activeadmin 0.5.1 → 0.6.0

data/lib/active_admin/authorization_adapter.rb

@@ -0,0 +1,128 @@
+module ActiveAdmin
+
+  # Default Authorization permissions for Active Admin
+  module Authorization
+    READ    = :read
+    CREATE  = :create
+    UPDATE  = :update
+    DESTROY = :destroy
+  end
+
+  Auth = Authorization
+
+
+  # Active Admin's default authorization adapter. This adapter returns true
+  # for all requests to `#authorized?`. It should be the starting point for
+  # implementing your own authorization adapter.
+  #
+  # To view an example subclass, check out `ActiveAdmin::CanCanAdapter`
+  class AuthorizationAdapter
+    attr_reader :resource, :user
+
+
+    # Initialize a new authorization adapter. This happens on each and
+    # every request to a controller.
+    #
+    # @param [ActiveAdmin::Resource, ActiveAdmin::Page] resource The resource
+    #        that the user is currently on. Note, we may be authorizing access
+    #        to a different subject, so don't rely on this other than to
+    #        pull configuration information from.
+    #
+    # @param [any] user The current user. The user is set to whatever is returned
+    #        from `#current_active_admin_user` in the controller.
+    #
+    def initialize(resource, user)
+      @resource = resource
+      @user = user
+    end
+
+    # Returns true of false depending on if the user is authorized to perform
+    # the action on the subject.
+    #
+    # @param [Symbol] action The name of the action to perform. Usually this will be
+    #        one of the `ActiveAdmin::Auth::*` symbols.
+    #
+    # @param [any] subject The subject the action is being performed on usually this
+    #        is a model object. Note, that this is NOT always in instance, it can be 
+    #        the class of the subject also. For example, Active Admin uses the class
+    #        of the resource to decide if the resource should be displayed in the 
+    #        global navigation. To deal with this nicely in a case statement, take
+    #        a look at `#normalized(klasss)`
+    #
+    # @returns [Boolean]
+    def authorized?(action, subject = nil)
+      true
+    end
+
+
+    # A hook method for authorization libraries to scope the collection. By
+    # default, we just return the same collection. The returned scope is used
+    # as the starting point for all queries to the db in the controller.
+    #
+    # @param [ActiveRecord::Relation] collection The collection the user is
+    #        attempting to view.
+    #
+    # @returns [ActiveRecord::Relation] A new collection, scoped to the 
+    #          objects that the current user has access to.
+    def scope_collection(collection)
+      collection
+    end
+
+    private
+
+    # The `#authorized?` method's subject can be set to both instances as well
+    # as classes of objects. This can make it much difficult to create simple
+    # case statements for authorization since you have to handle both the 
+    # class level match and the instance level match.
+    #
+    # For example:
+    #
+    #     class MyAuthAdapter < ActiveAdmin::AuthorizationAdapter
+    #
+    #       def authorized?(action, subject = nil)
+    #         case subject
+    #         when Post
+    #           true
+    #         when Class
+    #           if subject == Post
+    #             true
+    #           end
+    #         end
+    #       end
+    #
+    #     end
+    #
+    # To handle this, the normalized method takes care of returning a object
+    # which implements `===` to be matched in a case statement.
+    #
+    # The above now becomes:
+    #
+    #     class MyAuthAdapter < ActiveAdmin::AuthorizationAdapter
+    #
+    #       def authorized?(action, subject = nil)
+    #         case subject
+    #         when normalized(Post)
+    #           true
+    #         end
+    #       end
+    #
+    #     end
+    def normalized(klass)
+      NormalizedMatcher.new(klass)
+    end
+
+    class NormalizedMatcher
+
+      def initialize(klass)
+        @klass = klass
+      end
+
+      def ===(other)
+        @klass == other || other.is_a?(@klass)
+      end
+
+    end
+
+  end
+
+end

data/lib/active_admin/base_controller.rb

@@ -1,4 +1,6 @@
 require 'inherited_resources'
+
+require 'active_admin/base_controller/authorization'
 require 'active_admin/base_controller/menu'
 
 module ActiveAdmin
@@ -7,7 +9,7 @@ module ActiveAdmin
   class BaseController < ::InheritedResources::Base
     helper ::ActiveAdmin::ViewHelpers
 
-    layout 'active_admin'
+    layout :determine_active_admin_layout
 
     before_filter :only_render_implemented_actions
     before_filter :authenticate_active_admin_user
@@ -29,6 +31,7 @@ module ActiveAdmin
     end
 
     include Menu
+    include Authorization
 
     private
 
@@ -57,5 +60,19 @@ module ActiveAdmin
     end
     helper_method :active_admin_namespace
 
+
+    ACTIVE_ADMIN_ACTIONS = [:index, :show, :new, :create, :edit, :update, :destroy]
+
+    # Determine which layout to use.
+    #
+    #   1.  If we're rendering a standard Active Admin action, we want layout(false)
+    #       because these actions are subclasses of the Base page (which implements
+    #       all the required layout code)
+    #   2.  If we're rendering a custom action, we'll use the active_admin layout so
+    #       that users can render any template inside Active Admin.
+    def determine_active_admin_layout
+      ACTIVE_ADMIN_ACTIONS.include?(params[:action].to_sym) ? false : 'active_admin'
+    end
+
   end
 end

data/lib/active_admin/base_controller/authorization.rb

@@ -0,0 +1,153 @@
+module ActiveAdmin
+
+  # Exception class to raise when there is an authorized access
+  # exception thrown. The exception has a few goodies that may 
+  # be useful for capturing / recognizing security issues.
+  class AccessDenied < StandardError
+    attr_reader :user, :action, :subject
+
+    def initialize(user, action, subject)
+      @user, @action, @subject = user, action, subject
+
+      super()
+    end
+
+    def message
+      I18n.t("active_admin.access_denied.message")
+    end
+  end
+
+
+  class BaseController < ::InheritedResources::Base
+    module Authorization
+      include MethodOrProcHelper
+      extend ActiveSupport::Concern
+
+      ACTIONS_DICTIONARY = {
+        :index   => ActiveAdmin::Authorization::READ,
+        :show    => ActiveAdmin::Authorization::READ,
+        :new     => ActiveAdmin::Authorization::CREATE,
+        :create  => ActiveAdmin::Authorization::CREATE,
+        :edit    => ActiveAdmin::Authorization::UPDATE,
+        :update  => ActiveAdmin::Authorization::UPDATE,
+        :destroy => ActiveAdmin::Authorization::DESTROY
+      }
+
+      included do
+        rescue_from ActiveAdmin::AccessDenied, :with => :dispatch_active_admin_access_denied
+
+        helper_method :authorized?
+        helper_method :authorize!
+      end
+
+      protected
+
+      # Authorize the action and subject. Available in the controller
+      # as well as all the views. 
+      #
+      # @param [Symbol] action The action to check if the user has permission
+      #                 to perform on the subject.
+      #
+      # @param [any] subject The subject that the user is trying to perform
+      #                 the action on.
+      #
+      # @returns [Boolean]
+      #
+      def authorized?(action, subject = nil)
+        active_admin_authorization.authorized?(action, subject)
+      end
+
+
+      # Authorize the action and subject. Available in the controller
+      # as well as all the views. If the action is not allowd, it raises
+      # an ActiveAdmin::AccessDenied exception.
+      #
+      # @param [Symbol] action The action to check if the user has permission
+      #                 to perform on the subject.
+      #
+      # @param [any] subject The subject that the user is trying to perform
+      #                 the action on.
+      #
+      # @returns [Boolean] True if authorized, otherwise raises
+      #                 an ActiveAdmin::AccessDenied.
+      def authorize!(action, subject = nil)
+        unless authorized? action, subject
+          raise ActiveAdmin::AccessDenied.new(current_active_admin_user,
+                                              action,
+                                              subject)
+        end
+      end
+
+      # Performs authorization on the resource using the current controller
+      # action as the permission action.
+      #
+      def authorize_resource!(resource)
+        permission = action_to_permission(params[:action])
+        authorize! permission, resource
+      end
+
+      # Retrieve or instantiate the authorization instance for this resource
+      #
+      # @returns [ActiveAdmin::AuthorizationAdapter]
+      def active_admin_authorization
+        @active_admin_authorization ||= active_admin_authorization_adapter.new(active_admin_config, current_active_admin_user)
+      end
+
+      # Returns the class to be used as the authorization adapter
+      #
+      # @returns [Class]
+      def active_admin_authorization_adapter
+        if active_admin_namespace.authorization_adapter.is_a?(String)
+          ActiveSupport::Dependencies.constantize(active_admin_namespace.authorization_adapter)
+        else
+          active_admin_namespace.authorization_adapter
+        end
+      end
+
+      # Converts a controller action into one of the correct Active Admin
+      # authorization names. Uses the ACTIONS_DICTIONARY to convert the
+      # action name to permission.
+      #
+      # @param [String, Symbol] action The controller action name.
+      #
+      # @returns [Symbol] The permission name to use.
+      def action_to_permission(action)
+        return nil unless action
+
+        action = action.to_sym
+
+        if Authorization::ACTIONS_DICTIONARY.has_key?(action)
+          Authorization::ACTIONS_DICTIONARY[action]
+        else
+          action
+        end
+      end
+
+      def dispatch_active_admin_access_denied(exception)
+        call_method_or_exec_proc active_admin_namespace.on_unauthorized_access, exception
+      end
+
+      def rescue_active_admin_access_denied(exception)
+        error_message = exception.message
+
+        respond_to do |format|
+          format.html do
+            flash[:error] = error_message
+
+            if request.headers.keys.include?("HTTP_REFERER")
+              redirect_to :back
+            else
+              controller, action = active_admin_namespace.root_to.split("#")
+              redirect_to :controller => controller, :action => action
+            end
+          end
+
+          format.csv { render :text => error_message, :status => :unauthorized}
+          format.json { render :json => { :error => error_message }, :status => :unauthorized}
+          format.xml { render :xml => "<error>#{error_message}</error>", :status => :unauthorized}
+        end
+      end
+
+    end
+  end
+end

data/lib/active_admin/base_controller/menu.rb

@@ -11,14 +11,19 @@ module ActiveAdmin
       protected
 
       def current_menu
-        active_admin_config.namespace.menu
+        active_admin_config.navigation_menu
       end
 
       # Set's @current_tab to be name of the tab to mark as current
       # Get's called through a before filter
       def set_current_tab
-        @current_tab = if active_admin_config.belongs_to? && parent?
-          active_admin_config.belongs_to_config.target.menu_item
+        @current_tab = if current_menu && active_admin_config.belongs_to? && parent?
+          parent_item = active_admin_config.belongs_to_config.target.menu_item
+          if current_menu.include? parent_item
+            parent_item
+          else
+            active_admin_config.menu_item
+          end
         else
           active_admin_config.menu_item
         end

data/lib/active_admin/batch_actions/resource_extension.rb

@@ -51,8 +51,8 @@ module ActiveAdmin
       end
 
       # Path to the batch action itself
-      def batch_action_path
-        "batch_action_#{route_collection_path}".to_sym
+      def batch_action_path(params = {})
+        [route_collection_path(params), "batch_action"].join("/")
       end
 
       private
@@ -62,16 +62,17 @@ module ActiveAdmin
         destroy_options = {
           :priority => 100,
           :confirm => proc { I18n.t('active_admin.batch_actions.delete_confirmation', :plural_model => active_admin_config.plural_resource_label.downcase) },
-          :if => proc{ controller.action_methods.include?('destroy') }
+          :if => proc{ controller.action_methods.include?('destroy') && authorized?(ActiveAdmin::Auth::DESTROY, active_admin_config.resource_class) }
         }
 
         add_batch_action :destroy, proc { I18n.t('active_admin.delete') }, destroy_options do |selected_ids|
           active_admin_config.resource_class.find(selected_ids).each { |r| r.destroy }
 
-          redirect_to collection_path, :notice => I18n.t("active_admin.batch_actions.succesfully_destroyed",
-                                                         :count => selected_ids.count,
-                                                         :model => active_admin_config.resource_label.downcase,
-                                                         :plural_model => active_admin_config.plural_resource_label.downcase)
+          redirect_to active_admin_config.route_collection_path(params),
+                      :notice => I18n.t("active_admin.batch_actions.succesfully_destroyed",
+                                        :count => selected_ids.count,
+                                        :model => active_admin_config.resource_label.downcase,
+                                        :plural_model => active_admin_config.plural_resource_label.downcase)
         end
       end
 

data/lib/active_admin/batch_actions/views/batch_action_form.rb

@@ -13,7 +13,7 @@ module ActiveAdmin
         options[:id] ||= "collection_selection"
 
         # Open a form
-        text_node form_tag(send(active_admin_config.batch_action_path), :id => options[:id])
+        text_node form_tag(active_admin_config.batch_action_path(params), :id => options[:id])
         input(:name => :batch_action, :id => :batch_action, :type => :hidden)
 
         super(options)

data/lib/active_admin/cancan_adapter.rb

@@ -0,0 +1,40 @@
+require 'cancan'
+
+# Add a setting to the application to configure the ability
+ActiveAdmin::Application.inheritable_setting :cancan_ability_class, "Ability"
+
+module ActiveAdmin
+
+  class CanCanAdapter < AuthorizationAdapter
+
+    def authorized?(action, subject = nil)
+      cancan_ability.can?(action, subject)
+    end
+
+    def cancan_ability
+      @cancan_ability ||= initialize_cancan_ability
+    end
+
+    def scope_collection(collection)
+      collection.accessible_by(cancan_ability)
+    end
+
+    private
+
+    # The setting allows the class to be stored as a string
+    # to enable reloading in development.
+    def initialize_cancan_ability
+      ability_class_name = resource.namespace.cancan_ability_class
+
+      if ability_class_name.is_a?(String)
+        ability_class = ActiveSupport::Dependencies.constantize(ability_class_name)
+      else
+        ability_class = ability_class_name
+      end
+
+      ability_class.new(user)
+    end
+
+  end
+
+end

data/lib/active_admin/dashboards.rb

@@ -58,11 +58,10 @@ module ActiveAdmin
 
         dashboard_path = namespace.root? ? :dashboard_path : "#{namespace.name}_dashboard_path".to_sym
 
-        item = MenuItem.new  :id => "dashboard", 
-                             :label => proc{ I18n.t("active_admin.dashboard") },
-                             :url => dashboard_path,
-                             :priority => 1
-        menu.add item
+        menu.add :id => "dashboard", 
+                 :label => proc{ I18n.t("active_admin.dashboard") },
+                 :url => dashboard_path,
+                 :priority => 1
       end
     end
   end