Do not set up PUI routes for handling slug-based URLs if use_human_readable_urls is false

[andrew-morrison]

Description

Similar to #2436, this pull request prevents the PUI from attempting to handle requests for slug-based URLs when AppConfig[:use_human_readable_urls] is false (which is the default value.) At present, whenever it receives a request that matches any of the slug-based URLs defined in routes.rb, it sends a request to the backend, which does a lookup in the slug column of the relevant database table. The PUI won't generate any slug-based links, but this route in particular...

get ":obj_type/:slug_or_id" => 'objects#show'

...means any URL like https://test.archivesspace.org/foo/bar will trigger a lookup. Such a URL might be something a plug-in developer wants to write a controller to handle, but cannot because the above route will take precedence. Also, similar URLs may be probed by bad actors looking for known vulnerabilities in other platforms, such as https://test.archivesspace.org/admin/login.php. They won't find a vulnerability, but it does trigger an unnecessary database lookup every time.

Related JIRA Ticket or GitHub Issue

None

How Has This Been Tested?

It does not affect existing routes using :rid and :id parameters, and obviously won't make any difference to organizations that do have human-readable URLs enabled. There are a few routes that do double duty for both slug-based and ID-based URLs, such as...

get "repositories/:slug_or_id" => 'repositories#show'
get "subjects/:slug_or_id" => 'subjects#show'

...so I have added another test for AppConfig[:use_human_readable_urls] in application_controller.rb to prevent those triggering unnecessary database lookups either.

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have read the CONTRIBUTING document.
• I have authority to submit this code.
• I have added tests to cover my changes.
• All new and existing tests passed.

[donaldjosephsmith]

@andrew-morrison looks like there are some rubocop violations that need attention before we can merge this.

[andrew-morrison]

The rubocop violations have been fixed.

[brianzelip]

Hi @andrew-morrison. We've got a suspicion the Classification Terms routes don't work as expected. We need to set something up to test but haven't gotten to it yet. It's on our radar and we'll follow up in the near future.