2adc040a8f
Previously, attachments relied only on blob_id, which made it possible to attach blobs across accounts by enumerating IDs. We now require both blob_id and blob_key, add cross-account validation to prevent blob reuse, and centralize the logic in a shared BlobOwnershipValidation concern. It also fixes a frontend bug where mixed-type action params (number + string) were incorrectly dropped, causing attachment uploads to fail.
69 lines
2.1 KiB
Ruby
69 lines
2.1 KiB
Ruby
class Api::V1::Accounts::AutomationRulesController < Api::V1::Accounts::BaseController
|
|
include AttachmentConcern
|
|
|
|
before_action :check_authorization
|
|
before_action :fetch_automation_rule, only: [:show, :update, :destroy, :clone]
|
|
|
|
def index
|
|
@automation_rules = Current.account.automation_rules
|
|
end
|
|
|
|
def show; end
|
|
|
|
def create
|
|
blobs, actions, error = validate_and_prepare_attachments(params[:actions])
|
|
return render_could_not_create_error(error) if error
|
|
|
|
@automation_rule = Current.account.automation_rules.new(automation_rules_permit)
|
|
@automation_rule.actions = actions
|
|
@automation_rule.conditions = params[:conditions]
|
|
|
|
return render_could_not_create_error(@automation_rule.errors.messages) unless @automation_rule.valid?
|
|
|
|
@automation_rule.save!
|
|
blobs.each { |blob| @automation_rule.files.attach(blob) }
|
|
end
|
|
|
|
def update
|
|
blobs, actions, error = validate_and_prepare_attachments(params[:actions], @automation_rule)
|
|
return render_could_not_create_error(error) if error
|
|
|
|
ActiveRecord::Base.transaction do
|
|
@automation_rule.assign_attributes(automation_rules_permit)
|
|
@automation_rule.actions = actions if params[:actions]
|
|
@automation_rule.conditions = params[:conditions] if params[:conditions]
|
|
@automation_rule.save!
|
|
blobs.each { |blob| @automation_rule.files.attach(blob) }
|
|
rescue StandardError => e
|
|
Rails.logger.error e
|
|
render_could_not_create_error(@automation_rule.errors.messages)
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
@automation_rule.destroy!
|
|
head :ok
|
|
end
|
|
|
|
def clone
|
|
automation_rule = Current.account.automation_rules.find_by(id: params[:automation_rule_id])
|
|
new_rule = automation_rule.dup
|
|
new_rule.save!
|
|
@automation_rule = new_rule
|
|
end
|
|
|
|
private
|
|
|
|
def automation_rules_permit
|
|
params.permit(
|
|
:name, :description, :event_name, :active,
|
|
conditions: [:attribute_key, :filter_operator, :query_operator, :custom_attribute_type, { values: [] }],
|
|
actions: [:action_name, { action_params: [] }]
|
|
)
|
|
end
|
|
|
|
def fetch_automation_rule
|
|
@automation_rule = Current.account.automation_rules.find_by(id: params[:id])
|
|
end
|
|
end
|