Routing not mapping as expected

[cfcoder]

I created routes for /users using the following:

// Users 
mapper(mapFormat=false)
	.resources(name="users", except="index")
	.post(name="newUserRequest", pattern="users/NewRequest", to="users##NewRequest")
	.get(name="adminEditUsers", pattern="users/adminEdit/[key]", to="users##adminEdit")
	.get(name="adminUsersBase", pattern="users/adminUsersBase/", to="users##adminEdit")
	.patch(name="adminUpdateUsers", pattern="users/adminUpdate", to="users##adminUpdate")
.end()

I then look at the routing table and test "/users/adminEdit" with GET and it maps to /users/[key]. I didn't specify a key in the test. If I had it maps to /users/adminEdit/[key]. What is going on?
Routes:

[chapmandu]

That's what .resources(name="users", except="index") does. https://guides.cfwheels.org/cfwheels-guides/handling-requests-with-controllers/routing#resource-routing

If you want your users controllers under an admin directory/url path, I'd suggest looking at wrapping your user resources route/s in a namespace or scope function.
https://api.cfwheels.org/v2.5.0#mapper.namespace
https://api.cfwheels.org/v2.5.0#mapper.scope

If you are after 2 sets of user resource routes.. one for admin, and one for public users.. maybe look at something like:

mapper(mapFormat = false)
	// logged in users to update their own profiles (NOTE: resource - singular)
	.resource(name="users", only="show,edit,update")
	
	// all verbs for the admin namespace
	.namespace(name = "admin")
		.resources(name="users")	
	.end()

.end()

The guides are pretty good at showing you what's available.. though it can be pretty fiddly getting your routes configured exactly how you want.

https://guides.cfwheels.org/cfwheels-guides/handling-requests-with-controllers/routing

[bpamiri]

Bruce,

As Adam points out depending on what you want to achieve using a name space may help you out to better organize your routes, but in the example you posted it is good to remember that routes are resolved in the order they are defined. In your example you define your block of routes with the resources definition and then in the following lines you define additional routes that conflict with the default resources routes. The easiest way to resolve your issue would be to reorder your route definition:

// Users 
mapper(mapFormat=false)
	.post(name="newUserRequest", pattern="users/NewRequest", to="users##NewRequest")
	.get(name="adminEditUsers", pattern="users/adminEdit/[key]", to="users##adminEdit")
	.get(name="adminUsersBase", pattern="users/adminUsersBase/", to="users##adminEdit")
	.patch(name="adminUpdateUsers", pattern="users/adminUpdate", to="users##adminUpdate")
	.resources(name="users", except="index")
.end()

[cfcoder]

I think there is some details I'm not picking up from the docs yet that frustrates me. I've spent quite a bit of time trying to understand routing in CFW. For example, the logout I want to be a button that takes me to sessions.logout. My route for sessions is:

		.delete(name="logout", to="sessions##logout")
		.get(name="unauthorized", to="sessions##unauthorized")
		.resource(name="sessions", except="show,edit,delete")

I get

What do I specify for the buttonTo? Here's what I have:
#buttonTo(action="logout", method="delete", inputId="logout", inputClass="fas fa-sign-out-alt apply-tooltip", title="Sign Out", text="" )#

Yet that button doesn't work everywhere. If I'm on a webroot page it works. But if I go into admin page, it fails with the error:
"Wheels.InvalidAuthenticityToken
This POSTed request was attempted without a valid authenticity token."

The buttonTo tag is in the header that appears on every page.

[MvdO79]

Is that button placed in a form with an authentication field?

[MvdO79]

What happens when U use:

#buttonTo(route="logout", method="delete", inputId="logout", inputClass="fas fa-sign-out-alt apply-tooltip", title="Sign Out", text="" )#

[MvdO79]

The button is placed everywhere in the header so it needs to point to controller/action from anywhere by using "route".
Or explicit use "controller" and "action".
Right now there's only an "action" so the button tries to find a "logout" action in the controller belonging to the current page so it can't always find that.

[cfcoder]

@MvdO79 Given that route names are not unique when generated by using .resources(), then it requires addition of the method type, right? It appears that for a route to be usable anywhere, you either use route name with method, or controller with action. Please clarify.

[MvdO79]

You're right, so does the button work with route=routename, method=method?

[cfcoder]

It is in a form made by buttonTo but no authentication field. Here is the rendered code snippet:

<form action="/logout" method="post" title="" id="ui-id-2">
	<input id="_method" name="_method" type="hidden" value="delete">
	<button class="fas fa-sign-out-alt apply-tooltip" id="logout" type="submit" value="save"></button>
</form>

[cfcoder]

Notice that a DELETE becomes POST. That's what I don't understand about CFW routing. How do you use PATCH, PUT, DELETE when the browser seems to ignore them and change them to POST or GET. I type /logout in the Route table "TEST" and specify POST and it won't find a route. If I put /logout and DELETE in that test it finds the right route. Frustrated.

[cfcoder]

The overriding question I have is, when specifying a route in a redirectTo or linkto or buttonTo, etc. what should be specified? The route name (that doesn't work as I find multiple routes with the same name) or controller/action combo or url value path following the pattern?
I really wish there was more docs and examples to explain all this. I have read the CFW docs for Routing over and over but there's too few examples and explanation for best practices to make sure you get a unique route for a given redirect/link/button, etc specification in the code. Then the browser renders them differently even when I specify a method attribute.
I have also viewed the routing videos part 1 and 2 on Vimeo. That helps but again walks a narrow line. Need more examples and situations provided.

[cfcoder]

Just noticed that in the Admin.cfc controller the config() has this:

filters(through = "validateAccess");

That is likely the cause but not sure how that works (inherited code I'm working on). This explains why the root page for Admin is where the logout button fails (even if it's in the header code included on every page) but same code works in the wwwroot landing page. It doesn't have that same filters call.

[cfcoder]

Ok I've read the API for filters and it offers an "except" attribute to list actions to skip this authentication for. But it's an except for actions in this controller, meaning the Admin.cfc controller in my situation. But the logout action is in Sessions.cfc controller. Do I need a logout method in Admin.cfc that redirects to Sessions##logout? Then can I use except="logout":

function config(){
	filters(through="validateAccess", except="logout");
}

function logout(){
	redirectTo(controller="sessions", action="logout")
}

I tried it and it still fails. I would rather not have to put a logout action in all my controllers that may need to "except" it.

[bpamiri]

@cfcoder Bruce,

There are multiple questions and topics in this thread so let me try to answer as best I can. First the topic of the HTTP DELETE, PATCH, and PUT verbs. As you have pointed out, modern browsers only handle GET and POST. CFWheels allows you to define all the possible HTTP verbs including DELETE, PATCH, and PUT when defining routes but when you are submitting requests to these routes, the built in URL generation functions will take care of using hidden fields to specify the intent. That is why the generated code you posted above will take a DELETE route and generate a form using a POST method with a hidden field to specify that the intended method is a DELETE. <input id="_method" name="_method" type="hidden" value="delete">.

As for route names, controller, and action definitions in functions like linkTo(). Well, it's good to understand the history and backwards compatibility that needed to be maintained when this functionality was extended. At the core you need to define a controller and action. If only an action is defined, the controller is assumed to be the same controller as the current action. So if you are in an Admin controller and you define a linkTo() on a view page and only define an action, then Admin will be assumed for the controller, but if you define both the controller and action then those values will be used in the linkTo(). With the migration to v2.0 and introduction of resource based routing the resource name was introduced as a mechanism to forgo defining the controller and action and instead define the route you wish to use. But as you've pointed out, the route names are only unique when combined with the HTTP method.

What do I specify for the buttonTo? Here's what I have:
#buttonTo(action="logout", method="delete", inputId="logout", inputClass="fas fa-sign-out-alt apply-tooltip", title="Sign Out", text="" )#

As @MvdO79 suggested, I think what you should be defining here should be:

#buttonTo(route="logout", method="delete", inputId="logout", inputClass="fas fa-sign-out-alt apply-tooltip", title="Sign Out", text="" )#

[cfcoder]

Thanks @bpamiri.

[cfcoder]

Previous comments/questions I had here about CSRF error has been moved to it's own thread for new discussions.
#1371