REST changes: Allow PUT and POST requests to modify members, not

just entity.

TESTS ARE NOT UPDATED YET.

- Fix item_rest::get() to maintain the proper sort order, which
  requires duplicating some Item_Model code.

- Elide "weight" from the REST version of item

- Adjust the weight of members according to the order they're returned
  from the client.  You can't add or remove members here, you can only
  reorder them.

- Changed the wire protocol to handle more complex values.
  Now "entity" and "members" are JSON encoded.  The Gallery3
  helper does this correctly.

- Changed the wire protocol for tag_item -- now it stores the
  tag and item urls in the entity, not as members.  This is more
  consistent.

- Added missing security for renaming and deleting tags.

- Got rid of vestigial tag_rest::post().  We add/remove tags
  via the relationship.

2 files changed, 56 insertions, 119 deletions

diff --git a/modules/gallery/helpers/item_ordered_members_rest.php b/modules/gallery/helpers/item_ordered_members_rest.php
deleted file mode 100644
index 5ae331bc..00000000
--- a/modules/gallery/helpers/item_ordered_members_rest.php
+++ /dev/null
@@ -1,82 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2010 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class item_ordered_members_rest_Core {
-  static function get($request) {
-    $item = rest::resolve($request->url);
-    $ordered_members = array();
-    foreach ($item->children() as $child) {
-      $ordered_members[] = rest::url("item", $child);
-    }
-
-    return array(
-      "url" => $request->url,
-      "entity" => array("ordered_members" => $ordered_members));
-  }
-
-  static function put($request) {
-    $item = rest::resolve($request->url);
-    access::required("edit", $item);
-
-    // Verify that we're not adding or removing members this way
-    if (count($request->params->ordered_members) != $item->children_count()) {
-      throw new Rest_Exception("Bad Request", 400);
-    }
-
-    $ordered_members = array();
-    foreach ($request->params->ordered_members as $url) {
-      $member = rest::resolve($url);
-      if ($member->parent_id != $item->id) {
-        throw new Rest_Exception("Bad Request", 400);
-      }
-      $ordered_members[] = $member;
-    }
-
-    // Update all the weights.  This is a pretty inefficient way to do this if we're just changing
-    // one or two elements, but it's easy.  We could optimize this by looking at the current order
-    // and figuring out which elements have moved and then only changing those values.
-    $i = 0;
-    foreach ($ordered_members as $member) {
-      $member->weight = $i++;
-      $member->save();
-    }
-  }
-
-  static function relationships($resource_type, $resource) {
-    if ($resource_type == "item" && $resource->is_album()) {
-      return array(
-        "item_ordered_members" => array(
-          "url" => rest::url("item_ordered_members", $resource)));
-    }
-
-    return array();
-  }
-
-  static function resolve($id) {
-    $item = ORM::factory("item", $id);
-    if (!access::can("view", $item) || !$item->is_album()) {
-      throw new Kohana_404_Exception();
-    }
-    return $item;
-  }
-
-  static function url($item) {
-    return url::abs_site("rest/item_ordered_members/{$item->id}");
-  }
-}
diff --git a/modules/gallery/helpers/item_rest.php b/modules/gallery/helpers/item_rest.php
index 16abec5a..f52713b8 100644
--- a/modules/gallery/helpers/item_rest.php
+++ b/modules/gallery/helpers/item_rest.php
@@ -70,6 +70,14 @@ class item_rest_Core {
       $orm->where("type", "IN", explode(",", $p->type));
     }
 
+    // Apply the item's sort order, using id as the tie breaker.
+    // See Item_Model::children()
+    $order_by = array($item->sort_column => $item->sort_order);
+    if ($item->sort_column != "id") {
+      $order_by["id"] = "ASC";
+    }
+    $orm->order_by($order_by);
+
     $members = array();
     foreach ($orm->find_all() as $child) {
       $members[] = rest::url("item", $child);
@@ -86,33 +94,44 @@ class item_rest_Core {
     $item = rest::resolve($request->url);
     access::required("edit", $item);
 
-    $params = $request->params;
-
-    // Only change fields from a whitelist.
-    foreach (array("album_cover", "captured", "description",
-                   "height", "mime_type", "name", "parent", "rand_key", "resize_dirty",
-                   "resize_height", "resize_width", "slug", "sort_column", "sort_order",
-                   "thumb_dirty", "thumb_height", "thumb_width", "title", "view_count",
-                   "weight", "width") as $key) {
-      switch ($key) {
-      case "album_cover":
-        if (property_exists($request->params, "album_cover")) {
-          $album_cover_item = rest::resolve($request->params->album_cover);
-          access::required("view", $album_cover_item);
-          $item->album_cover_item_id = $album_cover_item->id;
+    if ($entity = $request->params->entity) {
+      // Only change fields from a whitelist.
+      foreach (array("album_cover", "captured", "description",
+                     "height", "mime_type", "name", "parent", "rand_key", "resize_dirty",
+                     "resize_height", "resize_width", "slug", "sort_column", "sort_order",
+                     "thumb_dirty", "thumb_height", "thumb_width", "title", "view_count",
+                     "width") as $key) {
+        switch ($key) {
+        case "album_cover":
+          if (property_exists($entity, "album_cover")) {
+            $album_cover_item = rest::resolve($entity->album_cover);
+            access::required("view", $album_cover_item);
+            $item->album_cover_item_id = $album_cover_item->id;
+          }
+          break;
+
+        case "parent":
+          if (property_exists($entity, "parent")) {
+            $parent = rest::resolve($entity->parent);
+            access::required("edit", $parent);
+            $item->parent_id = $parent->id;
+          }
+          break;
+        default:
+          if (property_exists($entity, $key)) {
+            $item->$key = $entity->$key;
+          }
         }
-        break;
+      }
+    }
 
-      case "parent":
-        if (property_exists($request->params, "parent")) {
-          $parent = rest::resolve($request->params->parent);
-          access::required("edit", $parent);
-          $item->parent_id = $parent->id;
-        }
-        break;
-      default:
-        if (property_exists($request->params, $key)) {
-          $item->$key = $request->params->$key;
+    $weight = 0;
+    if (isset($request->params->members)) {
+      foreach ($request->params->members as $url) {
+        $child = rest::resolve($url);
+        if ($child->parent_id == $item->id && $child->weight != $weight) {
+          $child->weight = $weight++;
+          $child->save();
         }
       }
     }
@@ -123,33 +142,33 @@ class item_rest_Core {
     $parent = rest::resolve($request->url);
     access::required("edit", $parent);
 
-    $params = $request->params;
+    $entity = $request->params->entity;
     $item = ORM::factory("item");
-    switch ($params->type) {
+    switch ($entity->type) {
     case "album":
       $item->type = "album";
       $item->parent_id = $parent->id;
-      $item->name = $params->name;
-      $item->title = isset($params->title) ? $params->title : $name;
-      $item->description = isset($params->description) ? $params->description : null;
-      $item->slug = isset($params->slug) ? $params->slug : null;
+      $item->name = $entity->name;
+      $item->title = isset($entity->title) ? $entity->title : $name;
+      $item->description = isset($entity->description) ? $entity->description : null;
+      $item->slug = isset($entity->slug) ? $entity->slug : null;
       $item->save();
       break;
 
     case "photo":
     case "movie":
-      $item->type = $params->type;
+      $item->type = $entity->type;
       $item->parent_id = $parent->id;
       $item->set_data_file($request->file);
-      $item->name = $params->name;
-      $item->title = isset($params->title) ? $params->title : $params->name;
-      $item->description = isset($params->description) ? $params->description : null;
-      $item->slug = isset($params->slug) ? $params->slug : null;
+      $item->name = $entity->name;
+      $item->title = isset($entity->title) ? $entity->title : $entity->name;
+      $item->description = isset($entity->description) ? $entity->description : null;
+      $item->slug = isset($entity->slug) ? $entity->slug : null;
       $item->save();
       break;
 
     default:
-      throw new Rest_Exception("Invalid type: $params->type", 400);
+      throw new Rest_Exception("Invalid type: $entity->type", 400);
     }
 
     return array("url" => rest::url("item", $item));