Class: Glib::ApiController

Inherits:
ActionController::API
  • Object
show all
Includes:
Glib::Auth::Policy, Glib::Auth::TokenAuthenticatable
Defined in:
app/controllers/glib/api_controller.rb

Overview

The ApplicationController analog for agent- or machine-facing JSON APIs.

Posture (do not re-derive it from a sibling app):

  • The Bearer token IS the credential; possession decides authentication. There is deliberately no cookie/session path in: ActionController::API has no CSRF protection, so a cookie-authenticated write endpoint here would be a CSRF target. Do not add one.
  • Authorization works exactly as on the browser side: policies decide, one per resource, derived by glib_authorize_resource from the controller name (override with class: when the derived name is wrong, as on any glib controller).
  • Every subclass defines glib_load_resource (glib has no default) and is covered by a policy, including index-only controllers (define it as a no-op there).
  • Opt OUT of authentication with skip_before_action :authenticate_api_token! for a public endpoint; never opt in ad hoc.

Callback order is declaration order and is load-bearing:

authenticate_api_token! -> glib_load_resource -> glib_authorize_resource

Token auth is declared before glib_auth_init so no request can reach record loading or authorization unauthenticated. Keep the includes in that order in subclasses too.

Unhandled exceptions keep Rails' default error body, which is HTML in development unless the app is api-only. Consumers wanting JSON there should set config.debug_exception_response_format = :api or add their own rescue_from (the browser side's json_libs_rescue_500 does this for the same reason).

Method Summary

Methods included from Glib::Auth::Policy

#assert_current_user_present, #can?, #cannot?, #glib_authorize_resource, #glib_raise_forbidden, #glib_skip_controller_action_if_permission_test, #resource_name_from_controller

Methods included from Glib::Auth::TokenAuthenticatable

#current_user, #user_signed_in?