require 'yaml' ## Debugging: # If the response should be filtered and it is not being filtered **and** you # are geting all the values for that column, check to make sure that you are # selecting from the allowed tables and columns. ALLOWED_TABLES = { "JointInfo" => ["Joint", "Osteokinematics"], "Joint" => ["Common Name", "Joint"] } class DashboardController < ApplicationController before_action :load_manifest def index # Renders the main page respond_to do |format| format.html format.json { render json: @manifest } end end # GET /dashboard/options?table=Joint&filter_col=joint_id&value=1 def options # 1. Define what is allowed to be accessed table_name = params[:table] col_name = params[:pluck_column] # 2. Validate that the table and column exist in your allowlist if ALLOWED_TABLES.key?(table_name) && ALLOWED_TABLES[table_name].include?(col_name) table = table_name.constantize quoted_col = ActiveRecord::Base.connection.quote_column_name(col_name) if params[:filter_column].present? && ALLOWED_TABLES[table_name].include?(params[:filter_column]) puts "Filtering with 'filter_column'" options = table.select(Arel.sql(quoted_col)).where(params[:filter_column] => params[:value]).pluck(Arel.sql(quoted_col)) else puts "***NO FILTERING***" options = table.distinct.pluck(Arel.sql(quoted_col)) end render json: options else render json: { error: "Invalid table or column requested" }, status: :bad_request end end # GET /dashboard/data?joint=Acromioclavicular&sub_joint=X def data results = {} # Use the data_sources from YAML to aggregate data @manifest['data_sources'].each do |source| debugger table = source['table'].constantize # Find the filter value from the params that matches the filter_column # We assume the filter_column name in DB matches the filter ID in YAML filter_val = params[source['filter_column']] record = table.find_by(source['filter_column'] => filter_val) results[source['key']] = record ? record.attributes : {} end #debugger render json: results end private def load_manifest @manifest = YAML.load_file(Rails.root.join('config', 'dashboard_manifest.yml')) end end