Module: Plutonium::Resource::Controllers::WizardActions

Extended by:
ActiveSupport::Concern
Includes:
Wizard::Driving
Included in:
Plutonium::Resource::Controller
Defined in:
lib/plutonium/resource/controllers/wizard_actions.rb

Overview

Resource-mounted wizard launch surface (§5.1 / Fix A). Anchored (and non-anchored) wizards registered via the wizard definition macro are auto-mounted as member/collection routes on the resource's OWN controller — the same way interactive record/resource actions are (see InteractiveActions). This is what makes the anchor IDOR-safe:

  • member actions (wizard_record_action / commit_wizard_record_action) resolve the anchor through the resource controller's scoped, policy-gated resource_record! — never an unscoped find_by(id:). A record outside the portal's authorized scope 404s, exactly like a record action.
  • collection actions (wizard_resource_action / commit_wizard_resource_action) have no anchor (create flows).

The runner-driving flow itself lives in Wizard::Driving (shared with the standalone Wizard::Controller); this concern only supplies the surface hooks (wizard class from the definition's registry, the anchor from resource_record!, the per-step URL) and the action authorization (the resource action policy predicate, mirroring interactive actions).

Constant Summary

Constants included from Wizard::Driving

Wizard::Driving::SESSION_TOKENS_KEY, Wizard::Driving::WIZARD_RETURN_TO_KEY

Instance Method Summary collapse

Methods included from Wizard::Driving

session_token_key

Methods included from StructuredInputs::ParamsConcern

#clean_structured_inputs

Instance Method Details

#cancel_wizard_record_action ⇒ Object

DELETE /resources/:id/wizards/:wizard_name/(:token)



71
72
73
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 71

def cancel_wizard_record_action
  wizard_cancel
end

#cancel_wizard_resource_action ⇒ Object

DELETE /resources/wizards/:wizard_name/(:token)



88
89
90
91
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 88

def cancel_wizard_resource_action
  skip_verify_current_authorized_scope!
  wizard_cancel
end

#commit_wizard_record_action ⇒ Object

POST /resources/:id/wizards/:wizard_name/(:token)/:step



66
67
68
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 66

def commit_wizard_record_action
  wizard_update
end

#commit_wizard_resource_action ⇒ Object

POST /resources/wizards/:wizard_name/(:token)/:step



82
83
84
85
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 82

def commit_wizard_resource_action
  skip_verify_current_authorized_scope!
  wizard_update
end

#launch_wizard_record_action ⇒ Object

GET /resources/:id/wizards/:wizard_name — resolve the run, redirect to step.



50
51
52
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 50

def launch_wizard_record_action
  wizard_launch
end

#launch_wizard_resource_action ⇒ Object

GET /resources/wizards/:wizard_name — resolve the run, redirect to step.



55
56
57
58
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 55

def launch_wizard_resource_action
  skip_verify_current_authorized_scope!
  wizard_launch
end

#wizard_record_action ⇒ Object

GET /resources/:id/wizards/:wizard_name/(:token)/:step



61
62
63
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 61

def wizard_record_action
  wizard_show
end

#wizard_resource_action ⇒ Object

GET /resources/wizards/:wizard_name/(:token)/:step



76
77
78
79
 
# File 'lib/plutonium/resource/controllers/wizard_actions.rb', line 76

def wizard_resource_action
  skip_verify_current_authorized_scope!
  wizard_show
end