aserto-rails 0.20.2 → 0.30.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c73023472e4a2c16c1d7f2d54302cfd533a63f592f2ca039c26ecdbc00945adc
-  data.tar.gz: 5ba34c354dd5e34970da2e76114055eaf14b58a7e72507a6df63966fac7fcecd
+  metadata.gz: 8d645132ed1cd5757c6c1d8c795b0cddab950f2be5cf90ef74411a86567b470d
+  data.tar.gz: f9cb34952224a4195a3322afc81f6f4e138d2c845fb9da6e55fe0ae7dac54f3b
 SHA512:
-  metadata.gz: b5883461dedf1448f933c1dbdc02d66d526e437c16e8696f70e5d7023cf03efe537674bbb32ce6a66420f26ee2609d7e100d0dc9a974909c56d6164ab47196b7
-  data.tar.gz: 133daa61ff2ee17d32746948b14974f9bbb81a5119399fa8826a31034fdb8785fc5ec495dabbd904cce923d767db80f45465ec66f2ad509f851c7511008c3dba
+  metadata.gz: 124e32e4d2c36f91b07509414eead1811dfe92401137d027bec6ebd677baf01e2cc35502b4918760f220470a13fd8a85e36d7960bdbf52f454473f362d6fca47
+  data.tar.gz: f1f984fcae8dbbf6d457c0681d8d7bd01524716bddb466f3902c11e076b0b1f40342e5e2385214f21d75a720c4ea675e139eee30c5c286184a3078d287297a46

data/README.md

@@ -10,7 +10,7 @@ Aserto authorization library for Ruby and Ruby on Rails.
 Built on top of [aserto](https://github.com/aserto-dev/aserto-ruby) and [aserto-grpc-authz](https://github.com/aserto-dev/ruby-grpc-authz).
 
 ## Prerequisites
-* [Ruby](https://www.ruby-lang.org/en/downloads/) 2.7 or newer.
+* [Ruby](https://www.ruby-lang.org/en/downloads/) 3.0 or newer.
 * [Rails](https://rubyonrails.org/) 6 or newer.
 * An [Aserto](https://console.aserto.com) account.
 
@@ -138,6 +138,8 @@ end
 
 ## Controller helpers
 
+### aserto_authorize!
+
 The `aserto_authorize!` method in the controller will raise an exception if the user is not able to perform the given action.
 
 ```ruby
@@ -167,6 +169,38 @@ class PostsController < ApplicationController
 end
 ```
 
+### check!
+
+The `check!` method in the controller will raise an exception if the user is not able to perform the given action.
+
+```ruby
+def show
+  # only users in the "evil_genius" group are allowed to get this resource
+  check!(object_id: "evil_genius", object_type: "group", relation: "member")
+  @post = Post.find(params[:id])
+end
+```
+
+Setting this for every action can be tedious, therefore the `aserto_check_resource` method is provided to
+automatically authorize all actions in a RESTful style resource controller.
+It will use a before action to load the resource into an instance variable and authorize it for every action.
+
+```ruby
+class PostsController < ApplicationController
+  aserto_authorize_resource
+  # aserto_check_resource only: %i[show], params: { object_id: "evil_genius", object_type: "group", relation: "member" }
+  # aserto_check_resource except: %i[index], params: { object_id: "evil_genius", object_type: "group", relation: "member" }
+
+  def show
+    # getting a single post authorized
+  end
+
+  def index
+    # getting all posts is authorized
+  end
+end
+```
+
 ## Check Permissions
 
 The current user's permissions can then be checked using the `allowed?`, `visible?` and `enabled?` methods in views and controllers.
@@ -181,7 +215,7 @@ The current user's permissions can then be checked using the `allowed?`, `visibl
 Prerequisites:
 
     - go >= 1.17 to run mage
-    - Ruby >= 2.7.0 to run the code
+    - Ruby >= 3.0 to run the code
 
 
  Run `bundle install` to install dependencies. Then, run `bundle exec rspec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/VERSION

@@ -1 +1 @@
-0.20.2
+0.30.1

data/lib/aserto/rails/controller_additions.rb

@@ -8,6 +8,10 @@ module Aserto
           aserto_resource_class.add_before_action(self, :authorize_resource, *args)
         end
 
+        def aserto_check_resource(*args)
+          aserto_resource_class.add_before_action(self, :check_resource, *args)
+        end
+
         def aserto_resource_class
           ControllerResource
         end
@@ -38,6 +42,23 @@ module Aserto
         raise Aserto::AccessDenied unless Aserto::AuthClient.new(request).is
       end
 
+      #
+      # Authorization call based on check relation
+      #
+      # @param [String] object_id
+      # @param [String] object_type
+      # @param [String] relation
+      #
+      # @return [nil]
+      #
+      # @raise Aserto::AccessDenied
+      #
+      def check!(object_id:, object_type:, relation:, options: {})
+        raise Aserto::AccessDenied unless Aserto::AuthClient.new(request).check(
+          object_id: object_id, object_type: object_type, relation: relation, options: options
+        )
+      end
+
       private
 
       def augment_request!(action, path, resource)

data/lib/aserto/rails/controller_resource.rb

@@ -10,6 +10,22 @@ module Aserto
         @name = args.first
       end
 
+      #
+      # Authorization call based on check relation
+      #
+      # @param [String] object_id
+      # @param [String] object_type
+      # @param [String] relation
+      #
+      # @return [nil]
+      #
+      # @raise Aserto::AccessDenied
+      #
+      def check_resource
+        client = Aserto::AuthClient.new(@controller.request)
+        raise Aserto::AccessDenied unless client.check(**(@options[:params] || {}))
+      end
+
       def authorize_resource
         raise Aserto::AccessDenied unless Aserto::AuthClient.new(@controller.request).is
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aserto-rails
 version: !ruby/object:Gem::Version
-  version: 0.20.2
+  version: 0.30.1
 platform: ruby
 authors:
 - Aserto
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-06-23 00:00:00.000000000 Z
+date: 2024-01-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aserto
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.5
+        version: 0.30.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.5
+        version: 0.30.6
 description: Aserto authorization library for Ruby and Ruby on Rails
 email:
 - aserto@aserto.com