From f4e134e9ed7b93b2cede686092cc39ab86b61988 Mon Sep 17 00:00:00 2001
From: Muhsin Keloth <muhsinkeramam@gmail.com>
Date: Wed, 8 May 2024 17:20:01 +0530
Subject: [PATCH] chore: add permitted params

---
 .../integrations/linear_controller.rb         | 10 +++++---
 lib/linear.rb                                 | 13 ++++++++---
 lib/linear_mutations.rb                       | 23 ++++++++++---------
 3 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/app/controllers/api/v1/accounts/integrations/linear_controller.rb b/app/controllers/api/v1/accounts/integrations/linear_controller.rb
index 7aa09fc6a..de0d4b0b4 100644
--- a/app/controllers/api/v1/accounts/integrations/linear_controller.rb
+++ b/app/controllers/api/v1/accounts/integrations/linear_controller.rb
@@ -19,9 +19,9 @@ class Api::V1::Accounts::Integrations::LinearController < Api::V1::Accounts::Bas
   end
 
   def create_issue
-    team_id = params[:team_id]
-    title = params[:title]
-    description = params[:description]
+    team_id = permitted_params[:team_id]
+    title = permitted_params[:title]
+    description = permitted_params[:description]
     issue = linear_processor_service.create_issue(team_id, title, description)
     if issue.is_a?(Hash) && issue[:error]
       render json: { error: issue[:error] }, status: :unprocessable_entity
@@ -35,4 +35,8 @@ class Api::V1::Accounts::Integrations::LinearController < Api::V1::Accounts::Bas
   def linear_processor_service
     Integrations::Linear::ProcessorService.new(account: Current.account)
   end
+
+  def permitted_params
+    params.permit(:team_id, :title, :description)
+  end
 end
diff --git a/lib/linear.rb b/lib/linear.rb
index b7b8e9add..c9ffa3839 100644
--- a/lib/linear.rb
+++ b/lib/linear.rb
@@ -1,6 +1,7 @@
 require 'graphlient'
 
 require_relative 'linear_queries'
+require_relative 'linear_mutations'
 class Linear
   BASE_URL = 'https://api.linear.app/graphql'.freeze
 
@@ -32,7 +33,13 @@ class Linear
     raise ArgumentError, 'Missing title' if title.blank?
     raise ArgumentError, 'Missing description' if description.blank?
 
-    execute_mutation(LinearMutations::ISSUE_CREATE, input: { teamId: team_id, title: title, description: description })
+    variables = {
+      title: title,
+      description: description,
+      teamId: team_id
+    }
+
+    execute_mutation(LinearMutations.issue_create(variables))
   end
 
   private
@@ -49,8 +56,8 @@ class Linear
     log_and_return_error("Unexpected Error: #{e.message}")
   end
 
-  def execute_mutation(query, variables)
-    response = @client.query(query, variables: variables)
+  def execute_mutation(query)
+    response = @client.query(query)
     log_and_return_error("Error creating issue: #{response.errors.messages}") if response.data.nil? && response.errors.any?
     response.data.to_h
   end
diff --git a/lib/linear_mutations.rb b/lib/linear_mutations.rb
index ec62f761c..f2f60f605 100644
--- a/lib/linear_mutations.rb
+++ b/lib/linear_mutations.rb
@@ -1,15 +1,16 @@
 module LinearMutations
-  ISSUE_CREATE = <<~GRAPHQL.freeze
-    mutation IssueCreate($input: IssueCreateInput!) {
-      issueCreate(
-        input: $input
-      ) {
-        success
-        issue {
-          id
-          title
+  def self.issue_create(input)
+    graphql_input = input.map { |key, value| "#{key}: \"#{value}\"" }.join(', ')
+    <<~GRAPHQL
+      mutation {
+        issueCreate(input: { #{graphql_input} }) {
+          success
+          issue {
+            id
+            title
+          }
         }
       }
-    }
-  GRAPHQL
+    GRAPHQL
+  end
 end