ae_declarative_authorization 2.0.0 → 2.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ef6198e116e9ca661b4799db0fb643b3ac2edfed4afecf87b44fd2f2dade3d8
-  data.tar.gz: 6231b714160be944286cb181b6c4f68dd49b8048688b38943bf078f84d666f02
+  metadata.gz: a2ca63e37d30027563b26e6c28b7fc79fd2db70199f0ca99943db814d745cec8
+  data.tar.gz: 9a3fea3211ed89316963093f7cb5e9de1bf0746f43ad144365b0e42ffd280a9d
 SHA512:
-  metadata.gz: e5e1396443afc071a0818ceb4ee65adbd65e518aa47d451d44d200a8f927cd29a8e47223f22581d6e746bae66f2a092ce6de371ebed7e504b1605bd0407c041f
-  data.tar.gz: ac878748b8c0d6bff2696e8e6a47e59be771da115b378a1a28d2aa0f9056dd41301434ef2325471a9255c2416b2e892ddef7ddbeafce491aad5c0bb77443ffb3
+  metadata.gz: 99a84b5518cd24595e6e411b3cbd59ed30367cd6cd862d3457e7313aa52ff5e85eadaccef200ceb3ecb7b78702399d2bd22642209663cefa6e19ef13ec7d0153
+  data.tar.gz: 69916da3d5a336647991102d2e9fa6b17bc9f50cc87999727c1e8b20b174218b0fd747741d45136e10e5aadeb1e71f195e7d0bc48693ef29bbc3a0bef5643237

data/lib/declarative_authorization/authorization.rb

@@ -3,6 +3,7 @@ require File.dirname(__FILE__) + '/reader.rb'
 require "set"
 require "forwardable"
 require 'rails'
+require 'uri'
 
 module Authorization
   # An exception raised if anything goes wrong in the Authorization realm
@@ -21,6 +22,24 @@ module Authorization
   # The exception is raised to ensure that the entire rule is invalidated.
   class NilAttributeValueError < AuthorizationError; end
 
+  class Config
+    # A function that takes one argument:
+    # - event details (hash)
+    attr_accessor :authorization_denied_callback
+
+    def initialize
+      @authorization_denied_callback = nil
+    end
+  end
+
+  def self.config
+    @config ||= Config.new
+  end
+
+  def self.configure
+    yield config
+  end
+
   AUTH_DSL_FILES = [Pathname.new(Rails.root || '').join("config", "authorization_rules.rb").to_s] unless defined? AUTH_DSL_FILES
 
   # Controller-independent method for retrieving the current user.
@@ -192,6 +211,28 @@ module Authorization
       end
 
       if options[:bang]
+        # Call authorization_denied_callback if configured
+        if Authorization.config.authorization_denied_callback
+          action = if options[:controller]&.respond_to?(:action_name)
+                     options[:controller].action_name
+                   elsif options[:controller]&.respond_to?(:route) # Grape API
+                     options[:controller].route&.request_method
+                   end
+
+          referer_url = options[:controller]&.respond_to?(:request) ? options[:controller].request&.referer : nil
+          referer_path = referer_url ? (URI.parse(referer_url).path rescue nil) : nil
+
+          Authorization.config.authorization_denied_callback.call(
+            {
+              action: action,
+              path: options[:controller]&.respond_to?(:request) ? options[:controller].request&.path : nil,
+              context: options[:context].to_s,
+              attribute_check_denial: !rules.empty?,
+              referer: referer_path
+            }
+          )
+        end
+
         if rules.empty?
           raise NotAuthorized, "No matching rules found for #{privilege} for User with id #{user.try(:id)} " +
             "(roles #{roles.inspect}, privileges #{privileges.inspect}, " +

data/lib/declarative_authorization/version.rb

@@ -1,3 +1,3 @@
 module DeclarativeAuthorization
-  VERSION = '2.0.0'.freeze
+  VERSION = '2.1.1'.freeze
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ae_declarative_authorization
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.1
 platform: ruby
 authors:
 - AppFolio
 bindir: bin
 cert_chain: []
-date: 2025-08-18 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: blockenspiel
@@ -98,7 +98,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Rails gem for maintainable authorization based on readable authorization
   rules.