Module: Plutonium::Resource::Controllers::WizardActions

Extended by:
ActiveSupport::Concern
Includes:
Wizard::Driving
Included in:
Plutonium::Resource::Controller
Defined in:
lib/plutonium/resource/controllers/wizard_actions.rb

Overview

Resource-mounted wizard launch surface (§5.1 / Fix A). Anchored (and non-anchored) wizards registered via the wizard definition macro are auto-mounted as member/collection routes on the resource's OWN controller — the same way interactive record/resource actions are (see InteractiveActions). This is what makes the anchor IDOR-safe:

  • member actions (wizard_record_action / commit_wizard_record_action) resolve the anchor through the resource controller's scoped, policy-gated resource_record! — never an unscoped find_by(id:). A record outside the portal's authorized scope 404s, exactly like a record action.
  • collection actions (wizard_resource_action / commit_wizard_resource_action) have no anchor (create flows).

The runner-driving flow itself lives in Wizard::Driving (shared with the standalone Wizard::Controller); this concern only supplies the surface hooks (wizard class from the definition's registry, the anchor from resource_record!, the per-step URL) and the action authorization (the resource action policy predicate, mirroring interactive actions).

Constant Summary

Constants included from Wizard::Driving

Wizard::Driving::SESSION_TOKENS_KEY, Wizard::Driving::WIZARD_RETURN_TO_KEY

Instance Method Summary collapse

Methods included from Wizard::Driving

session_token_key

Methods included from StructuredInputs::ParamsConcern

#clean_structured_inputs

Instance Method Details

#commit_wizard_record_action ⇒ Object

POST /resources/:id/wizards/:wizard_name/(:token)/:step



63
64
65
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 63

def commit_wizard_record_action
  wizard_update
end

#commit_wizard_resource_action ⇒ Object

POST /resources/wizards/:wizard_name/(:token)/:step



74
75
76
77
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 74

def commit_wizard_resource_action
  skip_verify_current_authorized_scope!
  wizard_update
end

#launch_wizard_record_action ⇒ Object

GET /resources/:id/wizards/:wizard_name — resolve the run, redirect to step.



47
48
49
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 47

def launch_wizard_record_action
  wizard_launch
end

#launch_wizard_resource_action ⇒ Object

GET /resources/wizards/:wizard_name — resolve the run, redirect to step.



52
53
54
55
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 52

def launch_wizard_resource_action
  skip_verify_current_authorized_scope!
  wizard_launch
end

#wizard_record_action ⇒ Object

GET /resources/:id/wizards/:wizard_name/(:token)/:step



58
59
60
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 58

def wizard_record_action
  wizard_show
end

#wizard_resource_action ⇒ Object

GET /resources/wizards/:wizard_name/(:token)/:step



68
69
70
71
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 68

def wizard_resource_action
  skip_verify_current_authorized_scope!
  wizard_show
end