action_policy 0.5.0 → 0.5.1

data/lib/.rbnext/2.7/action_policy/rspec/have_authorized_scope.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require "action_policy/testing"
+
+module ActionPolicy
+  module RSpec
+    # Implements `have_authorized_scope` matcher.
+    #
+    # Verifies that a block of code applies authorization scoping using specific policy.
+    #
+    # Example:
+    #
+    #   # in controller/request specs
+    #   subject { get :index }
+    #
+    #   it "has authorized scope" do
+    #     expect { subject }
+    #       .to have_authorized_scope(:active_record_relation)
+    #       .with(ProductPolicy)
+    #   end
+    #
+    class HaveAuthorizedScope < ::RSpec::Matchers::BuiltIn::BaseMatcher
+      attr_reader :type, :name, :policy, :scope_options, :actual_scopes,
+        :target_expectations
+
+      def initialize(type)
+        @type = type
+        @name = :default
+        @scope_options = nil
+      end
+
+      def with(policy)
+        @policy = policy
+        self
+      end
+
+      def as(name)
+        @name = name
+        self
+      end
+
+      def with_scope_options(scope_options)
+        @scope_options = scope_options
+        self
+      end
+
+      def with_target(&block)
+        @target_expectations = block
+        self
+      end
+
+      def match(_expected, actual)
+        raise "This matcher only supports block expectations" unless actual.is_a?(Proc)
+
+        ActionPolicy::Testing::AuthorizeTracker.tracking { actual.call }
+
+        @actual_scopes = ActionPolicy::Testing::AuthorizeTracker.scopings
+
+        matching_scopes = actual_scopes.select { |_1| _1.matches?(policy, type, name, scope_options) }
+
+        return false if matching_scopes.empty?
+
+        return true unless target_expectations
+
+        if matching_scopes.size > 1
+          raise "Too many matching scopings (#{matching_scopes.size}), " \
+                "you can run `.with_target` only when there is the only one match"
+        end
+
+        target_expectations.call(matching_scopes.first.target)
+        true
+      end
+
+      def does_not_match?(*)
+        raise "This matcher doesn't support negation"
+      end
+
+      def supports_block_expectations?() ;  true; end
+
+      def failure_message
+        "expected a scoping named :#{name} for type :#{type} " \
+        "#{scope_options_message} " \
+        "from #{policy} to have been applied, " \
+        "but #{actual_scopes_message}"
+      end
+
+      def scope_options_message
+        if scope_options
+          if defined?(::RSpec::Matchers::Composable) &&
+              scope_options.is_a?(::RSpec::Matchers::Composable)
+            "with scope options #{scope_options.description}"
+          else
+            "with scope options #{scope_options}"
+          end
+        else
+          "without scope options"
+        end
+      end
+
+      def actual_scopes_message
+        if actual_scopes.empty?
+          "no scopings have been made"
+        else
+          "the following scopings were encountered:\n" \
+          "#{formatted_scopings}"
+        end
+      end
+
+      def formatted_scopings
+        actual_scopes.map do |_1|
+          " - #{_1.inspect}"
+        end.join("\n")
+      end
+    end
+  end
+end
+
+RSpec.configure do |config|
+  config.include(Module.new do
+    def have_authorized_scope(type)
+      ActionPolicy::RSpec::HaveAuthorizedScope.new(type)
+    end
+  end)
+end

data/lib/.rbnext/2.7/action_policy/utils/pretty_print.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+old_verbose = $VERBOSE
+
+begin
+  require "method_source"
+  # Ignore parse warnings when patch
+  # Ruby version mismatches
+  $VERBOSE = nil
+  require "parser/current"
+  require "unparser"
+rescue LoadError
+  # do nothing
+ensure
+  $VERBOSE = old_verbose
+end
+
+module ActionPolicy
+  using RubyNext
+
+  # Takes the object and a method name,
+  # and returns the "annotated" source code for the method:
+  # code is split into parts by logical operators and each
+  # part is evaluated separately.
+  #
+  # Example:
+  #
+  #  class MyClass
+  #    def access?
+  #      admin? && access_feed?
+  #    end
+  #  end
+  #
+  #  puts PrettyPrint.format_method(MyClass.new, :access?)
+  #
+  #  #=> MyClass#access?
+  #  #=> ↳ admin? #=> false
+  #  #=> AND
+  #  #=> access_feed? #=> true
+  module PrettyPrint
+    TRUE = "\e[32mtrue\e[0m"
+    FALSE = "\e[31mfalse\e[0m"
+
+    class Visitor
+      attr_reader :lines, :object
+      attr_accessor :indent
+
+      def initialize(object)
+        @object = object
+      end
+
+      def collect(ast)
+        @lines = []
+        @indent = 0
+
+        visit_node(ast)
+
+        lines.join("\n")
+      end
+
+      def visit_node(ast)
+        if respond_to?("visit_#{ast.type}")
+          send("visit_#{ast.type}", ast)
+        else
+          visit_missing ast
+        end
+      end
+
+      def expression_with_result(sexp)
+        expression = Unparser.unparse(sexp)
+        "#{expression} #=> #{PrettyPrint.colorize(eval_exp(expression))}"
+      end
+
+      def eval_exp(exp)
+        return "<skipped>" if ignore_exp?(exp)
+        object.instance_eval(exp)
+      rescue => e
+        "Failed: #{e.message}"
+      end
+
+      def visit_and(ast)
+        visit_node(ast.children[0])
+        lines << indented("AND")
+        visit_node(ast.children[1])
+      end
+
+      def visit_or(ast)
+        visit_node(ast.children[0])
+        lines << indented("OR")
+        visit_node(ast.children[1])
+      end
+
+      def visit_begin(ast)
+        #  Parens
+        if ast.children.size == 1
+          lines << indented("(")
+          self.indent += 2
+          visit_node(ast.children[0])
+          self.indent -= 2
+          lines << indented(")")
+        else
+          # Multiple expressions
+          ast.children.each do |node|
+            visit_node(node)
+            # restore indent after each expression
+            self.indent -= 2
+          end
+        end
+      end
+
+      def visit_missing(ast)
+        lines << indented(expression_with_result(ast))
+      end
+
+      def indented(str)
+        "#{indent.zero? ? "↳ " : ""}#{" " * indent}#{str}".tap do
+          # increase indent after the first expression
+          self.indent += 2 if indent.zero?
+        end
+      end
+
+      # Some lines should not be evaled
+      def ignore_exp?(exp)
+        PrettyPrint.ignore_expressions.any? { |_1| exp.match?(_1) }
+      end
+    end
+
+    class << self
+      attr_accessor :ignore_expressions
+
+      if defined?(::Unparser) && defined?(::MethodSource)
+        def available?() ;  true; end
+
+        def print_method(object, method_name)
+          ast = object.method(method_name).source.then(&Unparser.method(:parse))
+          # outer node is a method definition itself
+          body = ast.children[2]
+
+          Visitor.new(object).collect(body)
+        end
+      else
+        def available?() ;  false; end
+
+        def print_method(_, _) ;  ""; end
+      end
+
+      def colorize(val)
+        return val unless $stdout.isatty
+        return TRUE if val.eql?(true)
+        return FALSE if val.eql?(false)
+        val
+      end
+    end
+
+    self.ignore_expressions = [
+      /^\s*binding\.(pry|irb)\s*$/s
+    ]
+  end
+end

data/lib/.rbnext/3.0/action_policy/behaviour.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require "action_policy/behaviours/policy_for"
+require "action_policy/behaviours/scoping"
+require "action_policy/behaviours/memoized"
+require "action_policy/behaviours/thread_memoized"
+require "action_policy/behaviours/namespaced"
+
+require "action_policy/authorizer"
+
+module ActionPolicy
+  # Provides `authorize!` and `allowed_to?` methods and
+  # `authorize` class method to define authorization context.
+  #
+  # Could be included anywhere to perform authorization.
+  module Behaviour
+    include ActionPolicy::Behaviours::PolicyFor
+    include ActionPolicy::Behaviours::Scoping
+
+    def self.included(base)
+      # Handle ActiveSupport::Concern differently
+      if base.respond_to?(:class_methods)
+        base.class_methods do
+          include ClassMethods
+        end
+      else
+        base.extend ClassMethods
+      end
+    end
+
+    # Authorize action against a policy.
+    #
+    # Policy is inferred from record
+    # (unless explicitly specified through `with` option).
+    #
+    # Raises `ActionPolicy::Unauthorized` if check failed.
+    def authorize!(record = :__undef__, to:, **options)
+      policy = lookup_authorization_policy(record, **options)
+
+      Authorizer.call(policy, authorization_rule_for(policy, to))
+    end
+
+    # Checks that an activity is allowed for the current context (e.g. user).
+    #
+    # Returns true of false.
+    def allowed_to?(rule, record = :__undef__, **options)
+      policy = lookup_authorization_policy(record, **options)
+
+      policy.apply(authorization_rule_for(policy, rule))
+    end
+
+    # Returns the authorization result object after applying a specified rule to a record.
+    def allowance_to(rule, record = :__undef__, **options)
+      policy = lookup_authorization_policy(record, **options)
+
+      policy.apply(authorization_rule_for(policy, rule))
+      policy.result
+    end
+
+    def authorization_context
+      return @__authorization_context if
+        instance_variable_defined?(:@__authorization_context)
+
+      @__authorization_context = self.class.authorization_targets
+        .each_with_object({}) do |(key, meth), obj|
+        obj[key] = send(meth)
+      end
+    end
+
+    # Check that rule is defined for policy,
+    # otherwise fallback to :manage? rule.
+    def authorization_rule_for(policy, rule)
+      policy.resolve_rule(rule)
+    end
+
+    def lookup_authorization_policy(record, **options) # :nodoc:
+      record = implicit_authorization_target! if record == :__undef__
+      raise ArgumentError, "Record must be specified" if record.nil?
+
+      options[:context] && (options[:context] = authorization_context.merge(options[:context]))
+
+      policy_for(record: record, **options)
+    end
+
+    module ClassMethods # :nodoc:
+      # Configure authorization context.
+      #
+      # For example:
+      #
+      #   class ApplicationController < ActionController::Base
+      #     # Pass the value of `current_user` to authorization as `user`
+      #     authorize :user, through: :current_user
+      #   end
+      #
+      #   # Assuming that in your ApplicationPolicy
+      #   class ApplicationPolicy < ActionPolicy::Base
+      #     authorize :user
+      #   end
+      def authorize(key, through: nil)
+        meth = through || key
+        authorization_targets[key] = meth
+      end
+
+      def authorization_targets
+        return @authorization_targets if instance_variable_defined?(:@authorization_targets)
+
+        @authorization_targets = if superclass.respond_to?(:authorization_targets)
+          superclass.authorization_targets.dup
+        else
+          {}
+        end
+      end
+    end
+  end
+end

data/lib/.rbnext/3.0/action_policy/behaviours/policy_for.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module ActionPolicy
+  module Behaviours
+    # Adds `policy_for` method
+    module PolicyFor
+      require "action_policy/ext/policy_cache_key"
+      using ActionPolicy::Ext::PolicyCacheKey
+
+      # Returns policy instance for the record.
+      def policy_for(record:, with: nil, namespace: authorization_namespace, context: authorization_context, allow_nil: false, default: default_authorization_policy_class)
+        policy_class = with || ::ActionPolicy.lookup(
+          record,
+          **{namespace: namespace, context: context, allow_nil: allow_nil, default: default}
+        )
+        policy_class&.new(record, **context)
+      end
+
+      def authorization_context
+        raise NotImplementedError, "Please, define `authorization_context` method!"
+      end
+
+      def authorization_namespace
+        # override to provide specific authorization namespace
+      end
+
+      def default_authorization_policy_class
+        # override to provide a policy class use when no policy found
+      end
+
+      # Override this method to provide implicit authorization target
+      # that would be used in case `record` is not specified in
+      # `authorize!` and `allowed_to?` call.
+      #
+      # It is also used to infer a policy for scoping (in `authorized_scope` method).
+      def implicit_authorization_target
+        # no-op
+      end
+
+      # Return implicit authorization target or raises an exception if it's nil
+      def implicit_authorization_target!
+        implicit_authorization_target || raise(
+          NotFound,
+          [
+            self,
+            "Couldn't find implicit authorization target " \
+            "for #{self.class}. " \
+            "Please, provide policy class explicitly using `with` option or " \
+            "define the `implicit_authorization_target` method."
+          ]
+        )
+      end
+
+      def policy_for_cache_key(record:, with: nil, namespace: nil, context: authorization_context, **)
+        record_key = record._policy_cache_key(use_object_id: true)
+        context_key = context.values.map { _1._policy_cache_key(use_object_id: true) }.join(".")
+
+        "#{namespace}/#{with}/#{context_key}/#{record_key}"
+      end
+    end
+  end
+end