Some currently existing issues in staff-api src

[dukenguyenxyz]

It'd be quite annoying to open each issue for each of these dot points, so instead of doing so, I've created this issue which is comprised of all of the problems which I have found currently with staff-api.

For each dot point, only one reference example is included, please fix all other existing similar problems

Style

• Prefer unless over if !(expression), example

Ameba did not run here probably due to it not going into the deeper macro context

Refactor

• Store ENVS as constants in a single file, example: 1

Security

• User var() for query sanitisation like here instead of this

Optimisation

• User find_or_create instead of this

Mass Assignment

Prevent mass assignment of fields like id, and implement direct deserialisation, i.e. create_from_json

examples

For this example, I'm not sure why we are serialising credentials here though

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/bookings.cr#L114-L115

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/tenants.cr#L11-L18

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/guests.cr#L180-L188

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/guests.cr#L145-L169

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/bookings.cr#L53-L54

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/bookings.cr#L78

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/bookings.cr#L114-L138

Double serialisation

examples

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/guests.cr#L168

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/controllers/utilities/responders.cr#L5-L25

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/models/booking.cr#L151-L159

#as_json for selective serialisation

Implement #as_json or expand [Clear JSONDeserialise model to accept annotation as macro arg in

• Clear](Allow passing in annotation arg in macro column place-labs/clear#7)

examples

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/models/tenant.cr#L67-L74

• https://github.com/place-labs/staff-api/blob/c099e3befe407b8a2c6c8a3958d704706c19fa4b/src/models/booking.cr#L151-L159

• Implement #as_json for 1, 2

[caspiano]

TBH, definining to_json(json : JSON::Builder) would be the best way to go instead of to_h/as_json

It might be helpful to get some ideas from how active-model does it.
https://github.com/spider-gazelle/active-model/blob/master/src/active-model/model.cr#L62-L84

[tassja]

All points addressed except for as_json implementation which has been extracted into its own issue
#154