#399

backend/app/controllers/post_imports_controller.rb

@@ -21,7 +21,7 @@ class PostImportsController < ApplicationController
     url_column = params[:url_column].presence || (parsed[:columns].length == 1 ? 0 : nil)
     return render_bad_request('URL 列を選択してください．') if url_column.nil?
 
-    rows = PostImportPreviewer.new(parsed:, url_column:, mappings: params[:mappings],
+    rows = PostImportPreviewer.new(parsed:, url_column:, mappings: mappings_params,
                                    existing: params[:existing]).preview
     render json: parsed.slice(:columns).merge(rows:)
   rescue ArgumentError => e
@@ -41,7 +41,7 @@ class PostImportsController < ApplicationController
   end
 
   def create
-    result = PostImportRunner.new(actor: current_user, rows: params[:rows].to_a,
+    result = PostImportRunner.new(actor: current_user, rows: create_rows_params,
                                   existing: params[:existing]).run
     render json: result, status: result[:created].positive? ? :created : :ok
   rescue ArgumentError => e
@@ -81,6 +81,37 @@ class PostImportsController < ApplicationController
     { columns: columns.map { |column| column.slice('key', 'label') }, rows: parsed_rows }
   end
 
+  def mappings_params
+    mappings = params[:mappings]
+    return { } if mappings.blank?
+    raise ArgumentError, '列割当ての形式が不正です．' unless mappings.is_a?(ActionController::Parameters)
+
+    raw = mappings.to_unsafe_h
+    unknown_fields = raw.keys - PostImportPreviewer::FIELDS
+    raise ArgumentError, '列割当て先が不正です．' if unknown_fields.present?
+
+    permitted = mappings.permit(*PostImportPreviewer::FIELDS.map { |field|
+      { field => [:kind, :value, { columns: [] }] }
+    }).to_h
+
+    raw.each_with_object({ }) do |(field, value), result|
+      raise ArgumentError, '列割当ての形式が不正です．' unless value.is_a?(Hash)
+      raise ArgumentError, '列割当ての項目が不正です．' unless (value.keys - ['kind', 'value', 'columns']).empty?
+
+      value = permitted.fetch(field)
+      kind = value['kind'].presence || 'columns'
+      raise ArgumentError, '列割当ての種別が不正です．' unless kind.in?(['columns', 'fixed'])
+      columns = value['columns']
+      unless columns.nil? || (columns.is_a?(Array) && columns.all? { |index| Integer(index, exception: false)&.>= 0 })
+        raise ArgumentError, '列番号が不正です．'
+      end
+      raise ArgumentError, '固定値が不正です．' if kind == 'fixed' && !value['value'].is_a?(String)
+
+      result[field] = { 'kind' => kind, 'value' => value['value'].to_s,
+                        'columns' => Array(columns).map { Integer(_1) } }
+    end
+  end
+
   def validate_rows_params
     rows = Array(params[:rows])
     raise ArgumentError, '取込件数が多すぎます．' if rows.length > PostImportSourceParser::MAX_ROWS
@@ -127,4 +158,19 @@ class PostImportsController < ApplicationController
 
     normalised_rows
   end
+
+  def create_rows_params
+    rows = params[:rows]
+    raise ArgumentError, '取込行の形式が不正です．' unless rows.is_a?(Array)
+
+    rows.map do |row|
+      unless row.is_a?(Hash) || row.is_a?(ActionController::Parameters)
+        raise ArgumentError, '取込行の形式が不正です．'
+      end
+
+      parameters = row.is_a?(ActionController::Parameters) ? row : ActionController::Parameters.new(row)
+      parameters.permit(:source_row, :sourceRow, :url, :metadata_url, :metadataUrl,
+                        attributes: {}, provenance: {}, tag_sources: {}, tagSources: {}).to_h
+    end
+  end
 end