@@ -254,6 +254,8 @@ def _filter_owner(self,model,model_setting,q):
254
254
255
255
def post (self ):
256
256
tag = self .request_data .get ("@tag" )
257
+ if not tag :
258
+ return json ({"code" :400 ,"msg" :"'tag' parameter is needed" })
257
259
for key in self .request_data :
258
260
if key [0 ]!= "@" :
259
261
rsp = self ._post_one (key ,tag )
@@ -265,7 +267,6 @@ def post(self):
265
267
return json (self .rdict )
266
268
267
269
def _post_one (self ,key ,tag ):
268
- tag = tag or key
269
270
modelname = key
270
271
params = self .request_data [key ]
271
272
params_role = params .get ("@role" )
@@ -282,12 +283,12 @@ def _post_one(self,key,tag):
282
283
request_setting_model = request_setting_tag .get (modelname ,{})
283
284
request_setting_POST = request_setting_model .get ("POST" ,{})
284
285
ADD = request_setting_POST .get ("ADD" )
285
- permission_check_ok = False
286
286
if ADD :
287
287
ADD_role = ADD .get ("@role" )
288
288
if ADD_role and not params_role :
289
289
params_role = ADD_role
290
290
291
+ permission_check_ok = False
291
292
POST = model_setting .get ("POST" )
292
293
if POST :
293
294
roles = POST .get ("roles" )
@@ -349,6 +350,8 @@ def _post_one(self,key,tag):
349
350
350
351
def put (self ):
351
352
tag = self .request_data .get ("@tag" )
353
+ if not tag :
354
+ return json ({"code" :400 ,"msg" :"'tag' parameter is needed" })
352
355
for key in self .request_data :
353
356
if key [0 ]!= "@" :
354
357
rsp = self ._put_one (key ,tag )
@@ -361,7 +364,6 @@ def put(self):
361
364
return json (self .rdict )
362
365
363
366
def _put_one (self ,key ,tag ):
364
- tag = tag or key
365
367
modelname = key
366
368
params = self .request_data [key ]
367
369
params_role = params .get ("@role" )
@@ -377,7 +379,6 @@ def _put_one(self,key,tag):
377
379
378
380
request_setting_model = request_setting_tag .get (modelname ,{})
379
381
request_setting_PUT = request_setting_model .get ("PUT" ,{})
380
- permission_check_ok = False
381
382
382
383
ADD = request_setting_PUT .get ("ADD" )
383
384
if ADD :
@@ -393,7 +394,10 @@ def _put_one(self,key,tag):
393
394
except ValueError as e :
394
395
return json ({"code" :400 ,"msg" :"id '%s' cannot convert to integer" % (params .get ("id" ))})
395
396
obj = model .get (id_ )
397
+ if not obj :
398
+ return json ({"code" :400 ,"msg" :"cannot find record id '%s'" % (id_ )})
396
399
400
+ permission_check_ok = False
397
401
PUT = model_setting .get ("PUT" )
398
402
if PUT :
399
403
roles = PUT .get ("roles" )
@@ -419,8 +423,6 @@ def _put_one(self,key,tag):
419
423
if not permission_check_ok :
420
424
return json ({"code" :400 ,"msg" :"no permission" })
421
425
422
- if not obj :
423
- return json ({"code" :400 ,"msg" :"cannot find record id '%s'" % (id_ )})
424
426
kwargs = {}
425
427
for k in params :
426
428
if k == "id" :
@@ -445,4 +447,95 @@ def _put_one(self,key,tag):
445
447
self .rdict [key ]= obj_dict
446
448
447
449
def delete (self ):
450
+ tag = self .request_data .get ("@tag" )
451
+ if not tag :
452
+ return json ({"code" :400 ,"msg" :"'tag' parameter is needed" })
453
+ for key in self .request_data :
454
+ if key [0 ]!= "@" :
455
+ rsp = self ._delete_one (key ,tag )
456
+ if rsp :
457
+ return rsp
458
+ else :
459
+ #only accept one table
460
+ return json (self .rdict )
448
461
return json (self .rdict )
462
+
463
+ def _delete_one (self ,key ,tag ):
464
+ modelname = key
465
+ params = self .request_data [key ]
466
+ params_role = params .get ("@role" )
467
+
468
+ try :
469
+ model = getattr (models ,modelname )
470
+ model_setting = settings .APIJSON_MODELS .get (modelname ,{})
471
+ request_setting_tag = settings .APIJSON_REQUESTS .get (tag ,{})
472
+ user_id_field = model_setting .get ("user_id_field" )
473
+ except ModelNotFound as e :
474
+ log .error ("try to find model '%s' but not found: '%s'" % (modelname ,e ))
475
+ return json ({"code" :400 ,"msg" :"model '%s' not found" % (modelname )})
476
+
477
+ request_setting_model = request_setting_tag .get (modelname ,{})
478
+ request_setting_DELETE = request_setting_model .get ("DELETE" ,{})
479
+
480
+ ADD = request_setting_DELETE .get ("ADD" )
481
+ if ADD :
482
+ ADD_role = ADD .get ("@role" )
483
+ if ADD_role and not params_role :
484
+ params_role = ADD_role
485
+
486
+ try :
487
+ id_ = params .get ("id" )
488
+ if not id_ :
489
+ return json ({"code" :400 ,"msg" :"id param needed" })
490
+ id_ = int (id_ )
491
+ except ValueError as e :
492
+ return json ({"code" :400 ,"msg" :"id '%s' cannot convert to integer" % (params .get ("id" ))})
493
+ obj = model .get (id_ )
494
+ if not obj :
495
+ return json ({"code" :400 ,"msg" :"cannot find record id '%s'" % (id_ )})
496
+
497
+ permission_check_ok = False
498
+ DELETE = model_setting .get ("DELETE" )
499
+ if DELETE :
500
+ roles = DELETE .get ("roles" )
501
+ if params_role :
502
+ if not params_role in roles :
503
+ return json ({"code" :401 ,"msg" :"'%s' not accessible by role '%s'" % (modelname ,params_role )})
504
+ roles = [params_role ]
505
+ if roles :
506
+ for role in roles :
507
+ if role == "OWNER" :
508
+ if request .user :
509
+ if user_id_field :
510
+ if obj .to_dict ().get (user_id_field )== request .user .id :
511
+ permission_check_ok = True
512
+ break
513
+ else :
514
+ return json ({"code" :400 ,"msg" :"need login user" })
515
+ else :
516
+ if functions .has_role (request .user ,role ):
517
+ permission_check_ok = True
518
+ break
519
+
520
+ if not permission_check_ok :
521
+ return json ({"code" :400 ,"msg" :"no permission" })
522
+
523
+ try :
524
+ obj .delete ()
525
+ ret = True
526
+ except Exception as e :
527
+ log .error ("remove %s %s fail" % (modelname ,id_ ))
528
+ ret = False
529
+
530
+ obj_dict = {"id" :id_ }
531
+ if ret :
532
+ obj_dict ["code" ]= 200
533
+ obj_dict ["message" ]= "success"
534
+ obj_dict ["count" ]= 1
535
+ else :
536
+ obj_dict ["code" ]= 400
537
+ obj_dict ["message" ]= "fail"
538
+ obj_dict ["count" ]= 0
539
+ self .rdict ["code" ]= 400
540
+ self .rdict ["message" ]= "fail"
541
+ self .rdict [key ]= obj_dict