active_entry 1.1.0 → 1.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e6ea0fd23af731840ed3e6f003c7b6beff6a14b2922bbb96444a5bfbeec58ae
-  data.tar.gz: b4a47cede63aa58e6f1675ab704fce6b7a7e4c4b46fc791330c4e770158bc6db
+  metadata.gz: 8473716d8d36f309773e287f91b9555d9dc166f84580f05998f03d87e3b3f96f
+  data.tar.gz: 59cb7db7d902f5507717582381662b6d3fa08114d06e8acb6dbdbb1c7ae3093e
 SHA512:
-  metadata.gz: c1dba6e952921afc6260b4a7e54878f2db97235f5d5c531dc769a34daf8bb65682f8d377670265000697e8715495f9a152a2be25aa05211a5916109e0db18e69
-  data.tar.gz: 5e813dd7d89ec9eb0514b470fcc3b1a7ffb256ea5d20f3f53e75bfc029a072dbff813a9413127cf83818e3d2d173f22240c7d91f0c3c2da335d069f0edd8b1e8
+  metadata.gz: 92182576896b166ccad824dc857f4b494366b02080bbd6f3de1aeb5c8551b5c659177cce9636e42cdd45c3120daa25ac6bde2a52a94cf456d8721c35c0e6602d
+  data.tar.gz: 5db0ea52d9dc59943db877b4dea88b657125e7deb0f457bd252ac897bb7fa5f15bd3b381396fceff1dc8d577826fd6c74fa1ffd4da579b09256e1e7adde67ffc

data/README.md

@@ -1,6 +1,6 @@
 [<img src="active_entry_logo.png" alt="Active Entry Logo" width="250px"/>](https://github.com/TFM-Agency/active_entry)
 
-# Active Entry - Simple and flexible authentication and authorization
+# Active Entry - Simple and flexible authentication and authorization [![Ruby](https://github.com/TFM-Agency/active_entry/actions/workflows/ci-rspec.yml/badge.svg)](https://github.com/TFM-Agency/active_entry/actions/workflows/ci-rspec.yml)
 
 Active Entry is a simple and secure authentication and authorization system for your Rails application, which lets you to authenticate and authorize directly in your controllers.
 
@@ -23,16 +23,29 @@ $ gem install active_entry
 
 ## Usage
 With Active Entry authentication and authorization is done in your Rails controllers. To enable authentication and authorization in one of your controllers, just add a before action for `authenticate!` and `authorize!` and the user has to authenticate and authorize on every call.
-You probably want to control authentication and authorization for every controller action you have in your app. To enable this, just add the before action to the `ApplicationController`.
+
+### Verify authentication and authorization
+You probably want to control authentication and authorization for every controller action you have in your app. As a safeguard to ensure, that auth is performed in every controller and the call for auth is not forgotten in development, add the `#verify_authentication!` and `#verify_authorization` as after action callbacks to your `ApplicationController`.
 
 ```ruby
 class ApplicationController < ActionController::Base
+  before_action :verify_authentication!, :verify_authorization!
+  # ...
+end
+```
+This ensures, that you call `authenticate!` and/or `authorize!` in all your controllers and raises an `ActiveEntry::AuthenticationNotPerformedError` / `ActiveEntry::AuthorizationNotPerformedError` if not.
+
+### Perform authentication and authorization
+in order to do the actual authentication and authorization, you have to add `authenticate!` and `authorize!` as before action callback in your controllers.
+
+```ruby
+class DashboardController < ApplicationController
   before_action :authenticate!, :authorize!
   # ...
 end
 ```
 
-If you try to open a page, you will get an `ActiveEntry::AuthenticationNotPerformedError` or `ActiveEntry::AuthorizationNotPerformedError`. This means that you have to instruct Active Entry when a user is authenticated/authorized and when not.
+If you try to open a page, you will get an `ActiveEntry::AuthenticationDecisionMakerMissingError` or `ActiveEntry::AuthorizationDecisionMakerMissingError`. This means that you have to instruct Active Entry when a user is authenticated/authorized and when not.
 You can do this by defining the methods `authenticated?` and `authorized?` in your controller.
 
 ```ruby
@@ -194,31 +207,6 @@ class ApplicationController < ActionController::Base
 end
 ```
 
-## Known Issues
-The authentication/authorization is done in a before action. These Rails controller before callbacks are done in defined order. If you set an instance variable which is needed in the `authenticated?` or `authorized?` method, you have to call the before action after the other method again.
-
-For example if you set `@user` in your controller in the `set_user` before action and you want to use the variable in `authorized?` action, you have to add the `authenticate!` or `authorize!` method after the `set_user` again, otherwise `@user` won't be available in `authenticate!` or `authorized?` yet.
-
-```ruby
-class UsersController < ApplicationController
-  before_action :set_user
-  before_action :authenticate!, :authorize!
-
-  def show
-  end
-
-  private
-
-  def authenticated?
-    return true if user_signed_in?
-  end
-
-  def authorized?
-    return true if current_user == @user
-  end
-end
-```
-
 ## Contributing
 Create pull requests on Github and help us to improve this Gem. There are some guidelines to follow:
 

data/lib/active_entry.rb

@@ -4,6 +4,11 @@ require "active_entry/controller_methods"
 require "active_entry/railtie" if defined? Rails::Railtie
 
 module ActiveEntry
+  # Verifies that #authenticate! has been called in the controller.
+  def verify_authentication!
+    raise ActiveEntry::AuthenticationNotPerformedError unless @_authentication_done == true
+  end
+
   # Authenticates the user
   def authenticate!
     general_decision_maker_method_name = :authenticated?
@@ -20,7 +25,7 @@ module ActiveEntry
     #
     # This ensures that you actually do authentication in your controller.
     if !scoped_decision_maker_defined && !general_decision_maker_defined 
-      raise ActiveEntry::AuthenticationNotPerformedError
+      raise ActiveEntry::AuthenticationDecisionMakerMissingError
     end
     
     error = {}
@@ -37,6 +42,15 @@ module ActiveEntry
     # Use the .rescue_from method from ActionController::Base
     # to catch the exception and show the user a proper error message.
     raise ActiveEntry::NotAuthenticatedError.new(error) unless is_authenticated == true
+
+    # Tell #verify_authentication! that authentication
+    # has been performed.
+    @_authentication_done = true
+  end
+
+  # Verifies that #authorize! has been called in the controller.
+  def verify_authorization!
+    raise ActiveEntry::AuthorizationNotPerformedError unless @_authorization_done == true
   end
   
   # Authorizes the user.
@@ -55,7 +69,7 @@ module ActiveEntry
     #
     # This ensures that you actually do authorization in your controller. 
     if !scoped_decision_maker_defined && !general_decision_maker_defined 
-      raise ActiveEntry::AuthorizationNotPerformedError
+      raise ActiveEntry::AuthorizationDecisionMakerMissingError
     end
     
     error = {}
@@ -72,5 +86,9 @@ module ActiveEntry
     # Use the .rescue_from method from ActionController::Base
     # to catch the exception and show the user a proper error message.
     raise ActiveEntry::NotAuthorizedError.new(error) unless is_authorized == true
+
+    # Tell #verify_authorization! that authorization
+    # has been performed.
+    @_authorization_done = true
   end
 end

data/lib/active_entry/errors.rb

@@ -11,11 +11,19 @@ module ActiveEntry
   # Error for controllers in which authorization isn't handled.
   #
   # @raise [AuthorizationNotPerformedError]
-  #    if the #authorized? method isn't defined
+  #    if authorize! is not called
   #    in the controller class.
   class AuthorizationNotPerformedError < AuthorizationError
   end
 
+  # Error for controllers in which authorization decision maker is missing.
+  #
+  # @raise [AuthorizationDecisionMakerMissingError]
+  #    if the #authorized? method isn't defined
+  #    in the controller class.
+  class AuthorizationDecisionMakerMissingError < AuthorizationError
+  end
+
   # Error if user unauthorized.
   #
   # @raise [NotAuthorizedError]
@@ -43,11 +51,19 @@ module ActiveEntry
   # Error for controllers in which authentication isn't handled.
   #
   # @raise [AuthenticationNotPerformedError]
-  #    if the #authenticated? method isn't defined
+  #    if authenticate! is not called
   #    in the controller class.
   class AuthenticationNotPerformedError < AuthenticationError
   end
 
+  # Error for controllers in which authentication decision maker is missing.
+  #
+  # @raise [AuthenticationDecisionMakerMissingError]
+  #    if the #authenticated? method isn't defined
+  #    in the controller class.
+  class AuthenticationDecisionMakerMissingError < AuthenticationError
+  end
+
   # Error if user not authenticated
   #
   # @raise [NotAuthenticatedError]

data/lib/active_entry/version.rb

@@ -1,3 +1,3 @@
 module ActiveEntry
-  VERSION = '1.1.0'
+  VERSION = '1.2.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_entry
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.2
 platform: ruby
 authors:
 - TFM Agency GmbH
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-03 00:00:00.000000000 Z
+date: 2021-03-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails