action_policy-graphql 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4af0cfd306d4128f52758c4336988f29bfa8628f5839aa18e1a54b366c07a9b9
-  data.tar.gz: 69098890e8c59b44dd2af5a902639dbc407ce190a73e55c1d84b6c9ce464bad0
+  metadata.gz: bd6ef7017bd2bda6778f20997ea146431c9ed368f35ca257fd96c2050f3036c4
+  data.tar.gz: 4270fc41dadbbce556841298bcd6b2de62bafd7ac9826dd7b7ea60907d6ba98e
 SHA512:
-  metadata.gz: 2ee55992d03aa2cd350c2c29e9c632c84dff85288a55ef3608e5f277d407f182a98a1bafd820e18caffe4571b1f896cc5608f72979958da0336e6afef0d7f7ef
-  data.tar.gz: a99cac79463311fecb84d459b537555b9cefe88e0b268b07412d5a0b053ce603c8cea3a426e92cd58033b789d474f008bd3f22b7296270f66e0409f37c0ac6bf
+  metadata.gz: 2337aa180c36185a1790863df06346c36ad17e3335d1dcc724ba6de9e9b498d0fb6c36336ee7cabe0489995dfe782447f9c1fe6da1747849a3ae58acb9a6aa90
+  data.tar.gz: f7448255b43d4cec0e5f837a11c00b48c74148ba0f2839520f9466286ff5f53594c1bcf1f033a08479790cc426a0a2feaf475a2c11739b2344a2231204b3f52f

data/.rubocop.yml

@@ -13,7 +13,7 @@ AllCops:
     - 'vendor/**/*'
     - 'gemfiles/**/*'
   DisplayCopNames: true
-  TargetRubyVersion: 2.4
+  TargetRubyVersion: 2.5
 
 Standard/SemanticBlocks:
   Enabled: false

data/.travis.yml

@@ -22,14 +22,14 @@ matrix:
       gemfile: gemfiles/action_policy/master.gemfile
     - rvm: 2.6
       gemfile: gemfiles/action_policy/0.3.gemfile
-    - rvm: jruby-9.2.5.0
+    - rvm: jruby-9.2.8.0
       gemfile: gemfiles/jruby.gemfile
+    - rvm: 2.7
+      gemfile: Gemfile
     - rvm: 2.6
       gemfile: Gemfile
     - rvm: 2.5
       gemfile: Gemfile
-    - rvm: 2.4
-      gemfile: Gemfile
   allow_failures:
     - rvm: ruby-head
       gemfile: gemfiles/graphql/master.gemfile
@@ -37,3 +37,5 @@ matrix:
       gemfile: gemfiles/graphql/master.gemfile
     - rvm: 2.6
       gemfile: gemfiles/action_policy/master.gemfile
+    - rvm: jruby-9.2.8.0
+      gemfile: gemfiles/jruby.gemfile

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## master (unreleased)
 
+## 0.4.0 (2010-03-11)
+
+- **Require Ruby 2.5+**. ([@palkan][])
+
+- Add `authorized_field: *` option to perform authorization on the base of the upper object policy prior to resolving fields. ([@sponomarev][])
+
 ## 0.3.2 (2019-12-12)
 
 - Fix compatibility with Action Policy 0.4.0 ([@haines][])
@@ -35,3 +41,4 @@ Action Policy helpers there.
 
 [@palkan]: https://github.com/palkan
 [@haines]: https://github.com/haines
+[@sponomarev]: https://github.com/sponomarev

data/README.md

@@ -98,7 +98,7 @@ class CityType < ::Common::Graphql::Type
 end
 ```
 
-**NOTE:** you cannot use `authorize: *` and `authorized_scope: *` at the same time but you can combine `preauthorize: *` with `authorized_scope: *`.
+**NOTE:** you cannot use `authorize: *` and `authorized_scope: *` at the same time but you can combine `preauthorize: *` or `authorize_field: *` with `authorized_scope: *`.
 
 ### `preauthorize: *`
 
@@ -126,7 +126,7 @@ end
 **NOTE:** we pass the field's name as the `record` to the policy rule. We assume that preauthorization rules do not depend on
 the record itself and pass the field's name for debugging purposes only.
 
-You can customize the authorization options, e.g. `authorize: {to: :preview?, with: CustomPolicy}`.
+You can customize the authorization options, e.g. `preauthorize: {to: :preview?, with: CustomPolicy}`.
 
 **NOTE:** unlike `authorize: *` you MUST specify the `with: SomePolicy` option.
 The default authorization rule depends on the type of the field:
@@ -134,6 +134,32 @@ The default authorization rule depends on the type of the field:
 - for lists we use `index?` (configured by `ActionPolicy::GraphQL.default_preauthorize_list_rule` parameter)
 - for _singleton_ fields we use `show?` (configured by `ActionPolicy::GraphQL.default_preauthorize_node_rule` parameter)
 
+### `authorize_field: *`
+
+If you want to perform authorization before resolving the field value _on the base of the upper object_, you can use `authorize_field: *` option:
+
+```ruby
+field :homes, Home, null: false, authorize_field: true
+
+def homes
+  Home.all
+end
+```
+
+The code above is equal to:
+
+```ruby
+field :homes, [Home], null: false
+
+def homes
+  authorize! object, to: :homes?
+  Home.all
+end
+```
+By default we use `#{underscored_field_name}?` authorization rule.
+
+You can customize the authorization options, e.g. `authorize_field: {to: :preview?, with: CustomPolicy}`.
+
 ### `expose_authorization_rules`
 
 You can add permissions/authorization exposing fields to "tell" clients which actions could be performed against the object or not (and why).

data/action_policy-graphql.gemspec

@@ -29,13 +29,13 @@ Gem::Specification.new do |spec|
 
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = ">= 2.4.0"
+  spec.required_ruby_version = ">= 2.5.0"
 
   spec.add_dependency "action_policy", ">= 0.3.0"
   spec.add_dependency "graphql", ">= 1.9.3"
 
   spec.add_development_dependency "bundler", ">= 1.15"
-  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.8"
   spec.add_development_dependency "rubocop", "~> 0.67.0"
   spec.add_development_dependency "rubocop-md", "~> 0.3"

data/lib/action_policy/graphql/authorized_field.rb

@@ -67,6 +67,28 @@ module ActionPolicy
         end
       end
 
+      class AuthorizeFieldExtension < Extension
+        def apply
+          @to = extract_option(:to) { underscored_field_name }
+          @raise = extract_option(:raise) { ::ActionPolicy::GraphQL.authorize_raise_exception }
+        end
+
+        def resolve(context:, object:, arguments:, **_rest)
+          if @raise
+            object.authorize! object.object, to: @to, **options
+            yield object, arguments
+          elsif object.allowed_to?(@to, object.object, **options)
+            yield object, arguments
+          end
+        end
+
+        private
+
+        def underscored_field_name
+          "#{field.instance_variable_get(:@underscored_name)}?".to_sym
+        end
+      end
+
       class ScopeExtension < Extension
         def after_resolve(value:, context:, object:, **_rest)
           return value if value.nil?
@@ -75,14 +97,14 @@ module ActionPolicy
         end
       end
 
-      def initialize(*args, preauthorize: nil, authorize: nil, authorized_scope: nil, **kwargs, &block)
+      def initialize(*args, preauthorize: nil, authorize: nil, authorized_scope: nil, authorize_field: nil, **kwargs, &block)
         if authorize && authorized_scope
           raise ArgumentError, "Only one of `authorize` and `authorized_scope` " \
-                               "options could be specified. You can use `preauthorize` along with scoping"
+                               "options could be specified. You can use `preauthorize` or `authorize_field` along with scoping"
         end
 
-        if authorize && preauthorize
-          raise ArgumentError, "Only one of `authorize` and `preauthorize` " \
+        if !!authorize == !!preauthorize ? authorize : authorize_field
+          raise ArgumentError, "Only one of `authorize`, `preauthorize` or `authorize_field` " \
                                "options could be specified."
         end
 
@@ -91,6 +113,7 @@ module ActionPolicy
         add_extension! extensions, AuthorizeExtension, authorize
         add_extension! extensions, ScopeExtension, authorized_scope
         add_extension! extensions, PreauthorizeExtension, preauthorize
+        add_extension! extensions, AuthorizeFieldExtension, authorize_field
 
         super(*args, **kwargs, &block)
       end

data/lib/action_policy/graphql/fields.rb

@@ -45,7 +45,7 @@ module ActionPolicy
                   null: false
 
             define_method(gql_field_name) do
-              allowance_to(rule, options)
+              allowance_to(rule, **options)
             end
           end
         end

data/lib/action_policy/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActionPolicy
   module GraphQL
-    VERSION = "0.3.2"
+    VERSION = "0.4.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: action_policy-graphql
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - Vladimir Dementyev
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-12-12 00:00:00.000000000 Z
+date: 2020-03-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: action_policy
@@ -58,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -183,7 +183,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.4.0
+      version: 2.5.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="