app/controllers/v1/omniauth_callbacks_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+require 'open-uri'
+  class V1::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCallbacksController
+
+    protected
+
+    # break out provider attribute assignment for easy method extension
+    def assign_provider_attrs(user, auth_hash)
+      avatar = URI.parse(auth_hash['info']['image']).open
+
+      user.assign_attributes({
+        nickname: auth_hash['info']['nickname'],
+        name:     auth_hash['info']['name'],
+        avatar:   avatar,
+        email:    auth_hash['info']['email']
+      })
+    end
+
+  end

app/controllers/v1/packages_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
 class V1::PackagesController < ApplicationController
   before_action :set_objects
 
   def link
-    response = PackageService.link(@objects)
-
-    if response.nil?
-      render nothing: true, status: :not_found
+    if @objects.blank?
+      render status: :not_found
     else
-      render json: { url: response }, status: :found
+      response = PackageService.link(@objects)
+
+      if response.nil?
+        render status: :not_found
+      else
+        render json: { url: response }, status: :found
+      end
     end
   end
 
@@ -15,10 +38,11 @@ class V1::PackagesController < ApplicationController
 
   def set_objects
     allowed = PackageService.allowed_classes
-
     @objects = objects_params[:object].map do |o|
       next unless allowed.include? o['type']
-      o['type'].constantize.find(o['id'])
+      obj = o['type'].constantize.where(id: o['id']).first
+      break if obj.blank?
+      obj
     end
   end
 

app/controllers/v1/questions_controller.rb

+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class V1::QuestionsController < ApplicationController
+  include ::Paginator
+
+  before_action :authenticate_user!, except: [:destroy, :index]
+  before_action :set_question, only: [:show, :update, :destroy]
+  before_action :authorize!, only: [ :update, :destroy ]
+
+  # GET /questions
+  def index
+    @questions = paginate Question.all
+
+    render json: @questions
+  end
+
+  # GET /questions/1
+  def show
+    render json: @question
+  end
+
+  # POST /questions
+  def create    
+    @question = Question.new(question_params)
+
+    authorize @question
+
+    if @question.save
+      render json: @question, status: :created
+    else
+      render json: @question.errors, status: :unprocessable_entity
+    end
+  end
+
+  # PATCH/PUT /questions/1
+  def update
+    if @question.update(question_params)
+      render json: @question
+    else
+      render json: @question.errors, status: :unprocessable_entity
+    end
+  end
+
+  # DELETE /questions/1
+  def destroy
+    @question.destroy
+  end
+
+  private
+    # Use callbacks to share common setup or constraints between actions.
+    def set_question
+      @question = Question.where(id: params[:id]).first
+
+      render status: :not_found if @question.blank?
+
+      @question
+    end
+
+    # Only allow a trusted parameter "white list" through.
+    def question_params
+      params.require(:question).permit(:description, :status)
+    end
+
+    def authorize! 
+      authorize @question
+    end
+end

app/controllers/v1/ratings_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
 class V1::RatingsController < ApplicationController
   include ::DeletedObjectsController
+  include ::Paginator
 
   before_action :set_rating, only: [:show, :update, :destroy]
   before_action :authenticate_user!, only: [:create, :update, :destroy]
+  before_action :authorize!, only: [:update, :destroy]
 
   # GET v1/ratings
   # GET v1/ratings.json
   def index
-    render json: Rating.all
+    ratings = paginate Rating
+    render json: ratings
   end
 
   # GET v1/ratings/1
@@ -20,6 +42,7 @@ class V1::RatingsController < ApplicationController
   # POST v1/ratings.json
   def create
     rating = Rating.new(rating_params)
+    authorize rating
 
     if rating.save
       render json: rating, status: :created
@@ -42,7 +65,8 @@ class V1::RatingsController < ApplicationController
   # DELETE v1/ratings/1.json
   def destroy
     @rating.destroy
-    render nothing: true, status: :ok
+    response = { 'status': 'deleted' }
+    render nothing: true, status: :ok, json: response
   end
 
   private
@@ -52,11 +76,18 @@ class V1::RatingsController < ApplicationController
   end
 
   def set_rating
-    @rating = Rating.find(params[:id])
+    @rating = Rating.where(id: params[:id]).first
+
+    render status: :not_found if @rating.blank?
+
+    @rating
   end
 
   def rating_params
     params.require(:rating).permit(:name, :description)
   end
 
+  def authorize!
+    authorize @rating
+  end
 end

app/controllers/v1/reviews_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
 class V1::ReviewsController < ApplicationController
   include ::DeletedObjectsController
   include ::ResourceModel
+  include ::Paginator
 
-  before_action :set_review, only: [:show, :destroy, :rate]
-  before_action :authenticate_user!, only: [:create, :rate, :destroy]
+  before_action :set_review, only: [:show, :destroy, :rate, :update]
+  before_action :authenticate_user!, only: [:create, :rate, :destroy, :update]
 
   # GET /v1/collections/1/reviews
   def index
-    render json: reviewable.reviews, each_serializer: ReviewSerializer
+    render json: paginate(reviewable.reviews), each_serializer: ReviewSerializer
   end
 
   # GET /v1/collections/1/reviews/1
@@ -29,6 +49,26 @@ class V1::ReviewsController < ApplicationController
     end
   end
 
+  # PUT /v1/learning_objects/1/reviews/1
+  # PUT /v1/learning_objects/1/reviews/1.json
+  def update
+      ratings_params = review_params
+      rp = ratings_params.delete(:review_ratings_attributes)
+      if @review.update(ratings_params)
+        @review.review_ratings.each do |r|
+          rp.each do |s|
+            if r.rating_id == s[:rating_id]
+              r.value = s[:value]
+              r.save
+            end
+          end
+        end
+        render json: @review, status: :ok
+      else
+        render json:  @review.errors, status: :unprocessable_entity
+      end
+  end
+
   def process_creation(review)
     # Store errors
     errors = []
@@ -46,7 +86,7 @@ class V1::ReviewsController < ApplicationController
       errors << review.errors
     end
 
-    errors = errors.map { |e| e.messages }.inject(:merge)
+    errors = errors.map(&:messages).inject(:merge)
   end
 
   # DELETE /v1/learning_objects/1/reviews/2
@@ -54,14 +94,14 @@ class V1::ReviewsController < ApplicationController
   def destroy
     authorize @review
     @review.destroy
-    render nothing: true, status: :ok
+    render status: :ok
   end
 
   # User can rate the review to approve or not
   # POST /v1/learning_objects/1/reviews/2/rate
   # POST /v1/learning_objects/1/reviews/2/rate.json
   def rate
-    approves = params[:approves].to_bool
+    approves = params[:approves] == 'true' ? true : false
     rate = Rate.where(user: current_user, review: @review).first_or_initialize
 
     if rate.update(approves: approves)

app/controllers/v1/roles_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
 class V1::RolesController < ApplicationController
+  include ::Paginator
+
   before_action :authenticate_user!, except: [:index, :show]
   before_action :set_role, only: [:show, :update, :destroy]
+  before_action :authorize!, only: [:update, :destroy]
 
   # GET /roles
   # GET /roles.json
   def index
-    render json: Role.all
+    roles = paginate Role
+    render json: roles
   end
 
   # GET /roles/1
@@ -18,6 +41,7 @@ class V1::RolesController < ApplicationController
   # POST /roles.json
   def create
     @role = Role.new(role_params)
+    authorize @role
 
     if @role.save
       render json: @role, status: :created
@@ -40,18 +64,27 @@ class V1::RolesController < ApplicationController
   # DELETE /roles/1.json
   def destroy
     @role.destroy
-    render nothing: true, status: :ok
+    response = { 'status': 'deleted' }
+    render status: :ok, json: response
   end
 
   private
 
   # Use callbacks to share common setup or constraints between actions.
   def set_role
-    @role = Role.find(params[:id])
+    @role = Role.where(id: params[:id]).first
+
+    render status: :not_found if @role.blank?
+
+    @role
   end
 
   # Never trust parameters from the scary internet, only allow the white list through.
   def role_params
     params.require(:role).permit(:name, :description)
   end
+
+  def authorize!
+    authorize @role
+  end
 end

app/controllers/v1/scores_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
 class V1::ScoresController < ApplicationController
-  before_action :set_score, only: [:show,:update]
+  include ::Paginator
+
   before_action :authenticate_user!, only: [:update]
+  before_action :set_score, only: [:show, :update]
+  before_action :authorize!, only: [:update]
 
   # GET v1/scores
   # GET v1/scores.json
   def index
-    render json: Score.order(:name).includes(:score_user_categories).sort{|score| score.score_user_categories.size}.reverse
+    params[:sort] = '["name","ASC"]' if params[:sort].blank?
+    scores = paginate Score
+    render json: scores
   end
 
   # GET /scores/1
@@ -18,7 +42,7 @@ class V1::ScoresController < ApplicationController
   # PUT/PATCH /v1/scores/1.json
   def update
     if @score.update(score_params)
-      render json: @score, status: :ok
+      render json: @score, status: :ok, :notice => "Score updated."
     else
       render json: @score.errors, status: :unprocessable_entity
     end
@@ -27,11 +51,19 @@ class V1::ScoresController < ApplicationController
   private
 
   def set_score
-    @score = Score.find params[:id]
+    @score = Score.where(id: params[:id]).first
+
+    render status: :not_found if @score.blank?
+
+    @score
   end
 
   def score_params
     params.require(:score).permit(:name, :weight, :active, score_type: [])
   end
 
+  def authorize!
+    authorize @score
+  end
+
 end

app/controllers/v1/search_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+include TagSearchService
+
 class V1::SearchController < ApplicationController
-  before_action :set_search
+  include ::Paginator
+  before_action :set_search, except: [:tag]
 
   # GET v1/search
   # GET v1/search.json
   def index
-    render json: SearchService.search(@search, current_user), status: :ok
+    search = SearchService.instance(@search, current_user).search
+    @search.number_of_results = search.total_count
+    save_search()
+
+    headers['X-Total-Count'] = search.total_count
+    render json: search.results, status: :ok
   rescue SearchService::InvalidSearchError
     render json: @search.errors, status: :bad_request
   end
@@ -17,6 +44,18 @@ class V1::SearchController < ApplicationController
     render json: @search.errors, status: :bad_request
   end
 
+  # GET v1/search/tag
+  # GET v1/search/tag.json
+  def tag
+    t = Tag.find_by_name(tag_search_params[:name])
+    if t.nil?
+      render json: {"error": "Tag not found."}, status: :unprocessable_entity
+    else    
+      results = TagSearchService.search(t)
+      render json: paginate(results), status: :ok
+    end
+  end
+
   private
 
   def set_search
@@ -25,6 +64,35 @@ class V1::SearchController < ApplicationController
 
   # Never trust parameters from the scary internet, only allow the white list through.
   def search_params
-    params.permit(:page, :results_per_page, :order, :query, :search_class, :tags, :types)
+    original_params = params
+    params = ActionController::Parameters.new({"search"=>original_params.except(:controller, :action).to_unsafe_h()})
+    params.require(:search).permit(:page, :results_per_page, :order, :query, :search_class, tags: [], subjects: [], educational_stages: [], object_types: [], languages: [], and_fields: [])
+  end
+
+  def tag_search_params
+    params.permit(:page, :results_per_page, :name)
+  end
+
+  private
+
+  def save_search
+    if (@search.tags)
+      @tag_ids = []
+      for tag_name in @search.tags
+        @tag = Tag.where(name: tag_name).first_or_create do |tag|
+          tag.name = tag_name
+        end
+        @tag_ids << @tag.id
+      end
+      @search.tag_ids = @tag_ids
+    end
+
+    if current_user
+      @search.user_id = current_user.id
+    else
+      @search.user_id = nil
+    end
+
+    @search.save()
   end
 end

app/controllers/v1/sessions_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+require 'open-uri'
+  class V1::SessionsController < DeviseTokenAuth::SessionsController
+    def create
+      # Check
+      field = (resource_params.keys.map(&:to_sym) & resource_class.authentication_keys).first
+
+      @resource = nil
+      if field
+        q_value = get_case_insensitive_field_from_resource_params(field)
+
+        @resource = find_resource(field, q_value)
+      end
+
+      if @resource && valid_params?(field, q_value) && (!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
+        valid_password = @resource.valid_password?(resource_params[:password])
+        if (@resource.respond_to?(:valid_for_authentication?) && !@resource.valid_for_authentication? { valid_password }) || !valid_password
+          return render_create_error_bad_credentials
+        end
+        @token = @resource.create_token
+        @resource.save
+
+        sign_in(:user, @resource, store: false, bypass: false)
+
+        yield @resource if block_given?
+
+        render_create_success
+      elsif @resource && !(!@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?)
+        # verify if user is to be reactivated
+        reactivate_user?
+        if @resource.blocked?
+          render_create_error_blocked
+        elsif @resource.banished?
+          render_create_error_banished
+        end
+      else
+        render_create_error_bad_credentials
+      end
+    end
+
+    def render_create_error_banished
+      render json: {
+        success: false,
+        errors: [ I18n.t("devise.sessions.banished")]
+      }, status: 401
+    end
+
+    def render_create_error_blocked
+      render json: {
+        success: false,
+        errors: [ I18n.t("devise.sessions.blocked")],
+        avaliable_at: @resource.reactivated_at
+      }, status: 401
+    end
+        
+    def reactivate_user?
+      unless @resource.reactivated_at.nil?
+        if @resource.reactivated_at < Time.current
+          @resource.active!
+          create
+        end
+      end
+    end
+  end

app/controllers/v1/statistics_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class V1::StatisticsController < ApplicationController
+  # GET v1/statistics
+  # GET v1/statistics.json
+  def index
+    statistics = { count: count_learning_objects, month_publications: month_publications, month_downloads: month_downloads }
+    render json: statistics
+  end
+
+  private
+
+  def count_learning_objects
+    LearningObject.where('state = ?', LearningObject.states[:published]).count
+  end
+
+  def month_publications
+    LearningObject.where('extract (month from published_at) = ? and extract (year from published_at) = ?', Time.current.month, Time.current.year).count
+  end
+
+  def month_downloads
+    Download.where('extract (month from created_at) = ? and extract (year from created_at) = ?', Time.current.month, Time.current.year).count
+  end
+end

app/controllers/v1/subjects_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class V1::SubjectsController < ApplicationController
+  
+  include ::Paginator
+
+
+  # GET /subjects
+  # GET /subjects.json
+  def index
+    subjects = Subject.all
+    render json: subjects
+  end
+
+end

app/controllers/v1/submissions_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class V1::SubmissionsController < ApplicationController
+  include ::Paginator
+
+  before_action :set_new_submission, only: :index
+  before_action :set_submission, only: [:show, :answer, :destroy]
+  before_action :authenticate_user!
+  before_action :authorize!, except: :create
+
+  def index
+    submissions = paginate Submission.all
+    render json: submissions
+  end
+
+  def show
+    render json: @submission
+  end
+
+  def create
+    learning_object = LearningObject.where(id: submission_params[:learning_object_id]).first
+    if learning_object.blank?
+      render :json, status: :not_found
+    else
+      @submission = Submission.new(learning_object: learning_object, submitter: current_user, status: :submitted)
+
+      authorize @submission
+
+      if @submission.save
+        CuratorAssignmentsService.new(@submission).assign
+        @submission.learning_object.submitted!
+        render json: @submission, status: :created
+      else
+        render json: @submission.errors, status: :unprocessable_entity
+      end
+    end
+  end
+
+  # GET /v1/submission/:id/answer
+  def answer
+    @submission.justification = answer_params[:justification]
+    answers = []
+    questions = Question.active.pluck(:id)
+    answers = answer_params[:answers]
+    if questions.size > answers.size
+      render json: { "error": "Active questions missing" }, status: :unprocessable_entity
+    else
+      answers.each do |answer|
+        if !questions.include?(answer[:question_id])
+          render json: {"error": "Inactive questions not permitted"}, status: :unprocessable_entity
+          return
+        else
+          @submission.answers << Answer.create(answer)
+        end
+      end
+      @submission.curator = current_user
+      if @submission.save
+        if @submission.accepted?
+          publisher = LearningObjectPublisher.new(DspaceService.create_client)
+          publisher.publish @submission.learning_object
+        else
+          @submission.learning_object.destroy
+        end
+        render json: @submission, status: :ok
+      else
+        render json: @submission.errors, status: :unprocessable_entity
+      end
+    end
+  end
+
+  def destroy
+    @submission.destroy
+    response = { 'status': 'deleted' }
+    render status: :ok, json: response
+  end
+
+  private
+
+  def answer_params
+    return nil if params[:submission].nil?
+    params[:submission].permit(:justification, answers: [:question_id, :accepted])
+  end
+
+  def submission_params
+    return nil if params[:submission].nil?
+    params[:submission].permit(:learning_object_id)
+  end
+
+  def set_new_submission
+    @submission ||= Submission.new
+  end
+
+  def set_submission
+    @submission ||= Submission.where(id: params[:id]).first
+    
+    render status: :not_found if @submission.blank?
+
+    @submission
+  end
+
+  def authorize!
+    authorize @submission
+  end
+end

app/controllers/v1/suggestions_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class V1::SuggestionsController < ApplicationController
+  include ::Paginator
+
+  before_action :set_suggestion, only: [:show, :update, :destroy]
+
+  # GET v1/suggestions
+  def index
+    suggestions= paginate Suggestion
+    render json: suggestions
+  end
+
+  # GET v1/suggestions/1
+  def show
+    render json: @suggestion
+  end
+
+  # POST v1/suggestions
+  def create
+    @suggestion = Suggestion.new(suggestion_params)
+
+    if @suggestion.save
+      SuggestionsMailer.new_suggestion_received(@suggestion).deliver_now
+      render json: @suggestion, status: :created
+    else
+      render json: @suggestion.errors, status: :unprocessable_entity
+    end
+  end
+
+  # PATCH/PUT v1/suggestions/1
+  def update
+    if @suggestion.update(suggestion_params)
+      SuggestionsMailer.suggestion_updated(@suggestion).deliver_now
+      render json: @suggestion
+    else
+      render json: @suggestion.errors, status: :unprocessable_entity
+    end
+  end
+
+  # DELETE v1/suggestions/1
+  def destroy
+    @suggestion.destroy
+    render status: :ok
+  end
+
+  private
+    # Use callbacks to share common setup or constraints between actions.
+    def set_suggestion
+      @suggestion = Suggestion.where(id: params[:id]).first
+
+      render status: :not_found if @suggestion.blank?
+
+      @suggestion
+    end
+
+    # Only allow a trusted parameter "white list" through.
+    def suggestion_params
+      params.require(:suggestion).permit(:name, :link, :description, :status)
+    end
+end

app/controllers/v1/users/bookmarks_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
 class V1::Users::BookmarksController < ApplicationController
   before_action :authenticate_user!
   before_action :set_user
@@ -23,7 +42,7 @@ class V1::Users::BookmarksController < ApplicationController
 
   def destroy
     Bookmark.where(user: @user, bookmarkable: @object).destroy_all
-    render nothing: true, status: :ok
+    render status: :ok
   end
 
   private
@@ -33,7 +52,11 @@ class V1::Users::BookmarksController < ApplicationController
   end
 
   def set_user
-    @user = User.find(params[:id])
+    @user = User.where(id: params[:user_id]).first
+
+    render status: :not_found if @user.blank?
+
+    @user
   end
 
   def find_object
@@ -41,7 +64,7 @@ class V1::Users::BookmarksController < ApplicationController
       klass = bookmarks_params[:type].constantize
       @object = klass.find bookmarks_params[:id]
     else
-      return render nothing: true, status: :not_acceptable
+      return render status: :not_acceptable
     end
   end
 

app/controllers/v1/users_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
 class V1::UsersController < ApplicationController
   include ::FollowableController
   include ::DeletedObjectsController
+  include ::Paginator
+  include ::PublisherController
+	include ::SubjectableController
 
-  before_action :set_user, only: [:show, :update, :destroy, :watching]
-  before_action :authenticate_user!, only: [:create, :update, :destroy, :watching]
+  before_action :set_user, only: [:show, :update, :destroy, :following, :own_reviews, :received_reviews, :followers, :add_teacher, :remove_teacher, :reactivate_user]
+  before_action :set_new_user, only: [:teacher_requests, :teacher_request]
+  before_action :authenticate_user!, only: [:create, :update, :destroy,
+                :following, :own_reviews, :received_reviews, :followers, :create_teacher_request, :update_teacher_request,
+                :teacher_requests, :add_teacher, :remove_teacher, :reactivate_user]
+  before_action :authorize_user, only: [:own_reviews, :received_reviews, :update, :destroy, :teacher_requests, :add_teacher, :remove_teacher]
 
   # GET /v1/users
   # GET /v1/users.json
   def index
-    render json: User.all
+    users = paginate policy_scope(User)
+    render json: users
   end
 
   # GET /v1/users/1
@@ -21,19 +48,20 @@ class V1::UsersController < ApplicationController
   # POST /v1/users.json
   def create
     user = User.new(user_params)
+    authorize user
 
     if user.save
       render json: user, status: :created
     else
       render json: user.errors, status: :unprocessable_entity
     end
-
   end
 
   # PUT/PATCH /v1/users/1
   # PUT/PATCH /v1/users/1.json
   def update
     if @user.update(user_params)
+      user_associations(@user)
       render json: @user, status: :ok
     else
       render json: @user.errors, status: :unprocessable_entity
@@ -43,22 +71,133 @@ class V1::UsersController < ApplicationController
   # DELETE /v1/users/1
   # DELETE /v1/users/1.json
   def destroy
-    if current_user == @user
-      render nothing: true, status: :forbidden
+    @user.destroy
+    response = { 'status': 'deleted' }
+    render status: :ok, json: response
+  end
+
+  # GET /v1/users/teacher_requests
+  # GET /v1/users/teacher_requests.json
+  def teacher_requests
+    users = paginate User.where(submitter_request: User.submitter_requests[:requested])
+    render json: users
+  end
+
+  # POST /v1/users/teacher_request
+  # POST /v1/users/teacher_request.json
+  def create_teacher_request
+    unless current_user.accepted?
+      current_user.terms_accepted_at = Time.now
+      current_user.school = School.where(inep_id: school_params[:inep_id]).first_or_create(school_params)
+      current_user.cpf = teacher_params[:cpf]
+      current_user.submitter_request = :requested
+
+      if current_user.save
+        TeacherMailer.new_teacher_received(current_user).deliver_now
+        render status: :ok
+      else
+        render json: current_user.errors, status: :unprocessable_entity
+      end
     else
-      @user.destroy
-      render nothing: true, status: :ok
+      render status: :forbidden
     end
   end
 
-  def watching
+  # PUT /v1/users/teacher_request
+  # PUT /v1/users/teacher_request.json
+  def update_teacher_request
+    if current_user.requested?
+      # current_user.terms_accepted_at = Time.now
+      school = School.where(inep_id: school_params[:inep_id]).first_or_create
+      school.update(school_params)
+      current_user.school = school
+      current_user.cpf = teacher_params[:cpf] unless teacher_params[:cpf].blank?
+      current_user.submitter_request = :requested
+
+      if current_user.save
+        TeacherMailer.teacher_update_received(current_user).deliver_now
+        render status: :ok
+      else
+        render json: current_user.errors, status: :unprocessable_entity
+      end
+    else
+      render status: :forbidden
+    end
+  end
+
+  # POST /v1/users/:id/add_teacher
+  # POST /v1/users/:id/add_teacher.json
+  def add_teacher
+    if @user.is_publisher?
+      if @user.submitter_request != "accepted"
+        @user.submitter_request = :accepted
+        @user.save
+      end
+      render status: :ok
+    elsif !approve_params.to_s.blank?
+      if approve_params
+        @user.submitter_request = :accepted
+        @user.roles << Role.where(name: "publisher")
+        if @user.save
+          TeacherMailer.new_teacher_approved(@user).deliver_now
+          render status: :ok
+        else
+          render json: @user.errors, status: :unprocessable_entity
+        end
+      else
+        @user.update(submitter_request: User.submitter_requests[:rejected])
+        TeacherMailer.new_teacher_rejected(@user).deliver_now
+        render status: :ok
+      end
+    else
+      render json: {error: "approves cannot be nil"}, status: :unprocessable_entity
+    end
+  end
+
+
+  # PUT/PATCH /v1/users/:id/reactivate_user
+  # PUT/PATCH /v1/users/:id/reactivate_user.json
+  def reactivate_user
+    unless @user.accepted?
+      @user.reactivated_at = Time.current
+      @user.active!
+    end
+
+    render status: :ok
+  end
+
+  # DELETE /v1/users/:id/remove_teacher
+  # DELETE /v1/users/:id/remove_teacher.json
+  def remove_teacher
+    if @user.is_publisher?
+      @user.update(submitter_request: :default)
+      @user.roles.delete(Role.where(name: "publisher").first)
+    end
+    render status: :ok
+  end
+
+  def following
     type = params[:object_type]
     is_current = (@user.id == current_user.id) unless current_user.nil?
-    return render nothing: true, status: :bad_request unless type.in? %w(User Collection)
-    w = @user.watching(type, is_current)
+    return render status: :bad_request unless type.in? %w(User Collection)
+    w = paginate @user.following(type, is_current)
+    return render json: w, include: '*.owner', root: 'follows', status: :ok if type=="Collection"
     render json: w, root: 'follows', status: :ok
   end
 
+  def own_reviews
+    render json: @user.own_reviews
+  end
+
+  def received_reviews
+    render json: @user.received_reviews
+  end
+
+  def followers
+    f = paginate @user.followers
+    render json: f
+  end
+
   private
 
   def deleted_resource
@@ -69,12 +208,86 @@ class V1::UsersController < ApplicationController
     set_user
   end
 
+  def authorize_user
+    authorize @user
+  end
+
   def set_user
-    @user = User.find(params[:id])
+    users = policy_scope(User)
+    @user = users.where(id: params[:id]).first
+
+    render status: :not_found if @user.blank?
+
+    @user
+  end
+
+  def set_new_user
+    @user ||= User.new
   end
 
   # Never trust parameters from the scary internet, only allow the white list through.
   def user_params
-    params.require(:user).permit(:name, :email, :password, :password_confirmation, :terms_of_service, role_ids: [])
+    return params.require(:user).permit(*admin_allowed_params) if !current_user.nil? && current_user.is_admin?
+    return params.require(:user).permit(*partner_allowed_params) if !current_user.nil? && current_user.is_partner?
+    params.require(:user).permit(*user_allowed_params)
+  end
+
+  def user_allowed_params
+    [
+      :name,
+      :email,
+      :description,
+      :education,
+      :password,
+      :password_confirmation,
+      :terms_of_service,
+      :avatar,
+      :cover,
+      :teacher_id,
+      :birthday,
+      :ask_teacher_question
+    ]
+  end
+
+  def partner_allowed_params
+    user_allowed_params.push(*[
+      :dspace_url,
+      :dspace_handle,
+      dspace_sets: []
+    ])
   end
+
+  def admin_allowed_params
+    partner_allowed_params.push(*[
+      role_ids: []
+    ])
+  end
+
+  def teacher_params
+    params.permit(:cpf, :phone, :school, :city, :uf, :inep_id)
+  end
+
+  def school_params
+    {
+      name: teacher_params[:school],
+      uf: teacher_params[:uf],
+      city: teacher_params[:city],
+      phone: teacher_params[:phone],
+      inep_id: teacher_params[:inep_id]
+    }
+  end
+
+  def approve_params
+    params.require(:approves)
+  end
+
+  def association_params
+    return {} if params[:user].nil?
+    params[:user].permit(subjects: [])
+  end
+
+  def user_associations(user)
+    user.add_subjects(ids: association_params[:subjects]) unless association_params[:subjects].nil?
+  end
+
 end

app/controllers/v1/versions_controller.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
 class V1::VersionsController < ApplicationController
   include ::ResourceModel
 
@@ -20,7 +39,7 @@ class V1::VersionsController < ApplicationController
     if resource.save
       render json: resource
     else
-      render nothing: true, status: :unprocessable_entity
+      render status: :unprocessable_entity
     end
   end
 

app/jobs/application_job.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class ApplicationJob < ActiveJob::Base
+end

app/mailers/application_mailer.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class ApplicationMailer < ActionMailer::Base
+  default to: 'plataformaintegrada@mec.gov.br'
+  default from: 'portalmec@inf.ufpr.br'
+  #layout 'mailer'
+end

app/mailers/complaints_mailer.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class ComplaintsMailer < ApplicationMailer
+    default to: 'integrada.contato@mec.gov.br'
+    default from: Proc.new { @user.email }
+
+    def new_complaint_received(complaint, user)
+        @complaint = complaint
+        @user = user
+        mail(subject: "Denuncia de objeto")
+    end
+end

app/mailers/contacts_mailer.rb

+
+# Copyright (C) 2015 Centro de Computacao Cientifica e Software Livre
+# Departamento de Informatica - Universidade Federal do Parana
+#
+# This file is part of portalmec.
+#
+# portalmec is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# portalmec is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with portalmec.  If not, see <http://www.gnu.org/licenses/>.
+
+class ContactsMailer < ApplicationMailer
+    default from: Proc.new { @contact.email }
+
+    def new_contact_received(contact)
+        @contact = contact
+        @subject = "Contato de " + @contact.name
+        mail(subject: @subject)
+    end
+
+    def contact_updated(contact)
+        @contact = contact
+        @subject = "O contato de " + @contact.name + " foi atualizado"
+        mail(subject: @subject)
+    end
+end