controllers/api/changeset_comments_controller.rb
@@ -1,7 +1,6 @@
 module Api
   class ChangesetCommentsController < ApiController
     before_action :authorize
 module Api
   class ChangesetCommentsController < ApiController
     before_action :authorize

-    before_action :api_deny_access_handler

 
     authorize_resource
 
 
     authorize_resource
 

diff --git a/app/controllers/api/changesets_controller.rb b/app/controllers/api/changesets_controller.rb
index 0f016c9025d5e8dca63d2705658aab3b3aebd726..8841d4b3b23c8457b00664dd087da065b46e8d6e 100644 (file)
--- a/app/controllers/api/changesets_controller.rb
+++ b/app/controllers/api/changesets_controller.rb
@@ -6,7 +6,6 @@ module Api
     require "xml/libxml"
 
     before_action :authorize, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
     require "xml/libxml"
 
     before_action :authorize, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]

-    before_action :api_deny_access_handler, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox]

 
     authorize_resource
 
 
     authorize_resource
 

diff --git a/app/controllers/api/map_controller.rb b/app/controllers/api/map_controller.rb
index 1073660713d106cafa8781fd9d2c4aa7462fc2f6..27d6f3667410b13504851e0298e1eb67257c4154 100644 (file)
--- a/app/controllers/api/map_controller.rb
+++ b/app/controllers/api/map_controller.rb
@@ -1,7 +1,5 @@
 module Api
   class MapController < ApiController
 module Api
   class MapController < ApiController

-    before_action :api_deny_access_handler
-

     authorize_resource :class => false
 
     before_action :check_api_readable
     authorize_resource :class => false
 
     before_action :check_api_readable

diff --git a/app/controllers/api/nodes_controller.rb b/app/controllers/api/nodes_controller.rb
index d081b28bb31b45f5c3e8d37a589aabdee0952a2b..5218159c16097f61b921e07d63d0ea7cee1ff601 100644 (file)
--- a/app/controllers/api/nodes_controller.rb
+++ b/app/controllers/api/nodes_controller.rb
@@ -5,7 +5,6 @@ module Api
     require "xml/libxml"
 
     before_action :authorize, :only => [:create, :update, :delete]
     require "xml/libxml"
 
     before_action :authorize, :only => [:create, :update, :delete]

-    before_action :api_deny_access_handler

 
     authorize_resource
 
 
     authorize_resource
 

diff --git a/app/controllers/api/notes_controller.rb b/app/controllers/api/notes_controller.rb
index 92b68bd4616f892f9d9ae5ffd1ec0f399e94de37..20a24ce997bbe10a6aaf546d2f0131b91a4abb47 100644 (file)
--- a/app/controllers/api/notes_controller.rb
+++ b/app/controllers/api/notes_controller.rb
@@ -5,7 +5,6 @@ module Api
     before_action :check_api_readable
     before_action :setup_user_auth, :only => [:create, :comment, :show]
     before_action :authorize, :only => [:close, :reopen, :destroy]
     before_action :check_api_readable
     before_action :setup_user_auth, :only => [:create, :comment, :show]
     before_action :authorize, :only => [:close, :reopen, :destroy]

-    before_action :api_deny_access_handler

 
     authorize_resource
 
 
     authorize_resource
 

diff --git a/app/controllers/api/old_controller.rb b/app/controllers/api/old_controller.rb
index 9d9f2fabc656d6421ee6d987e94c85d63cb681ab..fa2b5814e49a400a5b22fd95d5d287812bb4fb29 100644 (file)
--- a/app/controllers/api/old_controller.rb
+++ b/app/controllers/api/old_controller.rb
@@ -6,7 +6,6 @@ module Api
     require "xml/libxml"
 
     before_action :setup_user_auth, :only => [:history, :version]
     require "xml/libxml"
 
     before_action :setup_user_auth, :only => [:history, :version]

-    before_action :api_deny_access_handler

     before_action :authorize, :only => [:redact]
 
     authorize_resource
     before_action :authorize, :only => [:redact]
 
     authorize_resource

diff --git a/app/controllers/api/permissions_controller.rb b/app/controllers/api/permissions_controller.rb
index 15f3812674ab3bd520cf52e04ad94b302498ba82..9b168e04b568e5c1f880f0f2a035a11f1dc74c44 100644 (file)
--- a/app/controllers/api/permissions_controller.rb
+++ b/app/controllers/api/permissions_controller.rb
@@ -1,7 +1,5 @@
 module Api
   class PermissionsController < ApiController
 module Api
   class PermissionsController < ApiController

-    before_action :api_deny_access_handler
-

     authorize_resource :class => false
 
     before_action :check_api_readable
     authorize_resource :class => false
 
     before_action :check_api_readable

diff --git a/app/controllers/api/relations_controller.rb b/app/controllers/api/relations_controller.rb
index 6f52f2f946a119c7d915f8586b4b7c7e4b09d495..b7d990c3d3570321d21614afc1ef94293d39055b 100644 (file)
--- a/app/controllers/api/relations_controller.rb
+++ b/app/controllers/api/relations_controller.rb
@@ -3,7 +3,6 @@ module Api
     require "xml/libxml"
 
     before_action :authorize, :only => [:create, :update, :delete]
     require "xml/libxml"
 
     before_action :authorize, :only => [:create, :update, :delete]

-    before_action :api_deny_access_handler

 
     authorize_resource
 
 
     authorize_resource
 

diff --git a/app/controllers/api/tracepoints_controller.rb b/app/controllers/api/tracepoints_controller.rb
index 7799de2660a88102f1d1071c99f1df20983c09f0..b22bcfaeaff994508a4a7d2272035157e0867473 100644 (file)
--- a/app/controllers/api/tracepoints_controller.rb
+++ b/app/controllers/api/tracepoints_controller.rb
@@ -1,7 +1,5 @@
 module Api
   class TracepointsController < ApiController
 module Api
   class TracepointsController < ApiController

-    before_action :api_deny_access_handler
-

     authorize_resource
 
     before_action :check_api_readable
     authorize_resource
 
     before_action :check_api_readable

diff --git a/app/controllers/api/traces_controller.rb b/app/controllers/api/traces_controller.rb
index 88b6edc67903782a0e7b90d4a5d0aa269b8a30b2..47dd152a3fa6bc53bb38e8929865789fc37074a4 100644 (file)
--- a/app/controllers/api/traces_controller.rb
+++ b/app/controllers/api/traces_controller.rb
@@ -5,7 +5,6 @@ module Api
     before_action :authorize_web
     before_action :set_locale
     before_action :authorize
     before_action :authorize_web
     before_action :set_locale
     before_action :authorize

-    before_action :api_deny_access_handler

 
     authorize_resource
 
 
     authorize_resource
 

diff --git a/app/controllers/api/users_controller.rb b/app/controllers/api/users_controller.rb
index 5c3a6cb8e7e12d01f775c43f8457dad490f2dd6a..f24d50cf101d2525c8054a642cf6b8e5d68df858 100644 (file)
--- a/app/controllers/api/users_controller.rb
+++ b/app/controllers/api/users_controller.rb
@@ -4,7 +4,6 @@ module Api
 
     before_action :disable_terms_redirect, :only => [:api_details]
     before_action :authorize, :only => [:api_details, :api_gpx_files]
 
     before_action :disable_terms_redirect, :only => [:api_details]
     before_action :authorize, :only => [:api_details, :api_gpx_files]

-    before_action :api_deny_access_handler

 
     authorize_resource
 
 
     authorize_resource
 

diff --git a/app/controllers/api/ways_controller.rb b/app/controllers/api/ways_controller.rb
index 2de2d619becf6408927f18ded462a45478bd8c28..5e3e5e11ab1d511dea0882b5c455fa59c520f25b 100644 (file)
--- a/app/controllers/api/ways_controller.rb
+++ b/app/controllers/api/ways_controller.rb
@@ -3,7 +3,6 @@ module Api
     require "xml/libxml"
 
     before_action :authorize, :only => [:create, :update, :delete]
     require "xml/libxml"
 
     before_action :authorize, :only => [:create, :update, :delete]

-    before_action :api_deny_access_handler

 
     authorize_resource
 
 
     authorize_resource
 

diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb
index fb3717b2a981d99718e4a48b284ac2ac49175e25..8ddb7242fe5ee3a78d5188dfec62b6204eb5a653 100644 (file)
--- a/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@ -1,3 +1,17 @@
 class ApiController < ApplicationController
   skip_before_action :verify_authenticity_token
 class ApiController < ApplicationController
   skip_before_action :verify_authenticity_token

+
+  def deny_access(_exception)
+    if current_token
+      set_locale
+      report_error t("oauth.permissions.missing"), :forbidden
+    elsif current_user
+      head :forbidden
+    else
+      realm = "Web Password"
+      errormessage = "Couldn't authenticate you"
+      response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
+      render :plain => errormessage, :status => :unauthorized
+    end
+  end

 end
 end

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 8d9ee11f94929360b0b3ca7728ed1eddfbfd8741..485c30b21a65de7016d0e9f08067ee916b46e1d4 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -395,15 +395,7 @@ class ApplicationController < ActionController::Base
     end
   end
 
     end
   end
 

-  def deny_access(exception)
-    if @api_deny_access_handling
-      api_deny_access(exception)
-    else
-      web_deny_access(exception)
-    end
-  end
-
-  def web_deny_access(_exception)
+  def deny_access(_exception)

     if current_token
       set_locale
       report_error t("oauth.permissions.missing"), :forbidden
     if current_token
       set_locale
       report_error t("oauth.permissions.missing"), :forbidden


@@ -423,26 +415,6 @@ class ApplicationController < ActionController::Base
     end
   end
 
     end
   end
 

-  def api_deny_access(_exception)
-    if current_token
-      set_locale
-      report_error t("oauth.permissions.missing"), :forbidden
-    elsif current_user
-      head :forbidden
-    else
-      realm = "Web Password"
-      errormessage = "Couldn't authenticate you"
-      response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
-      render :plain => errormessage, :status => :unauthorized
-    end
-  end
-
-  attr_accessor :api_access_handling
-
-  def api_deny_access_handler
-    @api_deny_access_handling = true
-  end
-

   private
 
   # extract authorisation credentials from headers, returns user = nil if none
   private
 
   # extract authorisation credentials from headers, returns user = nil if none