ae_declarative_authorization 2.2.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a7b71e8b588137b1b2b96bc7e214cb6ab58ca778b9bdbafd34d6887897d7537
-  data.tar.gz: 98662f0d7b0d3ef4fcbec3bae6b71bb3ab8f97051e7fe3c9042c55f1f9c5391b
+  metadata.gz: 544398ffcc10dc4f2d5ee81e02b598c3bff5a79d329f3c58400b15319c2b784e
+  data.tar.gz: 8602306d8e14deb9b8799677de3c1bd640523ddc6700a1a3380d803971b7fa86
 SHA512:
-  metadata.gz: f7c3fe0957edf2aebac772624e17ba87157a0c99181ec7e64794cec22865acd1d74ab2f051b5429fe2a25abbee2665a4cef7b63235b6e26999df5c998bf51ad5
-  data.tar.gz: cc90c97438fc87fef2a014296abed704e56f37a810d8e858327caaec39cf71d3a46201a82cd4640106d7b70ffe3708163f8db0b9a72ed9612580f9c4d2d23944
+  metadata.gz: 8d9060dc0fe103609fb3eda69a0823982b857a0d9953723adb7bd10e817c12dd985e9f8ce396cdf146dcac74cda24df5f485ab9a71ad9e92138ebde0d065a9af
+  data.tar.gz: f5850595bf61b211ed0bf981c297bb1a823480b163de4d3a3cb90a25dbf48ec75cb3766c5c1f20a960d1876e61c679a9f2cf2b5a5c65567f5984bfca3c93e6fa

data/lib/declarative_authorization/authorization.rb

@@ -27,8 +27,13 @@ module Authorization
     # - event details (hash)
     attr_accessor :authorization_denied_callback
 
+    # Optional callback to wrap authorization check execution.
+    # Must return the result of executing the authorization check block.
+    attr_accessor :trace_authorization
+
     def initialize
       @authorization_denied_callback = nil
+      @trace_authorization = nil
     end
   end
 

data/lib/declarative_authorization/controller/grape.rb

@@ -1,6 +1,7 @@
 require File.dirname(__FILE__) + '/../authorization.rb'
 require File.dirname(__FILE__) + '/dsl.rb'
 require File.dirname(__FILE__) + '/runtime.rb'
+require File.dirname(__FILE__) + '/observability.rb'
 
 #
 # This mixin can be used to add declarative authorization support to APIs built using Grape
@@ -31,6 +32,7 @@ module Authorization
 
         base.helpers do
           include ::Authorization::Controller::Runtime
+          include ::Authorization::Controller::Observability
 
           def authorization_engine
             ::Authorization::Engine.instance
@@ -43,7 +45,14 @@ module Authorization
               # Acceessing route raises an exception when the response is a 405 MethodNotAllowed
               return
             end
-            unless allowed?("#{request.request_method} #{route.origin}")
+
+            action = "#{request.request_method} #{route.origin}"
+
+            allowed = trace_authorization(api: api_class&.name, action: action) do
+              allowed?(action)
+            end
+
+            unless allowed
               if respond_to?(:permission_denied, true)
                 # permission_denied needs to render or redirect
                 send(:permission_denied)

data/lib/declarative_authorization/controller/observability.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+#
+# Observability support for declarative authorization
+#
+module Authorization
+  module Controller
+    module Observability
+      def trace_authorization(*args, &block)
+        if ::Authorization.config.trace_authorization
+          ::Authorization.config.trace_authorization.call(*args, &block)
+        else
+          yield
+        end
+      end
+    end
+  end
+end

data/lib/declarative_authorization/controller/rails.rb

@@ -1,6 +1,7 @@
 require File.dirname(__FILE__) + '/../authorization.rb'
 require File.dirname(__FILE__) + '/dsl.rb'
 require File.dirname(__FILE__) + '/runtime.rb'
+require File.dirname(__FILE__) + '/observability.rb'
 
 #
 # Mixin to be added to rails controllers
@@ -18,6 +19,7 @@ module Authorization
         end
 
         base.include Runtime
+        base.include Observability
       end
 
       module ClassMethods
@@ -280,7 +282,11 @@ module Authorization
       protected
 
       def filter_access_filter # :nodoc:
-        unless allowed?(action_name)
+        allowed = trace_authorization(controller: self.class.name, action: action_name) do
+          allowed?(action_name)
+        end
+
+        unless allowed
           if respond_to?(:permission_denied, true)
             # permission_denied needs to render or redirect
             send(:permission_denied)

data/lib/declarative_authorization/version.rb

@@ -1,3 +1,3 @@
 module DeclarativeAuthorization
-  VERSION = '2.2.0'.freeze
+  VERSION = '2.3.0'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ae_declarative_authorization
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.0
 platform: ruby
 authors:
 - AppFolio
@@ -63,6 +63,7 @@ files:
 - lib/declarative_authorization/authorization.rb
 - lib/declarative_authorization/controller/dsl.rb
 - lib/declarative_authorization/controller/grape.rb
+- lib/declarative_authorization/controller/observability.rb
 - lib/declarative_authorization/controller/rails.rb
 - lib/declarative_authorization/controller/runtime.rb
 - lib/declarative_authorization/controller_permission.rb