alberich 0.2.0

data/app/models/alberich/privilege.rb

@@ -0,0 +1,29 @@
+module Alberich
+  class Privilege < ActiveRecord::Base
+    attr_accessible :action, :role, :role_id, :target_type
+
+    PERM_SET  = "set_perms"    # can create/modify/delete permission
+                               # records on this object
+    PERM_VIEW = "view_perms"   # can view permission records on this
+                               # object
+    CREATE    = "create"       # can create objects of this type here
+    MODIFY    = "modify"       # can modify objects of this type here
+    VIEW      = "view"         # can view objects of this type here
+    USE       = "use"          # can use objects of this type here
+
+    ACTIONS = [ CREATE, MODIFY, USE, VIEW,
+                PERM_SET, PERM_VIEW]
+    TARGET_TYPES = ["Alberich::BasePermissionObject"] +
+      Alberich.permissioned_object_classes +
+      Alberich.additional_privilege_scopes
+
+    belongs_to :role
+    validates_presence_of :role_id
+    validates_presence_of :target_type
+    validates_presence_of :action
+    validates_uniqueness_of :action, :scope => [:target_type, :role_id]
+    validates_inclusion_of :target_type, :in => TARGET_TYPES
+    validates_inclusion_of :action, :in => ACTIONS
+
+  end
+end

data/app/models/alberich/role.rb

@@ -0,0 +1,37 @@
+module Alberich
+  class Role < ActiveRecord::Base
+    VALID_SCOPES = ["Alberich::BasePermissionObject"] + Alberich.permissioned_object_classes
+    has_many :permissions, :dependent => :destroy
+    has_many :derived_permissions, :dependent => :destroy
+    has_many :privileges, :dependent => :destroy
+
+    attr_accessible :name, :assign_to_owner, :scope
+
+    validates_presence_of :scope
+    validates_presence_of :name
+    validates_uniqueness_of :name
+
+    validates_associated :privileges
+
+    validates_length_of :name, :maximum => 255
+    validates_inclusion_of :scope, :in => VALID_SCOPES
+    def privilege_target_types
+      privileges.collect {|x| x.target_type.constantize}.uniq
+    end
+    def privilege_target_match(obj_type)
+      (privilege_target_types & obj_type.active_privilege_target_types).any?
+    end
+
+    def self.all_by_scope
+      roles = self.all
+      role_hash = {}
+      roles.each do |role|
+        role_hash[role.scope] ||= []
+        role_hash[role.scope] << role
+      end
+      role_hash
+    end
+
+  end
+
+end

data/app/models/alberich/session_entity.rb

@@ -0,0 +1,15 @@
+module Alberich
+  class SessionEntity < ActiveRecord::Base
+    attr_accessible :entity_id, :permission_session_id, :user_id,
+                    :entity, :user
+    belongs_to :user
+    belongs_to :entity
+    belongs_to :permission_session
+
+    validates_presence_of :user_id
+    validates_presence_of :permission_session_id
+    validates_presence_of :entity_id
+    validates_uniqueness_of :entity_id, :scope => [:user_id, :permission_session_id]
+
+  end
+end

data/app/views/alberich/permissions/_form.html.haml

@@ -0,0 +1,27 @@
+= form_tag({:method => :post, :action => :create}) do
+  %table.flat.checkbox_table{ 'data-none_selected' => "none selected", 'data-confirm' => "are you sure?" }
+    %thead
+      %tr
+        - @header.each do |column|
+          - if column[:name] == 'checkbox'
+            %th{:class => column[:class]}= check_box_tag :select_all, true, false, :class => 'select_all'
+          -else
+            %th{:class => column[:class]}= column[:name]
+      - if !@entities.any?
+        %tr
+          %td{:colspan => @header.size}= "nothing here"
+    - @entities.each do |entity|
+      %tr{:class => cycle('nostripe','stripe')}
+        %td
+          -# - selected = params[:select] == 'all'
+          -#  = check_box_tag "entity_selected[]", entity.id, selected, :id => "entity_checkbox_#{entity.id}"
+        %td= link_to entity.name, main_app.url_for(entity.entity_target)
+        %td= select_tag "entity_role_selected[]", options_for_select([['', "#{entity.id},"]] + @roles.map {|r| [t(r.name, :scope=> :role_defs, :default => r.name), "#{entity.id},#{r.id}" ] }, :disabled => @permission_object.permissions.where(:entity_id=>entity.id).collect {|p| "#{entity.id},#{p.role.id}"}), :id => "entity_role_selected_#{entity.id}"
+
+  %fieldset.options
+    = hidden_field_tag :permission_object_type, @permission_object.class.name
+    = hidden_field_tag :permission_object_id, @permission_object.id
+    = hidden_field_tag :path_prefix, @path_prefix
+    = hidden_field_tag :use_tabs, @use_tabs
+    = submit_tag "Grant Access"
+    = link_to 'Cancel', @return_path, :class => 'button danger'

data/app/views/alberich/permissions/_list.html.haml

@@ -0,0 +1 @@
+= render :partial => 'permissions'

data/app/views/alberich/permissions/_objects.html.haml

@@ -0,0 +1,38 @@
+- content_for :permissions_form_header do
+  %span{:id => ("tab-container-1-nav" unless @inline)}
+    - if @show_inherited
+      %li= link_to "Direct Access", params.merge(:show_inherited => false, :page => 1), { :class => 'button primary', :id => 'direct_permission_button'}
+    - else
+      %li= link_to "Inherited Access", params.merge(:show_inherited => true, :page => 1), { :class => 'button primary', :id => 'inherited_permission_button'}
+
+= form_tag do
+  %div.controls
+    %ul.actions
+      = yield :permissions_form_header
+  %table.flat.checkbox_table{ 'data-none_selected' => "Please make a selection first.", 'data-confirm' => "Are you sure?" }
+    %thead
+      %tr
+        - @permission_list_header.each do |column|
+          - if column[:name] == 'checkbox'
+            - # checkboxes ignored for engine UI
+          -else
+            %th{:class => column[:class]}= column[:name]
+      - if !@permissions.any?
+        %tr
+          %td{:colspan => columns.size}= "No matching results"
+    - @permissions.each do |permission|
+      %tr{:class => cycle('nostripe','stripe')}
+        - if permission.permission_object.class == Alberich::BasePermissionObject
+          %td Global
+          %td
+        - else
+          %td= permission_object_type
+          %td= link_to permission.permission_object.name, permission.permission_object
+        %td= permission.role.name
+        - if not(@show_inherited) && check_privilege(Alberich::Privilege::PERM_SET)
+          %td= link_to 'Destroy', alberich.permission_path(permission), method: :delete, data: { confirm: 'Are you sure?' }
+        - if @show_inherited
+          - if permission.permission.permission_object.class == Alberich::BasePermissionObject
+            %td= t'permissions.global'
+          - else
+            %td= link_to permission.permission.permission_object.name, permission.permission.permission_object

data/app/views/alberich/permissions/_permissions.html.haml

@@ -0,0 +1,45 @@
+- has_admin_perms =  check_privilege(Alberich::Privilege::PERM_SET)
+- prevent_admin_deletion = has_admin_perms && !(@show_inherited || @show_global) && (@permission_object == Alberich::BasePermissionObject.general_permission_scope) && (Alberich::BasePermissionObject.global_admin_permission_count == 1)
+- content_for :permissions_form_header do
+  - if not(@show_inherited or @show_global) && check_privilege(Alberich::Privilege::PERM_SET)
+    %li= link_to "Grant Access", new_permission_path(:permission_object_type => @permission_object.class.name, :permission_object_id => @permission_object.id, :path_prefix => @path_prefix, :use_tabs => @use_tabs ? @use_tabs : (@tabs ? 'yes' : 'no')), { :class => 'button primary', :id => 'new_permission_button'}
+
+  %span{:id => ("tab-container-1-nav" unless @inline)}
+    - unless @permission_object == Alberich::BasePermissionObject.general_permission_scope
+      - if @show_inherited
+        %li= link_to "Direct Access", params.merge(:show_inherited => false, :show_global => false, :page => 1), { :class => 'button', :id => 'direct_permission_button'}
+        %li= link_to "Global Access", params.merge(:show_inherited => false, :show_global => true, :page => 1), { :class => 'button', :id => 'global_permission_button'}
+      - elsif @show_global
+        %li= link_to "Direct Accress", params.merge(:show_inherited => false, :show_global => false, :page => 1), { :class => 'button', :id => 'direct_permission_button'}
+        %li= link_to "Inherited Access", params.merge(:show_inherited => true, :show_global => false, :page => 1), { :class => 'button', :id => 'inherited_permission_button'}
+      - else
+        %li= link_to "Inherited Access", params.merge(:show_inherited => true, :show_global => false, :page => 1), { :class => 'button', :id => 'inherited_permission_button'}
+        %li= link_to "Global Access", params.merge(:show_inherited => false, :show_global => true, :page => 1), { :class => 'button', :id => 'global_permission_button'}
+
+= form_tag do
+  %div.controls
+    %ul.actions
+      = yield :permissions_form_header
+  %table.flat.checkbox_table{ 'data-none_selected' => "Please make a selection first.", 'data-confirm' => "Are you sure?" }
+    %thead
+      %tr
+        - @permission_list_header.each do |column|
+          - if column[:name] == 'checkbox'
+            - # checkboxes ignored for engine UI
+          -else
+            %th{:class => column[:class]}= column[:name]
+      - if !@permissions.any?
+        %tr
+          %td{:colspan => columns.size}= "No matching results"
+    - @permissions.each do |permission|
+      %tr{:class => cycle('nostripe','stripe')}
+        %td= permission.entity.entity_target.class.model_name.human
+        %td= link_to permission.entity.name, main_app.url_for(permission.entity.entity_target)
+        %td= permission.role.name
+        - if !(@show_inherited || @show_global) && has_admin_perms && !(prevent_admin_deletion && Alberich::BasePermissionObject.is_global_admin_perm(permission))
+          %td= link_to 'Destroy', permission, method: :delete, data: { confirm: 'Are you sure?' }
+        - if @show_inherited
+          %td= permission.permission.permission_object.name
+
+- if @permissions.respond_to?(:total_pages)
+  = render_pagination(@permissions)

data/app/views/alberich/permissions/index.html.haml

@@ -0,0 +1,2 @@
+%h1 Listing permissions
+= render :partial => 'permissions'

data/app/views/alberich/permissions/new.html.haml

@@ -0,0 +1,5 @@
+%h1 New permission
+
+= render 'form'
+
+= link_to 'Back', permissions_path

data/app/views/alberich/permissions/show.html.haml

@@ -0,0 +1,12 @@
+%p#notice= notice
+
+%p
+  %b Role:
+  = @permission.role_id
+%p
+  %b Entity:
+  = @permission.entity_id
+
+= link_to 'Edit', edit_permission_path(@permission)
+\|
+= link_to 'Back', permissions_path

data/app/views/alberich/privileges/_form.html.haml

@@ -0,0 +1,19 @@
+= form_for @privilege do |f|
+  - if @privilege.errors.any?
+    #error_explanation
+      %h2= "#{pluralize(@privilege.errors.count, "error")} prohibited this privilege from being saved:"
+      %ul
+        - @privilege.errors.full_messages.each do |msg|
+          %li= msg
+
+  = f.hidden_field :role_id
+  .field
+    = f.label :target_type
+    .input
+      = f.select :target_type, @target_type_list
+  .field
+    = f.label :action
+    .input
+      = f.select :action, @action_list
+  .actions
+    = f.submit 'Save'

data/app/views/alberich/privileges/_list.html.haml

@@ -0,0 +1,17 @@
+%table
+  %tr
+    %th Target type
+    %th Action
+    %th
+    %th
+    %th
+
+  - privileges.each do |privilege|
+    %tr
+      %td= privilege.target_type
+      %td= privilege.action
+      %td= link_to 'Show', privilege
+      %td= link_to 'Edit', edit_privilege_path(privilege)
+      %td= link_to 'Destroy', privilege, method: :delete, data: { confirm: 'Are you sure?' }
+
+%br

data/app/views/alberich/privileges/create.html.haml

@@ -0,0 +1,2 @@
+%h1 Privileges#create
+%p Find me in app/views/alberich/privileges/create.html.haml

data/app/views/alberich/privileges/destroy.html.haml

@@ -0,0 +1,2 @@
+%h1 Privileges#destroy
+%p Find me in app/views/alberich/privileges/destroy.html.haml

data/app/views/alberich/privileges/edit.html.haml

@@ -0,0 +1,5 @@
+%h1 Editing privilege
+
+= render 'form'
+
+= link_to 'Back', role_path(@privilege.role)

data/app/views/alberich/privileges/index.html.haml

@@ -0,0 +1,5 @@
+%h1 Listing privileges
+
+= render :partial => 'list', :locals => { :privileges => @privileges }
+
+= link_to 'New Privilege', new_privilege_path

data/app/views/alberich/privileges/new.html.haml

@@ -0,0 +1,5 @@
+%h1= "New privilege for #{@privilege.role.name}"
+
+= render 'form'
+
+= link_to 'Back', role_path(@privilege.role)

data/app/views/alberich/privileges/show.html.haml

@@ -0,0 +1,12 @@
+%p#notice= notice
+
+%p
+  %b Target type:
+  = @privilege.target_type
+%p
+  %b Action:
+  = @privilege.action
+
+= link_to 'Edit', edit_privilege_path(@privilege)
+\|
+= link_to 'Back', privileges_path

data/app/views/alberich/privileges/update.html.haml

@@ -0,0 +1,2 @@
+%h1 Privileges#update
+%p Find me in app/views/alberich/privileges/update.html.haml

data/app/views/alberich/roles/_form.html.haml

@@ -0,0 +1,24 @@
+= form_for(@role) do |f|
+  - if @role.errors.any?
+    %div#error_explanation
+      %h2= "#{pluralize(@role.errors.count, 'error')} prohibited this role from being saved:"
+
+      %ul
+      - @role.errors.full_messages.each do |msg|
+        %li= msg
+  %fieldset
+    .field
+      = f.label :name, :class => 'em'
+      .input
+        = f.text_field :name, :class => "em long"
+    .field
+      = f.label :scope, :class => 'em'
+      .input
+        = f.select :scope, @scope_list
+    .field
+      = f.label :assign_to_owner, :class => 'checkbox'
+      .input
+        = f.check_box :assign_to_owner
+
+  %div.actions
+    = f.submit

data/app/views/alberich/roles/edit.html.haml

@@ -0,0 +1,7 @@
+%h1 Editing role
+
+= render 'form'
+
+= link_to 'Show', @role
+|
+= link_to 'Back', roles_path

data/app/views/alberich/roles/index.html.haml

@@ -0,0 +1,23 @@
+%h1=t "Listing roles"
+
+%table
+  %tr
+    %th=t "Name"
+    %th=t "Scope"
+    %th=t "assign_to_owner"
+    %th
+    %th
+    %th
+
+  - @roles.each do |role|
+    %tr
+      %th= link_to role.name, role
+      %th= role.scope
+      %th= role.assign_to_owner
+      %th= link_to 'Show', role
+      %th= link_to 'Edit', edit_role_path(role)
+      %th= link_to 'Destroy', role, method: :delete, data: { confirm: 'Are you sure?' }, :id => "destroy_role_#{role.id}"
+
+%br
+
+= link_to 'New Role', new_role_path

data/app/views/alberich/roles/new.html.haml

@@ -0,0 +1,5 @@
+%h1 New role
+
+= render 'form'
+
+= link_to 'Back', roles_path

data/app/views/alberich/roles/show.html.haml

@@ -0,0 +1,16 @@
+%p#notice= notice
+
+%h1= @role.name
+
+%ul
+  %li= "Scope: #{@role.scope}"
+  %li= "Assign to Owner: #{@role.assign_to_owner}"
+
+  %li
+    %h2 Privileges
+    = render :partial => 'alberich/privileges/list', :locals => { :privileges => @role.privileges }
+    = link_to 'New Privilege', new_role_privilege_path(@role)
+
+= link_to 'Edit', edit_role_path(@role)
+|
+= link_to 'Back', roles_path

data/app/views/layouts/alberich/application.html.erb

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Alberich</title>
+  <%= stylesheet_link_tag    "alberich/application", :media => "all" %>
+  <%= javascript_include_tag "alberich/application" %>
+  <%= csrf_meta_tags %>
+</head>
+<body>
+
+<%= yield %>
+
+</body>
+</html>

data/config/initializers/haml.rb

@@ -0,0 +1 @@
+require 'haml'

data/config/routes.rb

@@ -0,0 +1,17 @@
+Alberich::Engine.routes.draw do
+  resources :permissions do
+    collection do
+      get :list
+      delete :multi_destroy
+      post :multi_update
+    end
+  end
+
+
+  resources :privileges
+
+  resources :roles do
+    resources :privileges
+  end
+
+end

data/db/migrate/20120925162242_create_alberich_roles.rb

@@ -0,0 +1,12 @@
+class CreateAlberichRoles < ActiveRecord::Migration
+  def change
+    create_table :alberich_roles do |t|
+      t.string  :name, :null => false
+      t.string  :scope, :null => false
+      t.integer :lock_version, :default => 0
+      t.boolean  :assign_to_owner, :default => false
+
+      t.timestamps
+    end
+  end
+end