From c938d61f9b36b64fa697eb7cd355ae9200f03d7e Mon Sep 17 00:00:00 2001
From: Chunlin Zhang <zhangchunlin@gmail.com>
Date: Thu, 5 Sep 2019 18:17:53 +0800
Subject: [PATCH 1/4] use menu to display example lists now

---
 demo/apps/apijson_demo/templates/index.html | 149 +++++++++++++-------
 1 file changed, 98 insertions(+), 51 deletions(-)

diff --git a/demo/apps/apijson_demo/templates/index.html b/demo/apps/apijson_demo/templates/index.html
index 2c582e7..2925a1d 100644
--- a/demo/apps/apijson_demo/templates/index.html
+++ b/demo/apps/apijson_demo/templates/index.html
@@ -23,9 +23,48 @@
         <tab-pane label="apijson put" name="tab_put"></tab-pane>
         <tab-pane label="apijson delete" name="tab_delete"></tab-pane>
     </tabs>
+    <layout>
+    <sider hide-trigger :style="{height: '80vh', width:'360px', 'min-width': '360px', 'max-width': '380px', overflow: 'auto', background: '#fff'}">
+    <i-menu :active-name="0" @on-select="on_select_get" width="360px" ref='menu_get'>
+        <menu-group title="apijson get examples" v-if="tab_current==='tab_get'">
+            <menu-item  v-for="(item,index) in request_get" :name="index" :key="index">
+                📋 {item.label}
+            </menu-item>
+        </menu-group>
+    </i-menu>
+    <i-menu :active-name="0" @on-select="on_select_head" width="360px">
+        <menu-group title="apijson head examples" v-if="tab_current==='tab_head'">
+            <menu-item  v-for="(item,index) in request_head" :name="index" :key="index">
+                📋 {item.label}
+            </menu-item>
+        </menu-group>
+    </i-menu>
+    <i-menu :active-name="0" @on-select="on_select_post" width="360px">
+        <menu-group title="apijson post examples" v-if="tab_current==='tab_post'">
+            <menu-item  v-for="(item,index) in request_post" :name="index" :key="index">
+                📋 {item.label}
+            </menu-item>
+        </menu-group>
+    </i-menu>
+    <i-menu :active-name="0" @on-select="on_select_put" width="360px">
+        <menu-group title="apijson put examples" v-if="tab_current==='tab_put'">
+            <menu-item  v-for="(item,index) in request_put" :name="index" :key="index">
+                📋 {item.label}
+            </menu-item>
+        </menu-group>
+    </i-menu>
+    <i-menu :active-name="0" @on-select="on_select_delete" width="360px">
+        <menu-group title="apijson delete examples" v-if="tab_current==='tab_delete'">
+            <menu-item  v-for="(item,index) in request_delete" :name="index" :key="index">
+                📋 {item.label}
+            </menu-item>
+        </menu-group>
+    </i-menu>
+    </sider>
+    <i-content :style="{padding: '24px', minHeight: '280px', background: '#fff'}">
     <Row>
         <i-col span="3"><div align="center">login user</div></i-col>
-        <i-col span="8"><i-input value="{{=user_info}}" readonly/></i-col>
+        <i-col span="18"><i-input value="{{=user_info}}" readonly/></i-col>
         {{if request.user:}}
         <i-col span="1"><div align="center"><i-button type="warning" size="large" @click="logout">Logout</i-button></div></i-col>
         {{else:}}
@@ -33,79 +72,61 @@
         {{pass}}
     </Row>
     <Row v-if="tab_current==='tab_get'">
-            <i-col span="3"><div align="center">HTTP POST URL</div></i-col>
-            <i-col span="8"><i-input value="/apijson/get" readonly/></i-col>
+        <i-col span="3"><div align="center">HTTP POST URL</div></i-col>
+        <i-col span="18"><i-input value="/apijson/get" readonly/></i-col>
     </Row>
     <Row v-if="tab_current==='tab_get'">
-        <i-col span="3"><div align="center"><strong>apijson get</strong> request <span class="notice">{request_get.length}</span> examples</div></i-col>
-        <i-col span="8">
-            <i-select v-model="select_current">
-                <i-option v-for="(item,index) in request_get" :value="item.value" :key="item.value">{index+1}. {item.label}</i-option>
-            </i-select>
-        </i-col>
+        <i-col span="3"><div align="center">example name</div></i-col>
+        <i-col span="18"><strong><i-input :value="request_get[cmenu_get].label" readonly/></strong></i-col>
     </Row>
 
     <Row v-if="tab_current==='tab_head'">
         <i-col span="3"><div align="center">HTTP HEAD URL</div></i-col>
-        <i-col span="8"><i-input value="/apijson/head" readonly/></i-col>
+        <i-col span="18"><i-input value="/apijson/head" readonly/></i-col>
     </Row>
     <Row v-if="tab_current==='tab_head'">
-        <i-col span="3"><div align="center"><strong>apijson head</strong> request <span class="notice">{request_head.length}</span> examples</div></i-col>
-        <i-col span="8">
-            <i-select v-model="select_current">
-                <i-option v-for="(item,index) in request_head" :value="item.value" :key="item.value">{index+1}. {item.label}</i-option>
-            </i-select>
-        </i-col>
+        <i-col span="3"><div align="center">example name</div></i-col>
+        <i-col span="18"><strong><i-input :value="request_head[cmenu_head].label" readonly/></strong></i-col>
     </Row>
 
     <Row v-if="tab_current==='tab_post'">
-            <i-col span="3"><div align="center">POST URL</div></i-col>
-            <i-col span="8"><i-input value="/apijson/post" readonly/></i-col>
+        <i-col span="3"><div align="center">POST URL</div></i-col>
+        <i-col span="18"><i-input value="/apijson/post" readonly/></i-col>
     </Row>
     <Row v-if="tab_current==='tab_post'">
-        <i-col span="3"><div align="center"><strong>apijson post</strong> request <span class="notice">{request_post.length}</span> examples</div></i-col>
-        <i-col span="8">
-            <i-select v-model="select_current">
-                <i-option v-for="(item,index) in request_post" :value="item.value" :key="item.value">{index+1}. {item.label}</i-option>
-            </i-select>
-        </i-col>
+        <i-col span="3"><div align="center">example name</div></i-col>
+        <i-col span="18"><strong><i-input :value="request_post[cmenu_post].label" readonly/></strong></i-col>
     </Row>
 
     <Row v-if="tab_current==='tab_put'">
         <i-col span="3"><div align="center">PUT URL</div></i-col>
-        <i-col span="8"><i-input value="/apijson/put" readonly/></i-col>
+        <i-col span="18"><i-input value="/apijson/put" readonly/></i-col>
     </Row>
     <Row v-if="tab_current==='tab_put'">
-        <i-col span="3"><div align="center"><strong>apijson put</strong> request <span class="notice">{request_put.length}</span> examples</div></i-col>
-        <i-col span="8">
-            <i-select v-model="select_current">
-                <i-option v-for="(item,index) in request_put" :value="item.value" :key="item.value">{index+1}. {item.label}</i-option>
-            </i-select>
-        </i-col>
+        <i-col span="3"><div align="center">example name</div></i-col>
+        <i-col span="18"><strong><i-input :value="request_put[cmenu_put].label" readonly/></strong></i-col>
     </Row>
 
     <Row v-if="tab_current==='tab_delete'">
         <i-col span="3"><div align="center">DELETE URL</div></i-col>
-        <i-col span="8"><i-input value="/apijson/delete" readonly/></i-col>
+        <i-col span="18"><i-input value="/apijson/delete" readonly/></i-col>
     </Row>
     <Row v-if="tab_current==='tab_delete'">
-        <i-col span="3"><div align="center"><strong>apijson delete</strong> request <span class="notice">{request_delete.length}</span> examples</div></i-col>
-        <i-col span="8">
-            <i-select v-model="select_current">
-                <i-option v-for="(item,index) in request_delete" :value="item.value" :key="item.value">{index+1}. {item.label}</i-option>
-            </i-select>
-        </i-col>
+        <i-col span="3"><div align="center">example name</div></i-col>
+        <i-col span="18"><strong><i-input :value="request_delete[cmenu_delete].label" readonly/></strong></i-col>
     </Row>
 
     <Row>
         <i-col span="3"><div align="center">request data</div></i-col>
-        <i-col span="8"><i-input v-model="request_data" type="textarea" :autosize="{minRows: 3,maxRows: 15}" placeholder="request data" /></i-col>
+        <i-col span="18"><i-input v-model="request_data" type="textarea" :autosize="{minRows: 3,maxRows: 15}" placeholder="request data" /></i-col>
         <i-col span="1"><div align="center"><i-button type="primary" size="large" @click="post_request_data" v-bind:disabled="!can_post">Post</i-button></div></i-col>
     </Row>
     <Row>
         <i-col span="3"><div align="center">response data</div></i-col>
-        <i-col span="8"><i-input v-model="response_data" type="textarea" readonly :autosize="{minRows: 5,maxRows: 30}" /></i-col>
+        <i-col span="18"><i-input v-model="response_data" type="textarea" readonly :autosize="{minRows: 5,maxRows: 30}" /></i-col>
     </Row>
+    </i-content>
+    </layout>
 </div>
 </div>
 <script>
@@ -119,7 +140,13 @@
         request_put : {{<<request_put_json}},
         request_delete : {{<<request_delete_json}},
         request_data : "",
-        select_current : "",
+
+        cmenu_get : 0,
+        cmenu_head : 0,
+        cmenu_post : 0,
+        cmenu_put : 0,
+        cmenu_delete : 0,
+        
         can_post : true,
         response_data : "",
         tab_current : "tab_get",
@@ -134,7 +161,36 @@
     methods: {
         init_default: function(){
             vm.request_data = vm.request_get[0].value
-            vm.select_current = vm.request_data
+        },
+        on_select_get: function(name){
+            vm.cmenu_get = parseInt(name)
+            vm.request_data = vm.request_get[vm.cmenu_get].value
+            vm.response_data = ""
+            vm.can_post = true
+        },
+        on_select_head: function(name){
+            vm.cmenu_head = parseInt(name)
+            vm.request_data = vm.request_head[vm.cmenu_head].value
+            vm.response_data = ""
+            vm.can_post = true
+        },
+        on_select_post: function(name){
+            vm.cmenu_post = parseInt(name)
+            vm.request_data = vm.request_post[vm.cmenu_post].value
+            vm.response_data = ""
+            vm.can_post = true
+        },
+        on_select_put: function(name){
+            vm.cmenu_put = parseInt(name)
+            vm.request_data = vm.request_put[vm.cmenu_put].value
+            vm.response_data = ""
+            vm.can_post = true
+        },
+        on_select_delete: function(name){
+            vm.cmenu_delete = parseInt(name)
+            vm.request_data = vm.request_delete[vm.cmenu_delete].value
+            vm.response_data = ""
+            vm.can_post = true
         },
         post_request_data: function(){
             $.ajax({
@@ -171,16 +227,7 @@
             else if (n=="tab_delete") {
                 vm.request_data = vm.request_delete[0].value
             }
-            vm.select_current = vm.request_data
             vm.response_data = ""
-        },
-        select_current : function(n,o){
-            if (n!=null && n!="" && n!==vm.request_data) {
-                vm.request_data = n
-            }
-            else {
-                vm.select_current = vm.request_data
-            }
         }
     }
 })

From d746fb22d27de6e41f1376a93711a34b06319f3c Mon Sep 17 00:00:00 2001
From: Chunlin Zhang <zhangchunlin@gmail.com>
Date: Fri, 6 Sep 2019 21:16:51 +0800
Subject: [PATCH 2/4] add association query support for  single record query,
 only absolute ref path now

---
 demo/apps/apijson_demo/settings.ini |  9 ++++++
 demo/apps/apijson_demo/views.py     | 45 ++++++++++++++++++++++-------
 uliweb_apijson/apijson/views.py     | 27 ++++++++++++++++-
 3 files changed, 70 insertions(+), 11 deletions(-)

diff --git a/demo/apps/apijson_demo/settings.ini b/demo/apps/apijson_demo/settings.ini
index 25d0c54..1bf78f9 100644
--- a/demo/apps/apijson_demo/settings.ini
+++ b/demo/apps/apijson_demo/settings.ini
@@ -4,6 +4,15 @@ comment = 'apijson_demo.models.Comment'
 moment = 'apijson_demo.models.Moment'
 
 [APIJSON_MODELS]
+user = {
+    "user_id_field" : "id",
+    "secret_fields" : ["password"],
+    "GET" : { "roles" : ["LOGIN","ADMIN","OWNER"] },
+    "HEAD" : { "roles" : ["LOGIN","ADMIN","OWNER"] },
+    "POST" : { "roles" : ["ADMIN"] },
+    "PUT" : { "roles" : ["ADMIN","OWNER"] },
+    "DELETE" : { "roles" : ["ADMIN"] },
+}
 moment = {
     "user_id_field" : "user_id",
     "GET" : { "roles" : ["OWNER","LOGIN","ADMIN"] },
diff --git a/demo/apps/apijson_demo/views.py b/demo/apps/apijson_demo/views.py
index 2593352..8728ee9 100644
--- a/demo/apps/apijson_demo/views.py
+++ b/demo/apps/apijson_demo/views.py
@@ -30,24 +30,34 @@ def index():
         {
             "label":"Single record query: @column",
             "value":'''{
-   "user":{
+    "user":{
        "@column": "id,username,email",
        "@role":"OWNER"
-   }
+    }
 }''',
         },
         {
-            "label":"Array query: user",
+            "label":"Single record query: association query",
             "value":'''{
-  "[]":{
-    "@count":2,
-    "@page":0,
+    "moment":{},
     "user":{
-        "@column":"id,username,nickname,email",
-        "@order":"id-",
-        "@role":"ADMIN"
+       "@column": "id,username,email",
+       "id@": "moment/user_id"
+    }
+}''',
+        },
+        {
+            "label":"Array query: user",
+            "value":'''{
+     "[]":{
+        "@count":2,
+        "@page":0,
+        "user":{
+            "@column":"id,username,nickname,email",
+            "@order":"id-",
+            "@role":"ADMIN"
+        }
     }
-  }
 }''',
         },
         {
@@ -112,6 +122,21 @@ def index():
         "email$":"%local%"
     }
   }
+}''',
+        },
+        {
+            "label":"Array query: association query",
+            "value":'''{
+  "[]": {
+    "moment": {
+      "@column": "id,date,user_id",
+      "id": 3
+    },
+    "user": {
+      "id@": "/moment/user_id",
+      "@column": "id,username"
+    }
+  }
 }''',
         },
     ]
diff --git a/uliweb_apijson/apijson/views.py b/uliweb_apijson/apijson/views.py
index 8b1381e..1d031aa 100644
--- a/uliweb_apijson/apijson/views.py
+++ b/uliweb_apijson/apijson/views.py
@@ -3,6 +3,7 @@
 from uliweb.orm import ModelNotFound
 from sqlalchemy.sql import and_, or_, not_
 from json import loads
+from collections import OrderedDict
 import logging
 import traceback
 
@@ -18,7 +19,9 @@ def __begin__(self):
         self.vars = {}
 
         try:
-            self.request_data = loads(request.data)
+            #https://blog.csdn.net/yockie/article/details/44065885
+            #keep order when parse json, because the order matters for association query
+            self.request_data = loads(request.data, object_pairs_hook=OrderedDict)
         except Exception as e:
             log.error("try to load json but get exception: '%s', request data: %s"%(e,request.data))
             return json({"code":400,"msg":"not json data in the request"})
@@ -31,6 +34,15 @@ def _apply_vars(self):
                 if v:
                     self.rdict[key[:-1]] = v
 
+    def _ref_get(self,path):
+        if path[0]=="/":
+            #TODO: relative path
+            pass
+        else:
+            #absolute path
+            m,c = path.split("/")
+            return self.rdict.get(m,{}).get(c)
+
     def get(self):
         try:
             for key in self.request_data:
@@ -93,6 +105,19 @@ def _get_one(self,key):
 
         params = self.request_data[key]
         if isinstance(params,dict):
+            #update reference,example: {"id@": "moment/user_id"} -> {"id": 2}
+            ref_fields = []
+            refs = {}
+            for n in params:
+                if n[-1]=="@":
+                    ref_fields.append(n)
+                    col_name = n[:-1]
+                    path = params[n]
+                    refs[col_name] = self._ref_get(path)
+            for i in ref_fields:
+                del params[i]
+            params.update(refs)
+            
             for n in params:
                 if n[0]=="@":
                     if n=="@column":

From 9b5d0e120781342508ea1308a85a18e37b1cefa5 Mon Sep 17 00:00:00 2001
From: Chunlin Zhang <zhangchunlin@gmail.com>
Date: Fri, 6 Sep 2019 21:54:02 +0800
Subject: [PATCH 3/4] add association query one to many support

---
 demo/apps/apijson_demo/views.py | 11 +++++++++++
 uliweb_apijson/apijson/views.py | 16 ++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/demo/apps/apijson_demo/views.py b/demo/apps/apijson_demo/views.py
index 8728ee9..2c213ee 100644
--- a/demo/apps/apijson_demo/views.py
+++ b/demo/apps/apijson_demo/views.py
@@ -122,6 +122,17 @@ def index():
         "email$":"%local%"
     }
   }
+}''',
+        },
+        {
+            "label":"Array query: association query one to many",
+            "value":'''{
+    "moment": {},
+    "[]": {
+        "comment": {
+            "moment_id@": "moment/id"
+        }
+    }
 }''',
         },
         {
diff --git a/uliweb_apijson/apijson/views.py b/uliweb_apijson/apijson/views.py
index 1d031aa..6add24a 100644
--- a/uliweb_apijson/apijson/views.py
+++ b/uliweb_apijson/apijson/views.py
@@ -55,6 +55,8 @@ def get(self):
                     rsp = self._get_one(key)
                 if rsp: return rsp
             self._apply_vars()
+        except UliwebError as e:
+            return json({"code":400,"msg":str(e)})
         except Exception as e:
             err = "exception when handling 'apijson get': %s"%(e)
             log.error(err)
@@ -230,6 +232,20 @@ def _get_array(self,key):
 
         model_expr = model_param.get("@expr")
 
+        #update reference
+        ref_fields = []
+        refs = {}
+        for n in model_param:
+            if n[-1]=="@":
+                ref_fields.append(n)
+                col_name = n[:-1]
+                path = model_param[n]
+                refs[col_name] = self._ref_get(path)
+        if ref_fields:
+            for i in ref_fields:
+                del model_param[i]
+            model_param.update(refs)
+
         if model_expr:
             c = self._expr(model,model_param,model_expr)
             q = q.filter(c)

From 872eeeb40d214e3075821315ba127be62b2d4413 Mon Sep 17 00:00:00 2001
From: Chunlin Zhang <zhangchunlin@gmail.com>
Date: Tue, 10 Sep 2019 22:25:07 +0800
Subject: [PATCH 4/4] add associated query  feature with multi-table in a array

---
 demo/apps/apijson_demo/views.py    |  46 ++++---
 uliweb_apijson/apijson/__init__.py | 205 +++++++++++++++++++++++++++++
 uliweb_apijson/apijson/views.py    | 191 ++++++---------------------
 3 files changed, 272 insertions(+), 170 deletions(-)

diff --git a/demo/apps/apijson_demo/views.py b/demo/apps/apijson_demo/views.py
index 2c213ee..0d276d9 100644
--- a/demo/apps/apijson_demo/views.py
+++ b/demo/apps/apijson_demo/views.py
@@ -11,15 +11,16 @@ def index():
 
     request_get = [
         {
-            "label":"Single record query: self user",
+            "label":"Single query: self user",
             "value":'''{
    "user":{
         "@role":"OWNER"
    }
 }''',
         },
+
         {
-            "label":"Single record query: with id as parameter",
+            "label":"Single query: with id as parameter",
             "value":'''{
    "user":{
         "id":2,
@@ -27,8 +28,9 @@ def index():
    }
 }''',
         },
+
         {
-            "label":"Single record query: @column",
+            "label":"Single query: @column",
             "value":'''{
     "user":{
        "@column": "id,username,email",
@@ -36,16 +38,7 @@ def index():
     }
 }''',
         },
-        {
-            "label":"Single record query: association query",
-            "value":'''{
-    "moment":{},
-    "user":{
-       "@column": "id,username,email",
-       "id@": "moment/user_id"
-    }
-}''',
-        },
+
         {
             "label":"Array query: user",
             "value":'''{
@@ -60,6 +53,7 @@ def index():
     }
 }''',
         },
+
         {
             "label":"Array query: moment",
             "value":'''{
@@ -74,6 +68,7 @@ def index():
     "total@":"/moment[]/total"
 }''',
         },
+
         {
             "label":"Array query: like",
             "value":'''{
@@ -89,6 +84,7 @@ def index():
   }
 }''',
         },
+
         {
             "label":"Array query: simple @expr",
             "value":'''{
@@ -106,6 +102,7 @@ def index():
   }
 }''',
         },
+
         {
             "label":"Array query: complex @expr",
             "value":'''{
@@ -124,24 +121,37 @@ def index():
   }
 }''',
         },
+
+        {
+            "label":"Association query: Two tables, one to one",
+            "value":'''{
+    "moment":{},
+    "user":{
+       "@column": "id,username,email",
+       "id@": "moment/user_id"
+    }
+}''',
+        },
+
         {
-            "label":"Array query: association query one to many",
+            "label":"Association query: Two tables, one to many",
             "value":'''{
     "moment": {},
     "[]": {
         "comment": {
-            "moment_id@": "moment/id"
+            "moment_id@": "moment/id",
+            "@order":"date-"
         }
     }
 }''',
         },
+
         {
-            "label":"Array query: association query",
+            "label":"Association query: Two tables in array",
             "value":'''{
   "[]": {
     "moment": {
-      "@column": "id,date,user_id",
-      "id": 3
+      "@column": "id,date,user_id"
     },
     "user": {
       "id@": "/moment/user_id",
diff --git a/uliweb_apijson/apijson/__init__.py b/uliweb_apijson/apijson/__init__.py
index 2567372..0d18e9f 100644
--- a/uliweb_apijson/apijson/__init__.py
+++ b/uliweb_apijson/apijson/__init__.py
@@ -1,5 +1,9 @@
 #coding=utf-8
 
+from uliweb import settings, models, request, functions
+from uliweb.orm import ModelNotFound
+
+
 def get_apijson_tables(role="UNKNOWN"):
     from uliweb import settings
 
@@ -47,3 +51,204 @@ def get_apijson_table(role="UNKNOWN",name=None):
                 editable = role in roles
         c["editable"] = editable
     return c
+
+class ApiJsonModelQuery(object):
+    def __init__(self,name,params,parent,key):
+        self.name = name
+        self.params = params
+        self.parent = parent
+        self.key = key
+        self.query_params = self.parent.request_data[key]
+
+        try:
+            self.model = getattr(models,name)
+        except ModelNotFound as e:
+            log.error("try to find model '%s' but not found: '%s'"%(name,e))
+            raise UliwebError("model '%s' not found"%(name))
+
+        self.setting = settings.APIJSON_MODELS.get(name,{})
+        self.secret_fields = self.setting.get("secret_fields")
+        self.column = params.get("@column")
+        if self.column:
+            self.column_set = set(self.column.split(","))
+            if self.secret_fields:
+                self.column_set -= set(self.secret_fields)
+            self.column_set &= set(self.model.columns.keys())
+        else:
+            self.column_set = None
+        
+        self.permission_check_ok = False
+
+    def _check_GET_permission(self):
+        GET = self.setting.get("GET")
+        if not GET:
+            raise UliwebError("'%s' not accessible by apijson"%(name))
+    
+        roles = GET.get("roles")
+        params_role = self.params.get("@role")
+        
+        if not params_role:
+            if request.user:
+                params_role = "LOGIN"
+            else:
+                params_role = "UNKNOWN"
+        if params_role not in roles:
+            raise UliwebError("'%s' not accessible by role '%s'"%(model_name,params_role))
+        if params_role == "UNKNOWN":
+            self.permission_check_ok = True
+        elif functions.has_role(request.user,params_role):
+            self.permission_check_ok = True
+        else:
+            raise UliwebError("user doesn't have role '%s'"%(params_role))
+
+        if not self.permission_check_ok:
+            raise UliwebError("no permission")
+        
+        self.params_role = params_role
+
+    def _get_array_params(self):
+        query_count = self.query_params.get("@count")
+        if query_count:
+            try:
+                query_count = int(query_count)
+            except ValueError as e:
+                log.error("bad param in '%s': '%s'"%(n,self.query_params))
+                raise UliwebError("@count should be an int, now '%s'"%(query_count))
+        self.query_count = query_count
+
+        query_page = self.query_params.get("@page")
+        if query_page:
+            #@page begin from 0
+            try:
+                query_page = int(query_page)
+            except ValueError as e:
+                log.error("bad param in '%s': '%s'"%(n,self.query_params))
+                raise UliwebError("@page should be an int, now '%s'"%(query_page))
+            if query_page<0:
+                raise UliwebError("page should >0, now is '%s'"%(query_page))
+        self.query_page = query_page
+
+        #https://github.com/TommyLemon/APIJSON/blob/master/Document.md#32-%E5%8A%9F%E8%83%BD%E7%AC%A6
+        query_type = self.query_params.get("@query",0)
+        if query_type not in [0,1,2]:
+            raise UliwebError("bad param 'query': %s"%(query_type))
+        self.query_type = query_type
+
+        #order not in query params but in model params
+        self.order = self.params.get("@order")
+
+    def _filter_owner(self,q):
+        owner_filtered = False
+        if hasattr(self.model,"owner_condition"):
+            q = q.filter(model.owner_condition())
+            owner_filtered = True
+        if not owner_filtered:
+            user_id_field = self.setting.get("user_id_field")
+            if user_id_field:
+                q = q.filter(getattr(model.c,user_id_field)==request.user.id)
+                owner_filtered = True
+        if not owner_filtered:
+            raise UliwebError("'%s' cannot filter with owner"%(model_name))
+        return q
+
+    def _get_array_q(self,params):
+        q = self.model.all()
+        if self.params_role == "OWNER":
+            q = self._filter_owner(q)
+
+        #@expr
+        model_expr = params.get("@expr")
+        if model_expr:
+            c = self.parent._expr(self.model,params,model_expr)
+            q = q.filter(c)
+        else:
+            for n in params:
+                if n[0]!="@":
+                    c = self.parent._get_filter_condition(self.model,params,n)
+                    q = q.filter(c)
+        return q
+
+    def _get_info(self,i,as_dict_child=False):
+        
+        d = i.to_dict()
+        if self.secret_fields:
+            for k in self.secret_fields:
+                del d[k]
+        if self.column_set:
+            keys = list(d.keys())
+            for k in keys:
+                if k not in self.column_set:
+                    del d[k]
+        if as_dict_child:
+            resultd = {}
+            resultd[self.name] = d
+            return resultd
+        else:
+            return d
+
+    def query_array(self):
+        self._check_GET_permission()
+        self._get_array_params()
+        params = self.params.copy()
+
+        #update reference
+        ref_fields = []
+        refs = {}
+        for n in params:
+            if n[-1]=="@":
+                ref_fields.append(n)
+                col_name = n[:-1]
+                path = params[n]
+                refs[col_name] = self.parent._ref_get(path)
+        if ref_fields:
+            for i in ref_fields:
+                del params[i]
+            params.update(refs)
+
+        q = self._get_array_q(params)
+        
+        if self.query_type in [1,2]:
+            self.parent.vars["/%s/total"%(self.key)] = q.count()
+
+        if self.query_type in [0,2]:
+            if self.query_count:
+                if self.query_page:
+                    q = q.offset(self.query_page*self.query_count)
+                q = q.limit(self.query_count)
+            if self.order:
+                for k in self.order.split(","):
+                    if k[-1] == "+":
+                        sort_key = k[:-1]
+                        sort_order = "asc"
+                    elif k[-1] == "-":
+                        sort_key = k[:-1]
+                        sort_order = "desc"
+                    else:
+                        sort_key = k
+                        sort_order = "asc"
+                    column = getattr(self.model.c,sort_key)
+                    q = q.order_by(getattr(column,sort_order)())
+            l = [self._get_info(i,True) for i in q]
+            self.parent.rdict[self.key] = l
+
+    def associated_query_array(self):
+        self._check_GET_permission()
+        self._get_array_params()
+        for item in self.parent.rdict[self.key]:
+            params = self.params.copy()
+            #update reference
+            ref_fields = []
+            refs = {}
+            for n in params:
+                if n[-1]=="@":
+                    ref_fields.append(n)
+                    col_name = n[:-1]
+                    path = params[n]
+                    refs[col_name] = self.parent._ref_get(path,context=item)
+            if ref_fields:
+                for i in ref_fields:
+                    del params[i]
+                params.update(refs)
+            q = self._get_array_q(params)
+            q = q.limit(1)
+            item[self.name] = self._get_info(q.one())
diff --git a/uliweb_apijson/apijson/views.py b/uliweb_apijson/apijson/views.py
index 6add24a..9ba040b 100644
--- a/uliweb_apijson/apijson/views.py
+++ b/uliweb_apijson/apijson/views.py
@@ -6,6 +6,7 @@
 from collections import OrderedDict
 import logging
 import traceback
+from . import ApiJsonModelQuery
 
 log = logging.getLogger('apijson')
 
@@ -34,14 +35,37 @@ def _apply_vars(self):
                 if v:
                     self.rdict[key[:-1]] = v
 
-    def _ref_get(self,path):
+    def _ref_get(self,path,context={}):
         if path[0]=="/":
-            #TODO: relative path
-            pass
+            #relative path
+            c = context
+            for i in path.split("/"):
+                if i:
+                    if isinstance(c,dict):
+                        c = c.get(i)
+                    elif isinstance(c,list):
+                        try:
+                            c = c[int(i)]
+                        except Exception as e:
+                            raise UliwebError("bad path item '%s' in path '%s', error: %s"%(i,path,e))
+                    else:
+                        raise UliwebError("cannot get '%s' from '%s'"%(i,c))
+            return c
         else:
             #absolute path
-            m,c = path.split("/")
-            return self.rdict.get(m,{}).get(c)
+            c = self.rdict
+            for i in path.split("/"):
+                if i:
+                    if isinstance(c,dict):
+                        c = c.get(i)
+                    elif isinstance(c,list):
+                        try:
+                            c = c[int(i)]
+                        except Exception as e:
+                            raise UliwebError("bad path item '%s' in path '%s', error: %s"%(i,path,e))
+                    else:
+                        raise UliwebError("bad path item '%s' in path '%s'"%(i,path))
+            return c
 
     def get(self):
         try:
@@ -144,154 +168,17 @@ def _get_one(self,key):
 
     def _get_array(self,key):
         params = self.request_data[key]
-        model_name = None
-        model_param = None
-        model_column_set = None
-
-        query_count = params.get("@count")
-        if query_count:
-            try:
-                query_count = int(query_count)
-            except ValueError as e:
-                log.error("bad param in '%s': '%s'"%(n,params))
-                return json({"code":400,"msg":"@count should be an int, now '%s'"%(params[n])})
-
-        query_page = params.get("@page")
-        if query_page:
-            #@page begin from 0
-            try:
-                query_page = int(query_page)
-            except ValueError as e:
-                log.error("bad param in '%s': '%s'"%(n,params))
-                return json({"code":400,"msg":"@page should be an int, now '%s'"%(params[n])})
-            if query_page<0:
-                return json({"code":400,"msg":"page should >0, now is '%s'"%(query_page)})
-
-        #https://github.com/TommyLemon/APIJSON/blob/master/Document.md#32-%E5%8A%9F%E8%83%BD%E7%AC%A6
-        query_type = params.get("@query",0)
-        if query_type not in [0,1,2]:
-            return json({"code":400,"msg":"bad param 'query': %s"%(query_type)})
-
-        for n in params:
-            if n[0]!="@":
-                # TODO: support join in the future, now only support 1 model
-                model_name = n
-                break
-
-        if not model_name:
-            return json({"code":400,"msg":"no model found in array query"})
-
-        #model settings
-        model_setting = settings.APIJSON_MODELS.get(model_name,{})
-        secret_fields = model_setting.get("secret_fields")
-
-        #model params
-        #column
-        model_param = params[n]
-        model_column = model_param.get("@column")
-        if model_column:
-            model_column_set = set(model_column.split(","))
-        try:
-            model = getattr(models,model_name)
-        except ModelNotFound as e:
-            log.error("try to find model '%s' but not found: '%s'"%(model_name,e))
-            return json({"code":400,"msg":"model '%s' not found"%(model_name)})
-        #order
-        model_order = model_param.get("@order")
-
-        q = model.all()
-
-        GET = model_setting.get("GET")
-        if not GET:
-            return json({"code":400,"msg":"'%s' not accessible by apijson"%(model_name)})
 
-        roles = GET.get("roles")
-        params_role = model_param.get("@role")
-        permission_check_ok = False
-        if not params_role:
-            if request.user:
-                params_role = "LOGIN"
-            else:
-                params_role = "UNKNOWN"
-        if params_role not in roles:
-            return json({"code":400,"msg":"'%s' not accessible by role '%s'"%(model_name,params_role)})
-        if params_role == "UNKNOWN":
-            permission_check_ok = True
-        elif functions.has_role(request.user,params_role):
-            permission_check_ok = True
-        else:
-            return json({"code":400,"msg":"user doesn't have role '%s'"%(params_role)})
-
-        if not permission_check_ok:
-            return json({"code":400,"msg":"no permission"})
-
-        if params_role == "OWNER":
-            owner_filtered,q = self._filter_owner(model,model_setting,q)
-            if not owner_filtered:
-                return  json({"code":400,"msg":"'%s' cannot filter with owner"%(model_name)})
-
-        model_expr = model_param.get("@expr")
-
-        #update reference
-        ref_fields = []
-        refs = {}
-        for n in model_param:
-            if n[-1]=="@":
-                ref_fields.append(n)
-                col_name = n[:-1]
-                path = model_param[n]
-                refs[col_name] = self._ref_get(path)
-        if ref_fields:
-            for i in ref_fields:
-                del model_param[i]
-            model_param.update(refs)
-
-        if model_expr:
-            c = self._expr(model,model_param,model_expr)
-            q = q.filter(c)
-        else:
-            for n in model_param:
-                if n[0]!="@":
-                    c = self._get_filter_condition(model,model_param,n)
-                    q = q.filter(c)
-
-        if query_type in [1,2]:
-            self.vars["/%s/total"%(key)] = q.count()
-
-        if query_type in [0,2]:
-            if query_count:
-                if query_page:
-                    q = q.offset(query_page*query_count)
-                q = q.limit(query_count)
-            if model_order:
-                for k in model_order.split(","):
-                    if k[-1] == "+":
-                        sort_key = k[:-1]
-                        sort_order = "asc"
-                    elif k[-1] == "-":
-                        sort_key = k[:-1]
-                        sort_order = "desc"
-                    else:
-                        sort_key = k
-                        sort_order = "asc"
-                    column = getattr(model.c,sort_key)
-                    q = q.order_by(getattr(column,sort_order)())
-
-            def _get_info(i):
-                resultd = {}
-                d = i.to_dict()
-                if secret_fields:
-                    for k in secret_fields:
-                        del d[k]
-                if model_column_set:
-                    keys = list(d.keys())
-                    for k in keys:
-                        if k not in model_column_set:
-                            del d[k]
-                resultd[model_name] = d
-                return resultd
-            l = [_get_info(i) for i in q]
-            self.rdict[key] = l
+        names = [n for n in params if n[0]!='@']
+        if names:
+            #main model
+            n = names[0]
+            mquery = ApiJsonModelQuery(n,params[n],self,key)
+            mquery.query_array()
+            #additional model
+            for n in names[1:]:
+                mquery = ApiJsonModelQuery(n,params[n],self,key)
+                mquery.associated_query_array()
 
     def _filter_owner(self,model,model_setting,q):
         owner_filtered = False