Class: Clickwrap::ReceiptsController

Inherits:
ApplicationController show all
Defined in:
app/controllers/clickwrap/receipts_controller.rb

Overview

"Show me exactly what the application recorded."

Every screen here answers that question about one recorded event, and every screen here goes through the host's authorization callback to do it. There is no built-in "actors can always read their own" shortcut: the host decides who may read what, and the conventional initializer says so out loud.

config.authorize_receipt_access_with = lambda do |controller, receipt|
controller.current_user.present? &&
  (controller.current_user == receipt.actor || controller.current_user.admin?)
end

Until that is configured the default answers false, so an unconfigured host shows an empty list rather than leaking a receipt it never decided to share. A receipt the viewer may not see is NOT FOUND, never forbidden: a 403 tells an outsider that the id they guessed exists, and existence is itself information about someone.

Constant Summary collapse

PER_PAGE =

An honest page size rather than an unbounded query. A production actor can accumulate years of retained history even when optional annex data is disposed on a separate schedule.

50
AUTHORIZATION_SCAN_LIMIT =

How many of the viewer's own rows this screen will read looking for PER_PAGE it may show. The host's callback is Ruby, not SQL, so the database cannot apply it and something has to bound the search. A viewer whose first thousand events are all unreadable to them is a host authorization question, not a paging question.

1_000
BATCH_SIZE = 
100

Instance Method Summary collapse

Dynamic Method Handling

This class handles dynamic methods through the method_missing method in the class Clickwrap::ApplicationController

Instance Method Details

#index ⇒ Object 



38
39
40
 
# File 'app/controllers/clickwrap/receipts_controller.rb', line 38

def index
  @events = authorized_page
end

#show ⇒ Object 



42
43
44
45
46
47
48
49
50
51
52
 
# File 'app/controllers/clickwrap/receipts_controller.rb', line 42

def show
  @event = find_readable_event
  return head :not_found if @event.nil?

  @receipt = @event.receipt

  respond_to do |format|
    format.html
    format.json { render json: @receipt.to_canonical_json }
  end
end