ae_declarative_authorization 1.7.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56ec4f643afa582330c80d6383b776bc99d459eec3ecc89369c5fcdbc11287a3
-  data.tar.gz: 76a94f61774f7b1e2c92b92f84bce2e924ef26f84135eb4e53109f29395322d0
+  metadata.gz: 7d3a61732493a7f1dfa8698fa016e257e119204c7bf878397b5caa62080c360b
+  data.tar.gz: 5d05fbeb9f859e393a42aa86108278037377225ddbe02160a5a6ad5ef4f199fa
 SHA512:
-  metadata.gz: 21bb39616062054dd32243a8511be52c61dac5d30aada8fd451874251c98f3600b1c3e7f35092525798dee652eda100c5a8251482769c759310b009cf68d98e8
-  data.tar.gz: 0b13eb2582830386ccc5544554415ea15c385ff6155523e889af55c7a5036c39964f6a0ba558b0b71203c535aa64dbd485b8510899ff74726634ca5ed564fc73
+  metadata.gz: 01ec7768b90fcdb701456f254519acce547a635cc6b49a0fad4080c41cc3d72901bf6443c44de132a5f10df63d7c7bf866189f8d1f6a3e79a4e11e51bfa92547
+  data.tar.gz: 7bf88799408d3883d41ecbb5e5616d1d12323e6f2e535c9d39ada2bea149ce349e6696750c57901d0059e930863e0f4b7a4caab2b7c770c683d1c7ac64f1fd91

data/lib/declarative_authorization/authorization.rb

@@ -21,6 +21,24 @@ module Authorization
   # The exception is raised to ensure that the entire rule is invalidated.
   class NilAttributeValueError < AuthorizationError; end
 
+  class Config
+    # A function that takes one argument:
+    # - event details (hash)
+    attr_accessor :authorization_denied_callback
+
+    def initialize
+      @authorization_denied_callback = nil
+    end
+  end
+
+  def self.config
+    @config ||= Config.new
+  end
+
+  def self.configure
+    yield config
+  end
+
   AUTH_DSL_FILES = [Pathname.new(Rails.root || '').join("config", "authorization_rules.rb").to_s] unless defined? AUTH_DSL_FILES
 
   # Controller-independent method for retrieving the current user.
@@ -192,6 +210,24 @@ module Authorization
       end
 
       if options[:bang]
+        # Call authorization_denied_callback if configured
+        if Authorization.config.authorization_denied_callback
+          action = if options[:controller]&.respond_to?(:action_name)
+                     options[:controller].action_name
+                   elsif options[:controller]&.respond_to?(:route) # Grape API
+                     options[:controller].route&.request_method
+                   end
+
+          Authorization.config.authorization_denied_callback&.call(
+            {
+              action: action,
+              path: options[:controller]&.respond_to?(:request) ? options[:controller].request&.path : nil,
+              context: options[:context].to_s,
+              attribute_check_denial: !rules.empty?
+            }
+          )
+        end
+
         if rules.empty?
           raise NotAuthorized, "No matching rules found for #{privilege} for User with id #{user.try(:id)} " +
             "(roles #{roles.inspect}, privileges #{privileges.inspect}, " +

data/lib/declarative_authorization/test/helpers.rb

@@ -23,6 +23,8 @@ module DeclarativeAuthorization
         end
 
         def allowed(options)
+          return unless @test_class.run_assertion?(options)
+
           role, privileges, actions, params_name = extract_options(options)
 
           actions.each do |action|
@@ -38,6 +40,8 @@ module DeclarativeAuthorization
         end
 
         def denied(options)
+          return unless @test_class.run_assertion?(options)
+
           role, privileges, actions, params_name = extract_options(options)
 
           actions.each do |action|
@@ -89,6 +93,8 @@ module DeclarativeAuthorization
         end
 
         def allowed(options)
+          return unless @test_class.run_assertion?(options)
+
           if options[:when]
             privilege(options[:when]) { allowed(options) }
           else
@@ -97,6 +103,8 @@ module DeclarativeAuthorization
         end
 
         def denied(options)
+          return unless @test_class.run_assertion?(options)
+
           if options[:when]
             privilege(options[:when]) { denied(options) }
           else
@@ -119,21 +127,54 @@ module DeclarativeAuthorization
 
         def role(role, &block)
           raise "Role cannot be blank!" if role.blank?
-          Blockenspiel.invoke(block, RoleTestGenerator.new(@test_class, role))
+
+          Blockenspiel.invoke(block, RoleTestGenerator.new(@test_class, role)) if @test_class.run_role_test?(role)
+        end
+      end
+
+      class AccessTestParser
+        include Blockenspiel::DSL
+
+        def initialize(test_class)
+          @test_class = test_class
+        end
+
+        def params(_name, &_block);end
+
+        def role(role, &block)
+          Blockenspiel.invoke(block, self) if @test_class.run_role_test?(role)
         end
 
+        def privilege(_privilege, &block)
+          Blockenspiel.invoke(block, self)
+        end
+
+        def allowed(options)
+          if options[:only]
+            @test_class.run_all_assertions = false
+          end
+        end
+
+        def denied(options)
+          if options[:only]
+            @test_class.run_all_assertions = false
+          end
+        end
       end
 
       module ClassMethods
-        attr_reader :access_tests_defined
+        attr_reader :access_tests_defined, :only_run_roles
+        attr_accessor :run_all_assertions
 
         def skip_access_tests_for_actions(*actions)
           @skipped_access_test_actions ||= []
           @skipped_access_test_actions += actions.map(&:to_sym)
         end
 
-        def access_tests(&block)
+        def access_tests(only_run_roles: nil, &block)
           @access_tests_defined = true
+          @run_all_assertions = true
+          @only_run_roles = only_run_roles
           file_output ||= [ Dir.tmpdir + '/test/profiles/access_checking', ENV['TEST_ENV_NUMBER'] ].compact.join('.')
           unless File.exist?(file_output)
             FileUtils.mkdir_p(File.dirname(file_output))
@@ -142,6 +183,7 @@ module DeclarativeAuthorization
             file.puts self.controller_class.name
           end
 
+          Blockenspiel.invoke(block, AccessTestParser.new(self))
           Blockenspiel.invoke(block, AccessTestGenerator.new(self))
         end
 
@@ -192,6 +234,14 @@ module DeclarativeAuthorization
           define_method("access_test_params_for_#{name}", &block)
         end
 
+        def run_role_test?(role)
+          @only_run_roles.nil? || @only_run_roles.include?(role)
+        end
+
+        def run_assertion?(assertion_options)
+          @run_all_assertions || assertion_options[:only]
+        end
+
       end
 
       protected
@@ -248,15 +298,27 @@ module DeclarativeAuthorization
         errors_to_reraise << Mocha::ExpectationError if defined?(Mocha::ExpectationError)
 
         begin
+          if options[:debug]
+            puts "Debug: Sending request - role: #{role}, action: #{action}, privilege: #{privilege}, params: #{params.inspect}, http_method: #{http_method}, xhr: #{xhr}"
+          end
           send *send_args, **send_kwargs
+          if options[:debug]
+            puts "Debug: Response status: #{response.status}" if response.status
+            puts "Debug: flash[:error]: #{flash[:error]}" if flash[:error]
+            puts "Debug: flash[:alert]: #{flash[:alert]}" if flash[:alert]
+          end
           return response_forbidden?
         rescue *errors_to_reraise => e
           raise e
         rescue => e
-          if options[:print_error]
-            puts "\n#{e.class.name} raised in action '#{action}':"
-            puts e.message
-            puts e.backtrace.join("\n")
+          # Exceptions are expected from controllers as complete requests are not always made in access tests
+          if options[:debug]
+            puts "Debug: Exception raised from controller, not considered as an error for access tests as response is not coming from the declarative authorization framework."
+            puts "Debug: Response status: #{response.status}" if response.status
+            puts "Debug: flash[:error]: #{flash[:error]}" if flash[:error]
+            puts "Debug: flash[:alert]: #{flash[:alert]}" if flash[:alert]
+            puts "Debug: Exception: #{e.class} - #{e.message}"
+            puts e.backtrace.join("\n") if e.backtrace
           end
           return false
         end

data/lib/declarative_authorization/version.rb

@@ -1,3 +1,3 @@
 module DeclarativeAuthorization
-  VERSION = '1.7.0'.freeze
+  VERSION = '2.1.0'.freeze
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ae_declarative_authorization
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 2.1.0
 platform: ruby
 authors:
 - AppFolio
 bindir: bin
 cert_chain: []
-date: 2025-06-18 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: blockenspiel
@@ -77,7 +77,6 @@ files:
 - lib/generators/authorization/install/install_generator.rb
 - lib/generators/authorization/rules/rules_generator.rb
 - lib/generators/authorization/rules/templates/authorization_rules.rb
-- lib/rubocop/cop/decl_auth/before_actions_precede_access_filter.rb
 - lib/tasks/authorization_tasks.rake
 - rubocop-decl-auth.yml
 homepage: https://github.com/appfolio/ae_declarative_authorization
@@ -99,7 +98,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Rails gem for maintainable authorization based on readable authorization
   rules.

data/lib/rubocop/cop/decl_auth/before_actions_precede_access_filter.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-module RuboCop
-  module Cop
-    module DeclAuth
-      # Enforces placing all `before_action` statements prior to the first `filter_access_to` statement.
-      # This ensures that any data required by the access filters is available before the filter is applied.
-      # See the documentation above the `filter_access_to` method in Authorization::Controller::DSL for more information
-      #
-      # @example
-      #   # bad
-      #   before_action: :do_something
-      #   filter_access_to :all
-      #   before_action :find_object
-      #
-      #   # good
-      #   before_action: :do_something
-      #   before_action :find_object
-      #
-      #   filter_access_to :all
-      #
-      class BeforeActionsPrecedeAccessFilter < RuboCop::Cop::Base
-        def_node_search :before_actions, '(send nil? :before_action ...)'
-        def_node_search :access_filters, '(send nil? :filter_access_to ...)'
-
-        MSG = '`:filter_access_to` statements should be placed after all other `:before_action` statements.'
-
-        def on_class(node)
-          before_actions = before_actions(node)
-          access_filters = access_filters(node)
-
-          return if before_actions.count.zero? || access_filters.count.zero?
-
-          last_before_action = before_actions.to_a.last
-          first_access_filter = access_filters.to_a.first
-
-          return if last_before_action.sibling_index < first_access_filter.sibling_index
-
-          add_offense(access_filters.first, message: MSG)
-        end
-      end
-    end
-  end
-end