gitlab-org--gitlab-foss/lib/api/notes.rb

152 lines
5.6 KiB
Ruby
Raw Normal View History

module API
# Notes API
class Notes < Grape::API
before { authenticate! }
NOTEABLE_TYPES = [Issue, MergeRequest, Snippet]
resource :projects do
NOTEABLE_TYPES.each do |noteable_type|
noteables_str = noteable_type.to_s.underscore.pluralize
noteable_id_str = "#{noteable_type.to_s.underscore}_id"
# Get a list of project +noteable+ notes
#
# Parameters:
# id (required) - The ID of a project
# noteable_id (required) - The ID of an issue or snippet
# Example Request:
2012-11-29 14:21:14 -05:00
# GET /projects/:id/issues/:noteable_id/notes
# GET /projects/:id/snippets/:noteable_id/notes
get ":id/#{noteables_str}/:#{noteable_id_str}/notes" do
2016-05-10 15:06:02 -04:00
@noteable = user_project.send(noteables_str.to_sym).find(params[noteable_id_str.to_sym])
if can?(current_user, noteable_read_ability_name(@noteable), @noteable)
# We exclude notes that are cross-references and that cannot be viewed
# by the current user. By doing this exclusion at this level and not
# at the DB query level (which we cannot in that case), the current
# page can have less elements than :per_page even if
# there's more than one page.
notes =
# paginate() only works with a relation. This could lead to a
# mismatch between the pagination headers info and the actual notes
# array returned, but this is really a edge-case.
paginate(@noteable.notes).
reject { |n| n.cross_reference_not_visible_for?(current_user) }
present notes, with: Entities::Note
else
2016-05-10 15:06:02 -04:00
not_found!("Notes")
end
end
2012-11-29 14:33:41 -05:00
# Get a single +noteable+ note
#
# Parameters:
# id (required) - The ID of a project
2012-11-29 14:33:41 -05:00
# noteable_id (required) - The ID of an issue or snippet
# note_id (required) - The ID of a note
# Example Request:
# GET /projects/:id/issues/:noteable_id/notes/:note_id
# GET /projects/:id/snippets/:noteable_id/notes/:note_id
get ":id/#{noteables_str}/:#{noteable_id_str}/notes/:note_id" do
2016-05-10 15:06:02 -04:00
@noteable = user_project.send(noteables_str.to_sym).find(params[noteable_id_str.to_sym])
2012-11-29 14:33:41 -05:00
@note = @noteable.notes.find(params[:note_id])
can_read_note = can?(current_user, noteable_read_ability_name(@noteable), @noteable) && !@note.cross_reference_not_visible_for?(current_user)
2016-05-16 15:43:19 -04:00
if can_read_note
present @note, with: Entities::Note
2016-05-16 15:43:19 -04:00
else
not_found!("Note")
end
2012-11-29 14:33:41 -05:00
end
2012-11-29 15:06:24 -05:00
# Create a new +noteable+ note
#
# Parameters:
# id (required) - The ID of a project
2012-11-29 15:06:24 -05:00
# noteable_id (required) - The ID of an issue or snippet
# body (required) - The content of a note
2016-04-05 14:04:11 -04:00
# created_at (optional) - The date
2012-11-29 15:06:24 -05:00
# Example Request:
# POST /projects/:id/issues/:noteable_id/notes
# POST /projects/:id/snippets/:noteable_id/notes
post ":id/#{noteables_str}/:#{noteable_id_str}/notes" do
required_attributes! [:body]
opts = {
note: params[:body],
noteable_type: noteables_str.classify,
noteable_id: params[noteable_id_str]
}
2016-04-05 14:04:11 -04:00
if params[:created_at] && (current_user.is_admin? || user_project.owner == current_user)
opts[:created_at] = params[:created_at]
end
@note = ::Notes::CreateService.new(user_project, current_user, opts).execute
2012-11-29 15:06:24 -05:00
if @note.valid?
present @note, with: Entities::Note
else
2014-12-30 09:17:46 -05:00
not_found!("Note #{@note.errors.messages}")
2012-11-29 15:06:24 -05:00
end
end
# Modify existing +noteable+ note
#
# Parameters:
# id (required) - The ID of a project
# noteable_id (required) - The ID of an issue or snippet
# node_id (required) - The ID of a note
# body (required) - New content of a note
# Example Request:
# PUT /projects/:id/issues/:noteable_id/notes/:note_id
# PUT /projects/:id/snippets/:noteable_id/notes/:node_id
put ":id/#{noteables_str}/:#{noteable_id_str}/notes/:note_id" do
required_attributes! [:body]
note = user_project.notes.find(params[:note_id])
authorize! :admin_note, note
opts = {
note: params[:body]
}
@note = ::Notes::UpdateService.new(user_project, current_user, opts).execute(note)
if @note.valid?
present @note, with: Entities::Note
else
render_api_error!("Failed to save note #{note.errors.messages}", 400)
end
end
2016-04-06 13:04:17 -04:00
# Delete a +noteable+ note
2016-04-05 19:21:02 -04:00
#
# Parameters:
# id (required) - The ID of a project
# noteable_id (required) - The ID of an issue, MR, or snippet
# node_id (required) - The ID of a note
# Example Request:
# DELETE /projects/:id/issues/:noteable_id/notes/:note_id
# DELETE /projects/:id/snippets/:noteable_id/notes/:node_id
delete ":id/#{noteables_str}/:#{noteable_id_str}/notes/:note_id" do
note = user_project.notes.find(params[:note_id])
authorize! :admin_note, note
2016-04-12 09:43:29 -04:00
2016-04-05 19:21:02 -04:00
::Notes::DeleteService.new(user_project, current_user).execute(note)
2016-04-12 09:43:29 -04:00
2016-04-06 13:04:17 -04:00
present note, with: Entities::Note
2016-04-05 19:21:02 -04:00
end
end
end
helpers do
def noteable_read_ability_name(noteable)
"read_#{noteable.class.to_s.underscore}".to_sym
end
end
end
end