From b399d79545e5e5430cb9d6a2c936efc244b69a75 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Sat, 27 Aug 2022 20:56:47 +0200 Subject: [PATCH] Add admin API for managing IP blocks (#19065) --- .../api/v1/admin/ip_blocks_controller.rb | 99 +++++++++++++++++++ app/models/ip_block.rb | 3 +- app/policies/ip_block_policy.rb | 4 + .../rest/admin/ip_block_serializer.rb | 14 +++ config/routes.rb | 1 + 5 files changed, 120 insertions(+), 1 deletion(-) create mode 100644 app/controllers/api/v1/admin/ip_blocks_controller.rb create mode 100644 app/serializers/rest/admin/ip_block_serializer.rb diff --git a/app/controllers/api/v1/admin/ip_blocks_controller.rb b/app/controllers/api/v1/admin/ip_blocks_controller.rb new file mode 100644 index 0000000000..f13d632671 --- /dev/null +++ b/app/controllers/api/v1/admin/ip_blocks_controller.rb @@ -0,0 +1,99 @@ +# frozen_string_literal: true + +class Api::V1::Admin::IpBlocksController < Api::BaseController + include Authorization + include AccountableConcern + + LIMIT = 100 + + before_action -> { authorize_if_got_token! :'admin:read', :'admin:read:ip_blocks' }, only: [:index, :show] + before_action -> { authorize_if_got_token! :'admin:write', :'admin:write:ip_blocks' }, except: [:index, :show] + before_action :set_ip_blocks, only: :index + before_action :set_ip_block, only: [:show, :update, :destroy] + + after_action :verify_authorized + after_action :insert_pagination_headers, only: :index + + PAGINATION_PARAMS = %i( + limit + ).freeze + + def create + authorize :ip_block, :create? + + @ip_block = IpBlock.create!(resource_params) + log_action :create, @ip_block + + render json: @ip_block, serializer: REST::Admin::IpBlockSerializer + end + + def index + authorize :ip_block, :index? + render json: @ip_blocks, each_serializer: REST::Admin::IpBlockSerializer + end + + def show + authorize @ip_block, :show? + render json: @ip_block, serializer: REST::Admin::IpBlockSerializer + end + + def update + authorize @ip_block, :update? + + @ip_block.update(resource_params) + log_action :update, @ip_block + + render json: @ip_block, serializer: REST::Admin::IpBlockSerializer + end + + def destroy + authorize @ip_block, :destroy? + + @ip_block.destroy! + log_action :destroy, @ip_block + + render json: @ip_block, serializer: REST::Admin::IpBlockSerializer + end + + private + + def set_ip_blocks + @ip_blocks = IpBlock.order(id: :desc).to_a_paginated_by_id(limit_param(LIMIT), params_slice(:max_id, :since_id, :min_id)) + end + + def set_ip_block + @ip_block = IpBlock.find(params[:id]) + end + + def resource_params + params.permit(:ip, :severity, :comment, :expires_in) + end + + def insert_pagination_headers + set_pagination_headers(next_path, prev_path) + end + + def next_path + api_v1_admin_ip_blocks_url(pagination_params(max_id: pagination_max_id)) if records_continue? + end + + def prev_path + api_v1_admin_ip_blocks_url(pagination_params(min_id: pagination_since_id)) unless @ip_blocks.empty? + end + + def pagination_max_id + @ip_blocks.last.id + end + + def pagination_since_id + @ip_blocks.first.id + end + + def records_continue? + @ip_blocks.size == limit_param(LIMIT) + end + + def pagination_params(core_params) + params.slice(*PAGINATION_PARAMS).permit(*PAGINATION_PARAMS).merge(core_params) + end +end diff --git a/app/models/ip_block.rb b/app/models/ip_block.rb index f40c8a0b1d..8666f4248e 100644 --- a/app/models/ip_block.rb +++ b/app/models/ip_block.rb @@ -16,6 +16,7 @@ class IpBlock < ApplicationRecord CACHE_KEY = 'blocked_ips' include Expireable + include Paginable enum severity: { sign_up_requires_approval: 5000, @@ -28,7 +29,7 @@ class IpBlock < ApplicationRecord after_commit :reset_cache def to_log_human_identifier - "#{record.ip}/#{record.ip.prefix}" + "#{ip}/#{ip.prefix}" end class << self diff --git a/app/policies/ip_block_policy.rb b/app/policies/ip_block_policy.rb index 1abc97ad8b..2986a4fdb3 100644 --- a/app/policies/ip_block_policy.rb +++ b/app/policies/ip_block_policy.rb @@ -9,6 +9,10 @@ class IpBlockPolicy < ApplicationPolicy role.can?(:manage_blocks) end + def update? + role.can?(:manage_blocks) + end + def destroy? role.can?(:manage_blocks) end diff --git a/app/serializers/rest/admin/ip_block_serializer.rb b/app/serializers/rest/admin/ip_block_serializer.rb new file mode 100644 index 0000000000..6a38f8b566 --- /dev/null +++ b/app/serializers/rest/admin/ip_block_serializer.rb @@ -0,0 +1,14 @@ +# frozen_string_literal: true + +class REST::Admin::IpBlockSerializer < ActiveModel::Serializer + attributes :id, :ip, :severity, :comment, + :created_at, :expires_at + + def id + object.id.to_s + end + + def ip + "#{object.ip}/#{object.ip.prefix}" + end +end diff --git a/config/routes.rb b/config/routes.rb index dff0add3ae..1168c9aee4 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -591,6 +591,7 @@ Rails.application.routes.draw do resources :domain_allows, only: [:index, :show, :create, :destroy] resources :domain_blocks, only: [:index, :show, :update, :create, :destroy] + resources :ip_blocks, only: [:index, :show, :update, :create, :destroy] namespace :trends do resources :tags, only: [:index]