ae_declarative_authorization 1.7.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56ec4f643afa582330c80d6383b776bc99d459eec3ecc89369c5fcdbc11287a3
-  data.tar.gz: 76a94f61774f7b1e2c92b92f84bce2e924ef26f84135eb4e53109f29395322d0
+  metadata.gz: 3ef6198e116e9ca661b4799db0fb643b3ac2edfed4afecf87b44fd2f2dade3d8
+  data.tar.gz: 6231b714160be944286cb181b6c4f68dd49b8048688b38943bf078f84d666f02
 SHA512:
-  metadata.gz: 21bb39616062054dd32243a8511be52c61dac5d30aada8fd451874251c98f3600b1c3e7f35092525798dee652eda100c5a8251482769c759310b009cf68d98e8
-  data.tar.gz: 0b13eb2582830386ccc5544554415ea15c385ff6155523e889af55c7a5036c39964f6a0ba558b0b71203c535aa64dbd485b8510899ff74726634ca5ed564fc73
+  metadata.gz: e5e1396443afc071a0818ceb4ee65adbd65e518aa47d451d44d200a8f927cd29a8e47223f22581d6e746bae66f2a092ce6de371ebed7e504b1605bd0407c041f
+  data.tar.gz: ac878748b8c0d6bff2696e8e6a47e59be771da115b378a1a28d2aa0f9056dd41301434ef2325471a9255c2416b2e892ddef7ddbeafce491aad5c0bb77443ffb3

data/lib/declarative_authorization/test/helpers.rb

@@ -23,6 +23,8 @@ module DeclarativeAuthorization
         end
 
         def allowed(options)
+          return unless @test_class.run_assertion?(options)
+
           role, privileges, actions, params_name = extract_options(options)
 
           actions.each do |action|
@@ -38,6 +40,8 @@ module DeclarativeAuthorization
         end
 
         def denied(options)
+          return unless @test_class.run_assertion?(options)
+
           role, privileges, actions, params_name = extract_options(options)
 
           actions.each do |action|
@@ -89,6 +93,8 @@ module DeclarativeAuthorization
         end
 
         def allowed(options)
+          return unless @test_class.run_assertion?(options)
+
           if options[:when]
             privilege(options[:when]) { allowed(options) }
           else
@@ -97,6 +103,8 @@ module DeclarativeAuthorization
         end
 
         def denied(options)
+          return unless @test_class.run_assertion?(options)
+
           if options[:when]
             privilege(options[:when]) { denied(options) }
           else
@@ -119,21 +127,54 @@ module DeclarativeAuthorization
 
         def role(role, &block)
           raise "Role cannot be blank!" if role.blank?
-          Blockenspiel.invoke(block, RoleTestGenerator.new(@test_class, role))
+
+          Blockenspiel.invoke(block, RoleTestGenerator.new(@test_class, role)) if @test_class.run_role_test?(role)
+        end
+      end
+
+      class AccessTestParser
+        include Blockenspiel::DSL
+
+        def initialize(test_class)
+          @test_class = test_class
+        end
+
+        def params(_name, &_block);end
+
+        def role(role, &block)
+          Blockenspiel.invoke(block, self) if @test_class.run_role_test?(role)
         end
 
+        def privilege(_privilege, &block)
+          Blockenspiel.invoke(block, self)
+        end
+
+        def allowed(options)
+          if options[:only]
+            @test_class.run_all_assertions = false
+          end
+        end
+
+        def denied(options)
+          if options[:only]
+            @test_class.run_all_assertions = false
+          end
+        end
       end
 
       module ClassMethods
-        attr_reader :access_tests_defined
+        attr_reader :access_tests_defined, :only_run_roles
+        attr_accessor :run_all_assertions
 
         def skip_access_tests_for_actions(*actions)
           @skipped_access_test_actions ||= []
           @skipped_access_test_actions += actions.map(&:to_sym)
         end
 
-        def access_tests(&block)
+        def access_tests(only_run_roles: nil, &block)
           @access_tests_defined = true
+          @run_all_assertions = true
+          @only_run_roles = only_run_roles
           file_output ||= [ Dir.tmpdir + '/test/profiles/access_checking', ENV['TEST_ENV_NUMBER'] ].compact.join('.')
           unless File.exist?(file_output)
             FileUtils.mkdir_p(File.dirname(file_output))
@@ -142,6 +183,7 @@ module DeclarativeAuthorization
             file.puts self.controller_class.name
           end
 
+          Blockenspiel.invoke(block, AccessTestParser.new(self))
           Blockenspiel.invoke(block, AccessTestGenerator.new(self))
         end
 
@@ -192,6 +234,14 @@ module DeclarativeAuthorization
           define_method("access_test_params_for_#{name}", &block)
         end
 
+        def run_role_test?(role)
+          @only_run_roles.nil? || @only_run_roles.include?(role)
+        end
+
+        def run_assertion?(assertion_options)
+          @run_all_assertions || assertion_options[:only]
+        end
+
       end
 
       protected
@@ -248,15 +298,27 @@ module DeclarativeAuthorization
         errors_to_reraise << Mocha::ExpectationError if defined?(Mocha::ExpectationError)
 
         begin
+          if options[:debug]
+            puts "Debug: Sending request - role: #{role}, action: #{action}, privilege: #{privilege}, params: #{params.inspect}, http_method: #{http_method}, xhr: #{xhr}"
+          end
           send *send_args, **send_kwargs
+          if options[:debug]
+            puts "Debug: Response status: #{response.status}" if response.status
+            puts "Debug: flash[:error]: #{flash[:error]}" if flash[:error]
+            puts "Debug: flash[:alert]: #{flash[:alert]}" if flash[:alert]
+          end
           return response_forbidden?
         rescue *errors_to_reraise => e
           raise e
         rescue => e
-          if options[:print_error]
-            puts "\n#{e.class.name} raised in action '#{action}':"
-            puts e.message
-            puts e.backtrace.join("\n")
+          # Exceptions are expected from controllers as complete requests are not always made in access tests
+          if options[:debug]
+            puts "Debug: Exception raised from controller, not considered as an error for access tests as response is not coming from the declarative authorization framework."
+            puts "Debug: Response status: #{response.status}" if response.status
+            puts "Debug: flash[:error]: #{flash[:error]}" if flash[:error]
+            puts "Debug: flash[:alert]: #{flash[:alert]}" if flash[:alert]
+            puts "Debug: Exception: #{e.class} - #{e.message}"
+            puts e.backtrace.join("\n") if e.backtrace
           end
           return false
         end

data/lib/declarative_authorization/version.rb

@@ -1,3 +1,3 @@
 module DeclarativeAuthorization
-  VERSION = '1.7.0'.freeze
+  VERSION = '2.0.0'.freeze
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ae_declarative_authorization
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 2.0.0
 platform: ruby
 authors:
 - AppFolio
 bindir: bin
 cert_chain: []
-date: 2025-06-18 00:00:00.000000000 Z
+date: 2025-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: blockenspiel
@@ -77,7 +77,6 @@ files:
 - lib/generators/authorization/install/install_generator.rb
 - lib/generators/authorization/rules/rules_generator.rb
 - lib/generators/authorization/rules/templates/authorization_rules.rb
-- lib/rubocop/cop/decl_auth/before_actions_precede_access_filter.rb
 - lib/tasks/authorization_tasks.rake
 - rubocop-decl-auth.yml
 homepage: https://github.com/appfolio/ae_declarative_authorization

data/lib/rubocop/cop/decl_auth/before_actions_precede_access_filter.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-module RuboCop
-  module Cop
-    module DeclAuth
-      # Enforces placing all `before_action` statements prior to the first `filter_access_to` statement.
-      # This ensures that any data required by the access filters is available before the filter is applied.
-      # See the documentation above the `filter_access_to` method in Authorization::Controller::DSL for more information
-      #
-      # @example
-      #   # bad
-      #   before_action: :do_something
-      #   filter_access_to :all
-      #   before_action :find_object
-      #
-      #   # good
-      #   before_action: :do_something
-      #   before_action :find_object
-      #
-      #   filter_access_to :all
-      #
-      class BeforeActionsPrecedeAccessFilter < RuboCop::Cop::Base
-        def_node_search :before_actions, '(send nil? :before_action ...)'
-        def_node_search :access_filters, '(send nil? :filter_access_to ...)'
-
-        MSG = '`:filter_access_to` statements should be placed after all other `:before_action` statements.'
-
-        def on_class(node)
-          before_actions = before_actions(node)
-          access_filters = access_filters(node)
-
-          return if before_actions.count.zero? || access_filters.count.zero?
-
-          last_before_action = before_actions.to_a.last
-          first_access_filter = access_filters.to_a.first
-
-          return if last_before_action.sibling_index < first_access_filter.sibling_index
-
-          add_offense(access_filters.first, message: MSG)
-        end
-      end
-    end
-  end
-end