aclatraz 0.1.3 → 0.1.4

data/spec/aclatraz/guard_spec.rb

@@ -1,10 +1,10 @@
 require 'spec_helper'
 
 describe "Aclatraz guard" do 
-  before(:all) { Aclatraz.init(:redis, "redis://localhost:6379/0") }
-  let(:suspect) { @foo ||= StubSuspect.new }
-  
   subject { Class.new(StubGuarded) }
+  let(:suspect) { @suspect ||= StubSuspect.new }
+  before(:all) { Aclatraz.init(:redis, "redis://localhost:6379/0") }
+  define_method(:deny_access) { raise_error(Aclatraz::AccessDenied) }
  
   it "#acl_guard? should be true" do 
     subject.acl_guard?.should be_true
@@ -12,19 +12,19 @@ describe "Aclatraz guard" do
   
   it "should properly guard permissions" do
     guarded_class = subject
-    guarded_class.name = "test1"
+    guarded_class.name = "FirstGuarded"
     
     guarded_class.suspects suspect do 
-      allow :role1
-      deny :role2
+      allow :manager
+      deny  :client
       on :bar do
-        allow :role3
-        deny :role4 => StubTarget
+        allow :bartender
+        deny  :owner => StubTarget
       end
-      on :bla do 
-        deny :role3
-        allow :role2 => :target
-        allow :role6 => 'bar'
+      on :kitchen do 
+        deny  :bartender
+        allow :client_of => :target
+        allow :cleaner_of => 'bar'
       end
       on :deny_all do 
         deny all
@@ -34,7 +34,7 @@ describe "Aclatraz guard" do
       end
     end
     guarded_class.suspects do 
-      allow :role5
+      allow :boss
     end
     
     guarded_class.class_eval do 
@@ -43,163 +43,152 @@ describe "Aclatraz guard" do
     
     guarded = guarded_class.new
     
-    lambda { guarded.guard! }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is.role1!
-    lambda { guarded.guard! }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is.role2!
-    lambda { guarded.guard! }.should raise_error(Aclatraz::AccessDenied) 
-    suspect.is.role5!
-    lambda { guarded.guard! }.should_not raise_error(Aclatraz::AccessDenied)
-    
-    lambda { guarded.guard!(:bar) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role5!
-    lambda { guarded.guard!(:bar) }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role2!
-    lambda { guarded.guard!(:bar) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role1!
-    lambda { guarded.guard!(:bar) }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is.role3!
-    lambda { guarded.guard!(:bar) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is.role4!(StubTarget)
-    lambda { guarded.guard!(:bar) }.should raise_error(Aclatraz::AccessDenied)
-    
-    lambda { guarded.guard!(:bla) }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role3!
-    suspect.is.role1!
-    lambda { guarded.guard!(:bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role1!
-    lambda { guarded.guard!(:bla) }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is.role2!(guarded.target)
-    lambda { guarded.guard!(:bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role2!(guarded.target)
+    lambda { guarded.guard! }.should deny_access
+    lambda { suspect.is.manager!; guarded.guard! }.should_not deny_access
+    lambda { suspect.is.client!; guarded.guard! }.should deny_access 
+    lambda { suspect.is.boss!; guarded.guard! }.should_not deny_access
+    
+    lambda { guarded.guard!(:bar) }.should_not deny_access
+    lambda { suspect.is_not.boss!; guarded.guard!(:bar) }.should deny_access
+    lambda { suspect.is_not.client!; guarded.guard!(:bar) }.should_not deny_access
+    lambda { suspect.is_not.manager!; guarded.guard!(:bar) }.should deny_access
+    lambda { suspect.is.bartender!; guarded.guard!(:bar) }.should_not deny_access
+    lambda { suspect.is.owner!(StubTarget); guarded.guard!(:bar) }.should deny_access
+    
+    lambda { guarded.guard!(:kitchen) }.should deny_access
+    lambda { 
+      suspect.is_not.bartender!
+      suspect.is.manager!
+      guarded.guard!(:kitchen) 
+    }.should_not deny_access
+    lambda { suspect.is_not.manager!; guarded.guard!(:kitchen) }.should deny_access
+    lambda { suspect.is.client!(guarded.target); guarded.guard!(:kitchen) }.should_not deny_access
+    
     bar = StubTarget.new
     guarded.instance_variable_set('@bar', bar)
-    suspect.is.role6!(bar)
-    lambda { guarded.guard!(:bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is.role3!
-    lambda { guarded.guard!(:bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role6!(bar)
-    suspect.is.role5!
-    lambda { guarded.guard!(:bla) }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role3!
-    lambda { guarded.guard!(:bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    
-    suspect.is_not.role5!
-    suspect.is_not.role4!(StubTarget)
-    lambda { guarded.guard!(:bar, :bla) }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is.role1!
-    lambda { guarded.guard!(:bar, :bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is.role4!(StubTarget)
-    lambda { guarded.guard!(:bar, :bla) }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is.role2!(guarded.target)
-    lambda { guarded.guard!(:bar, :bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    
-    lambda { guarded.guard!(:allow_all) }.should_not raise_error(Aclatraz::AccessDenied)
-    lambda { guarded.guard!(:deny_all) }.should raise_error(Aclatraz::AccessDenied)
-    
-    lambda { guarded.guard!(:bar, :allow_all, :bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is_not.role2!(guarded.target)
-    lambda { guarded.guard!(:bar, :allow_all, :bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    suspect.is.role3! 
-    lambda { guarded.guard!(:bar, :allow_all, :bla) }.should raise_error(Aclatraz::AccessDenied)
-    
-    suspect.is_not.role3!
-    lambda { guarded.guard!(:bar, :deny_all, :bla) }.should raise_error(Aclatraz::AccessDenied)
-    suspect.is.role2!(guarded.target)
-    lambda { guarded.guard!(:bar, :deny_all, :bla) }.should_not raise_error(Aclatraz::AccessDenied)
-    
-    lambda { guarded.guard! { deny :role2 => :target } }.should raise_error(Aclatraz::AccessDenied)
+    
+    lambda { 
+      suspect.is_not.client!(guarded.target)
+      suspect.is.cleaner!(bar)
+      guarded.guard!(:kitchen) 
+    }.should_not deny_access
+    
+    lambda { suspect.is.bartender!; guarded.guard!(:kitchen) }.should_not deny_access
+    lambda { 
+      suspect.is_not.cleaner!(bar)
+      suspect.is.boss!
+      guarded.guard!(:kitchen) 
+    }.should deny_access
+    lambda { suspect.is_not.bartender!; guarded.guard!(:kitchen) }.should_not deny_access
+    
+    lambda { 
+      suspect.is_not.boss!
+      suspect.is_not.owner!(StubTarget)
+      guarded.guard!(:bar, :kitchen) 
+    }.should deny_access
+    lambda { suspect.is.manager!; guarded.guard!(:bar, :kitchen) }.should_not deny_access
+    lambda { suspect.is.owner!(StubTarget); guarded.guard!(:bar, :kitchen) }.should deny_access
+    lambda { suspect.is.client!(guarded.target); guarded.guard!(:bar, :kitchen) }.should_not deny_access
+    
+    lambda { guarded.guard!(:allow_all) }.should_not deny_access
+    lambda { guarded.guard!(:deny_all) }.should deny_access
+    
+    lambda { guarded.guard!(:bar, :allow_all, :kitchen) }.should_not deny_access
+    lambda { 
+      suspect.is_not.client!(guarded.target)
+      guarded.guard!(:bar, :allow_all, :kitchen) 
+    }.should_not deny_access
+    lambda { 
+      suspect.is.bartender!
+      guarded.guard!(:bar, :allow_all, :kitchen) 
+    }.should deny_access
+    
+    lambda { 
+      suspect.is_not.bartender!
+      guarded.guard!(:bar, :deny_all, :kitchen) 
+    }.should deny_access
+    lambda { 
+      suspect.is.client!(guarded.target)
+      guarded.guard!(:bar, :deny_all, :kitchen) 
+    }.should_not deny_access
+    
+    lambda { guarded.guard! { deny :client => :target } }.should deny_access
   end
   
-  it "when invalid permission given then #guard! should raise InvalidPermission error" do 
-    guarded_class = subject
-    guarded_class.name = "test2"
-    guarded_class.suspects(suspect) { allow Object.new }
-    guarded = guarded_class.new
-    lambda { guarded.guard! }.should raise_error(Aclatraz::InvalidPermission)
+  it "should raise error when invalid permission given" do 
+    lambda { 
+      guarded_class = subject
+      guarded_class.name = "SecondGuarded"
+      guarded_class.suspects(suspect) { allow Object.new }
+      guarded = guarded_class.new
+      guarded.guard! 
+    }.should raise_error(Aclatraz::InvalidPermission)
   end
   
-  it "when invalid suspect given then #guard! should raise InvalidSuspect error" do 
-    guarded_class = subject
-    guarded_class.name = "test3"
-    guarded_class.suspects('bar') { }
-    guarded = guarded_class.new
-    lambda { guarded.guard! }.should raise_error(Aclatraz::InvalidSuspect)
+  it "should raise error when invalid suspect given" do 
+    lambda { 
+      guarded_class = subject
+      guarded_class.name = "ThirdGuarded"
+      guarded_class.suspects('invalid_suspect') { }
+      guarded = guarded_class.new
+      guarded.guard! 
+    }.should raise_error(Aclatraz::InvalidSuspect)
   end
 
-  it "when ACL is not defined then #guard! should raise UndefinedAccessControlList error" do 
-    guarded_class = subject
-    guarded_class.name = "test4"
-    guarded = guarded_class.new
-    lambda { guarded.guard! }.should raise_error(Aclatraz::UndefinedAccessControlList)
+  it "should raise error when ACL is not defined" do 
+    lambda { 
+      guarded_class = subject
+      guarded_class.name = "FourthGuarded"
+      guarded = guarded_class.new
+      guarded.guard! 
+    }.should raise_error(Aclatraz::UndefinedAccessControlList)
   end
   
-  it "when given suspect name is symbol then #suspect should reference to instance method" do 
+  it "suspect should reference to instance method when given suspect name is kind of symbol" do 
     guarded_class = subject
-    guarded_class.name = "test5"
-    guarded_class.suspects(:foo) {}
+    guarded_class.name = "FifthGuarded"
+    guarded_class.suspects(:user) {}
     guarded = guarded_class.new
-    guarded.class.class_eval { def foo; @foo ||= StubSuspect.new; end } 
-    guarded.suspect.should == guarded.foo
+    guarded.class.class_eval { def user; @user ||= StubSuspect.new; end } 
+    guarded.suspect.should == guarded.user
   end
 
-  it "when given suspect name is string #suspect should reference to instance variable" do 
+  it "suspect should reference to instance variable when given suspect name is kind of string" do 
     guarded_class = subject
-    guarded_class.name = "test6"
-    guarded_class.suspects('foo') {}
+    guarded_class.name = "SixthGuarded"
+    guarded_class.suspects('user') {}
     guarded = guarded_class.new
-    guarded.instance_variable_set("@foo", StubSuspect.new)
-    guarded.suspect.should == guarded.instance_variable_get("@foo")
+    guarded.instance_variable_set("@user", StubSuspect.new)
+    guarded.suspect.should == guarded.instance_variable_get("@user")
   end
   
-  it "when given suspect is an object then #suspect should refence to it" do 
-    bar = StubSuspect.new
+  it "suspect should reference to given object if passed" do 
+    suspect = StubSuspect.new
     guarded_class = subject
-    guarded_class.name = "test7"
-    guarded_class.suspects(bar) {}
+    guarded_class.name = "SeventhGuarded"
+    guarded_class.suspects(suspect) {}
     guarded = guarded_class.new
-    guarded.suspect.should == bar
+    guarded.suspect.should == suspect
   end 
   
-  context "inherited guards" do 
-    class FooParent
-      include Aclatraz::Guard
-      
-      suspects :user do
-        allow :nested1
-        deny :nested2
-      end
-      
-      def user; @user ||= StubSuspect.new; end
-    end
+  it "should properly resolve inherited permissions" do
+    parent = GuardedParent.new
+    child  = GuardedChild.new
     
-    class BarChild < FooParent
-      suspects do
-        deny :nested1
-        allow :nested3
-      end
-    end
+    child.user.is_not.cooker!
+    child.user.is_not.waiter!
+    child.user.is_not.manager!
     
-    it "should work properly" do
-      foo = FooParent.new
-      bar = BarChild.new
-      
-      lambda { foo.guard! }.should raise_error(Aclatraz::AccessDenied)
-      foo.user.is.nested1!
-      lambda { foo.guard! }.should_not raise_error(Aclatraz::AccessDenied)
-      foo.user.is.nested2!
-      lambda { foo.guard! }.should raise_error(Aclatraz::AccessDenied)
-      
-      bar.user.is_not.nested1!
-      bar.user.is_not.nested2!
-      
-      lambda { bar.guard! }.should raise_error(Aclatraz::AccessDenied)
-      bar.user.is.nested1!
-      lambda { bar.guard! }.should raise_error(Aclatraz::AccessDenied)
-      bar.user.is.nested2!
-      lambda { bar.guard! }.should raise_error(Aclatraz::AccessDenied)
-      bar.user.is.nested3!
-      lambda { bar.guard! }.should_not raise_error(Aclatraz::AccessDenied)
-    end
+    lambda { parent.guard! }.should deny_access
+    lambda { parent.user.is.cooker!; parent.guard! }.should_not deny_access
+    lambda { parent.user.is.waiter!; parent.guard! }.should deny_access
+    
+    child.user.is_not.cooker!
+    child.user.is_not.waiter!
+    
+    lambda { child.guard! }.should deny_access
+    lambda { child.user.is.cooker!; child.guard! }.should deny_access
+    lambda { child.user.is.waiter!; child.guard! }.should deny_access
+    lambda { child.user.is.manager!; child.guard! }.should_not deny_access
   end
 end

data/spec/aclatraz/stores_spec.rb

@@ -1,53 +1,52 @@
 require 'spec_helper'
 
-STORE_SPECS = proc do
-  it "should properly assign given roles to owner and check permissions" do
+COMMON_STORE_SPECS = proc do
+  it "should assign roles to owner and properly check permissions" do
     subject.clear
-    subject.set("foo", owner)
-    subject.check("foo", owner).should be_true
+    subject.set("admin", owner)
+    subject.set("manager", owner, StubTarget)
+    subject.set("creator", owner, target)
     
-    subject.set("bar", owner, StubTarget)
-    subject.check("bar", owner, StubTarget).should be_true
-    
-    subject.set("bla", owner, target)
-    subject.check("bla", owner, target).should be_true
-    
-    subject.check("foo", owner, target).should be_false
-    subject.check("foo", owner, StubTarget).should be_false
-    subject.check("bar", owner).should be_false
+    subject.check("admin", owner).should be_true
+    subject.check("manager", owner, StubTarget).should be_true
+    subject.check("creator", owner, target).should be_true
+
+    subject.check("owner", owner, target).should be_false
+    subject.check("tester", owner, StubTarget).should be_false
+    subject.check("waiter", owner).should be_false
   end
   
-  it "should properly delete given permission" do
+  it "should delete given permission" do
     subject.clear
-    subject.set("foo", owner)
-    subject.set("bar", owner, StubTarget)
-    subject.set("bla", owner, target)
+    subject.set("admin", owner)
+    subject.set("manager", owner, StubTarget)
+    subject.set("creator", owner, target)
     
-    subject.delete("foo", owner)
-    subject.delete("bar", owner, StubTarget)
-    subject.delete("bla", owner, target)
+    subject.delete("admin", owner)
+    subject.delete("manager", owner, StubTarget)
+    subject.delete("creator", owner, target)
     
-    subject.check("bar", owner).should be_false
-    subject.check("bar", owner, StubTarget).should be_false
-    subject.check("bar", owner, target).should be_false
+    subject.check("admin", owner).should be_false
+    subject.check("manager", owner, StubTarget).should be_false
+    subject.check("creator", owner, target).should be_false
   end
   
-  it "should allow to fetch whole list of roles" do 
-    subject.set("foo", owner)
-    subject.set("bar", owner)
-    subject.set("bla", owner)
+  it "should allow to fetch list of all roles" do 
+    subject.clear
+    subject.set("waiter", owner)
+    subject.set("cooker", owner)
+    subject.set("worker", owner)
     
-    subject.roles.should_not be_empty
-    (subject.roles - ["foo", "bar", "bla"]).should be_empty 
+    (subject.roles - ["waiter", "cooker", "worker"]).should be_empty 
   end
   
   it "should allow to fetch list of roles for specified member" do 
-    subject.set("foo", owner)
-    subject.set("bar", owner)
-    subject.set("bla", owner)
+    subject.clear
+    subject.set("waiter", owner)
+    subject.set("cooker", owner)
+    subject.set("worker", owner)
     
-    subject.roles(owner).should_not be_empty
-    (subject.roles(owner) - ["foo", "bar", "bla"]).should be_empty
+    (subject.roles(owner) - ["waiter", "cooker", "worker"]).should be_empty
   end
 end
 
@@ -57,8 +56,7 @@ describe "Aclatraz" do
   
   context "for Redis store" do 
     subject { Aclatraz.init(:redis, "redis://localhost:6379/0") }
-    
-    class_eval &STORE_SPECS
+    class_eval(&COMMON_STORE_SPECS)
     
     it "should respect persistent connection given on initalize" do 
       Aclatraz.instance_variable_set("@store", nil)
@@ -74,22 +72,9 @@ describe "Aclatraz" do
     end 
   end
 
-  context "for Riak store" do 
-    subject { Aclatraz.init(:riak, "roles") }
-    
-    class_eval &STORE_SPECS
-    
-    it "should respect persistent connection given on initalize" do 
-      Aclatraz.instance_variable_set("@store", nil)
-      Aclatraz.init(:riak, "roles", Riak::Client.new)
-      Aclatraz.store.instance_variable_get('@backend').should be_kind_of(Riak::Bucket)
-    end
-  end
-  
   context "for Cassandra store" do 
     subject { Aclatraz.init(:cassandra, "Super1", "Keyspace1") }
-  
-    class_eval &STORE_SPECS
+    class_eval(&COMMON_STORE_SPECS)
   
     it "should respect persistent connection given on initialize" do 
       Aclatraz.instance_variable_set("@store", nil)
@@ -97,4 +82,23 @@ describe "Aclatraz" do
       Aclatraz.store.instance_variable_get('@backend').should be_kind_of(Cassandra)
     end
   end
+  
+  context "for MongoDB store" do
+    subject {
+      require 'mongo'
+      Aclatraz.init(:mongo, "roles", @mongo ||= Mongo::Connection.new.db("aclatraz_test"))
+    }
+    class_eval(&COMMON_STORE_SPECS)
+  end
+  
+  context "for Riak store" do 
+    subject { Aclatraz.init(:riak, "roles") }
+    class_eval(&COMMON_STORE_SPECS)
+    
+    it "should respect persistent connection given on initalize" do 
+      Aclatraz.instance_variable_set("@store", nil)
+      Aclatraz.init(:riak, "roles", Riak::Client.new)
+      Aclatraz.store.instance_variable_get('@backend').should be_kind_of(Riak::Bucket)
+    end
+  end
 end