gem install standardapi

gem 'standardapi', require: 'standard_api'

module MyApplication
  class Application < Rails::Application
    # Initialize configuration defaults for originally generated Rails version.
    config.load_defaults 7.0

    # QueryEncoding middleware intercepts and parses the query string
    # as MessagePack if the `Query-Encoding` header is set to `application/msgpack`
    # which allows GET request with types as opposed to all values being interpeted
    # as strings
    config.middleware.insert_after Rack::MethodOverride, StandardAPI::Middleware::QueryEncoding
  end
end

class PhotosController < ApplicationController
  include StandardAPI
  
  # Allowed paramaters
  # By default any paramaters passed to update and create are whitelisted by
  # the method named after the model the controller represents. For example,
  # the following will only allow the `caption` attribute of the `Photo`
  # model to be set on update or create.
  def photo_params
    [:caption]
  end
  
  # Allowed orderings
  # The ordering is whitelisted as well, you will mostly likely want to
  # ensure indexes have been created on these columns. In this example the
  # response can be ordered by any permutation of `id`, `created_at`, and
  # `updated_at`.
  def photo_orders
    [:id, :created_at, :updated_at]
  end
  
  # Allowed includes
  # Similarly, the includes (including of relationships in the reponse) are
  # whitelisted. Note how includes can also support nested includes. In this
  # case when including the author, the photos that the author took can also
  # be included.
  def photo_includes
    { author: [:photos] }
  end
end

class ApplicationController
    include StandardAPI::Control
    include StandardAPI::AccessControlList
end

module PhotoACL
  # Allowed attributes
  def attributes
    [ :caption ]
  end
  
  # Allowed saving / creating nested attributes
  def nested
    [ :camera ]
  end
  
  # Allowed orders
  def orders
    [ :id, :created_at, :updated_at ]
  end
  
  # Allowed includes
  def includes
    [ :author ]
  end
end

module AuthorACL
  def includes
    [ :photos ]
  end
end

GET     /records/:id        fetch record
PATCH   /records/:id        update record
GET     /records/           fetch records
GET     /records/calculate  apply count and other functions on record(s)
POST    /records            create record
DELETE  /records            destroy record

id: 5               WHERE properties.id = 5
id: [5, 10, 15]     WHERE properties.id IN (5, 10, 15)
id: {gt: 5}         WHERE properties.id > 5
id: {gte: 5}        WHERE properties.id >= 5
id: {lt: 5}         WHERE properties.id < 5
id: {lte: 5}        WHERE properties.id <= 5
address_id: nil     WHERE properties.address_id IS NULL
address_id: false   WHERE properties.address_id IS NULL..."
address_id: true    WHERE properties.address_id IS NOT NULL..."

// Array columns
tags: 'Skyscraper'                          WHERE properties.tags = {"Skyscraper"}
tags: ['Skyscraper', 'Brick']               WHERE properties.tags = '{"Skyscraper", "Brick"}'
tags: {overlaps: ['Skyscraper', 'Brick']}   WHERE properties.tags && '{"Skyscraper", "Brick"}'
tags: {contains: ['Skyscraper', 'Brick']}   WHERE accounts.tags @> '{"Skyscraper", "Brick"}'

// Geospatial
location: {within: 0106000020e6...}         WHERE ST_Within("listings"."location", ST_GeomFromEWKB(E'\\x0106000020e6...)

// On Relationships
property: {size: 10000}         JOIN properties WHERE properties.size = 10000"

{ count: '*' }                                          SELECT COUNT(*)
[{ count: '*' }]                                        SELECT COUNT(*)
[{ count: '*', maximum: :id, minimum: :id }]            SELECT COUNT(*), MAXIMUM(id), MINIMUM(id)
[{ maximum: :id }, { maximum: :count }]                 SELECT MAXIMUM(id), MAXIMUM(count)

class PhotosController < ApplicationController
    include StandardAPI

    # If you have actions you don't want include be sure to hide them,
    # otherwise if you include StandardAPI::TestCase and you don't have the
    # action setup, the test will fail.
    hide_action :destroy

    # Allowed params
    def photo_params
      [:id, :file, :caption]
    end

    # Allowed orderings
    def photo_orders
      [:id, :created_at, :updated_at, :caption]
    end

    # Allowed includes
    # You can include the author and the authors photos in the JSON response
    def photo_includes
      { :author => [:photos] }
    end

    # Mask for Photo. Provide this method if you want to mask some records
    # The mask is then applyed to all actions when querring ActiveRecord
    # Will only allow photos that have id one. For more on the syntax see
    # the activerecord-filter gem.
    def mask_for(table_name)
        { id: 1 }
    end

end