active_record_api-rest 1.0.3 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f46306ab7aa8dfd69c9d099776f1fc095c2e9188eee1ece50edc83b87543ac69
-  data.tar.gz: 59fc5ee48bfa4341773b76b41e7f543f0aefe6973332751aaa931b49a6197fb8
+  metadata.gz: d6c7bfa36f4f4e1cf3a3013003dc091864a44e6a2f0df9c47886ce37b7c4a88f
+  data.tar.gz: 5929dfad290e2789a5acbfa574cde379c409d4de125679966c0ed5e98f230edf
 SHA512:
-  metadata.gz: 421c5a6f00e821c52d51d1b940664e9f8498b049ab77fbec9adb955564b7053ccc804c2310d7322d3e3806f801b536c890c46baf4d23a6a07d63abefb0d8aee1
-  data.tar.gz: 69b974c414193b3667f0e5327e0e60e12939b6024937452c2d3f7b6ed7f05582eb339828b6f3ac5d8d52eadb155ac68d6e3e573a7f70a2085b22c2790fb7d4d2
+  metadata.gz: a524c311c0cd8ecda10d96d82a9900b68853e108c96d59109e5493dce0052a6ee31348807a2f423a0234ce011bbf272eccf3d39ca2063e095ca585ef951033b1
+  data.tar.gz: b3c7af25eb3864129781d0cdc564c33a65ba14da22001601b5450a517267466fa865e1dd63b0b48d6d26b89137c61b9f227c8a06ddbfe7675ba50abe5ce9b719

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    active_record_api-rest (1.0.1)
+    active_record_api-rest (1.0.3)
       active_attr
       active_model_serializers
       rails (>= 5.1)

data/lib/active_record_api/rest/access_denied_exception.rb

@@ -1,12 +1,13 @@
-# module ActiveRecordApi
-#   module Rest
-#     class AccessDeniedException < Exception
-#       attr_reader :action
-#       attr_reader :controller
-#       def initialize(controller, action)
-#         @action = action
-#         @controller = controller
-#       end
-#     end
-#   end
-# end
+module ActiveRecordApi
+  module Rest
+    class AccessDeniedException < Exception
+      attr_reader :action
+      attr_reader :controller
+      def initialize(controller, action, message)
+        super(message)
+        @action = action
+        @controller = controller
+      end
+    end
+  end
+end

data/lib/active_record_api/rest/application_policy.rb

@@ -1,32 +1,60 @@
 module ActiveRecordApi
   module Rest
     class ApplicationPolicy
+      class Scope
+        attr_reader :user, :scope
+
+        def initialize(user, scope)
+          @user  = user
+          @scope = scope
+        end
+
+        def resolve
+          @scope.where(id: false)
+        end
+      end
+
       attr_reader :user
-      attr_reader :entity
+      attr_reader :model_class
+
+      READ = 'read'.freeze
+      MANAGE = 'manage'.freeze
 
-      def initialize(user, entity)
+      def initialize(user, model_class)
         @user = user
-        @entity = entity
+        @model_class = model_class
       end
 
       def index?
-        true
+        can?(READ)
       end
 
       def show?
-        true
+        can?(READ)
       end
 
       def create?
-        true
+        can?(MANAGE)
       end
 
       def update?
-        true
+        can?(MANAGE)
       end
 
       def destroy?
-        true
+        can?(MANAGE)
+      end
+
+      protected
+
+      def can?(action)
+        user.full_permissions.include?("#{service_name}__#{@model_class.name.downcase}:#{action}")
+      end
+
+      private
+
+      def service_name
+        File.basename(Rails.root.to_s)
       end
     end
   end

data/lib/active_record_api/rest/bad_session_exception.rb

@@ -1,6 +1,12 @@
 module ActiveRecordApi
   module Rest
     class BadSessionException < Exception
+      attr_reader :action
+      attr_reader :controller
+      def initialize(controller, action)
+        @action = action
+        @controller = controller
+      end
     end
   end
 end

data/lib/active_record_api/rest/controller.rb

@@ -60,7 +60,7 @@ module ActiveRecordApi
       end
 
       def load_model
-        @model ||= model_klass.find(params[:id])
+        @model ||= scope_filter(model_klass).find(params[:id])
       end
 
       def initialize_model
@@ -68,10 +68,16 @@ module ActiveRecordApi
       end
 
       def authorize
-        user = current_user
-        raise BadSessionException if user.nil?
-        policy = ("#{controller_name.classify}Policy".safe_constantize) ? "#{controller_name.classify}Policy".constantize.new(user, model) : ApplicationPolicy.new(user, model)
-        raise AccessDeniedException.new(controller_name, action_name) unless policy.send("#{action_name}?")
+        raise BadSessionException.new(controller_name, action_name) if current_user.nil?
+        raise AccessDeniedException.new(controller_name, action_name, 'Insufficient permissions') unless policy.send("#{action_name}?")
+      end
+
+      def scope_filter(scope)
+        "#{policy.class.name}::Scope".constantize.new(current_user, scope).resolve
+      end
+
+      def policy
+        @policy ||= ("#{controller_name.classify}Policy".safe_constantize) ? "#{controller_name.classify}Policy".constantize.new(current_user, model_klass) : ApplicationPolicy.new(current_user, model_klass)
       end
     end
   end

data/lib/active_record_api/rest/graceful_errors.rb

@@ -8,9 +8,13 @@ module ActiveRecordApi
           render status: :not_found, json: { base: exception.message }
         end
 
-        # rescue_from AccessDeniedException do |exception|
-        #   render status: :forbidden, json: { base: "Access denied on #{exception.action} #{exception.controller}" }
-        # end
+        rescue_from BadSessionException do |exception|
+          render status: :unauthorized, json: { base: "No user for session on #{exception.action} #{exception.controller}" }
+        end
+
+        rescue_from AccessDeniedException do |exception|
+          render status: :forbidden, json: { base: "Access denied on #{exception.action} #{exception.controller}", message: exception.message }
+        end
       end
     end
   end

data/lib/active_record_api/rest/index_controller.rb

@@ -36,7 +36,7 @@ module ActiveRecordApi
       end
 
       def load_models
-        @models = model_klass.where(filtered_params)
+        @models = scope_filter(model_klass).where(filtered_params)
         @total = models.count
         page_models
       end

data/lib/active_record_api/rest/spec/rest_controller_shared_example.rb

@@ -1,15 +1,14 @@
 shared_examples 'all::rest::actions' do
-  let(:authorize_read) { mock_valid_auth(permission_name(model_klass, 'r'), model.organization_id) }
-  let(:unauthorize_read) { mock_valid_auth(permission_name(model_klass, ''), -1) }
-  let(:authorize_create) { mock_valid_auth(permission_name(model_klass, 'c'), model.organization_id) }
-  let(:unauthorize_create) { mock_valid_auth(permission_name(model_klass, ''), -1) }
-  let(:authorize_update) { mock_valid_auth(permission_name(model_klass, 'u'), model.organization_id) }
-  let(:unauthorize_update) { mock_valid_auth(permission_name(model_klass, ''), -1) }
-  let(:authorize_delete) { mock_valid_auth(permission_name(model_klass, 'd'), model.organization_id) }
-  let(:unauthorize_delete) { mock_valid_auth(permission_name(model_klass, ''), -1) }
+  let(:authorize_read) { mock_valid_auth([permission_name(model_klass, 'read')]) }
+  let(:unauthorize_read) { mock_valid_auth([permission_name(model_klass, '')]) }
+  let(:authorize_create) { mock_valid_auth([permission_name(model_klass, 'manage')]) }
+  let(:unauthorize_create) { mock_valid_auth([permission_name(model_klass, '')]) }
+  let(:authorize_update) { mock_valid_auth([permission_name(model_klass, 'manage')]) }
+  let(:unauthorize_update) { mock_valid_auth([permission_name(model_klass, '')]) }
+  let(:authorize_delete) { mock_valid_auth([permission_name(model_klass, 'manage')]) }
+  let(:unauthorize_delete) { mock_valid_auth([permission_name(model_klass, '')]) }
   let(:factory_symbol) { model_klass.to_s.underscore.to_sym }
-  let(:index_non_accessible_data) { create factory_symbol, organization_id: (model.organization_id + 1) }
-  let(:model_array) { [model] + create_list(factory_symbol, 4, organization_id: model.organization_id) }
+  let(:model_array) { [model] + create_list(factory_symbol, 4) }
   let(:base_model_klass) do
     if model_klass.superclass == ApplicationRecord
       model_klass
@@ -59,14 +58,21 @@ shared_examples 'get::show' do
         it { expect(JSON.parse(response.body)['base']).to include "Couldn't find #{base_model_klass} with 'id'=-1" }
       end
     end
-    # context 'when not authorized' do
-    #   before(:each) do
-    #     unauthorize_read
-    #     get :show, params: { id: model.to_param }
-    #   end
-    #   it { expect(response.status).to eq 403 }
-    #   it { expect(JSON.parse(response.body)['base']).to include 'Access denied on show' }
-    # end
+    context 'when not authorized' do
+      before(:each) do
+        unauthorize_read
+        get :show, params: { id: model.to_param }
+      end
+      it { expect(response.status).to eq 403 }
+      it { expect(JSON.parse(response.body)['base']).to include 'Access denied on show' }
+    end
+    context 'when bad session' do
+      before(:each) do
+        get :show, params: { id: model.to_param }
+      end
+      it { expect(response.status).to eq 401 }
+      it { expect(JSON.parse(response.body)['base']).to include 'No user for session on show' }
+    end
   end
 end
 
@@ -98,27 +104,17 @@ shared_examples 'get::index' do
         it { expect(response.headers['x-link-next']).to eq "#{host}#{request.path}?limit=1&previous_id=#{next_previous_id}" }
         it { expect(response.body).to be_json_eql model_klass.where('id > ?', previous_id).limit(1).map { |o| serializer.new(o) }.to_json }
       end
-
-      # context 'when only access some of the data' do
-      #   before(:each) do
-      #     index_non_accessible_data
-      #     get :index
-      #   end
-      #   it { expect(response.status).to eq 200 }
-      #   it { expect(response.headers['x-total']).to eq 1 }
-      #   it { expect(response.body).to be_json_eql [serializer.new(model)].to_json }
-      # end
     end
-    # context 'when not authorized' do
-    #   before(:each) do
-    #     unauthorize_read
-    #   end
-    #   before(:each) do
-    #     get :index
-    #   end
-    #   it { expect(response.status).to eq 403 }
-    #   it { expect(JSON.parse(response.body)['base']).to include 'Access denied on index' }
-    # end
+    context 'when not authorized' do
+      before(:each) do
+        unauthorize_read
+      end
+      before(:each) do
+        get :index
+      end
+      it { expect(response.status).to eq 403 }
+      it { expect(JSON.parse(response.body)['base']).to include 'Access denied on index' }
+    end
   end
 end
 
@@ -154,14 +150,14 @@ shared_examples 'put::update' do
         it { expect(response.body).to be_json_eql({ base: 'Extra parameters are not allow: foobars' }.to_json) }
       end
     end
-    # context 'when not authorized' do
-    #   before(:each) do
-    #     unauthorize_update
-    #     get :show, params: new_attributes
-    #   end
-    #   it { expect(response.status).to eq 403 }
-    #   it { expect(JSON.parse(response.body)['base']).to include 'Access denied on show' }
-    # end
+    context 'when not authorized' do
+      before(:each) do
+        unauthorize_update
+        get :show, params: new_attributes
+      end
+      it { expect(response.status).to eq 403 }
+      it { expect(JSON.parse(response.body)['base']).to include 'Access denied on show' }
+    end
   end
 end
 
@@ -192,14 +188,14 @@ shared_examples 'post::create' do
         end
       end
     end
-    # context 'when not authorized' do
-    #   before(:each) do
-    #     unauthorize_create
-    #     post :create, params: new_attributes
-    #   end
-    #   it { expect(response.status).to eq 403 }
-    #   it { expect(JSON.parse(response.body)['base']).to include 'Access denied on create' }
-    # end
+    context 'when not authorized' do
+      before(:each) do
+        unauthorize_create
+        post :create, params: new_attributes
+      end
+      it { expect(response.status).to eq 403 }
+      it { expect(JSON.parse(response.body)['base']).to include 'Access denied on create' }
+    end
   end
 end
 
@@ -210,19 +206,19 @@ shared_examples 'delete::delete' do
         authorize_delete
       end
       it 'remove record' do
-        expect {
-          expect_any_instance_of(model_klass).to receive(:destroyed_bus_cleanup_message_publish) if model.respond_to? :destroyed_bus_cleanup_message_publish
-          delete :destroy, params: { id: model.id }
-        }.to change(model_klass, :count).by(-1)
+        model
+        before_count = model_klass.count
+        delete :destroy, params: { id: model.id }
+        expect(model_klass.count).to eq(before_count - 1)
+      end
+    end
+    context 'when not authorized' do
+      before(:each) do
+        unauthorize_delete
+        delete :destroy, params: { id: model.id }
       end
+      it { expect(response.status).to eq 403 }
+      it { expect(JSON.parse(response.body)['base']).to include 'Access denied on destroy' }
     end
-    # context 'when not authorized' do
-    #   before(:each) do
-    #     unauthorize_delete
-    #     delete :destroy, params: { id: model.id }
-    #   end
-    #   it { expect(response.status).to eq 403 }
-    #   it { expect(JSON.parse(response.body)['base']).to include 'Access denied on destroy' }
-    # end
   end
 end

data/lib/active_record_api/rest/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveRecordApi
   module Rest
-    VERSION = '1.0.3'.freeze
+    VERSION = '1.0.4'.freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: active_record_api-rest
 version: !ruby/object:Gem::Version
-  version: 1.0.3
+  version: 1.0.4
 platform: ruby
 authors:
 - Full Measure Education
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-03-15 00:00:00.000000000 Z
+date: 2019-03-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler