DEV Community: Nuttee

Enhancing User Input Validation: Ensuring Proper Decimal Formatting with Regular Expressions

Nuttee — Thu, 30 Mar 2023 06:20:11 +0000

Because the user must pass a string of numbers, I must use regex to validate the input to ensure proper decimal format.

Example values and results.

Input result
"2" ✅
"2.3" ✅
"2.35" ✅
"2.357" ❌
1 ❌
1.0 ❌
1.325 ❌
"a" ❌
"1." ❌
"1.a" ❌
"" ❌

So the regex should be

~r/^\d+(\.\d{1,2})?$/

Here's the breakdown of the updated pattern:

^: Start of the string.
\d+: One or more digits (0-9).
(.\d{1,2})?: This part is optional, denoted by the ? at the end. If there is a decimal point ., it must be followed by 1 to 2 digits (\d{1,2}). Now, the input requires at least one digit after the decimal point.
$: End of the string.

This pattern will only match valid strings with one or more digits before the decimal point and, if a decimal point is present, at least one digit after it.

Handle CSRF issue when upgrade Rails from 5 to 6

Nuttee — Fri, 09 Apr 2021 07:43:32 +0000

I would like to share my knowledge on how to handle the issue regarding the authenticated token from csrf_meta_tags that are not compatible between Rails 5 and 6 versions, which causes an error something like this;

What is `csrf_meta_tags`?

It's a helper method to generate meta tags "csrf-param" and "csrf-token" with the name of the cross-site request forgery protection parameter and token. It's also a view helper that embeds the authenticity token into the HTML.

As you know, Rails 6 has a different algorithm for csrf token generation and its incompatibility, and to avoid showing errors to users, we decorated csrf generate function to catch the aforementioned errors and reset the session.

As mentioned previously, csrf token generation between Rails 5 and 6 is incompatibility so what should do is as given below;

Firstly, If you found that you got the error ArgumentError with invalid base64 due to an incompatible csrf token generated in your application, then you could implement the code by using the rescue concept.

Putting in application_controller.rb

rescue_from ArgumentError do |exception|
  if request.format.html? && exception.message == "invalid base64"
    request.reset_session # reset your old existing session.
    redirect_to login_path # your login page.
  else
    raise(exception)
  end
end

Next, How about if your application needs to handle the AJAX request, then.

rescue_from ArgumentError do |exception|
  if request.format.html? && exception.message == "invalid base64"
    request.reset_session
    redirect_to signin_path
  elsif request.xhr? && exception.message == "invalid base64"
    request.reset_session
    render js: "window.location = '#{login_path}'"
  else
    raise(exception)
  end
end

From the above snippet code, You can also check whether the request is xhr? because the AJAX request is not a request from HTML format. So it would be best if you handled this case as well.

You can then redirect a user back to the login page again if a token that's generated from the csrf_meta_tags incompatibility.

I hope this solution may solve the special issue of csrf_meta_tags that comes from upgrade Rails 5 to 6 and prevent showing the error page from the user perspective.

Check the connectivity of PG database

Nuttee — Thu, 28 Jan 2021 13:35:02 +0000

Basically, You want to know that the PG connection is still alive and ready for the queries used by your application.

You may have your application checked for the database connectivity via /ping for a health check.

Which Rails provide the built-in method for checking the status as follows;



> ActiveRecord::Base.connection.active?
> # true

If true means that the PG connection is still alive; otherwise, it was down.

Or maybe you will try something like this instead.



> ActiveRecord::Base.connection.execute('SELECT 1')
> # (0.5ms)  SELECT 1
> #<PG::Result:0x007f8e98bf3758 status=PGRES_TUPLES_OK ntuples=1 nfields=1 cmd_tuples=1>

The above sample works well, but I found that the query performance of SELECT 1 is worse than the empty string ''. It is raised on Here

The solution is referred to Use empty query instead of "SELECT 1" That improves database throughput to reduce the usage of CPUs in the database due to health checks.

Luckily, Rails supports queries with the empty string as follows;



> ActiveRecord::Base.connection.execute('')
> (0.4ms)
> #<PG::Result:0x007f8ea485e8e8 status=PGRES_EMPTY_QUERY ntuples=0 nfields=0 cmd_tuples=0>

10 things to guide you when you design an API

Nuttee — Fri, 22 Jan 2021 10:27:20 +0000

I want to share what I've learned to be nice to the developer when designing the new API with the best practices.

1. Naming resource

My question was, Should this be singular or plural? I guess it depends on a specific resource. Mostly, we use the noun plural form of the name of a resource.

For example

# To create a customer
POST /customers

GET /customers # To get all customers

# To update the specified customer (#id)
PUT /customers/:id

You will notice that the naming resource is plural.

However, if you need to deal with the relation between resources, let's assume the customer has many orders, so you want to know all the customer's orders.

GET /customers/:id/orders

# Allowing the customer to make a new order.
POST /customers/:id/orders

Unless the resource is singular, then it would be something like

# To get a user profile
GET /profile
GET /me

Here's my suggestion below

Try not to use an abbreviation term like POST /cust (customers). It's hard to forecast. Bear in mind that you should build API to be predictable.

Try not to use a verb in URI like POST /create-customers because CRUD (Create) helps us create a new record, so it's pretty redundant.

2. Using version

Your API can allow versioning even though you think your API framework is tiny. Often, you don't have a choice because you need to change your response structure and rename the attribute, but versioning lets you escape this situation.

There are a variety of ways to apply to the version.

2.1) Place it in the URI prefix.

Ex:

/v2/customers

But

try not to use URI postfix to say the version like /customers/api_version2

2.2) Place it in the Accept Header with a custom.

Ex:

application/vnd.myapp+json;version=2

2.3) Place it in Query.

Ex:

/customers?api_version=2

If you add a new attribute, you don't need to build a new version of the API because you don't interrupt the business transition.

For example

GET /v1/customers/cust_12345

{
    "id": "cust_12345",
    "name": "jone doe"
    "email" "jone@mail" # Add a new `email` attribute. You can add it directly.
}

On the order hand, If you wish to rename the attribute from name to fullname you need to re-thinking what happenห if the person who uses your API is attempting to use the name attribute's gone.

Then you may decide to build a new version of /v2, or you add more attributes like fullname into /v1

3. Separation Concern

It's a distinction between concerns that looks like in the Object-Oriented.

Let's assume you have the resource name User, which has several columns, such as email, password, address, mobile_number

You want the API to be able to change your password.

If it looks simple and generic to modify a user like the below one.

PATCH /v1/users/:id

{
    email: "john@mail",
    password: "abcdefg",
    confirmation_passowrd: "abcdefg"
}

After looking at the name of this endpoint, I should not recognize it immediately. And in my view, the number of comprehensive users would change.

This may not be convenient for the person who uses this API so that the API can be divided into two APIs;

One for modifying the generic user details.

POST /v1/users/:id

{
    address: "new address",
    mobile_number: "new mobile number"
}

One for just changing a password.

POST /v1/users/:id/password

{
    password: "abcdefg",
    confirmation_passowrd: "abcdefg"
}

4. Time format

It should return times in UTC formatted to ISO8601.

ISO8601 format: YYYY-MM-DDTHH:MM:SSZ

For example

{
    "created_at": "2021-01-21T15:23:38Z"
}

Typically, I describe the name of the field base for the category between Date and DateTime that look like below;

_on suffixes for Date
_at suffixes for DateTime

5. camelCase or snake_case

It depends on your preference, but I feel that snake_case is easier to read than camelCase for attribute names.

6. Errors

It's similar when you have an error on the website that displays an error with a thorough explanation.

As far as the API is concerned, it should also include a meaningful human-readable error message and support a unique error class for each type of error to the client.

For example

The status code for HTTP should be 404

{
    type: "account_not_found",
    message: "The account is not existing"
}

7. Using HTTP verbs and status codes correctly

HTTP offers a wonderful mechanism to inform the API to consumers whether the request is successful or not.

You may also refer to a lof of HTTP status code to apply to the API.

HTTP verbs

GET to retrieve a resource.
POST to create a resource (Sometime, you might use it without creating any record)
PATCH to modify the partial resource
PUT to replace a resource or collect of a resource.
DELETE to delete a resource.

HTTP status codes

2xx Success Everything's going smoothly.
200 OK It's a successful response that everything goes well.
201 Created Most of the time, it's used to POST that results in a creation.
204 No content It is also used for DELETE, which resource has been removed and the returned body is null.
400 Bad Request The request is invalid/unacceptable, or an appropriate parameter is lacking.
401 Unauthorized Mostly, It's used for invalid authentication.
404 NotFound
429 Too many requests
5xx Something went wrong with us.

8. Pagination

You might fail to worry about how large the data is since it returns a lot of records at once, so you should have a way to limit the number of records per request.

GET /v1/customers?page=2&per_page=30

9. Rate limiting

You might be surprised if someone attempts to spam your API unreasonably. So you may start implementing a rate-limit early.

You may use Redis with EXPIRE feature to limit the specified person's request.

10. Good Documentation

You should have good API documentation that should be reliable and simple for the developer to understand. I think all developers (including me) enjoy good examples; not only do they have code samples like curl -- but they can cover all test cases like Postman Examples or Swagger Examples.

See Postman Examples and Swagger Examples for more details.

How to know the analyzer of Elasticsearch tokenize

Nuttee — Sat, 16 Jan 2021 10:49:16 +0000

Sometimes, you may be curious about what a given analyzer is tokening your queries to your code that you're working on it.

For example. Let's say your index's mapping look like as given below;

{
  "mappings": {
    "user": {
      "properties": {
        "fullname": {
          "type": "text"
        },
        "email": {
          "type": "text",
          "analyzer": "keyword_ngram_analyzer",
        }
      }
    }
  }
}

Let's check one by one.

First, properties uses the default analyzer because there is no specified analyzer. See Elasticsearch documentation for more details)

So we're trying to debug by using analyze with the query is Scott Leblanc then.

POST /_analyze
{
  "analyzer": "standard",
  "text": "Scott Leblanc"
}

Output will be

{
  "tokens" : [
    {
      "token" : "scott",
      "start_offset" : 0,
      "end_offset" : 5,
      "type" : "<ALPHANUM>",
      "position" : 0
    },
    {
      "token" : "leblanc",
      "start_offset" : 6,
      "end_offset" : 13,
      "type" : "<ALPHANUM>",
      "position" : 1
    }
  ]
}

Second, What about keyword_ngram_analyzer that defined to email?

POST /_analyze
{
  "analyzer": "keyword_ngram_analyzer",
  "text": "joh@m.co"
}

Output will be

{
  "tokens" : [
    {
      "token" : "joh",
    },
    {
      "token" : "joh@",
    },
    {
      "token" : "joh@m",
    },
    {
      "token" : "joh@m.",
    },
    {
      "token" : "joh@m.c",
    },
    {
      "token" : "joh@m.co",
    },
    {
      "token" : "oh@",
    },
    {
      "token" : "oh@m",
    },
    {
      "token" : "oh@m.",
    },
    {
      "token" : "oh@m.c",
    },
    {
      "token" : "oh@m.co",
    },
    {
      "token" : "h@m",
    },
    {
      "token" : "h@m.",
    },
    {
      "token" : "h@m.c",
    },
    {
      "token" : "h@m.co",
    },
    {
      "token" : "@m.",
    },
    {
      "token" : "@m.c",
    },
    {
      "token" : "@m.co",
    },
    {
      "token" : "m.c",
    },
    {
      "token" : "m.co",
    },
    {
      "token" : ".co",
    }
  ]
}

Above the sample, you can query/filter by entering these tokens such as joh@ or @m.co or referring to resulting tokens.

Conclusion

If you want to know, each analyzer of Elasticsearch tokenizes your queries. You can use Analyze API to analyze it.

See more Analyze API for more details.

Integrate CircleCI on Bitbucket with Ruby on Rails project

Nuttee — Wed, 13 Jan 2021 14:22:19 +0000

First of all, I want to share my experience integrating CircleCI to the Bitbucket Cloud repository with a Rails project using Postgres as a Database to run automatically test the project.

You need to create and commit a .bitbucket-pipelines.yml in your project’s root directory.

Once you push a commit to Bitbucket, CircleCI will automatically build and test the project.

Below example is a sample build without Postgres;

image: ruby:2.6.6

pipelines:
  default:
    - parallel:
      - step:
          name: Test
          script:
            - bundle install
            - RAILS_ENV=test bundle exec rake db:setup
            - RAILS_ENV=test bundle exec rake db:test:prepare
            - RAILS_ENV=test bundle exec rake test

From the example built above, I'm using Ruby version 2.6.6 you can adjust what version you're using instead. It's enough to let CircleCI run the test automatically.

What if you use Postgres as a Database?

image: ruby:2.6.6

pipelines:
  default:
    - parallel:
      - step:
          name: Test
          script:
            - apt-get update
            - apt-get install -y build-essential libpq-dev nodejs
            - export DATABASE_URL=postgresql://test_user:test_user_password@localhost/pipelines
            - bundle install
            - RAILS_ENV=test bundle exec rake db:setup
            - RAILS_ENV=test bundle exec rake db:test:prepare
            - RAILS_ENV=test bundle exec rake test
          services:
            - postgres

definitions:
  services:
    postgres:
      image: postgres
      environment:
        POSTGRES_DB: pipelines
        POSTGRES_USER: test_user
        POSTGRES_PASSWORD: test_user_password

Above 2 samples, bundle install is still running without being cached every time it takes a bit of time to set it up.

By having a cache, we would save the building time.

Define bundler into caches step.

- step:
    caches:
      - bundler

Change bundle install command with a specific path.

script:
  - bundle install --path vendor/bundle

Make a new definition looks like

definitions:
  caches:
    bundler: vendor/bundle

Example full file pipeline.

By the way, some of the other dependencies that might happen based on your project.

image: ruby:2.6.6

pipelines:
  default:
    - parallel:
      - step:
          caches:
            - bundler
          name: Test
          script:
            - apt-get update
            - apt-get install -y build-essential libpq-dev nodejs
            - export DATABASE_URL=postgresql://test_user:test_user_password@localhost/pipelines
            - bundle install --path vendor/bundle
            - RAILS_ENV=test bundle exec rake db:setup
            - RAILS_ENV=test bundle exec rake db:test:prepare
            - RAILS_ENV=test bundle exec rake test
          services:
            - postgres

definitions:
  caches:
    bundler: vendor/bundle
  services:
    postgres:
      image: postgres
      environment:
        POSTGRES_DB: pipelines
        POSTGRES_USER: test_user
        POSTGRES_PASSWORD: test_user_password

How to access a Hash either string or symbol keys

Nuttee — Wed, 06 Jan 2021 13:18:01 +0000

Sometimes, You may have stumbled across these cases why you got nil value from accessing a hash.

For example

First case,

fruit = { name: "Grape", color: "purple" }

Then

fruit[:name]
=> "Grape"

fruit["name"]
=> nil

Second case,

fruit = { "name" => "Grape", "color" => "purple" }

Then

fruit[:name]
=> nil

fruit["name"]
=> "Grape"

These two examples show that you need to know the hash key's structure, whether it's a string or a symbol key, to access it correctly.

Or you can convert it by using symbolize_keys() (returns a new hash with all keys converted to be symbols) and you can access it by using the symbol key.

Would it be better if we can access a hash either string or symbol keys?

Using with_indifferent_access()

For example

fruit = { name: "Grape", color: "purple" }.with_indifferent_access

fruit[:name]
=> "Grape"

fruit["name"]
=> "Grape"

It's pretty convenient because it ensures you get the value of the hash.

Reference: https://api.rubyonrails.org/classes/ActiveSupport/HashWithIndifferentAccess.html

How to install bundler for Ruby < 2.3

Nuttee — Mon, 04 Jan 2021 08:16:49 +0000

You may get the following error when you attempt to install Bundler 2 with Ruby version < 2.3

ERROR:  Error installing bundler:
    bundler requires Ruby version >= 2.3.0.

In order to address this, we must update the ruby version of your project or set up the last supported Bundler version for Ruby < 2.3

gem install bundler -v '~>1'

DEV Community: Nuttee

Enhancing User Input Validation: Ensuring Proper Decimal Formatting with Regular Expressions

Handle CSRF issue when upgrade Rails from 5 to 6

What is csrf_meta_tags?

Check the connectivity of PG database

10 things to guide you when you design an API

1. Naming resource

2. Using version

3. Separation Concern

4. Time format

5. camelCase or snake_case

6. Errors

7. Using HTTP verbs and status codes correctly

HTTP verbs

HTTP status codes

8. Pagination

9. Rate limiting

10. Good Documentation

How to know the analyzer of Elasticsearch tokenize

Integrate CircleCI on Bitbucket with Ruby on Rails project

How to access a Hash either string or symbol keys

Would it be better if we can access a hash either string or symbol keys?

How to install bundler for Ruby < 2.3

What is `csrf_meta_tags`?