aserto-rails 0.20.1 → 0.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dbb7151353f86f941690b382de5e1d5f81076db081262abeb7dbc55c45745c66
-  data.tar.gz: a7aa53b6275c4613aa367b77c568c8641d9e55b5c1a5c0a2205a91eb72e29f71
+  metadata.gz: db5e72e6292b71ced35b0f37998cc46901356c44dfce224981a1196a0d978f0f
+  data.tar.gz: 72a97cb5107d799c1087636838d283b60ddd1092fcff6c9c06c5fe4cca9fe3ed
 SHA512:
-  metadata.gz: 853876ec44491170671af35673e1b32b26f02c79ca6d8dfdc9c5ec4eac0074d7c7d62cfb99193583f5ca96790d1805fbe2a5e2873d043d571f8490a0117c7055
-  data.tar.gz: fd7ca8c2b5250bddcc7314da3b114c35cb13166af2b73899c81174a748b1dad6c416a158f6ece38268ca7610702450a700c9e7dba1d170db80842e62c190e251
+  metadata.gz: 30f24678897474717e27bc9120ce84a5535472efede444fa0054c48b403fd3ba3a4501f60824da2a126e560f94c245bbbda0b8a47bd34184f8d8cfa9358d9905
+  data.tar.gz: abd7814fc2cb926ed1e0f1e99b57f550e91c3cdc54f1b8b6ac0629cc67529d5c223e7647a432614ca82590bedf1550c91c313650e3c55fdee3587910b010ac18

data/README.md

@@ -138,6 +138,8 @@ end
 
 ## Controller helpers
 
+### aserto_authorize!
+
 The `aserto_authorize!` method in the controller will raise an exception if the user is not able to perform the given action.
 
 ```ruby
@@ -167,6 +169,38 @@ class PostsController < ApplicationController
 end
 ```
 
+### check!
+
+The `check!` method in the controller will raise an exception if the user is not able to perform the given action.
+
+```ruby
+def show
+  # only users in the "evil_genius" group are allowed to get this resource
+  check!(object_id: "evil_genius", object_type: "group", relation: "member")
+  @post = Post.find(params[:id])
+end
+```
+
+Setting this for every action can be tedious, therefore the `aserto_check_resource` method is provided to
+automatically authorize all actions in a RESTful style resource controller.
+It will use a before action to load the resource into an instance variable and authorize it for every action.
+
+```ruby
+class PostsController < ApplicationController
+  aserto_authorize_resource
+  # aserto_check_resource only: %i[show], params: { object_id: "evil_genius", object_type: "group", relation: "member" }
+  # aserto_check_resource except: %i[index], params: { object_id: "evil_genius", object_type: "group", relation: "member" }
+
+  def show
+    # getting a single post authorized
+  end
+
+  def index
+    # getting all posts is authorized
+  end
+end
+```
+
 ## Check Permissions
 
 The current user's permissions can then be checked using the `allowed?`, `visible?` and `enabled?` methods in views and controllers.

data/VERSION

@@ -1 +1 @@
-0.20.1
+0.30.0

data/lib/aserto/rails/controller_additions.rb

@@ -8,6 +8,10 @@ module Aserto
           aserto_resource_class.add_before_action(self, :authorize_resource, *args)
         end
 
+        def aserto_check_resource(*args)
+          aserto_resource_class.add_before_action(self, :check_resource, *args)
+        end
+
         def aserto_resource_class
           ControllerResource
         end
@@ -38,6 +42,23 @@ module Aserto
         raise Aserto::AccessDenied unless Aserto::AuthClient.new(request).is
       end
 
+      #
+      # Authorization call based on check relation
+      #
+      # @param [String] object_id
+      # @param [String] object_type
+      # @param [String] relation
+      #
+      # @return [nil]
+      #
+      # @raise Aserto::AccessDenied
+      #
+      def check!(object_id:, object_type:, relation:)
+        raise Aserto::AccessDenied unless Aserto::AuthClient.new(request).check(
+          object_id: object_id, object_type: object_type, relation: relation
+        )
+      end
+
       private
 
       def augment_request!(action, path, resource)

data/lib/aserto/rails/controller_resource.rb

@@ -10,6 +10,22 @@ module Aserto
         @name = args.first
       end
 
+      #
+      # Authorization call based on check relation
+      #
+      # @param [String] object_id
+      # @param [String] object_type
+      # @param [String] relation
+      #
+      # @return [nil]
+      #
+      # @raise Aserto::AccessDenied
+      #
+      def check_resource
+        client = Aserto::AuthClient.new(@controller.request)
+        raise Aserto::AccessDenied unless client.check(**(@options[:params] || {}))
+      end
+
       def authorize_resource
         raise Aserto::AccessDenied unless Aserto::AuthClient.new(@controller.request).is
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aserto-rails
 version: !ruby/object:Gem::Version
-  version: 0.20.1
+  version: 0.30.0
 platform: ruby
 authors:
 - Aserto
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-11-28 00:00:00.000000000 Z
+date: 2023-11-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aserto
@@ -16,124 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.2
+        version: 0.30.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.2
-- !ruby/object:Gem::Dependency
-  name: appraisal
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 2.0.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 2.0.0
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.15.0
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.15.0
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: codecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-- !ruby/object:Gem::Dependency
-  name: grpc_mock
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.4'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.4'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: rubocop-performance
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.14'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.14'
-- !ruby/object:Gem::Dependency
-  name: rubocop-rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.11'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.11'
+        version: 0.30.1
 description: Aserto authorization library for Ruby and Ruby on Rails
 email:
 - aserto@aserto.com
@@ -166,7 +56,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="