active_acl 0.2.0

data/README

@@ -0,0 +1,255 @@
+=Active Access Control Lists (ActiveAcl)
+The ActiveAcl plugin implements a flexible, fast and easy to use generic access control system.
+
+==License
+ActiveAcl is released under the LGPL[http://www.opensource.org/licenses/lgpl-license.php] (Gnu Lesser General Public License) - see the included LICENSE file, too.
+
+==New in 0.2
+* API CHANGE! Renamed the Permission model to Privilege, to stick to common acl language and avoid confusion in the docs. This also means a schema change (simple column and table renaming should do it). has_permission?() is now has_privilege?().
+* added migrations to the plugin
+* look to limitations section for current issues
+* tests completely refactored and moved out of the main distribution
+* several bugfixes
+
+==Features
+* ease of use - uses polymorphic collections for associations.
+* advanced design - uses SQL nested sets for inheritance, thus only needs a single DB query to decide on a permission request.
+* scalable - there are no real benchmarks yet. But the system design is based on http://phpgacl.sourceforge.net, adding object orientation, polymorphism and two levels of caching. PhpGacl claims "A real-world working version with many added layers of complexity supports over 60,000 Accounts, 200 Groups and 300 ACO's." Tests on my dev notebook show 10 - 30 times performance improvements compared to active_rbac.
+* caching - uses instance caching and optionally stores permission results in memcached using timeouts.
+* flexible - grants simple (2D, like <code>current_user.has_permission?(User::LOGIN)</code>) and object level (3D, like <code>admin.has_permission?(Forum::ADMIN, :on => team_forum)</code>) permissions. Can assign and request permissions to and from every ActiveRecord model. No "hardcoded" permissions - all permissions can be assigned at runtime.
+* grouping - permissions are inherited at target and requester side through groups. Every model implementing an SQL nested set tree may be used as a group.
+* ControllerAction model loader: It maps controller actions to the DB so they can be used in permission assignment. The access object is available via calling <code>current_action</code> on the controller.
+* exchangeable DB interface: ActiveRecord and direct MySQL adapter available
+* supports namespaced models and single table inheritance (STI)
+* 100 % C0 code coverage on unit tests
+
+==Limitations
+* At present only one grouping type per model is supported. This could be changed on request but I don't see a use case for it yet.
+* The DBMS has to support subselects. So PostgreSQL, Sqllite and MySQL 5 work, but MySQL 4 does not.
+* At present has_many_polymorphs has a bug that prevents usage with sqllite, hope this is fixed the next days.
+* At present plugin_migrations and loaded_plugins - which are dependencies for active_acl - need edge rails to run. Obrie told me he would release a 1.1.6 version soon. ActiveAcl core is 1.1.6 compatible, but I felt migration support is critical so I decided to add it now.
+
+
+==Prerequisites/Installation
+ActiveAcl uses the has_many_polymorphs[http://www.agilewebdevelopment.com/plugins/restful_authentication] plugin. Make shure you've got a recent version, old versions have bugs affecting active_acl. 
+
+Also required are plugin_migrations and loaded_plugins from <a href="http://pluginaweek.org/" target="_blank">http://pluginaweek.org</a>. Look at their website for installation instructions.
+
+You can either download a tar.gz file of active_acl at http://rubyforge.org/projects/activeacl/ or use the subversion repository at svn://rubyforge.org/var/svn/activeacl/trunk for the development version or svn://rubyforge.org/var/svn/activeacl/tags/release-X.X.X for a particular release.
+
+In case you used svn from rubyforge, rename the plugin folder from activeacl to active_acl - rubyforge doesn't allow underscores in project names.
+
+To set up the needed tables, execute rake db:migrate:plugins PLUGIN=active_acl. You can set the table names by setting the table name in the options array before executing the task.
+
+
+==Short summary
+The ActiveAcl system consists of access objects, organized by access groups, that request privileges on each other. Allowing or denying access to a privilege is controlled by ACL (access control list entry) objects. Access objects and access groups can be instances of arbitrary ActiveRecord model classes enhanced by acts_as_access_object and acts_as_access_group. They are associated to ACL entries via polymorphic associations.
+
+===Access objects
+These are basically requesters and targets in the permission system, as for example a User or a Forum model object. In this case a user could act as a requester ("do I have privilege Y?") or target ("does access object X have privilege Y on me?"). A Forum would most certainly be only used as a target, but all access objects can theoretically be used as both requesters and targets. Access objects use the acts_as_access_object macro inside their definition. This registers the model with the ACL system and enhances it with methods like has_privilege?.
+
+Every model class must specify an association that is used as the "grouping type" to it. So User may declare has_and_belongs_to_many :user_groups and use acts_as_access_object :grouped_by => :user_groups. You can use a has_and_belongs_to_many or a belongs_to association for this. Common mapping attributes (:join_table, :foreign_key etc.) are supported.
+
+
+===Access groups
+The access group model needs to implement a tree with nested set semantics having a "left" and "right" column, e.g. by using the built-in acts_as_nested_set or the much more recommended acts_as_betted_nested_set plugin. Groups are declared with acts_as_access_group. 
+
+Groups may be used to specify inheritance hierarchies for permissions. So you could have a 'registered users' group as a subgroup of the 'users' group and assign the privilege to log in to this group via an ACL entry. Every user belonging to this group will now be granted the privilege to log in. Then you could add a subgroup to registerd users, 'banned users', and deny the log in privilege for this group. Every user added to this group would now be unable to log in, regardless of beeing in 'registered users' or not, as 'banned users' would override the permission settings of 'registered users'.
+
+
+===Privileges
+A privilege object is an object for the thing we wish to define a permission for. So User::LOGIN could be a privilege object for checking a users permission to log in, while Forum::ADMIN might define administration rights on a forum.
+
+A privilege object itself is little more than it’s name and id and is usually bound to a constant inside the application, as it is not expected to change at runtime. Privileges are usually created by the developer in the source code and not in the admin frontend, as creating new privilege objects that have no meaning (by code that checks for them) would be pointless.
+
+
+===Access Control List (ACL) entries
+ACL entries are the glue between all these objects, defining which requesters and requester groups have access to which privileges, optionally defining target objects and target groups as well. ACL entries are organized by ACL sections, for better overview in the admin screens. 
+
+
+==Usage
+===In short
+"No access defined" for a privilege evaluates to "deny". This may be overriden by an explicit "allow" or "deny". Privileges are inherited in requestor and target groups, this means you can override them in subgroups again. Privileges directly assigned to an object always supercede those assigned to groups. 
+
+===Simple (2D) permissions
+We want all registered users to be able to log in. We create the User model, the UserGroup model and the User::LOGIN privilege object as described above. Then we create a new ACL entry, set 'allow' to true, add the "registered users" group as requester group, User::LOGIN as privilege and we are done. Every user assigned to "registered users" or a subgroup of it will now be granted access by calling <code>my_user.has_privilege?(User::LOGIN)</code>. 
+
+====Simple permissions example
+
+  class UserGroup < ActiveRecord::Base
+    acts_as_nested_set
+    acts_as_access_group
+    has_and_belongs_to_many :users
+  end
+
+  class User < ActiveRecord::Base
+    has_and_belongs_to_many :user_groups
+    acts_as_access_object :grouped_by => :user_groups
+    privilege_const_set('LOGIN')
+  end
+
+  # assume 'registered_users' exists and users 'john' and 'dr_evil' are members of it but 'anonymous' is not. 
+  registered_users = UserGroup.find_by_name('registered_users')
+
+  acl = ActiveAcl::Acl.create :section => ActiveAcl::AclSection.create(:description => 'users')
+
+  acl.allow = true # true is default
+  acl.privileges << User::LOGIN
+  acl.requester_groups << registered_users
+
+  acl.save
+
+  john.has_privilege?(User::LOGIN) #=> true
+  dr_evil.has_privilege?(User::LOGIN) #=> true
+
+  anonymous.has_privilege?(User::LOGIN) #=> false
+
+===Overriding permissions
+We want to ban specific users from our site. We create another ACL entry, assign the User::LOGIN privilege object, set 'allow' to false and then assign these users as requesters to the ACL entry. The direct permission assignment on the objects overrides the 'allow login' ACL entry from above.
+
+====Overriding permissions example
+
+  ban_users = ActiveAcl::Acl.create :section => ActiveAcl::AclSection.find_by_description('users')
+
+  ban_users.allow = false
+  ban_users.privileges << User::LOGIN
+  ban_users.requesters << dr_evil
+
+  ban_users.save
+
+  john.has_privilege?(User::LOGIN) #=> true
+  dr_evil.has_privilege?(User::LOGIN) #=> false
+
+===Object level (3D) permissions
+We want to assign forum permissions. We have several privileges (Forum::ADMIN, Forum::READ, Forum::POST etc.), the afore mentioned User and UserGroup models as well as a Forum and a Category model for grouping the forums. 
+
+If we want to check if a certain user may read in a certain forum, it is not sufficient to check <code>test_user.has_privilege?(Forum::READ)</code> as the target object - in this case a forum - is needed to make a decision. The code to do the check is like <code>test_user.has_privilege?(Forum::READ, :on => teamforum)</code>. 
+
+To make this work you create a new ACL entry, add Forum::POST and Forum::READ as privileges, set 'allow' to true, add the registered users group as a requester group and the public forums category as a target group to the acl. Now every user belonging to the registered users group or a subgroup of it gains post and read privileges on all forums of the public forums category or a subcategory of it. 
+
+====Object level permissions example
+
+  # Assuming setup as in the above examples
+
+  class Category < ActiveRecord::Base
+    acts_as_nested_set
+    acts_as_access_group
+    has_many :forums
+  end
+
+  class Forum < ActiveRecord::Base
+    belongs_to :category
+    acts_as_access_object :grouped_by => :category
+    privilege_const_set 'READ' => 'read postings in forum', 
+                         'POST' => 'reply to threads in a forum'
+  end
+
+  # assume there is a forum 'speakers corner' assigned to the category 'public'.
+
+  acl = ActiveAcl::Acl.create :section => ActiveAcl::AclSection.create(:description => 'forum')
+
+  acl.allow = true
+  acl.requester_groups << registered_users
+  acl.target_groups << Category.find_by_name('public')
+
+  acl.privileges << Forum::READ
+  acl.privileges << Forum::POST
+
+  acl.save
+
+  speakers = Forum.find_by_name('speakers corner')
+
+  john.has_privilege?(Forum::READ, :on => speakers) #=> true
+  john.has_privilege?(Forum::POST, :on => speakers) #=> true
+  anonymous.has_privilege?(Forum::READ, :on => speakers) #=> false
+
+==CAUTION
+Do not create ACL entries that are on different branches of the inheritance hierarchy and have allow/deny set differently on the same privilege objects. This way it's impossible to tell which permission should take precedence. At present this is by creation date, later entries superceding older ones, but this is most certainly not what you want. 
+
+Error checking for conflicting ACL entries is high up on the ToDo list.
+
+==Controller Actions
+Defining permissions on controller actions (like "may user x execute AdminController.list ?") is quite a common case but we are facing a problem here: Controller actions have no corresponding DB models so permissions on them can't be easily defined. 
+
+ActiveAcl solves this by adding a ControllerAction and ControllerGroup model. For every public controller method (=action) there is one ControllerAction object in the DB.
+
+On application startup, the plugin loader checks all controller files in app/controllers and loads or creates a ControllerAction object for every action it finds. These objects get cached in a hash in the ActiveAcl module. Every controller now has a method <code>current_action</code> that looks up and returns the access object for the current action, so it can be used for access checks like <code>current_user.has_privilege?(ActiveAcl::ControllerAction::EXECUTE, :on => current_action)</code>.
+
+This works nicely for before_filters with authorization checks. 
+
+A word on the load mechanism: If the action has no corresponding DB entry (it's looked up on method creation by controller and action name) the loader searches for a controller group with the same name as the controller. If it is found, the action is created and assigned to this group. Else the controller group is created as a subgroup to the "unassigned controller actions" group (this name can be changed in the options) and the unassigned action is added to the controller group.
+
+So you are free on how to organize your controllers. Maybe create an admin group and a public group and move controllers as a subgroup inside them?
+
+==Caching
+The plugin provides two levels of caching. The instance cache is a hash inside the access object. The object first tries to serve a permission request from the instance cache. If it is not found and a simple permission is requested, the query fetches all simple permissions of the object and puts them in the instance cache. The reason for this is that there is no noticable speed penalty in fetching all 2D permissions at once compared to fetching only one, so this will save time and DB IO later on. Complex 3D queries are fetched independently and also saved to the instance cache. The instance cache lives inside the access object, so it has it's lifetime, too - which in rails usually is no more than a single request.
+
+The second level cache tries to overcome this limitation by putting the instance cache of an access object in an external cache. It tries to get the instance cache from there if it is not set, and sets it if it was changed. The only real implementation for now is with the memcache daemon. The second level cache uses a timeout (which can be defined in the options) to expire the cached permissions. 
+
+Instance and second level cache can be expired explicitly by calling <code>clear_cached_permissions</code> on the access object. Calling <code>reload</code> on the object also purges the caches.
+
+See ActiveAcl::Cache::MemcacheAdapter on how to set it up.
+
+
+==Preloader
+The plugin includes a <code>load_files_from filenames</code> function. It can be used to preload source files (and therefore the classes in it) from an application path and should be used from environment.rb.
+
+  load_files_from("#{RAILS_ROOT}/app/controllers/**/[^.]*.rb")
+  load_files_from("#{RAILS_ROOT}/app/models/**/[^.]*.rb")
+
+will load all models and controllers inside these folders and their subfolders. This way you can be shure they are registered with the ACL system at rails boot time - else they will be registered when they are called for the first time. This means that new controllers will not show up in the admin screens until they were accessed if not using the preloader.
+
+==Options
+<code>ActiveAcl::OPTIONS</code> is an array that can be used to override various options for the system by setting the values in environment.rb. <code>ActiveAcl::DEFAULT_OPTIONS</code> is as follows:
+
+  DEFAULT_OPTIONS = {
+    :acl_sections_table => 'acl_sections',
+    :acls_privileges_table => 'acls_privileges',
+    :acls_table => 'acls',
+    :privileges_table => 'privileges',
+    :requester_links_table => 'requester_links',
+    :target_links_table => 'target_links',
+    :requester_group_links_table => 'requester_group_links',
+    :target_group_links_table => 'target_group_links', 
+    :controller_actions_table => 'controller_actions',
+    :controller_groups_table => 'controller_groups',
+  
+    :controllers_group_name => 'unassigned_controller_actions', # the name of the base group that newly created controller groups get assigned to
+    :controller_group_name_suffix => '_controller', # name suffix for generated controller groups
+  
+    :cache_permission_timeout => 10, # timeout in seconds for the second level cache
+  
+    :db => ActiveAcl::DB::ActiveRecordAdapter, # the DB Adapter to use
+    :cache => ActiveAcl::Cache::NoCacheAdapter, # the Cache Adapter to use
+  }
+
+==Tests
+* The tests were moved out of the main distribution as they include a custom rails root with external references and are not needed by most people anyway. Also the tests break the 'rake test:plugins' command, since all tests from the fake rails root plugins would be run also. 
+
+If you want to execute the tests, go to the active_acl plugin directory. Then check out svn://rubyforge.org/var/svn/activeacl/tests/trunk - or whatever your main branch is instead of trunk - to the test directory.
+
+  svn co svn://rubyforge.org/var/svn/activeacl/tests/trunk test
+
+You can test different environments by setting RAILS_ENV before. Look to database.example for possible setups and copy it to database.yml for changes. Then use 'rake test' from inside the plugin directory. Using 'rake test:plugins PLUGIN=active_acl' from the root of your application will NOT work! 
+
+If you have questions about the setup for my tests, take a look at
+
+  http://www.pluginaweek.org/2006/11/24/plugin-tip-of-the-week-testing-your-plugins-the-right-way
+
+==Credits
+* Evan for writing that great polymorph plugin and beeing so kind to add namespace and tablename support on my request. 
+* ReinH and markmeves for great support and suggestions at the rubyonrails channel on freenode.org.
+* http://phpgacl.sourceforge.net as a great source of inspiration
+* Obrie for writing plugin_migrations and loaded_plugins and also very nice support when I got stuck with using them.
+
+==ToDo
+
+in no particular order, just a reminder...
+
+* filtered result sets, implementing <code>MyTarget.find(:all, :privilege => my_privilege, :on => my_requester)</code>. This should return all targets of a special type that the requester has a certain privilege on and avoids having n permission queries for n objects in the result set.
+* direct PostgreSQL interface
+* example on how to integrate with acts_as_authenticated
+* example on controller actions
+* make grouping optional
+* add interface generators (partially done)
+* error checking for conflicting ACL entries

data/Rakefile

@@ -0,0 +1,97 @@
+require 'rake'
+require 'rake/testtask'
+require 'rake/rdoctask'
+require 'rake/gempackagetask'
+require 'rake/contrib/sshpublisher'
+
+# RCOV command, run as though from the commandline.
+RCOV = "rcov" 
+
+PKG_NAME		   = "active_acl"
+PKG_VERSION		= "0.2.0"
+PKG_FILE_NAME	  = "#{PKG_NAME}-#{PKG_VERSION}"
+RUBY_FORGE_PROJECT = "activeacl"
+RUBY_FORGE_USER = "hildolfur"
+
+spec = Gem::Specification.new do |s|
+  s.name			= PKG_NAME
+  s.version		 = PKG_VERSION
+  s.platform		= Gem::Platform::RUBY
+  s.summary		 = "Provides an unintrusive, scalable and very flexible approach to fine grained access control."
+  s.files		   = FileList["{lib,tasks,generators,db}/[^.]**/[^.]*"].to_a + %w(init.rb install.rb LICENSE Rakefile README CHANGELOG)
+  s.require_path	= "lib"
+  s.autorequire	 = PKG_NAME
+  s.has_rdoc		= true
+  s.add_dependency	"rails", ">= 1.1.6"
+  s.author		  = "Gregor Melhorn"
+  s.email		   = "g.melhorn@web.de"
+  s.homepage		= "http://activeacl.rubyforge.org"
+end
+
+Rake::GemPackageTask.new(spec) do |p|
+  p.gem_spec = spec
+  p.need_tar = true
+  p.need_zip = true
+end
+
+desc 'Default: run unit tests.'
+task :default => :test
+
+#desc "Publish the beta gem"
+#task :pgem => [:package] do
+#  Rake::SshFilePublisher.new("pluginaweek@pluginaweek.org", "/home/pluginaweek/gems.pluginaweek.org/gems", "pkg", "#{PKG_FILE_NAME}.gem").upload
+#end
+
+desc "Publish the API documentation"
+task :pdoc => [:rdoc] do
+  Rake::SshDirPublisher.new("hildolfur@rubyforge.org", "/var/www/gforge-projects/activeacl/api", "rdoc").upload
+  #Rake::RubyForgePublisher.new(RUBY_FORGE_PROJECT, RUBY_FORGE_USER).upload
+end
+
+desc "Publish the API docs and gem"
+task :publish => [:pdoc, :release]
+
+desc "Publish the release files to RubyForge."
+task :release => [:gem, :package] do
+  require 'rubyforge'
+  options = {"cookie_jar" => RubyForge::COOKIE_F}
+  options["password"] = ENV["RUBY_FORGE_PASSWORD"] if ENV["RUBY_FORGE_PASSWORD"]
+  ruby_forge = RubyForge.new("./config.yml", options)
+  ruby_forge.login
+  %w( gem tgz zip ).each do |ext|
+	file = "pkg/#{PKG_FILE_NAME}.#{ext}"
+	puts "Releasing #{File.basename(file)}..."
+	ruby_forge.add_release(RUBY_FORGE_PROJECT, PKG_NAME, PKG_VERSION, file)
+  end
+end
+
+desc "generate a coverage report"
+task :coverage do
+  sh "#{RCOV} --rails -T -Ilib -x db/**/* --output ../../../coverage/active_acl test/all_tests.rb"
+end
+
+desc "generate a coverage report saving current state"
+task :coverage_save do
+  sh "#{RCOV} --rails -T -Ilib -x db/**/* --output ../../../coverage/active_acl --save ../../../coverage/active_acl/coverage.info test/all_tests.rb"
+end
+
+desc "generate a diff coverage report on previously saved state"
+task :coverage_diff do
+  sh "#{RCOV} --rails -T -Ilib -x db/**/* --text-coverage-diff ../../../coverage/active_acl/coverage.info --output ../../../coverage/active_acl test/all_tests.rb"
+end
+
+desc 'Test the active_acl plugin.'
+Rake::TestTask.new(:test) do |t|
+  t.libs << 'lib'
+  t.pattern = 'test/unit/**/*_test.rb'
+  t.verbose = true
+end
+
+desc 'Generate documentation for the active_acl plugin.'
+Rake::RDocTask.new(:rdoc) do |rdoc|
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title    = 'GaclBase'
+  rdoc.options << '--line-numbers' << '--inline-source'
+  rdoc.rdoc_files.include('README')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/db/migrate/001_base_table_setup.rb

@@ -0,0 +1,111 @@
+class BaseTableSetup < ActiveRecord::Migration
+  def self.up
+    create_table ActiveAcl::OPTIONS[:acls_table] do |t|
+        t.column :section_id,  :int
+        t.column :allow,       :boolean, :null => false, :default => true
+        t.column :enabled,     :boolean, :null => false, :default => true
+        t.column :note,        :string, :null => true
+        t.column :updated_at,  :datetime, :null => false
+    end
+    
+    add_index ActiveAcl::OPTIONS[:acls_table], :enabled
+    add_index ActiveAcl::OPTIONS[:acls_table], :section_id
+    add_index ActiveAcl::OPTIONS[:acls_table], :updated_at
+    add_index ActiveAcl::OPTIONS[:acls_table], :note, :unique
+        
+    create_table ActiveAcl::OPTIONS[:acl_sections_table] do |t|
+        t.column :description, :string, :limit => 230, :null => false
+    end
+    
+    add_index ActiveAcl::OPTIONS[:acl_sections_table], :description, :unique
+        
+    create_table ActiveAcl::OPTIONS[:privileges_table] do |t|
+        t.column :section,        :string, :limit => 230, :null => false
+        t.column :value,          :string, :limit => 230, :null => false
+        t.column :description,    :string, :limit => 230, :null => true
+    end
+    
+    add_index ActiveAcl::OPTIONS[:privileges_table], [:section, :value], :unique
+        
+    create_table ActiveAcl::OPTIONS[:acls_privileges_table], :id => false do |t|
+        t.column :acl_id,         :int, :null => false
+        t.column :privilege_id,  :int, :null => false
+    end
+    
+    add_index ActiveAcl::OPTIONS[:acls_privileges_table], [:acl_id, :privilege_id], :unique
+                                      
+    create_table ActiveAcl::OPTIONS[:requester_links_table] do |t|
+      t.column :acl_id, :int, :null => false
+      t.column :requester_id, :int, :null => false
+      t.column :requester_type, :string, :null => false
+    end
+    
+    add_index ActiveAcl::OPTIONS[:requester_links_table], [:acl_id, :requester_id, :requester_type], :unique => true, :name => 'requester_links_join_index_1'
+    add_index ActiveAcl::OPTIONS[:requester_links_table], [:requester_type, :requester_id], :name => 'requester_links_join_index_2'
+    add_index ActiveAcl::OPTIONS[:requester_links_table], [:requester_id]
+
+    create_table ActiveAcl::OPTIONS[:requester_group_links_table] do |t|
+      t.column :acl_id, :int, :null => false
+      t.column :requester_group_id, :int, :null => false
+      t.column :requester_group_type, :string, :null => false
+    end
+    
+    add_index ActiveAcl::OPTIONS[:requester_group_links_table], [:acl_id, :requester_group_id, :requester_group_type], :unique => true, :name => 'requester_group_links_join_index_1'
+    add_index ActiveAcl::OPTIONS[:requester_group_links_table], [:requester_group_type, :requester_group_id], :name => 'requester_group_links_join_index2'
+    
+    create_table ActiveAcl::OPTIONS[:target_group_links_table] do |t|
+      t.column :acl_id, :int, :null => false
+      t.column :target_group_id, :int, :null => false
+      t.column :target_group_type, :string, :null => false
+    end
+    
+    add_index ActiveAcl::OPTIONS[:target_group_links_table], [:acl_id, :target_group_id, :target_group_type], :unique => true, :name => 'target_group_links_join_index_1'
+    add_index ActiveAcl::OPTIONS[:target_group_links_table], [:target_group_type, :target_group_id], :name => 'target_group_links_join_index_2'
+               
+    create_table ActiveAcl::OPTIONS[:target_links_table] do |t|
+      t.column :acl_id, :int, :null => false
+      t.column :target_id, :int, :null => false
+      t.column :target_type, :string, :null => false
+    end
+    
+    add_index ActiveAcl::OPTIONS[:target_links_table], [:acl_id, :target_id, :target_type], :unique => true, :name => 'target_links_join_index_1'
+    add_index ActiveAcl::OPTIONS[:target_links_table], [:target_type, :target_id], :name => 'target_links_join_index_2'
+    add_index ActiveAcl::OPTIONS[:target_links_table], [:target_id]
+    
+    create_table ActiveAcl::OPTIONS[:controller_actions_table] do |t|
+      t.column :controller, :string, :null => false
+      t.column :action, :string, :null => false
+      t.column :controller_group_id, :integer, :null => false
+    end
+    
+    add_index ActiveAcl::OPTIONS[:controller_actions_table], [:controller, :action], :unique
+  
+    create_table ActiveAcl::OPTIONS[:controller_groups_table] do |t|
+      t.column :description, :string, :null => false
+      t.column :lft, :integer
+      t.column :rgt, :integer
+      t.column :parent_id, :integer     
+    end
+        
+    add_index ActiveAcl::OPTIONS[:controller_groups_table], :description
+    add_index ActiveAcl::OPTIONS[:controller_groups_table], :lft
+    add_index ActiveAcl::OPTIONS[:controller_groups_table], :rgt
+    add_index ActiveAcl::OPTIONS[:controller_groups_table], :parent_id
+        
+    # create root node
+    execute("INSERT INTO #{ActiveAcl::OPTIONS[:controller_groups_table]}(description, lft, rgt) VALUES ('controllers', 1, 2)")      
+  end
+  
+  def self.down
+    drop_table ActiveAcl::OPTIONS[:acls_table]
+    drop_table ActiveAcl::OPTIONS[:acl_sections_table]
+    drop_table ActiveAcl::OPTIONS[:privileges_table]
+    drop_table ActiveAcl::OPTIONS[:acls_privileges_table]
+    drop_table ActiveAcl::OPTIONS[:requester_links_table]
+    drop_table ActiveAcl::OPTIONS[:target_links_table]
+    drop_table ActiveAcl::OPTIONS[:requester_group_links_table]
+    drop_table ActiveAcl::OPTIONS[:target_group_links_table]
+    drop_table ActiveAcl::OPTIONS[:controller_actions_table]
+    drop_table ActiveAcl::OPTIONS[:controller_groups_table]  
+  end
+end

data/generators/active_acl/active_acl_generator.rb

@@ -0,0 +1,25 @@
+class ActiveAclGenerator < Rails::Generator::Base
+  attr_accessor :privileges_class_name, :privileges_file_name, :privileges_view_dir
+  
+  def initialize(*runtime_args)
+    super(*runtime_args)
+    @privileges_class_name = (args[0] || 'PrivilegesController')
+    @privileges_file_name = @privileges_class_name.underscore
+    @privileges_view_dir = File.join('app', 'views', @privileges_file_name.gsub('_controller', ''))
+  end
+
+  def manifest
+    record do |m|
+      # Stylesheet, controllers and public directories.
+      m.directory File.join('public', 'stylesheets')
+      m.directory File.join('app', 'controllers')
+      m.directory File.join('app', 'views')
+      m.directory privileges_view_dir
+
+      m.template 'controllers/privileges_controller.rb', File.join(RAILS_ROOT, 'app', 'controllers', "#{privileges_file_name}.rb")
+      m.file 'views/privileges/_privilege_form.rhtml', File.join(privileges_view_dir, '_privilege_form.rhtml')      
+      m.file 'views/privileges/edit.rhtml', File.join(privileges_view_dir, 'edit.rhtml')      
+      m.file 'views/privileges/list.rhtml', File.join(privileges_view_dir, 'list.rhtml')      
+    end
+  end
+end

data/init.rb

@@ -0,0 +1 @@
+require 'active_acl'

data/install.rb

@@ -0,0 +1 @@
+# Install hook code here

data/lib/active_acl/acl.rb

@@ -0,0 +1,39 @@
+# This model is the "glue" :-). Every permission assignment uses an Acl 
+# model object, assigns objects, groups and privileges and setting   
+# 'allow' to "true" or "false" to grant or deny access.
+class ActiveAcl::Acl < ActiveRecord::Base
+  set_table_name ActiveAcl::OPTIONS[:acls_table]
+  
+  has_and_belongs_to_many :privileges, :uniq => true, :join_table => ActiveAcl::OPTIONS[:acls_privileges_table], :class_name => 'ActiveAcl::Privilege'
+  
+  has_many :target_links, :dependent => :delete_all
+  has_many :requester_links, :dependent => :delete_all
+  
+  validates_uniqueness_of :note
+  validates_presence_of :note
+      
+  belongs_to :section, :class_name => 'ActiveAcl::AclSection', :foreign_key => 'section_id'
+  
+  has_many :requester_group_links, :dependent => :delete_all
+  has_many :target_group_links, :dependent => :delete_all
+  
+  has_many :requester_groups, :through => :requester_group_links, :source => :acl
+  has_many :target_groups, :through => :target_group_links, :source => :acl
+          
+  def self.reloadable? #:nodoc:
+    return false
+  end
+  
+  # used as instance description in admin screen
+  def active_acl_description
+    if note
+      if section
+        '/' + section.description + '/' + note
+      else
+        return note
+      end
+    else
+      return nil
+    end
+  end
+end

data/lib/active_acl/acl_section.rb

@@ -0,0 +1,20 @@
+# Groups Acl model objects into different sections to provide better
+# overview in the admin screens. Has no meaning in permission resolution.
+class ActiveAcl::AclSection < ActiveRecord::Base
+  set_table_name ActiveAcl::OPTIONS[:acl_sections_table]
+
+  has_many :members, :class_name => 'ActiveAcl::Acl', :foreign_key => 'section_id'
+  
+  validates_presence_of :description
+  validates_uniqueness_of :description
+  
+  # Make shure there are no associated acls before destroying a section
+  def before_destroy
+    if members.empty?
+      true
+    else
+      errors.add_to_base("Can't delete a section with associated ACLs")
+      false
+    end
+  end
+end

data/lib/active_acl/acts_as_access_group.rb

@@ -0,0 +1,64 @@
+require 'active_record'
+
+module ActiveAcl #:nodoc:
+  module Acts #:nodoc:
+    module AccessGroup #:nodoc:
+      
+      def self.included(base)    
+        base.extend(ClassMethods)
+      end
+
+      module ClassMethods
+        # Extend self with access group capabilites. See README for details
+        # on usage. Accepts the following options as a hash:
+        # left_column:: name of the left column for nested set functionality, default :lft
+        # right_column:: name of the right column for nested set functionality, default :rgt
+        # Don't use 'left' and 'right' as column names - these are reserved words in most DBMS.
+        def acts_as_access_group(options = {})
+          configuration = {:left_column => :lft, :right_column => :rgt,
+                           :controller => ActiveAcl::OPTIONS[:default_group_selector_controller],
+                           :action => ActiveAcl::OPTIONS[:default_group_selector_action]}
+          configuration.update(options) if options.is_a?(Hash)
+          ActiveAcl::GROUP_CLASSES[self.name] = configuration
+          
+          from_classes = ActiveAcl::GROUP_CLASSES.keys.collect do |x| 
+            x.split('::').join('/').underscore.pluralize.to_sym
+          end
+                        
+          ActiveAcl::Acl.instance_eval do
+            has_many_polymorphs :requester_groups, {:from => from_classes, 
+              :through => :"active_acl/requester_group_links",
+              :join_table_name => ActiveAcl::OPTIONS[:requester_group_links_table],
+              :rename_individual_collections => true}
+
+            has_many_polymorphs :target_groups, {:from => from_classes, 
+              :through => :"active_acl/target_group_links",
+              :join_table_name => ActiveAcl::OPTIONS[:target_group_links_table],
+              :rename_individual_collections => true}
+          end
+          
+          include InstanceMethods
+          extend SingletonMethods                         
+          
+         end
+      end
+      
+      module SingletonMethods
+        # class description in engine interface
+        def active_acl_description
+          name
+        end
+      end
+      
+      module InstanceMethods
+        # override this to customize the description in the interface
+        def active_acl_description
+          to_s
+        end              
+      end
+      
+    end    
+  end
+end
+
+ActiveRecord::Base.send(:include, ActiveAcl::Acts::AccessGroup)