# Copyright 2018 ACSONE SA/NV # License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl). import abc import functools import json from cerberus import Validator from odoo import _, http from odoo.exceptions import UserError, ValidationError from .tools import ROUTING_DECORATOR_ATTR, cerberus_to_json def method(routes, input_param=None, output_param=None, **kw): """Decorator marking the decorated method as being a handler for REST requests. The method must be part of a component inheriting from ``base.rest.service``. :param routes: list of tuple (path, http method). path is a string or array. Each tuple determines which http requests and http method will match the decorated method. The path part can be a single string or an array of strings. See werkzeug's routing documentation for the format of path expression ( http://werkzeug.pocoo.org/docs/routing/ ). :param: input_param: An instance of an object that implemented ``RestMethodParam``. When processing a request, the http handler first call the from_request method and then call the decorated method with the result of this call. :param: output_param: An instance of an object that implemented ``RestMethodParam``. When processing the result of the call to the decorated method, the http handler first call the `to_response` method with this result and then return the result of this call. :param auth: The type of authentication method. A special auth method named 'public_or_default' can be used. In such a case when the HTTP route will be generated, the auth method will be computed from the '_default_auth' property defined on the controller with 'public_or_' as prefix. The purpose of 'public_or_default' auth method is to provide a way to specify that a method should work for anonymous users but can be enhanced when an authenticated user is know. It implies that when the 'default' auth part of 'public_or_default' will be replaced by the default_auth specified on the controller in charge of registering the web services, an auth method with the same name is defined into odoo to provide such a behavior. In the following example, the auth method on my ping service will be `public_or_jwt` since this authentication method is provided by the auth_jwt addon. .. code-block:: python class PingService(Component): _inherit = "base.rest.service" _name = "ping_service" _usage = "ping" _collection = "test.api.services" @restapi.method( [(["/""], "GET")], auth="public_or_auth", ) def _ping(self, message): return {"message": message} class MyRestController(main.RestController): _root_path = '/test/' _collection_name = "test.api.services" _default_auth = "jwt' :param cors: The Access-Control-Allow-Origin cors directive value. When set, this automatically adds OPTIONS to allowed http methods so the Odoo request handler will accept it. :param bool csrf: Whether CSRF protection should be enabled for the route. Defaults to ``False`` :param bool save_session: Whether HTTP session should be saved into the session store: Default to ``True`` """ def decorator(f): _routes = [] for paths, http_methods in routes: if not isinstance(paths, list): paths = [paths] if not isinstance(http_methods, list): http_methods = [http_methods] if kw.get("cors") and "OPTIONS" not in http_methods: http_methods.append("OPTIONS") for m in http_methods: _routes.append(([p for p in paths], m)) routing = { "routes": _routes, "input_param": input_param, "output_param": output_param, } routing.update(kw) @functools.wraps(f) def response_wrap(*args, **kw): response = f(*args, **kw) return response setattr(response_wrap, ROUTING_DECORATOR_ATTR, routing) response_wrap.original_func = f return response_wrap return decorator class RestMethodParam(abc.ABC): @abc.abstractmethod def from_params(self, service, params): """ This method is called to process the parameters received at the controller. This method should validate and sanitize these paramaters. It could also be used to transform these parameters into the format expected by the called method :param service: :param request: `HttpRequest.params` :return: Value into the format expected by the method """ @abc.abstractmethod def to_response(self, service, result) -> http.Response: """ This method is called to prepare the result of the call to the method in a format suitable by the controller (http.Response or JSON dict). It's responsible for validating and sanitizing the result. :param service: :param obj: :return: http.Response or JSON dict """ @abc.abstractmethod def to_openapi_query_parameters(self, service, spec) -> dict: return {} @abc.abstractmethod def to_openapi_requestbody(self, service, spec) -> dict: return {} @abc.abstractmethod def to_openapi_responses(self, service, spec) -> dict: return {} @abc.abstractmethod def to_json_schema(self, service, spec, direction) -> dict: return {} class BinaryData(RestMethodParam): def __init__(self, mediatypes="*/*", required=False): if not isinstance(mediatypes, list): mediatypes = [mediatypes] self._mediatypes = mediatypes self._required = required def to_json_schema(self, service, spec, direction): return { "type": "string", "format": "binary", "required": self._required, } @property def _binary_content_schema(self): return { mediatype: {"schema": self.to_json_schema(None, None, None)} for mediatype in self._mediatypes } def to_openapi_requestbody(self, service, spec): return {"content": self._binary_content_schema} def to_openapi_query_parameters(self, service, spec): raise NotImplementedError( "BinaryData are not (?yet?) supported as query paramters" ) def to_openapi_responses(self, service, spec): return {"200": {"content": self._binary_content_schema}} def to_response(self, service, result): if not isinstance(result, http.Response): # The response has not been build by the called method... result = self._to_http_response(result) return result def from_params(self, service, params): return params def _to_http_response(self, result): mediatype = self._mediatypes[0] if len(self._mediatypes) == 1 else "*/*" headers = [ ("Content-Type", mediatype), ("X-Content-Type-Options", "nosniff"), ("Content-Disposition", http.content_disposition("file")), ("Content-Length", len(result)), ] return http.request.make_response(result, headers) class CerberusValidator(RestMethodParam): def __init__(self, schema): """ :param schema: can be dict as cerberus schema, an instance of cerberus.Validator or a sting with the method name to call on the service to get the schema or the validator """ self._schema = schema def from_params(self, service, params): validator = self.get_cerberus_validator(service, "input") if validator.validate(params): return validator.document raise UserError(_("BadRequest %s") % validator.errors) def to_response(self, service, result): validator = self.get_cerberus_validator(service, "output") if validator.validate(result): return validator.document raise SystemError(_("Invalid Response %s") % validator.errors) def to_openapi_query_parameters(self, service, spec): json_schema = self.to_json_schema(service, spec, "input") parameters = [] for prop, spec in list(json_schema["properties"].items()): params = { "name": prop, "in": "query", "required": prop in json_schema["required"], "allowEmptyValue": spec.get("nullable", False), "default": spec.get("default"), } if spec.get("schema"): params["schema"] = spec.get("schema") else: params["schema"] = {"type": spec["type"]} if spec.get("items"): params["schema"]["items"] = spec.get("items") if "enum" in spec: params["schema"]["enum"] = spec["enum"] parameters.append(params) if spec["type"] == "array": # To correctly handle array into the url query string, # the name must ends with [] params["name"] = params["name"] + "[]" return parameters def to_openapi_requestbody(self, service, spec): json_schema = self.to_json_schema(service, spec, "input") return {"content": {"application/json": {"schema": json_schema}}} def to_openapi_responses(self, service, spec): json_schema = self.to_json_schema(service, spec, "output") return {"200": {"content": {"application/json": {"schema": json_schema}}}} def get_cerberus_validator(self, service, direction): assert direction in ("input", "output") schema = self._schema if isinstance(self._schema, str): validator_component = service.component(usage="cerberus.validator") schema = validator_component.get_validator_handler( service, self._schema, direction )() if isinstance(schema, Validator): return schema if isinstance(schema, dict): return Validator(schema, purge_unknown=True) raise Exception(_("Unable to get cerberus schema from %s") % self._schema) def to_json_schema(self, service, spec, direction): schema = self.get_cerberus_validator(service, direction).schema return cerberus_to_json(schema) class CerberusListValidator(CerberusValidator): def __init__(self, schema, min_items=None, max_items=None, unique_items=None): """ :param schema: Cerberus list item schema can be dict as cerberus schema, an instance of cerberus.Validator or a sting with the method name to call on the service to get the schema or the validator :param min_items: A list instance is valid against "min_items" if its size is greater than, or equal to, min_items. The value MUST be a non-negative integer. :param max_items: A list instance is valid against "max_items" if its size is less than, or equal to, max_items. The value MUST be a non-negative integer. :param unique_items: Used to document that the list should only contain unique items. (Not enforced at validation time) """ super(CerberusListValidator, self).__init__(schema=schema) self._min_items = min_items self._max_items = max_items self._unique_items = unique_items def from_params(self, service, params): return self._do_validate(service, data=params, direction="input") def to_response(self, service, result): return self._do_validate(service, data=result, direction="output") def to_openapi_query_parameters(self, service, spec): raise NotImplementedError("List are not (?yet?) supported as query paramters") # pylint: disable=W8120,W8115 def _do_validate(self, service, data, direction): validator = self.get_cerberus_validator(service, direction) values = [] ExceptionClass = UserError if direction == "input" else SystemError for idx, p in enumerate(data): if not validator.validate(p): raise ExceptionClass( _( "BadRequest item %(idx)s :%(errors)s", idx=idx, errors=validator.errors, ) ) values.append(validator.document) if self._min_items is not None and len(values) < self._min_items: raise ExceptionClass( _( "BadRequest: Not enough items in the list (%(current)s < %(expected)s)", current=len(values), expected=self._min_items, ) ) if self._max_items is not None and len(values) > self._max_items: raise ExceptionClass( _( "BadRequest: Too many items in the list (%(current)s > %(expected)s)", current=len(values), expected=self._max_items, ) ) return values def to_json_schema(self, service, spec, direction): cerberus_schema = self.get_cerberus_validator(service, direction).schema json_schema = cerberus_to_json(cerberus_schema) json_schema = {"type": "array", "items": json_schema} if self._min_items is not None: json_schema["minItems"] = self._min_items if self._max_items is not None: json_schema["maxItems"] = self._max_items if self._unique_items is not None: json_schema["uniqueItems"] = self._unique_items return json_schema class MultipartFormData(RestMethodParam): def __init__(self, parts): """This allows to create multipart/form-data endpoints. :param parts: list of RestMethodParam """ if not isinstance(parts, dict): raise ValidationError(_("You must provide a dict of RestMethodParam")) self._parts = parts def to_openapi_properties(self, service, spec, direction): properties = {} for key, part in self._parts.items(): properties[key] = part.to_json_schema(service, spec, direction) return properties def to_openapi_encoding(self): encodings = {} for key, part in self._parts.items(): if isinstance(part, BinaryData): encodings[key] = {"contentType": ", ".join(part._mediatypes)} return encodings def to_json_schema(self, service, spec, direction): res = { "multipart/form-data": { "schema": { "type": "object", "properties": self.to_openapi_properties(service, spec, direction), } } } encoding = self.to_openapi_encoding() if len(encoding) > 0: res["multipart/form-data"]["schema"]["encoding"] = encoding return res def from_params(self, service, params): for key, part in self._parts.items(): param = None if isinstance(part, BinaryData): param = part.from_params(service, params[key]) else: # If the part is not Binary, it should be JSON try: json_param = json.loads( params[key] ) # multipart ony sends its parts as string except json.JSONDecodeError as error: raise ValidationError( _( "%(key)'s JSON content is malformed: %(error)s", key=key, error=error, ) ) from error param = part.from_params(service, json_param) params[key] = param return params def to_openapi_query_parameters(self, service, spec): raise NotImplementedError( "MultipartFormData are not (?yet?) supported as query paramters" ) def to_openapi_requestbody(self, service, spec): return {"content": self.to_json_schema(service, spec, "input")} def to_openapi_responses(self, service, spec): return {"200": {"content": self.to_json_schema(service, spec, "output")}} def to_response(self, service, result): raise NotImplementedError()