ae_declarative_authorization 0.12.1 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 719562dc167a376019c1cbf5ef98fd3156bbd0420345b49499fb4e2932f7760b
-  data.tar.gz: 5e730141340ca6205f1c43616c0e4585fb203d3f992848911a778433c01b7da9
+  metadata.gz: 25a8212f21bb76701233314163ecdc43a91245dda378125f45f0dd819637f933
+  data.tar.gz: 1f91baaa43b7c905f0e263c5ac6a5824d7754764806d13e5da8e7f8ebd5d0b40
 SHA512:
-  metadata.gz: 954e5d140855c4db4c1be63431e64357bcb1c2a3cdf54fd36bd2ecdd3b45bbf75315da5ca6762af8cab7d6cb582831f5b57e0e57d87e7b9bb05ebbf4c065017c
-  data.tar.gz: 15132703089d3c1b7c84a474dbf5d3445c21d41580e128c7120bc6a6a3ae184a5c2945b397417463a3c4190ad17453dca442e8c37d93685629179c879cbc7d9c
+  metadata.gz: 34e5b75e9ab125ade50e801701982cb7a2db33aaab837246fb03900b7edcaba2ec39d981a3fcc94821de54190adbe9e6eed5bd29146f3732b867dc3625e6cc02
+  data.tar.gz: bc6fc502242c55259f8b2736bdd0fa221b21fde64c288e3a16b7baa1451d0c13b754012ab159bea47969838287c89db69b12c3746fb6bdd7465a9ebc2aebc5fe

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2017 AppFolio, Inc., Steffen Bartsch
+Copyright (c) 2017-2022 AppFolio, Inc., Steffen Bartsch
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/declarative_authorization.gemspec

@@ -1,24 +1,23 @@
-# -*- encoding: utf-8 -*-
-lib = File.expand_path('../lib', __FILE__)
-$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require 'declarative_authorization/version'
+# frozen_string_literal: true
 
-Gem::Specification.new do |s|
-  s.name        = 'ae_declarative_authorization'
-  s.version     = DeclarativeAuthorization::VERSION
-  s.platform    = Gem::Platform::RUBY
-  s.authors     = ['AppFolio', 'Steffen Bartsch']
-  s.email       = 'dev@appfolio.com'
-  s.description = 'ae_declarative_authorization is a Rails gem for maintainable authorization based on readable authorization rules.'
-  s.summary     = s.description
-  s.homepage    = 'http://github.com/appfolio/ae_declarative_authorization'
-  s.licenses    = ['MIT']
+require_relative 'lib/declarative_authorization/version'
 
-  s.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features|gemfiles)/}) }
-  s.executables   = s.files.grep(%r{^bin/}) { |f| File.basename(f) }
-  s.test_files    = s.files.grep(%r{^(test|spec|features)/})
-  s.require_paths = ['lib']
+Gem::Specification.new do |spec|
+  spec.name                  = 'ae_declarative_authorization'
+  spec.version               = DeclarativeAuthorization::VERSION
+  spec.platform              = Gem::Platform::RUBY
+  spec.author                = 'AppFolio'
+  spec.email                 = 'opensource@appfolio.com'
+  spec.description           = 'Rails gem for maintainable authorization based on readable authorization rules.'
+  spec.summary               = spec.description
+  spec.homepage              = 'https://github.com/appfolio/ae_declarative_authorization'
+  spec.license               = 'MIT'
+  spec.files                 = Dir['**/*'].select { |f| f[%r{^(lib/|LICENSE.txt|.*gemspec)}] }
+  spec.require_paths         = ['lib']
+  spec.required_ruby_version = Gem::Requirement.new('>= 2.6.3')
 
-  s.add_dependency(%q<blockenspiel>, ['~> 0.5.0'])
-  s.add_dependency(%q<rails>, ['>= 4.2.5.2', '< 7'])
+  spec.metadata['allowed_push_host'] = 'https://rubygems.org'
+
+  spec.add_dependency('blockenspiel', ['>= 0.5', '< 1'])
+  spec.add_dependency('rails', ['>= 4.2.5.2', '< 7.1'])
 end

data/lib/declarative_authorization/authorization.rb

@@ -2,6 +2,7 @@
 require File.dirname(__FILE__) + '/reader.rb'
 require "set"
 require "forwardable"
+require 'rails'
 
 module Authorization
   # An exception raised if anything goes wrong in the Authorization realm
@@ -175,6 +176,9 @@ module Authorization
 
       user, roles, privileges = user_roles_privleges_from_options(privilege, options)
 
+      callback = Rails.application.config.try(:ae_declarative_authorization_permit_callback)
+      callback.call(controller: options[:controller], privilege: privilege) if callback && options.include?(:controller)
+
       return true if roles.is_a?(Hash) && !(roles.keys & omnipotent_roles).empty?
 
       # find a authorization rule that matches for at least one of the roles and

data/lib/declarative_authorization/controller_permission.rb

@@ -29,7 +29,8 @@ module Authorization
                                          :user => contr.send(:current_user),
                                          :object => object,
                                          :skip_attribute_test => !@attribute_check,
-                                         :context => @context || controller_class(contr).decl_auth_context)
+                                         :context => @context || controller_class(contr).decl_auth_context,
+                                         :controller => contr)
     end
 
     def remove_actions(actions)

data/lib/declarative_authorization/test/helpers.rb

@@ -135,7 +135,7 @@ module DeclarativeAuthorization
         def access_tests(&block)
           @access_tests_defined = true
           file_output ||= [ 'test/profiles/access_checking', ENV['TEST_ENV_NUMBER'] ].compact.join('.')
-          unless File.exists?(file_output)
+          unless File.exist?(file_output)
             FileUtils.mkdir_p(File.dirname(file_output))
           end
           File.open(file_output, "a+") do |file|

data/lib/declarative_authorization/version.rb

@@ -1,3 +1,3 @@
 module DeclarativeAuthorization
-  VERSION = '0.12.1'.freeze
+  VERSION = '1.0.0'.freeze
 end

metadata

@@ -1,30 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: ae_declarative_authorization
 version: !ruby/object:Gem::Version
-  version: 0.12.1
+  version: 1.0.0
 platform: ruby
 authors:
 - AppFolio
-- Steffen Bartsch
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-08-11 00:00:00.000000000 Z
+date: 2022-02-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: blockenspiel
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.5'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: '1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.5.0
+        version: '0.5'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -34,7 +39,7 @@ dependencies:
         version: 4.2.5.2
     - - "<"
       - !ruby/object:Gem::Version
-        version: '7'
+        version: '7.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -44,27 +49,16 @@ dependencies:
         version: 4.2.5.2
     - - "<"
       - !ruby/object:Gem::Version
-        version: '7'
-description: ae_declarative_authorization is a Rails gem for maintainable authorization
-  based on readable authorization rules.
-email: dev@appfolio.com
+        version: '7.1'
+description: Rails gem for maintainable authorization based on readable authorization
+  rules.
+email: opensource@appfolio.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".circleci/config.yml"
-- ".gitignore"
-- ".ruby-version"
-- Appraisals
-- CHANGELOG
-- Gemfile
 - LICENSE.txt
-- README.md
-- README.rdoc
-- Rakefile
-- authorization_rules.dist.rb
 - declarative_authorization.gemspec
-- init.rb
 - lib/declarative_authorization.rb
 - lib/declarative_authorization/authorization.rb
 - lib/declarative_authorization/controller/dsl.rb
@@ -84,11 +78,12 @@ files:
 - lib/generators/authorization/rules/rules_generator.rb
 - lib/generators/authorization/rules/templates/authorization_rules.rb
 - lib/tasks/authorization_tasks.rake
-homepage: http://github.com/appfolio/ae_declarative_authorization
+homepage: https://github.com/appfolio/ae_declarative_authorization
 licenses:
 - MIT
-metadata: {}
-post_install_message: 
+metadata:
+  allowed_push_host: https://rubygems.org
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -96,16 +91,16 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.6.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.3.3
+signing_key:
 specification_version: 4
-summary: ae_declarative_authorization is a Rails gem for maintainable authorization
-  based on readable authorization rules.
+summary: Rails gem for maintainable authorization based on readable authorization
+  rules.
 test_files: []

data/.circleci/config.yml

@@ -1,29 +0,0 @@
-version: 2.1
-commands:
-  bundle_install_and_test:
-    steps:
-      - checkout
-      - run: bundle install
-      - run: bundle exec appraisal install
-      - run: bundle exec appraisal rake test
-
-jobs:
-  test-ruby-253:
-    docker:
-      - image: circleci/ruby:2.5.3
-    steps:
-      - bundle_install_and_test
-
-  test-ruby-263:
-    docker:
-      - image: circleci/ruby:2.6.3
-    steps:
-      - bundle_install_and_test
-
-workflows:
-  rc:
-    jobs:
-      - test-ruby-253:
-          context: appfolio_test_context
-      - test-ruby-263:
-          context: appfolio_test_context

data/.gitignore

@@ -1,32 +0,0 @@
-# Because this is a gem, ignore Gemfile.lock:
-
-Gemfile.lock
-gemfiles/*.gemfile.lock
-
-# And because this is Ruby, ignore the following
-# (source: https://github.com/github/gitignore/blob/master/Ruby.gitignore):
-
-*.gem
-*.rbc
-.bundle
-.config
-coverage
-InstalledFiles
-lib/bundler/man
-pkg
-log
-rdoc
-spec/reports
-test/test.log
-test/tmp
-test/version_tmp
-test/test_app/log
-tmp
-test/profiles
-
-# YARD artifacts
-.yardoc
-_yardoc
-doc/
-
-.idea

data/.ruby-version

@@ -1 +0,0 @@
-ruby-2.6.3

data/Appraisals

@@ -1,27 +0,0 @@
-RAILS_VERSIONS = ['5.2.2.1', '6.0.2.1']
-GRAPE_VERSIONS = ['1.1.0', '1.2.3', '1.3.0']
-
-case RUBY_VERSION
-
-when '2.5.3', '2.6.3' then
-  RAILS_VERSIONS.product(GRAPE_VERSIONS).each do |rails_version, grape_version|
-    appraise "ruby-#{RUBY_VERSION}-rails#{rails_version}-grape#{grape_version}" do
-      gem 'rails', rails_version
-      gem 'grape', grape_version
-
-      if Gem::Version.new(grape_version) < Gem::Version.new('1.3.0')
-        # https://github.com/ruby-grape/grape/pull/1956
-        gem "rack", "< 2.1.0"
-      end
-
-      if Gem::Version.new(rails_version) >= Gem::Version.new('6')
-        gem 'sqlite3', '~> 1.4'
-      else
-        gem 'sqlite3', '~> 1.3.0'
-      end
-    end
-  end
-else
-  raise "Unsupported Ruby version #{RUBY_VERSION}"
-
-end

data/CHANGELOG

@@ -1,189 +0,0 @@
-** RELEASE 0.5.7 (Mar 10, 2013)
-
-* Ruby 2.0 compatibility [jhawthorn]
-
-** RELEASE 0.5.6 (Sep 23, 2012)
-
-* Fix handling of stray object associations [jhawthorn]
-
-* Improve test infrastructure [jhawthorn]
-
-* Allow decl_auth to be used without ActiveRecord [bterkuile]
-
-* Rule reloading in development based on changes [urkle/sb]
-
-** RELEASE 0.5.5 (Jan 10, 2012)
-
-* Update of handling of association proxies for Rails 3.2
-
-** RELEASE 0.5.4 (Nov 30, 2011)
-
-* Cumulative loading of authorization rules [Damian Curso/sb]
-
-* Improved used_privileges rake task [urkle]
-
-* Performance improvements [John Hawthorn]
-
-** RELEASE 0.5.3 (May 25, 2011)
-
-* Bugfixes and documentation cleanup
-
-* Rails 3.1.rc1 compatibility [sb]
-
-* Added has_any_role?, has_any_role_with_hierarchy? [t.pickett66]
-
-* Allow changing the default role [dbloete]
-
-** RELEASE 0.5.2 (Dec 31, 2010) **
-
-* Bugfixes and documentation updates
-
-** RELEASE 0.5.1 (Sep 12, 2010) **
-
-** RELEASE 0.5 (July 21, 2010) **
-
-* Ruby 1.9.2 compatibility [sb]
-
-* Comparisons in authorization roles: lt, lte, gt, gte [aepstein,hollownest]
-
-* DSL optimization: allow array being passed to to 
-
-* Omnipotent roles [timcharper]
-
-* Meaningful error in case of missing authorization rules file [timcharper]
-
-* Rails 3 support [sb]
-
-* Support shallow nested resources [jjb]
-
-* Allow multiple authorization rules files [kaichen]
-
-** RELEASE 0.4 (November 15, 2009) **
-
-* Implemented controller namespace handling [sb]
-
-* Improved if_attribute to allow nesting of has_many associations [sb]
-
-* Improved if_permitted_to: allow has_many associations and improved context inference [sb]
-
-* Added option on handling non-existant auto-loaded object [sb]
-
-* Added with_user as module method [sb]
-
-* Change support i18n [sb]
-
-** RELEASE 0.3.2.3 (October 12, 2009) **
-
-* Switched to gemcutter [sb]
-
-* Fixed has_role? for guest user. Closes #8 [sb]
-
-* Fixed unnecessary DB query with named scopes [sb, ledermann]
-
-* Change support: suggestions: grouping, sorting by affected users [sb]
-
-* Fixed context inference from AR objects for STI by switching to #class.name.tableize [sb]
-
-* Allow multiple contexts as arguments to has_permission_on [Jeroen van Dijk]
-
-** RELEASE 0.3.2.2 (August 27, 2009) **
-
-* Fix without_access_control test cases [sb]
-
-* Fixed error on debug logging (Closes #6) [sb]
-
-* Fixed without_access_control instance method in TestHelper [sb]
-
-** RELEASE 0.3.2.1 (August 14, 2009) **
-
-* Fix gemspec for Rdoc generation [sb]
-
-** RELEASE 0.3.2 (August 13, 2009) **
-
-* Fix for model-level permitted_to?/! [sb]
-
-** RELEASE 0.3.1 (August 12, 2009) **
-
-* Change Support: Suggestion grouping, sort by affected users [sb]
-
-* Changed context derived from objects to #class.name.tableize to fix STI [sb]
-
-* Simplified controller authorization with filter_resource_access [sb]
-
-* Allow passing explicit context in addition to object in permitted_to? [Olly Lylo, sb]
-
-* Change Supporter: suggest changes to authorization rules [sb]
-
-* Added permitted_to!/? in model [Eike Carls]
-
-* New test helper: should_(not_)_be_allowed_to(privilege, object_or_context) [sb]
-
-** RELEASE 0.3 (April 20, 2009) **
-
-* New option :join_by for has_permission_on to allow AND'ing of statements in one has_permission_on block [sb]
-
-* Allow using_access_control to be called directly on ActiveRecord::Base, globally enabling model security [sb]
-
-* New operator:  intersects_with, comparing two Enumerables in if_attribute [sb]
-
-* Improved if_permitted_to syntax:  if the attribute is left out, permissions are checked on for the current object [sb]
-
-* Added #has_role_with_hierarchy? method to retrieve explicit and calculated roles [jeremyf]
-
-* Added a simple rules analyzer to help improve authorization rules [sb]
-
-* Gemified plugin.  Needed to restructure the lib path contents [sb]
-
-* Added handling of Authorization::AuthorizationInController::ClassMethods.filter_access_to parameters that are of the form [:show, :update] instead of just :show, :update. [jeremyf]
-
-* Added authorization usage helper for checking filter_access_to usage in controllers [sb]
-
-* Added a authorization rules browser.  See README for more information [sb]
-
-* Added Model.using_access_control? to check if a model has model security activated [sb]
-
-* Changed Authorization::ObligationScope#map_table_alias_for [Brian Langenfeld]
-  * Fixed to prevent bad aliases from being produced.
-
-* Changed Authorization::Attribute#validate? [Brian Langenfeld]
-  * Encountering a nil value when evaluating an attribute now raises a NilAttributeValueError, instead of an AuthorizationError.  We leave it to the caller to decide what to do about it.
-
-* Changed Authorization::Engine#permit! [Brian Langenfeld]
-  * We now convert incoming privileges to symbols (e.g. 'read' is made equivalent to :read).  This ensures the privileges will match those defined in the authorization rules file.
-  * The method now properly infers context when checking against an association (e.g. user.posts).  We do this by leveraging ActiveRecord builder method 'new' to instantiate a proper object we can work with.
-  * When testing rules for positive results (via Authorization::Attribute#validate?), we now rescue NilAttributeValueError exceptions, simply causing the rule to return a negative result (instead of barfing).
-
-* Changed Authorization::ObligationScope#rebuild_join_options! [Brian Langenfeld]
-  * If we're dealing with multiple obligations we have to check (i.e. ones that result in OR'd conditions), we now use :include instead of :joins for our generated scope.  This does seem like a kludge, but until ActiveRecord scopes support unions (for checking obligations individually and consolidating the results), we don't have much choice.  Something to revisit later, for sure.
-
-** RELEASE 0.2 (February 2, 2009) **
-
-* added negative operators: is_not, not_in, does_not_contain [sb]
-
-* changed user.roles to user.role_symbols to reduce interferance with associations [sb]
-
-* Ruby 1.9 and Rails 2.3 compatibility [sb]
-
-* if_permitted_to for has_permission_on blocks for DRYer auth rules [sb]
-
-* ObligationScope rewrite of query rewriting [Brian Langenfeld]
-
-* changed exception hierarchy to begin at StandardError [sb]
-
-* :is_in operator [sb]
-
-* added has_role? helper [sb]
-
-* made plugin thread-safe [sb]
-
-* added maintenance and test helpers [sb]
-
-* changed default permission denied response to 403 Forbidden [sb]
-
-* descriptions for titles and roles [sb]
-
-* fixed for PostgreSQL [Mark Mansour]
-
-* improved DSL syntax: allow for array of contexts in has_permission_on [sb]
-
-** RELEASE 0.1 (August 22, 2008) **

data/Gemfile

@@ -1,9 +0,0 @@
-source 'http://rubygems.org'
-
-gemspec
-
-gem 'appraisal', '~> 2.1'
-gem 'mocha', '~> 1.0', require: false
-gem 'sprockets', '< 4'
-
-gem 'rails-controller-testing'