access_context 1.0.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 35f221094e6d947704c8e17e0c4644318d636fc077a0c4d62262f8b5378c076d
-  data.tar.gz: 867c0f9a28e8c95c3a031b248ab4531856b82c7933408faee8ec54c6b787719c
+  metadata.gz: cf8fd9c40fd8ead10a5b0339819ebbe28df810da205a62ad2cfe89941719b378
+  data.tar.gz: 3c470c7062ef14ef0bf3b4f84de9300debfa56d6c7660a507f87ba8aacad3ec5
 SHA512:
-  metadata.gz: 79f979e9c208881bb092bd43e72882fc978f9f75fc98e83d2a7e346b47c8b3f048fa67f6d6221083f21249d3291b175030a4d938d5b433f76ad01db107403e2a
-  data.tar.gz: 0d2e2bd9bb250b6b38da3383a5fac485dc8c93a4a644a351e1ac5579a6d0ec91a551cc6e2b00fdf9782eb6936ac744c30456f1fce8f796733872e3a5de3e84d4
+  metadata.gz: 10bc8fbdb23048b79ed04cff2331798b146697e077646795b3b84a5cd43b541a4fcbcfc7619c73c391379b4944fdc2ca2a2a2cae6710f76f6b0bef9c3b6e88d7
+  data.tar.gz: 2c21b244b465bf0f4e9a0b39af640dd27e57f849b3861a49022c944b77e1806a2359218e8747ed094a88f1d1f0d833f770b600d4098876f3addf7ab4ebbf9da0

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 ## [Unreleased]
 
+## [2.0.0] - 2026-10-10
+
+- Add `AccessContext#granted_by_permission?` to check a context against a single permission
+- `AccessContext#permit?` also checks `user.permissions` when the user responds to it
+- `AccessContext#permit?` also checks `user.roles` when the user responds to it
+- `AccessContext#permit?` no longer requires `user.role`; a missing or `nil` role counts as no role
+- Fix loading with activesupport 7.1+
+
+### Upgrading from 1.x
+
+`permit?(user)` used to check only `user.role`. It now also checks `user.roles` and `user.permissions` whenever the user responds to them. Before upgrading, check whether your `User` already has `roles` or `permissions` methods for other reasons (e.g. a `has_many :roles` association from rolify):
+
+- `roles` must return role names (or `AccessContext::Role` objects) defined in `AccessContext.config`. Unknown names, or records that are not names, will raise.
+- `permissions` must return permission names (or `AccessContext::Permission` objects) defined in `AccessContext.config`. Any matching name now grants access, and an unknown name raises `AccessContext::Error`.
+
+If those methods mean something else in your app, rename them or pass `permit?` an object that only exposes what AccessContext should see, for example `permit?(OpenStruct.new(role: user.role))`.
+
+## [1.1.0] - 2025-03-24
+
+- Able to setup context without actions
+
 ## [1.0.0] - 2025-03-23
 
 - Initial release

data/README.md

@@ -29,6 +29,7 @@ AccessContext.config do
       job :welcome, :perform
     end
     grant 'admin_default' do
+      controller "admin/products"
       controller 'admin/dashboard', [:show]
       context :controller, "admin/orders", :show
     end
@@ -62,6 +63,24 @@ AccessContext.service(:visit, :call).permit?(support) #=> true
 AccessContext.view("admin/orders", :order_edit_button).permit?(support) #=> false
 ```
 
+`permit?` also supports users with several roles via `roles`, and users with their own `permissions`. Each of `role`, `roles` and `permissions` is only checked when `User` responds to it, and access is granted when any of them grants the context.
+
+```ruby
+user = User.new(roles: [:support, :admin])
+AccessContext.controller('admin/dashboard', :show).permit?(user) #=> true
+
+support = User.new(role: :support, permissions: ['admin_default'])
+AccessContext.controller('admin/dashboard', :show).permit?(support) #=> true
+```
+
+Or check whether a specific permission grants the context, regardless of role. An unknown permission name raises `AccessContext::Error`.
+
+```ruby
+AccessContext.controller(:home, :show).granted_by_permission?(:default) #=> true
+AccessContext.controller("admin/products", :new).granted_by_permission?(:admin_default) #=> true
+AccessContext.view("admin/orders", :order_edit_button).granted_by_permission?(:default) #=> false
+```
+
 3. Integrate it with Rails 
 
 ```ruby

data/lib/access_context/permission.rb

@@ -6,8 +6,12 @@ class AccessContext
         permissions[name.to_sym] = new(name, &block)
       end
 
-      def [](name)
-        permissions[name.to_sym]
+      def [](permission)
+        if permission.is_a?(Permission)
+          permission
+        else
+          permissions[permission.to_sym]
+        end
       end
 
       def all
@@ -28,13 +32,17 @@ class AccessContext
 
     def permit?(context)
       contexts.any? do |c|
-        c == context
+        c.contains?(context)
       end
     end
 
     def context(type, name, targets=[])
-      ([targets] || []).flatten.each do |target|
-        contexts << AccessContext.new(type, name, target)
+      if targets.present?
+        ([targets] || []).flatten.each do |target|
+          contexts << AccessContext.new(type, name, target)
+        end
+      else
+        contexts << AccessContext.new(type, name)
       end
     end
 

data/lib/access_context/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class AccessContext
-  VERSION = "1.0.0"
+  VERSION = "2.0.0"
 end

data/lib/access_context.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require_relative "access_context/version"
+require 'active_support'
+require 'active_support/dependencies/autoload'
+require 'active_support/core_ext'
 
 class AccessContext
 
@@ -36,14 +39,14 @@ class AccessContext
 
   attr_reader :type, :name, :target
 
-  def initialize(type, name, target)
+  def initialize(type, name, target=nil)
     @type = type.to_sym
     @name = name.to_sym
-    @target = target.to_sym
+    @target = target&.to_sym
   end
 
   def permit?(user)
-    permit_role?(user.role)
+    user_roles(user).any? { |role| permit_role?(role) } || permit_permissions?(user)
   end
 
   def permit_role?(role)
@@ -52,10 +55,37 @@ class AccessContext
     end
   end
 
-  def ==(context)
+  def granted_by_permission?(permission)
+    granted_permission = AccessContext::Permission[permission]
+    raise Error, "Unknown permission: #{permission.inspect}" unless granted_permission
+
+    granted_permission.permit?(self)
+  end
+
+  def contains?(context)
     type == context.type &&
     name == context.name &&
-    target == context.target
+    (
+      target == context.target ||
+      target.blank?
+    )
+  end
+
+  private
+
+  def user_roles(user)
+    roles = []
+    roles.concat(Array(user.role)) if user.respond_to?(:role)
+    roles.concat(Array(user.roles)) if user.respond_to?(:roles)
+    roles
+  end
+
+  def permit_permissions?(user)
+    return false unless user.respond_to?(:permissions)
+
+    Array(user.permissions).any? do |permission|
+      granted_by_permission?(permission)
+    end
   end
 
 end

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: access_context
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Hopper Gee
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-03-23 00:00:00.000000000 Z
-dependencies: []
+date: 2026-10-09 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Setup role with lightweight context-based permission
 email:
 - hopper.gee@hey.com