adeia 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4532656038bf240c25749082f7be357f05f7e355
-  data.tar.gz: f0df2615b74907c8fa22038531358c040726a0a2
+  metadata.gz: bb72e440667ceb322201245578196b58cd73e5f7
+  data.tar.gz: 912258e0e88dc60ac9b28b370d6ba64a19f48a90
 SHA512:
-  metadata.gz: 3d14df596215915a2101d4cdeb2d8ef7138a76aa3ce9371cb44ff3e09ba1f2521e4a028c9abea9550f3bcdeea9799e07bef822790f543bfbfc383c634fdcfb4d
-  data.tar.gz: a90b37a268eaf2eba9c7bcd22deda19378450d7bbfc292ca7d2999bd106b4313c11d43cfafeef8bfbfc00afee53fe41a421982d7a771691d70f772eba9afda79
+  metadata.gz: 701bcd0c7eeb411ad63f5272160a611351e103409da5a2d61bfc59d97216257535e772eb0c90112b64166422a468c61b091815653c60cd53055e286a3dc9101e
+  data.tar.gz: e8c68bc12f8b1b0c799bb7a52cfd35d1a3253f1c4e2cc496febab89be45fa48dbaf66cba1bc879901c0dc31e0269f14a8e263f5d5dcb029ebd4715713a99dee8

data/README.md

@@ -0,0 +1,3 @@
+# Adeia
+
+An authorization gem for Rails that allows you to have the complete control of your app.

data/Rakefile

@@ -5,7 +5,7 @@ rescue LoadError
 end
 
 
-APP_RAKEFILE = File.expand_path("../test/dummy/Rakefile", __FILE__)
+APP_RAKEFILE = File.expand_path("../spec/test_app/Rakefile", __FILE__)
 load 'rails/tasks/engine.rake'
 
 

data/app/models/adeia/action.rb

@@ -1,5 +1,8 @@
 module Adeia
   class Action < ActiveRecord::Base
-    has_many :action_permissions
+    has_many :action_permissions, dependent: :destroy
+    has_many :permissions, through: :action_permissions
+
+    validates :name, presence: true
   end
 end

data/app/models/adeia/element.rb

@@ -1,3 +1,5 @@
 class Adeia::Element < ActiveRecord::Base
   has_many :permissions
+
+  validates :name, presence: true
 end

data/app/models/adeia/group.rb

@@ -1,3 +1,6 @@
 class Adeia::Group < ActiveRecord::Base
-  has_many :group_users
+  has_many :group_users, dependent: :destroy
+  has_many :permissions, as: :owner
+
+  validates :name, presence: true
 end

data/app/models/adeia/permission.rb

@@ -1,4 +1,30 @@
 class Adeia::Permission < ActiveRecord::Base
-  belongs_to :owner
+  belongs_to :owner, polymorphic: true
   belongs_to :element
+
+  has_many :action_permissions, dependent: :destroy
+  has_many :actions, through: :action_permissions
+
+  enum permission_type: [:all_entries, :on_ownerships, :on_entry]
+
+  validates :owner, presence: true
+  validates :element, presence: true
+  validates :permission_type, presence: true
+  validate :presence_of_resource_id
+  validate :presence_of_a_right
+
+  private
+
+  def presence_of_resource_id
+    if permission_type == "on_entry" && resource_id.nil?
+      errors.add(:resource_id, I18n.t("errors.messages.blank"))
+    end
+  end
+
+  def presence_of_a_right
+    if permission_type == "on_ownerships" && !(read_right || update_right || destroy_right || actions.any?)
+      errors[:base] << I18n.t("errors.messages.right_required")
+    end
+  end
+
 end

data/app/models/adeia/token.rb

@@ -1,5 +1,17 @@
 module Adeia
   class Token < ActiveRecord::Base
     belongs_to :permission
+
+    validates :permission_id, presence: true
+    validates :exp_at, presence: true
+
+    before_create :generate_token
+
+    private
+
+    def generate_token
+      self.token = SecureRandom.urlsafe_base64
+    end
+    
   end
 end

data/config/locales/en.yml

@@ -3,4 +3,7 @@ en:
     messages:
       login_required: "Please login before visiting this page !"
       access_denied: "You don't have access to this page !"
-      missing_params: "params %{params} is missing !"
+      missing_params: "params %{params} is missing !"
+  errors:
+    messages:
+      right_required: "If you want to add a permission linked to user's ownerships, please check at least one right or add an action"

data/config/locales/fr.yml

@@ -3,4 +3,7 @@ fr:
     messages:
       login_required: "Veuillez vous connecter pour accéder à cette page !"
       access_denied: "Vous n'êtes pas autorisé à accéder à cette page !"
-      missing_params: "Le paramètre %{params} est manquant !"
+      missing_params: "Le paramètre %{params} est manquant !"
+  errors:
+    messages:
+      right_required: "Lorsque vous voulez créer une permission liée aux possessions de l'utilisateur, vous devez cocher au moins un droit ou ajouter une action"

data/db/migrate/20151003150524_create_adeia_tokens.rb

@@ -2,7 +2,7 @@ class CreateAdeiaTokens < ActiveRecord::Migration
   def change
     create_table :adeia_tokens do |t|
       t.string :token
-      t.boolean :valid
+      t.boolean :is_valid
       t.references :permission, index: true, foreign_key: true
       t.date :exp_at
 

data/lib/adeia/authorization.rb

@@ -6,15 +6,21 @@ module Adeia
   class Authorization < Database
 
     def authorize!
-      @rights = token_rights(right_name)
-      raise LoginRequired if @rights.empty? && @user.nil?
-      @rights.push(send("#{right_name}_rights")) if @user
-      raise AccessDenied unless authorize?
+      rights = token_rights(right_name)
+      raise LoginRequired if rights[:rights].empty? && @user.nil?
+      rights = rights.merge(send("#{right_name}_rights")) { |key, v1, v2| v1 + v2 } if @user
+      @rights, @resource_ids = rights[:rights], rights[:resource_ids]
+      raise AccessDenied unless @rights.any? && authorize?
+    end
+
+    def check_permissions!
+      load_permissions
+      raise AccessDenied unless @rights.any?
     end
 
     def can?
-      @rights = token_rights.push(send("#{right_name}_rights"))
-      authorize?
+      load_permissions
+      @rights.any? && authorize?
     end
 
     private
@@ -28,11 +34,11 @@ module Adeia
     end
 
     def on_ownerships?
-      @rights.any? { |r| r.permission_type == "on_ownerships" } && @user && @resource.try(:user) == @user
+      @user && @resource && @rights.any? { |r| r.permission_type == "on_ownerships" } && @resource.user == @user
     end
 
     def on_entry?
-      @rights.pluck(:resource_id).compact.include? @resource.try(:id)
+      @resource && @resource_ids.include?(@resource.id)
     end
 
     def right_names
@@ -43,6 +49,11 @@ module Adeia
       right_names.select { |k, v| v.include? @action.to_sym }.keys[0] || :action
     end
 
+    def load_permissions
+      rights = token_rights(right_name).merge(send("#{right_name}_rights")) { |key, v1, v2| v1 + v2 }
+      @rights, @resource_ids = rights[:rights], rights[:resource_ids]
+    end
+
   end
 
 end

data/lib/adeia/controller_methods.rb

@@ -7,7 +7,7 @@ module Adeia
     module ClassMethods
 
       def load_and_authorize(**args)
-        ControllerResource.add_before_filter(self, :load_resoure_or_records_and_authorize, **args)
+        ControllerResource.add_before_filter(self, :load_resource_or_records_and_authorize, **args)
       end
 
     end
@@ -26,7 +26,7 @@ module Adeia
 
     def authorize_and_load_records!(**args)
       controller_resource = ControllerResource.new(self, **args)
-      controller_resource.authorize!
+      controller_resource.check_permissions!
       return controller_resource.load_records
     end
 

data/lib/adeia/controller_resource.rb

@@ -11,7 +11,7 @@ module Adeia
       end
     end
 
-    def self.load_resoure_or_records_and_authorize(controller)
+    def self.load_resource_or_records_and_authorize(controller)
       if controller.action_name == "index"
         controller.authorize_and_load_records!
       else
@@ -38,12 +38,12 @@ module Adeia
     end
 
     def load_records
-      rights = authorization.read_rights + authorization.token_rights
-      resource_ids = rights.pluck(:resource_id).compact
+      rights = authorization.read_rights.merge(authorization.token_rights(:read)) { |key, v1, v2| v1 + v2 }
+      rights, resource_ids = rights[:rights], rights[:resource_ids]
       @records ||= if rights.any? { |r| r.permission_type == "all_entries" }
         resource_class.all
       elsif rights.any? { |r| r.permission_type == "on_ownerships" }
-        resource_class.where(user_id: @user.id, id: resource_ids)
+        resource_class.where("user_id = ? OR id IN (?)", @user.id, resource_ids)
       elsif rights.any? { |r| r.permission_type == "on_entry" }
         resource_class.where(id: resource_ids)
       else
@@ -56,11 +56,14 @@ module Adeia
       @authorization ||= Authorization.new(@controller_name, @action_name, @token, @resource, @user)
     end
 
-
     def authorize!
       authorization.authorize!
     end
 
+    def check_permissions!
+      authorization.check_permissions!
+    end
+
     def can?
       authorization.can?
     end

data/lib/adeia/database.rb

@@ -11,31 +11,42 @@ module Adeia
     end
 
     def read_rights
-      @read_rights ||= Adeia::Permission.joins(:element).where(owner: owners, read_right: true, elements: {name: @controller})
+      @read_rights ||= Adeia::Permission.joins(:element).where(owner: owners, read_right: true, adeia_elements: {name: @controller})
+      @read_resource_ids ||= @read_rights.pluck(:resource_id).compact
+      return { rights: @read_rights, resource_ids: @read_resource_ids }
     end
 
     def create_rights
-      @create_rights ||= Adeia::Permission.joins(:element).where(owner: owners, create_right: true, elements: {name: @controller})
+      @create_rights ||= Adeia::Permission.joins(:element).where(owner: owners, create_right: true, adeia_elements: {name: @controller})
+      return { rights: @create_rights }
     end
 
     def update_rights
-      @update_rights ||= Adeia::Permission.joins(:element).where(owner: owners, update_right: true, elements: {name: @controller})
+      @update_rights ||= Adeia::Permission.joins(:element).where(owner: owners, update_right: true, adeia_elements: {name: @controller})
+      @update_resource_ids ||= @update_rights.pluck(:resource_id).compact
+      return { rights: @update_rights, resource_ids: @update_resource_ids }
     end
 
     def destroy_rights
-      @destroy_rights ||= Adeia::Permission.joins(:element).where(owner: owners, destroy_right: true, elements: {name: @controller})
+      @destroy_rights ||= Adeia::Permission.joins(:element).where(owner: owners, destroy_right: true, adeia_elements: {name: @controller})
+      @destroy_resource_ids ||= @destroy_rights.pluck(:resource_id).compact
+      return { rights: @destroy_rights, resource_ids: @destroy_resource_ids }
     end
 
     def action_rights
-      @action_rights ||= Adeia::Permission.joins(:actions, :element).where(owner: owners, elements: {name: @controller}, actions: {name: @action})
+      @action_rights ||= Adeia::Permission.joins(:actions, :element).where(owner: owners, adeia_elements: {name: @controller}, adeia_actions: {name: @action})
+      @action_resource_ids ||= @action_rights.pluck(:resource_id).compact
+      return { rights: @action_rights, resource_ids: @action_resource_ids }
     end
 
     def token_rights(right_name)
       @permission_token ||= Adeia::Token.find_by_token(@token)
-      if @permission_token && @permission_token.valid
-        @token_rights ||= Adeia::Permission.joins(:element).where("ownerships.id = ? AND elements.name = ? AND #{right_name}_right = ?", @permission_token.permission_id, @controller, true)
+      if @permission_token && @permission_token.is_valid
+        @token_rights ||= Adeia::Permission.joins(:element).where(id: @permission_token.permission_id, adeia_elements: { name: @controller }, "#{right_name}_right": true)
+        @token_resource_ids ||= @token_rights.pluck(:resource_id).compact
+        return { rights: @token_rights, resource_ids: @token_resource_ids }
       else
-        @token_rights ||= Adeia::Permission.none
+        return { rights: Adeia::Permission.none }
       end
     end
 

data/lib/adeia/engine.rb

@@ -4,6 +4,13 @@ module Adeia
   class Engine < ::Rails::Engine
     isolate_namespace Adeia
 
+    config.generators do |g|
+      g.test_framework :rspec
+      g.assets false
+      g.helper false
+      g.factory_girl false
+    end
+
     initializer 'Adeia.controller' do |app|
       ActionController::Base.send :include, Adeia::ControllerMethods
     end

data/lib/adeia/version.rb

@@ -1,3 +1,3 @@
 module Adeia
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/spec/authorization_spec.rb

@@ -0,0 +1,162 @@
+require 'rails_helper'
+
+module Adeia
+
+  describe Authorization do
+    let(:user) { mock_model(User) }
+
+    it "does not allow a visitor without a token" do
+      authorization = Authorization.new("admin/articles", "new", nil, nil, nil)
+      expect { authorization.authorize! }.to raise_error LoginRequired
+    end
+
+    it "allows a visitor with a valid token" do
+      permission = create(:permission, create_right: true)
+      token = create(:token, permission: permission).token
+      authorization = Authorization.new("admin/articles", "new", token, nil, nil)
+      expect { authorization.authorize! }.not_to raise_error
+    end
+
+    it "does not allow a user without a permission" do
+      authorization = Authorization.new("admin/articles", "new", nil, nil, user)
+      expect { authorization.authorize! }.to raise_error AccessDenied
+    end
+
+    it "does not allow a user with a wrong permission" do
+      create(:permission, owner: user, read_right: true, update_right: true, destroy_right: true)
+      authorization = Authorization.new("admin/articles", "new", nil, nil, user)
+      expect { authorization.authorize! }.to raise_error AccessDenied
+    end
+
+    context "with read permission" do
+      before(:each) { create(:permission, owner: user, read_right: true) }
+
+      it "allows the user in the index action" do
+        authorization = Authorization.new("admin/articles", "index", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+      it "allows the user in the show action" do
+        authorization = Authorization.new("admin/articles", "show", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+    end
+
+    context "with create permission" do
+      before(:each) { create(:permission, owner: user, create_right: true) }
+
+      it "allows the user in the new action" do
+        authorization = Authorization.new("admin/articles", "new", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+      it "allows the user in the create action" do
+        authorization = Authorization.new("admin/articles", "create", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+    end
+
+    context "with update permission" do
+      before(:each) { create(:permission, owner: user, update_right: true) }
+
+      it "allows the user in the edit action" do
+        authorization = Authorization.new("admin/articles", "edit", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+      it "allows the user in the update action" do
+        authorization = Authorization.new("admin/articles", "update", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+    end
+
+    context "with destroy permission" do
+      before(:each) { create(:permission, owner: user, destroy_right: true) }
+
+      it "allows the user in the destroy action" do
+        authorization = Authorization.new("admin/articles", "destroy", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+    end
+
+    context "with an specific action permission" do
+      before(:each) { create(:permission, owner: user, action: "share") }
+
+      it "allows the user in the destroy action" do
+        authorization = Authorization.new("admin/articles", "share", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+    end
+
+    context "with an 'on ownership' permission" do
+      let!(:permission) { create(:permission, owner: user, update_right: true, type_name: "on_ownerships") }
+
+      it "does not allow a visitor" do
+        token = create(:token, permission: permission).token
+        authorization = Authorization.new("admin/articles", "edit", token, nil, nil)
+        expect { authorization.authorize! }.to raise_error AccessDenied
+      end
+
+      it "does not allow when no resource is provided" do
+        authorization = Authorization.new("admin/articles", "edit", nil, nil, user)
+        expect { authorization.authorize! }.to raise_error AccessDenied
+      end
+
+      it "does not allow when the resource is not his" do
+        foreign_user = mock_model(User)
+        article = mock_model(Article, user: foreign_user)
+        authorization = Authorization.new("admin/articles", "edit", nil, article, user) 
+        expect { authorization.authorize! }.to raise_error AccessDenied
+      end
+
+      it "allows the user" do
+        article = mock_model(Article, user: user)
+        authorization = Authorization.new("admin/articles", "edit", nil, article, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+    end
+
+    context "with an 'on entry' permission" do
+
+      it "does not allow when there is no resource" do
+        permission = create(:permission, owner: user, update_right: true, type_name: "on_entry", resource_id: 1)
+        authorization = Authorization.new("admin/articles", "edit", nil, nil, user)
+        expect { authorization.authorize! }.to raise_error AccessDenied
+      end
+
+      it "does not allow when the resource is not allowed" do
+        article = mock_model(Article)
+        permission = create(:permission, owner: user, update_right: true, type_name: "on_entry", resource_id: article.id + 1)
+        authorization = Authorization.new("admin/articles", "edit", nil, article, user)
+        expect { authorization.authorize! }.to raise_error AccessDenied
+      end
+
+      it "allows the user" do
+        article = mock_model(Article)
+        permission = create(:permission, owner: user, update_right: true, type_name: "on_entry", resource_id: article.id)
+        authorization = Authorization.new("admin/articles", "edit", nil, article, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+    end
+
+    context "with an inherited permission" do
+
+      it "allows the user" do
+        group = create(:user_group, user: user).group
+        permission = create(:permission, owner: group, create_right: true)
+        authorization = Authorization.new("admin/articles", "new", nil, nil, user)
+        expect { authorization.authorize! }.not_to raise_error
+      end
+
+    end
+
+  end
+
+end