Add before_hook to bodied to allow to pre-authorize permissions

lib/api/utilities/endpoints/bodied.rb

@@ -58,6 +58,7 @@ module API
                        params_modifier: default_params_modifier,
                        params_source: default_params_source,
                        process_state: default_process_state,
+                       before_hook: nil,
                        parse_representer: nil,
                        render_representer: nil,
                        process_service: nil,
@@ -74,12 +75,14 @@ module API
           self.process_contract = process_contract || deduce_process_contract
           self.process_service = process_service || deduce_process_service
           self.parse_service = parse_service || deduce_parse_service
+          self.before_hook = before_hook
         end
 
         def mount
           update = self
 
           -> do
+            update.before_hook&.(request: self)
             params = update.parse(self)
             call = update.process(self, params)
 
@@ -134,7 +137,8 @@ module API
                       :process_contract,
                       :process_service,
                       :parse_service,
-                      :process_state
+                      :process_state,
+                      :before_hook
 
         private
 

lib/api/v3/attachments/attachments_by_container_api.rb

@@ -53,14 +53,14 @@ module API
           def restrict_permissions(permissions)
             authorize_any(permissions, projects: container.project) unless permissions.empty?
           end
+        end
 
-          def parse_multipart(request)
-            request.params.tap do |params|
-              params[:metadata] = JSON.parse(params[:metadata]) if params.key?(:metadata)
-            end
-          rescue JSON::ParserError
-            raise ::API::Errors::InvalidRequestBody.new(I18n.t('api_v3.errors.invalid_json'))
+        def self.parse_multipart(request)
+          request.params.tap do |params|
+            params[:metadata] = JSON.parse(params[:metadata]) if params.key?(:metadata)
           end
+        rescue JSON::ParserError
+          raise ::API::Errors::InvalidRequestBody.new(I18n.t('api_v3.errors.invalid_json'))
         end
 
         def self.read
@@ -73,36 +73,30 @@ module API
         end
 
         def self.create(permissions = [])
-          -> do
-            restrict_permissions permissions
-
-            instance_exec &::API::V3::Utilities::Endpoints::Create
-              .new(model: ::Attachment,
-                   parse_representer: AttachmentParsingRepresenter,
-                   params_source: method(:parse_multipart),
-                   params_modifier: ->(params) do
-                     params.merge(container: container)
-                   end)
-              .mount
-          end
+          ::API::V3::Utilities::Endpoints::Create
+            .new(model: ::Attachment,
+                 parse_representer: AttachmentParsingRepresenter,
+                 params_source: method(:parse_multipart),
+                 before_hook: ->(request:) { request.restrict_permissions(permissions) },
+                 params_modifier: ->(params) do
+                   params.merge(container: container)
+                 end)
+            .mount
         end
 
         def self.prepare(permissions = [])
-          -> do
-            restrict_permissions permissions
-
-            instance_exec &::API::V3::Utilities::Endpoints::Create
-               .new(model: ::Attachment,
-                    parse_representer: AttachmentParsingRepresenter,
-                    render_representer: AttachmentUploadRepresenter,
-                    process_service: ::Attachments::PrepareUploadService,
-                    process_contract: ::Attachments::PrepareUploadContract,
-                    params_source: method(:parse_multipart),
-                    params_modifier: ->(params) do
-                      params.merge(container: container)
-                    end)
-               .mount
-          end
+          ::API::V3::Utilities::Endpoints::Create
+            .new(model: ::Attachment,
+                 parse_representer: AttachmentParsingRepresenter,
+                 render_representer: AttachmentUploadRepresenter,
+                 process_service: ::Attachments::PrepareUploadService,
+                 process_contract: ::Attachments::PrepareUploadContract,
+                 params_source: method(:parse_multipart),
+                 before_hook: ->(request:) { request.restrict_permissions(permissions) },
+                 params_modifier: ->(params) do
+                   params.merge(container: container)
+                 end)
+            .mount
         end
       end
     end