group_controller.rb

class GroupController < ApplicationController
  include ValidationHelper

  validate_action groupinfo: { method: :get, response: :group }
  validate_action groupinfo: { method: :put, request: :group, response: :status }
  validate_action groupinfo: { method: :delete, response: :status }

  # raise an exception if authorize has not yet been called.
  after_action :verify_authorized, except: [:index, :show]

  rescue_from Pundit::NotAuthorizedError do |exception|
    pundit_action = case exception.query.to_s
                    when "index?" then "list"
                    when "show?" then "view"
                    when "create?" then "create"
                    when "new?" then "create"
                    when "update?" then "update"
                    when "destroy?" then "delete"
                    else exception.query
    end

    render_error status: 403, errorcode: "No permission to #{pundit_action} group"
  end

  def index
    if params[:login]
      user = User.find_by_login!(params[:login])
      @list = user.groups
    else
      @list = Group.all
    end
    @list = @list.find_all { |group| group.title.starts_with? params[:prefix] } if params[:prefix]
  end

  # DELETE for removing it
  def delete
    group = Group.find_by_title!(params[:title])
    authorize group, :destroy?
    group.destroy
    render_ok
  end

  # GET for showing the group
  def show
    @group = Group.find_by_title!(params[:title])
  end

  # PUT for rewriting it completely including defined user list.
  def update
    group = Group.find_by_title(params[:title])
    if group.nil?
      authorize Group, :create?
      group = Group.create(title: params[:title])
    end
    authorize group, :update?

    xmlhash = Xmlhash.parse(request.raw_post)
    raise InvalidParameterError, "group name from path and xml mismatch" unless group.title == xmlhash.value('title')

    group.update_from_xml(xmlhash)
    group.save!

    render_ok
  end

  # POST for editing it, adding or remove users
  def command
    group = Group.find_by_title!(URI.unescape(params[:title]))
    authorize group, :update?

    user = User.find_by_login!(params[:userid]) if params[:userid]

    if params[:cmd] == "add_user"
      group.add_user user
    elsif params[:cmd] == "remove_user"
      group.remove_user user
    elsif params[:cmd] == "set_email"
      group.set_email params[:email]
    else
      raise UnknownCommandError, "cmd must be set to add_user or remove_user"
    end

    render_ok
  end
end