action_policy 0.0.1 → 0.1.0

data/lib/action_policy/policy/core.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "action_policy/behaviours/policy_for"
+
+module ActionPolicy
+  # Raised when `resolve_rule` failed to find an approriate
+  # policy rule method for the activity
+  class UnknownRule < Error
+    attr_reader :policy, :rule, :message
+
+    def initialize(policy, rule)
+      @policy = policy.class
+      @rule = rule
+      @message = "Couldn't find rule '#{@rule}' for #{@policy}"
+    end
+  end
+
+  module Policy
+    # Core policy API
+    module Core
+      include ActionPolicy::Behaviours::PolicyFor
+
+      attr_reader :record
+
+      def initialize(record = nil)
+        @record = record
+      end
+
+      # Returns a result of applying the specified rule.
+      # Unlike simply calling a predicate rule (`policy.manage?`),
+      # `apply` also calls pre-checks.
+      def apply(rule)
+        public_send(rule)
+      end
+
+      # Returns a result of applying the specified rule to the specified record.
+      # Under the hood a policy class for record is resolved
+      # (unless it's explicitly set through `with` option).
+      #
+      # If record is `nil` then we uses the current policy.
+      def allowed_to?(rule, record = :__undef__, **options)
+        policy =
+          if record == :__undef__
+            self
+          else
+            policy_for(record: record, **options)
+          end
+
+        policy.apply(rule)
+      end
+
+      # Returns a rule name (policy method name) for activity.
+      #
+      # By default, rule name is equal to activity name.
+      #
+      # Raises ActionPolicy::UknownRule when rule is not found in policy.
+      def resolve_rule(activity)
+        raise UnknownRule.new(self, activity) unless
+          respond_to?(activity)
+        activity
+      end
+    end
+  end
+end

data/lib/action_policy/policy/defaults.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module ActionPolicy
+  module Policy
+    # Create default rules and aliases:
+    # - `index?` (=`false`)
+    # - `create?` (=`false`)
+    # - `new?` as an alias for `create?`
+    # - `manage?` as a fallback for all unspecified rules (default rule)
+    module Defaults
+      def self.included(base)
+        raise "Aliases support is required for defaults" unless
+          base.ancestors.include?(Aliases)
+
+        base.default_rule :manage?
+        base.alias_rule :new?, to: :create?
+
+        raise "Verification context support is required for defaults" unless
+          base.ancestors.include?(Aliases)
+
+        base.authorize :user
+      end
+
+      def index?
+        false
+      end
+
+      def create?
+        false
+      end
+
+      def manage?
+        false
+      end
+    end
+  end
+end

data/lib/action_policy/policy/pre_check.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+module ActionPolicy
+  module Policy
+    # Adds callback-style checks to policies to
+    # extract common checks from rules.
+    #
+    #    class ApplicationPolicy < ActionPolicy::Base
+    #      authorize :user
+    #      pre_check :allow_admins
+    #
+    #      private
+    #        # Allow every action for admins
+    #        def allow_admins
+    #          allow! if user.admin?
+    #        end
+    #    end
+    #
+    # You can specify conditional pre-checks (through `except` / `only`) options
+    # and skip already defined pre-checks if necessary.
+    #
+    #    class UserPolicy < ApplicationPolicy
+    #      skip_pre_check :allow_admins, only: :destroy?
+    #
+    #      def destroy?
+    #        user.admin? && !record.admin?
+    #      end
+    #    end
+    module PreCheck
+      # Single pre-check instance.
+      #
+      # Implements filtering logic.
+      class Check
+        # Wrapper over check result
+        class Result
+          DENY = :__deny__
+          ALLOW = :__allow__
+
+          KINDS = {
+            DENY => false,
+            ALLOW => true
+          }.freeze
+
+          attr_reader :fulfilled
+
+          def initialize(val)
+            @fulfilled = KINDS.keys.include?(val)
+            @value = val
+          end
+
+          alias fulfilled? fulfilled
+
+          def denied?
+            @value == DENY
+          end
+
+          def value
+            KINDS.fetch(@value)
+          end
+        end
+
+        attr_reader :name, :policy_class
+
+        def initialize(policy, name, except: nil, only: nil)
+          if !except.nil? && !only.nil?
+            raise ArgumentError,
+                  "Only one of `except` and `only` may be specified for pre-check"
+          end
+
+          @policy_class = policy
+          @name = name
+          @blacklist = Array(except) unless except.nil?
+          @whitelist = Array(only) unless only.nil?
+
+          rebuild_filter
+        end
+
+        def applicable?(rule)
+          return true if filter.nil?
+          filter.call(rule)
+        end
+
+        def call(policy)
+          Result.new(policy.send(name)).tap do |res|
+            # add denial reason if Reasons included
+            policy.reasons.add(policy_class, name) if
+              res.denied? && policy.respond_to?(:reasons)
+          end
+        end
+
+        # rubocop: disable Metrics/AbcSize, Metrics/CyclomaticComplexity
+        # rubocop: disable Metrics/PerceivedComplexity, Metrics/MethodLength
+        def skip!(except: nil, only: nil)
+          if !except.nil? && !only.nil?
+            raise ArgumentError,
+                  "Only one of `except` and `only` may be specified when skipping pre-check"
+          end
+
+          if except.nil? && only.nil?
+            raise ArgumentError,
+                  "At least one of `except` and `only` must be specified when skipping pre-check"
+          end
+
+          if except
+            @whitelist = Array(except)
+            @whitelist -= blacklist if blacklist
+            @blacklist = nil
+          else
+            # only
+            @blacklist += Array(only) if blacklist
+            @whitelist -= Array(only) if whitelist
+            @blacklist = Array(only) if filter.nil?
+          end
+
+          rebuild_filter
+        end
+        # rubocop: enable Metrics/AbcSize, Metrics/CyclomaticComplexity
+        # rubocop: enable Metrics/PerceivedComplexity, Metrics/MethodLength
+
+        def dup
+          self.class.new(policy_class, name, except: blacklist&.dup, only: whitelist&.dup)
+        end
+
+        private
+
+        attr_reader :whitelist, :blacklist, :filter
+
+        def rebuild_filter
+          @filter =
+            if whitelist
+              proc { |rule| whitelist.include?(rule) }
+            elsif blacklist
+              proc { |rule| !blacklist.include?(rule) }
+            end
+        end
+      end
+
+      class << self
+        def prepended(base)
+          base.extend ClassMethods
+          base.prepend InstanceMethods
+        end
+
+        alias included prepended
+      end
+
+      def run_pre_checks(rule)
+        self.class.pre_checks.each do |check|
+          next unless check.applicable?(rule)
+          res = check.call(self)
+          return res.value if res.fulfilled?
+        end
+
+        yield if block_given?
+      end
+
+      def deny!
+        Check::Result::DENY
+      end
+
+      def allow!
+        Check::Result::ALLOW
+      end
+
+      module InstanceMethods # :nodoc:
+        def apply(rule)
+          run_pre_checks(rule) { super }
+        end
+      end
+
+      module ClassMethods # :nodoc:
+        def pre_check(*names, **options)
+          names.each do |name|
+            # do not allow pre-check override
+            check = pre_checks.find { |c| c.name == name }
+            raise "Pre-check already defined: #{name}" unless check.nil?
+
+            pre_checks << Check.new(self, name, **options)
+          end
+        end
+
+        # rubocop: disable Metrics/AbcSize
+        def skip_pre_check(*names, **options)
+          names.each do |name|
+            check = pre_checks.find { |c| c.name == name }
+            raise "Pre-check not found: #{name}" if check.nil?
+
+            # when no options provided we remove this check completely
+            next pre_checks.delete(check) if options.empty?
+
+            # otherwise duplicate and apply skip options
+            pre_checks[pre_checks.index(check)] = check.dup.tap { |c| c.skip! options }
+          end
+        end
+        # rubocop: enable Metrics/AbcSize
+
+        def pre_checks
+          return @pre_checks if instance_variable_defined?(:@pre_checks)
+
+          @pre_checks =
+            if superclass.respond_to?(:pre_checks)
+              superclass.pre_checks.dup
+            else
+              []
+            end
+        end
+      end
+    end
+  end
+end

data/lib/action_policy/policy/reasons.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module ActionPolicy
+  module Policy
+    class FailureReason # :nodoc:
+      attr_reader :policy, :rule
+
+      def initialize(policy_or_class, rule)
+        @policy = policy_or_class.is_a?(Class) ? policy_or_class : policy_or_class.class
+        @rule = rule
+      end
+    end
+
+    # Failures reasons store
+    class FailureReasons
+      include Enumerable
+      extend Forwardable
+
+      def_delegators :@reasons, :size, :empty?, :last, :each
+
+      def initialize
+        @reasons = []
+      end
+
+      def add(policy, rule)
+        @reasons << FailureReason.new(policy, rule)
+      end
+    end
+
+    # Provides failure reasons tracking functionality.
+    # That allows you to distinguish between the reasons why authorization was rejected.
+    #
+    # It's helpful when you compose policies (i.e. use one policy within another).
+    #
+    # For example:
+    #
+    #   class ApplicantPolicy < ApplicationPolicy
+    #     def show?
+    #       user.has_permission?(:view_applicants) &&
+    #         allowed_to?(:show?, object.stage)
+    #     end
+    #   end
+    #
+    # Now when you receive an exception, you have a reasons object, which contains additional
+    # information about the failure:
+    #
+    #   rescue_from ActionPolicy::Unauthorized do |ex|
+    #     ex.reasons.messages  #=> { stage: [:show] }
+    #   end
+    #
+    # You can also wrap _local_ rules into `allowed_to?` to populate reasons:
+    #
+    #   class ApplicantPolicy < ApplicationPolicy
+    #     def show?
+    #       allowed_to?(:view_applicants?) &&
+    #         allowed_to?(:show?, object.stage)
+    #     end
+    #
+    #     def view_applicants?
+    #       user.has_permission?(:view_applicants)
+    #     end
+    #   end
+    module Reasons
+      class << self
+        def prepended(base)
+          base.prepend InstanceMethods
+        end
+
+        alias included prepended
+      end
+
+      attr_reader :reasons
+
+      def with_clean_reasons # :nodoc:
+        old_reasons = reasons
+        @reasons = nil
+        res = yield
+        @reasons = old_reasons
+        res
+      end
+
+      module InstanceMethods # :nodoc:
+        def apply(rule)
+          @reasons = FailureReasons.new
+          super
+        end
+
+        # rubocop: disable Metrics/MethodLength
+        def allowed_to?(rule, record = :__undef__, **options)
+          policy = nil
+
+          succeed =
+            if record == :__undef__
+              policy = self
+              with_clean_reasons { apply(rule) }
+            else
+              policy = policy_for(record: record, **options)
+
+              policy.apply(rule)
+            end
+
+          reasons.add(policy, rule) if reasons && !succeed
+          succeed
+        end
+        # rubocop: enable Metrics/MethodLength
+      end
+    end
+  end
+end

data/lib/action_policy/rails/channel.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+require "action_policy/behaviour"
+
+module ActionPolicy
+  # Channel concern.
+  # Add `authorize!` and `allowed_to?` methods.
+  module Channel
+    extend ActiveSupport::Concern
+
+    include ActionPolicy::Behaviour
+    include ActionPolicy::Behaviours::Namespaced
+  end
+end

data/lib/action_policy/rails/controller.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+require "action_policy/behaviour"
+
+module ActionPolicy
+  # Raised when `authorize!` hasn't been called for action
+  class UnauthorizedAction < Error
+    def initialize(controller, action)
+      super("Action '#{controller}##{action}' hasn't been authorized")
+    end
+  end
+
+  # Controller concern.
+  # Add `authorize!` and `allowed_to?` methods,
+  # provide `verify_authorized` hook.
+  module Controller
+    extend ActiveSupport::Concern
+
+    include ActionPolicy::Behaviour
+    include ActionPolicy::Behaviours::ThreadMemoized
+    include ActionPolicy::Behaviours::Memoized
+    include ActionPolicy::Behaviours::Namespaced
+
+    included do
+      helper_method :allowed_to?
+
+      attr_writer :authorize_count
+
+      protected :authorize_count=, :authorize_count
+    end
+
+    # Authorize action against a policy.
+    #
+    # Policy is inferred from record
+    # (unless explicitly specified through `with` option).
+    #
+    # If action is not provided, it's inferred from `action_name`.
+    #
+    # If record is not provided, tries to infer the resource class
+    # from controller name (i.e. `controller_name.classify.safe_constantize`).
+    #
+    # Raises `ActionPolicy::Unauthorized` if check failed.
+    def authorize!(record = :__undef__, to: nil, **options)
+      record = controller_name.classify.safe_constantize if
+        record == :__undef__
+
+      to ||= :"#{action_name}?"
+
+      super(record, to: to, **options)
+
+      self.authorize_count += 1
+    end
+
+    # Checks that an activity is allowed for the current context (e.g. user).
+    #
+    # If record is not provided, tries to infer the resource class
+    # from controller name (i.e. `controller_name.classify.safe_constantize`).
+    #
+    # Returns true of false.
+    def allowed_to?(rule, record = :__undef__, **options)
+      record = controller_name.classify.safe_constantize if
+        record == :__undef__
+
+      super(rule, record, **options)
+    end
+
+    def verify_authorized
+      raise UnauthorizedAction.new(controller_path, action_name) if
+        authorize_count.zero?
+    end
+
+    def authorize_count
+      @authorize_count ||= 0
+    end
+
+    class_methods do
+      # Adds after_action callback to check that
+      # authorize! method has been called.
+      def verify_authorized(**options)
+        after_action :verify_authorized, **options
+      end
+
+      # Skips verify_authorized after_action callback.
+      def skip_verify_authorized(**options)
+        skip_after_action :verify_authorized, **options\
+      end
+    end
+  end
+end