access_allow 0.3.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 458da1a119c6606e246922038f072b38c0bc2f8c20523632f488bd4d43edfc44
-  data.tar.gz: 1542588b7aa2089606ad86e7d3f6f12758518c254d18f6dfe1b66ecf967f309d
+  metadata.gz: 55a090067e35bd41ae5733616ab549afcf3b3d535ccd9b39e216b9ae07860f76
+  data.tar.gz: 43959999c68c2fd34ebfb5a0c96e19e3670270d42b398c9246c1a41f814b7d46
 SHA512:
-  metadata.gz: f79b8ced59ff64a928c1dcc5bfda60e565f535a7ce14d00b60793da62116f4e5841235a7e18647c5ae121a1853dec0e9f6b879d90162b80dc1007d2d04bcac57
-  data.tar.gz: e693609407e0170b2ba310ace1cfa617a84c17053ad66d7e151862e4860267457bfd01de6021f48c6eaff77b1abf76638c7d9b9c21cecc4aa9a4708e117f4bb6
+  metadata.gz: a31d49e551f83ac73531d086f6c4af5cd28a915b254ecd2ae335a4aef659b1e43afd609185989e87c3cf5ace04f2e89e25df017d752880c84d488781b2ba291e
+  data.tar.gz: 07b0445358724d79cbc504dff3ef07bfe95073c16407bd4036012486c7c0073586806a76bc07666bcf1a4fe9adc3367dcee727b3dde0d6c694e0dcf8803e0246

data/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0]
+
+First stable release. The public DSL (`access_allow`, `access_require`,
+`access_no_match`, `access_allowed?`) is unchanged and considered stable.
+
+### Added
+- Configurable logging: `config.logger` (defaults to `Rails.logger`) and
+  `config.permission_check_log_level` (defaults to `:debug`).
+
+### Changed
+- Per-check "user cannot do X" lines now log at `:debug` instead of `:info`.
+  These fire on every failed ability check (menu visibility, record scoping)
+  and are normal control flow, not violations, so they no longer flood
+  request logs. Set `config.permission_check_log_level = nil` to silence them
+  entirely. Actual access violations remain logged at `:info`/`:error`.
+
+### Fixed
+- `Abilities.parse_qualified_name` raised `NoMethodError` instead of a
+  descriptive `StandardError` for blank or malformed ability names (missing
+  comma in the `raise` call).
+
+### Removed
+- Dead `AbilitiesManager#about_user` method.
+
+### Internal
+- Test coverage raised to 100% line / 98% branch; the two remaining branches
+  are unreachable defensive guards.
+- Added a project `.standard.yml`.
+
+## [0.3.0]
+- Earlier releases (pre-changelog). See the git history for details.

data/README.md

@@ -367,6 +367,34 @@ Then run the **generator to add the initializer**
     rails g access_allow:install
 
 
+## Configuration
+
+All configuration is done through `AccessAllow.configure` (see the generated
+initializer):
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `roles_and_permissions` | `{}` | The roles/abilities schema (often loaded from YAML). |
+| `current_user_method` | `:current_user` | Controller method returning the current user. |
+| `permissions_association_name` | `:permissions` | Association holding a user's individually-assigned permissions. |
+| `role_method_name` | `:role` | Method on the user returning their role name. |
+| `logger` | `Rails.logger` | Logger used for all access logging. |
+| `permission_check_log_level` | `:debug` | Level for per-check "user cannot do X" lines. Set to `nil` to silence them. |
+
+### Logging
+
+A failed ability check (`access_allowed?`, `has_perms_for?`, a `with:` ability
+that isn't granted) is normal control flow — it decides menu visibility,
+record scoping, and so on. These produce one log line per check, so by default
+they are logged at `:debug` and stay out of production logs. Set
+`config.permission_check_log_level = nil` to silence them entirely, or raise it
+(e.g. `:info`) while debugging permission resolution.
+
+Actual access *violations* — a blocked request, a `:severe`/`:hidden`/
+`:not_permitted`/`:redirect` outcome — are always logged at `:info`/`:error`
+regardless of this setting.
+
+
 ## Contributing
 Contribution directions go here.
 

data/lib/access_allow/abilities.rb

@@ -10,11 +10,11 @@ module AccessAllow
 
       def parse_qualified_name(name)
         parts = name.split("/").map do |part|
-          raise StandardError "Ability namespaces or names cannot be blank" if part.blank?
+          raise StandardError, "Ability namespaces or names cannot be blank" if part.blank?
           part.to_sym
         end
         return parts if parts.size == 2
-        raise StandardError "Ability name must have a namespace and name (was #{name})"
+        raise StandardError, "Ability name must have a namespace and name (was #{name})"
       end
 
       def humanized_name(type, ability_namespace, ability_name)

data/lib/access_allow/abilities_manager.rb

@@ -73,9 +73,5 @@ module AccessAllow
       role = user.send(AccessAllow.configuration.role_method_name)
       (role.presence || "primary").to_sym
     end
-
-    def about_user
-      "#{user.class} with ID #{user.id}"
-    end
   end
 end

data/lib/access_allow/access_manager.rb

@@ -219,7 +219,7 @@ module AccessAllow
     # the rule configuration itself.
     def apply_custom_rule(rule, user, controller, action_name)
       controller.instance_exec(user, rule: rule, action_name: action_name) do |uut, rule_info|
-        check_name = "allow_#{rule}?".to_sym
+        check_name = :"allow_#{rule}?"
         unless respond_to?(check_name)
           raise NotImplementedError, "Check #{check_name} not implemented!"
         end

data/lib/access_allow/check.rb

@@ -28,28 +28,35 @@ module AccessAllow
 
     def possible?
       unless user
-        Rails.logger.info error_message(false)
+        log_failed_check
         return false
       end
-      ability_manager.has?(ability_namespace, ability_name).tap { |can| Rails.logger.info error_message(can) unless can }
+      ability_manager.has?(ability_namespace, ability_name).tap { |can| log_failed_check unless can }
     end
 
     def possible!
-      possible? || raise(AccessAllow::ViolationError, error_message(false))
+      possible? || raise(AccessAllow::ViolationError, error_message)
     end
 
     private
 
     attr_reader :user, :ability_namespace, :ability_name, :ability_manager
 
-    # Error messages
+    # A failed check is normal control flow, not a violation, so it logs at
+    # the configured level (default :debug; nil silences it). Actual access
+    # violations are logged by ControllerAccessDsl at :info/:error.
+    def log_failed_check
+      level = AccessAllow.configuration.permission_check_log_level
+      return unless level
+      AccessAllow.configuration.logger&.public_send(level) { error_message }
+    end
 
     def about_user
       user ? "#{user.class} with ID #{user.id}" : "Unauthenticated user"
     end
 
-    def error_message(can)
-      "#{about_user} #{can ? "can" : "cannot"} do '#{ability_name}'"
+    def error_message
+      "#{about_user} cannot do '#{ability_name}'"
     end
   end
 end

data/lib/access_allow/version.rb

@@ -1,3 +1,3 @@
 module AccessAllow
-  VERSION = "0.3.0"
+  VERSION = "1.0.0"
 end

data/lib/access_allow.rb

@@ -24,13 +24,28 @@ module AccessAllow
   end
 
   class Configuration
-    attr_accessor :roles_and_permissions, :current_user_method, :permissions_association_name, :role_method_name
+    attr_writer :logger
+    attr_accessor :roles_and_permissions, :current_user_method, :permissions_association_name,
+      :role_method_name, :permission_check_log_level
 
     def initialize
       @roles_and_permissions = {}
       @current_user_method = :current_user
       @permissions_association_name = :permissions
       @role_method_name = :role
+      @logger = nil
+      # Level used for the per-check "user cannot do X" lines. These fire on
+      # every failed ability check and are normal control flow (menu
+      # visibility, scoping), not violations — so they default to :debug.
+      # Set to nil to silence them entirely. Actual access violations are
+      # logged separately by ControllerAccessDsl at :info/:error.
+      @permission_check_log_level = :debug
+    end
+
+    # Falls back to Rails.logger at call time (not memoised) so a logger
+    # swapped in tests or after boot is always respected.
+    def logger
+      @logger || (defined?(Rails) ? Rails.logger : nil)
     end
   end
 end

data/lib/generators/access_allow/templates/access_allow.rb

@@ -7,4 +7,13 @@ AccessAllow.configure do |config|
   # config.current_user_method = :current_user
   # config.permissions_association_name = :permissions
   # config.role_method_name = :role
+
+  # Logger used for access logging. Defaults to Rails.logger.
+  # config.logger = Rails.logger
+
+  # Level for the per-check "user cannot do X" lines. These fire on every
+  # failed ability check and are normal control flow (menu visibility,
+  # scoping), so they default to :debug. Set to nil to silence them entirely.
+  # Actual access violations are always logged at :info/:error.
+  # config.permission_check_log_level = :debug
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: access_allow
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Stephen Ierodiaconou
@@ -29,13 +29,15 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '9'
-description: Permissions and access control gem for Rails.
+description: Role- and ability-based authorization for Rails controllers, with a declarative
+  DSL for allow/require rules, named checks and configurable access violations.
 email:
 - stevegeek@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - MIT-LICENSE
 - README.md
 - Rakefile
@@ -57,8 +59,9 @@ homepage: https://github.com/stevegeek/access_allow
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/stevegeek/access_allow
   source_code_uri: https://github.com/stevegeek/access_allow
+  changelog_uri: https://github.com/stevegeek/access_allow/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -73,7 +76,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Permissions and access control gem for Rails.
 test_files: []