
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
This gem aims to provide an easier way to implement REST api endpoints using OpenAPI specs in a Rails project.
Add this line to your application's Gemfile:
gem 'openapi_rest'
And then execute:
$ bundle install
Now, generate the initializer:
$ rails g openapi_rest:install
Place your OpenAPI spec yml file in config/
, see example generators/templates/api_docs.yml
. The file needs to be formatted in OpenAPI v2.0. You can then use OpenAPIRest::ApiModel
directly from a controller. Example:
class Product < ActiveRecord::Base
end
module Api
module V1
class MyController < ActionController::Base
def index
response = OpenAPIRest::ApiModel.new(:product).where(params)
render_rest response
end
def show
# The find method will expect a second parameter that ultimately will call find_by
response = OpenAPIRest::ApiModel.new(:product).find(params, id: params[:id])
if response.results?
render_rest response
end
end
def update
# The find method will expect a second parameter that ultimately will call find_by
response = OpenAPIRest::ApiModel.new(:product).find(params, id: params[:id])
if response.results?
response.update_resource
render_rest response
end
end
def create
# For cases when our model needs to be inserted through another model.
response = OpenAPIRest::ApiModel.new(:product).build(params, extra_param_ids: store.id)
response.create_resource
render_rest response
end
def destroy
response = OpenAPIRest::ApiModel.new(:product).find(params, id: params[:id])
if response.results?
# When using cancancan gem, we can get the AR model by calling results.
# authorize! :delete, response.results
response.delete_resource
render_rest response
end
end
end
end
end
render_rest
is a custom method that takes a QueryResponse
object to be rendered.
Last but not least, we need to tell to the Rails app which routes will be using the openapi parsing and if the routes have any namespace with the following syntax:
scope module: :api, defaults: { format: 'json' }, openapi: true, namespace: 'api' do
scope module: :v1 do
resources :myresources, only: [:index, :show]
end
end
Create a wrapper object that inherits from OpenAPIRest::ApiModel
if you need custom filter. From the ApiModel you will have access to the @model
class variable which is the original AR model.
Example:
module Api
class MyFilteredApiModel < OpenAPIRest::ApiModel
def filter(params)
@model = model.where('mymodelname.updated_at > ?', params[:date_param])
end
end
end
On the Controller side:
module Api
module V1
class MyController < ActionController::Base
def index
# The where and find methods can contain a block which will return the wrapper so you can specify custom filters
response = Api::MyFilteredApiModel.new(:product).where(params) do |wrapper|
wrapper.filter(params)
end
render_rest response
end
end
end
end
Bug reports and pull requests are welcome on GitHub at https://github.com/bizimply/OpenAPI-Rails-REST
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that openapi_rest demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.