authorails 1.0.0

data/helpers/application_helper.rb

@@ -0,0 +1,315 @@
+# Methods added to this helper will be available to all templates in the application.
+module ApplicationHelper
+
+def fathers_for_list(object)
+ @code=""
+ unless @fathers.nil?
+  @fathers.each do |father|
+   unless object.send(father).nil? #if the row has an associated father
+    for column in father.camelize.constantize.content_columns 
+     if session[:superuser] #superuser can view anything
+      @code << "<td>" + h(object.send(father).send(column.name)) + "</td>"
+     else #we have to check if the user can view the field
+       @fields_readable[father].each do |field|
+        if column.name == field.name
+         @code << "<td>" + h(object.send(father).send(column.name)) + "</td>"
+        end 
+       end
+     end 
+    end 
+   else 
+    for column in father.camelize.constantize.content_columns 
+      if session[:superuser] #superuser can view anything
+       @code << "<td></td>" 
+      else #we have to check if the user can view the field
+       @fields_readable[father].each do |field|
+        if column.name == field.name
+         @code << "<td></td>"
+        end 
+       end
+     end 
+    end    
+   end
+  end
+ end
+ return @code
+end
+
+def one_to_ones_for_list(object)
+ @code=""
+ unless @one_to_ones.nil?
+  @one_to_ones.each do |one|
+   unless object.send(one).nil?
+    for column in one.camelize.constantize.content_columns 
+     if session[:superuser] #superuser can view anything
+      @code << "<td>" + h(object.send(one).send(column.name)) + "</td>" 
+     else #we have to check if the user can view the field
+       @fields_readable[one].each do |field|
+        if column.name == field.name
+         @code << "<td>" + h(object.send(one).send(column.name)) + "</td>"
+        end 
+       end
+     end 
+    end
+   else
+    for column in one.camelize.constantize.content_columns 
+     if session[:superuser] #superuser can view anything
+      @code << "<td></td>" 
+     else #we have to check if the user can view the field
+       @fields_readable[one].each do |field|
+        if column.name == field.name
+         @code << "<td></td>"
+        end 
+       end
+     end 
+    end    
+   end
+  end
+ end 
+  
+  unless @one_to_one_fathers.nil?
+  @one_to_one_fathers.each do |one|
+   unless object.send(one).nil?
+    for column in one.camelize.constantize.content_columns 
+     if session[:superuser] #superuser can view anything
+      @code << "<td>" + h(object.send(one).send(column.name)) + "</td>" 
+     else #we have to check if the user can view the field
+       @fields_readable[one].each do |field|
+        if column.name == field.name
+         @code << "<td>" + h(object.send(one).send(column.name)) + "</td>"
+        end 
+       end
+     end 
+    end
+   else
+    for column in one.camelize.constantize.content_columns 
+     if session[:superuser] #superuser can view anything
+      @code << "<td></td>" 
+     else #we have to check if the user can view the field
+       @fields_readable[one].each do |field|
+        if column.name == field.name
+         @code << "<td></td>"
+        end 
+       end
+     end  
+    end    
+   end
+  end
+ end 
+ 
+ return @code
+end
+
+def verse(object)
+ if object.relation_type=="many-to-many"
+  return "<->"
+ else
+  return "<-"
+ end 
+end
+
+def check_update(object,attribute,code_if_privileged,code_if_not_privileged)
+if (controller.action_name=="edit" or controller.action_name=="update") and !session[:superuser]
+ found=false #variable for checking if the user has the privileges
+ @fields_editable.each do |field|
+ if attribute == field 
+  found=true #the user can update the field
+  return code_if_privileged
+ end
+end
+if !found #the user can't update the field
+  found=false
+  for field in @fields_readable[:self]
+   if attribute == field.name 
+    found=true #the user can't update the field, but can read it
+    return code_if_not_privileged
+   end
+  end  
+  if !found #the user can't either edit and read the field
+   return "<span id='green'>Not readable</span>"
+  end
+end 
+
+else
+ return code_if_privileged
+end
+end
+
+def check_if_child(father,child)
+ fk_name=controller.controller_name.singularize.foreign_key
+ if child.send(fk_name)==father.id
+  return "checked"
+ else
+  return ""
+ end  
+end
+
+def check_if_related(current,related_table,join_table)
+ fk_name1=controller.controller_name.singularize.foreign_key #name of the first foreign key
+ fk_name2=@table.singularize.foreign_key #name of the second foreign key
+ @found=false
+ current.send(join_table).each {|row|
+ if row.send(fk_name1)==current.id and row.send(fk_name2)==related_table.id
+  @found=true
+ end 
+ }
+ if @found
+  return "checked"
+ else
+  return ""
+ end  
+end
+
+def pagination_links_remote(paginator,action,update) #for ajax pagination
+  page_options = {:window_size => 1}
+  pagination_links_each(paginator, page_options) do |n|
+    options = {
+      :url => {:action => action, :params => @params.merge({:page => n})},
+      :update => update,
+      :before => "Element.show('spinner')",
+      :success => "Element.hide('spinner')"
+    }
+    html_options = {:href => url_for(:action => action, :params => @params.merge({:page => n}))}
+    link_to_remote(n.to_s, options, html_options)
+
+  end
+ end
+ 
+def check_relation_privileges(model_name,foreign_key,referenced_object,referenced_table,object)
+ can_create=false
+ can_destroy=false
+ can_update=false
+ can_create=true if session[:superuser] #superuser can do anything 
+ can_destroy=true if session[:superuser] #superuser can do anything 
+ can_update=true if session[:superuser] #superuser can do anything 
+ @relations_to_create.each {|r|
+  can_create=true if referenced_table==r
+  }
+ @relations_to_destroy.each {|r|
+  can_destroy=true if referenced_table==r
+  } 
+ @relations_to_update.each {|r|
+  can_update=true if referenced_table==r
+  } 
+  
+ #if user can create and destroy a relation 
+ if can_create and can_destroy
+  if can_update or object.send(referenced_table.singularize).nil? #we add a select with a blank field
+   return select( model_name,foreign_key,referenced_object,:include_blank => true)
+  else   
+   return select_tag( model_name + "[" + foreign_key + "]","<option value=''></option><option value='#{object.send(referenced_table.singularize).id}' selected>#{readable_columns(object.send(referenced_table.singularize),referenced_table)}</option>") + " <span id='green'>N.B.:you can only destroy the relation</span>"
+  end 
+ end
+ #if user can create but can't destroy a relation, we add a select without a blank field if there is no association between the tables (if the fk of the related table is null)
+ if can_create and !can_destroy
+  if can_update  #we add a select without a blank field
+   if object.send(referenced_table.singularize).nil?
+    return select( model_name,foreign_key,referenced_object,:include_blank => true)  
+   else
+    return select( model_name,foreign_key,referenced_object,:include_blank => false)
+   end
+  elsif object.send(referenced_table.singularize).nil?
+   return select( model_name,foreign_key,referenced_object,:include_blank => true)
+  else
+   return "<br />#{readable_columns(object.send(referenced_table.singularize),referenced_table)} <span id='green'>You can't update and neither destroy the relation</span>"
+  end
+ end 
+ #if user can't create but can destroy a relation, we add a select with a blank field if there is an association between the tables (if the fk of the related table is not null)
+ if !can_create and can_destroy
+  if can_update and !object.send(referenced_table.singularize).nil? 
+   return select( model_name,foreign_key,referenced_object,:include_blank => true)  
+  elsif !object.send(referenced_table.singularize).nil?
+   return select_tag( model_name + "[" + foreign_key + "]","<option value=''></option><option value='#{object.send(referenced_table.singularize).id}' selected>#{readable_columns(object.send(referenced_table.singularize),referenced_table)}</option>") + " <span id='green'>N.B.:you can only destroy the relation</span>"
+  else
+   return "<span id='green'>You can't create the relation</span>"
+  end 
+ end 
+ #if user can't create and destroy a relation, we add a select without a blank field if the user can update an existing association
+ if !can_create and !can_destroy
+  if can_update and !object.send(referenced_table.singularize).nil? 
+   return select( model_name,foreign_key,referenced_object,:include_blank => false)  
+  else
+   return "<span id='green'>You can't update the relation</span>"
+  end 
+ end 
+end
+
+def check_relation_privileges2(model_name,foreign_key,referenced_object,selected,object)
+ can_create=false
+ can_destroy=false
+ can_update=false
+ can_create=true if session[:superuser] #superuser can do anything 
+ can_destroy=true if session[:superuser] #superuser can do anything 
+ can_update=true if session[:superuser] #superuser can do anything 
+ @relations_to_create.each {|r|
+  can_create=true if model_name.pluralize==r
+  }
+ @relations_to_destroy.each {|r|
+  can_destroy=true if model_name.pluralize==r
+  } 
+ @relations_to_update.each {|r|
+  can_update=true if model_name.pluralize==r
+  } 
+  
+ #if user can create and destroy a relation 
+ if can_create and can_destroy
+  if can_update or object.send(model_name).nil? #we add a select with a blank field
+   return select( model_name,foreign_key,referenced_object,:selected => selected,:include_blank => true)
+  else   
+   return select_tag( model_name + "[" + foreign_key.to_s + "]","<option value=''></option><option value='#{object.send(model_name).id}' selected>#{readable_columns(object.send(model_name),model_name.pluralize)}</option>") + " <span id='green'>N.B.:you can only destroy the relation</span>"
+  end 
+ end
+ #if user can create but can't destroy a relation, we add a select without a blank field if there is no association between the tables (if the fk of the related table is null)
+ if can_create and !can_destroy
+  if can_update  #we add a select without a blank field
+   if object.send(model_name).nil?
+    return select( model_name,foreign_key,referenced_object,:include_blank => true)  
+   else
+    return select( model_name,foreign_key,referenced_object,:selected => selected,:include_blank => false)
+   end
+  elsif object.send(model_name).nil?
+   return select( model_name,foreign_key,referenced_object,:selected => selected,:include_blank => true)
+  else
+   return "<br />#{readable_columns(object.send(model_name),model_name.pluralize)} <span id='green'>You can't update and neither destroy the relation</span>"
+  end
+ end 
+ #if user can't create but can destroy a relation, we add a select with a blank field if there is an association between the tables (if the fk of the related table is not null)
+ if !can_create and can_destroy
+  if can_update and !object.send(model_name).nil? 
+   return select( model_name,foreign_key,referenced_object,:selected => selected,:include_blank => true)  
+  elsif !object.send(model_name).nil?
+   return select_tag( model_name + "[" + foreign_key.to_s + "]","<option value=''></option><option value='#{object.send(model_name).id}' selected>#{readable_columns(object.send(model_name),model_name.pluralize)}</option>") + " <span id='green'>N.B.:you can only destroy the relation</span>"
+  else
+   return "<span id='green'>You can't create the relation</span>"
+  end 
+ end 
+ #if user can't create and destroy a relation, we add a select without a blank field if the user can update an existing association
+ if !can_create and !can_destroy
+  if can_update and !object.send(model_name).nil? 
+   return select( model_name,foreign_key,referenced_object,:selected => selected,:include_blank => false)  
+  else
+   return "<span id='green'>You can't update the relation</span>" unless object.send(model_name).nil?
+   return "<span id='green'>You can't create the relation</span>" if can_update
+  end 
+ end 
+end
+
+  def readable_columns(object,ref_table)
+   string=""
+   for column in ref_table.singularize.camelize.constantize.content_columns
+      if session[:superuser]
+       string += "#{object.send(column.name)} "
+      else
+       unless @fields_readable[ref_table.singularize].empty? 
+       @fields_readable[ref_table.singularize].each do |field|
+        if column.name == field.name 
+         string += "#{object.send(column.name)} "
+        end
+       end 
+      end
+     end
+   end  
+   return string  
+  end
+
+end

data/helpers/permission_helper.rb

@@ -0,0 +1,27 @@
+module PermissionHelper
+
+def check(role,table,op)
+ if TabPermission.find_by_role_id_and_table_id_and_tab_operation_id(role,table,op)
+  return "checked"
+ else
+  return ""
+ end  
+end
+
+def check2(role,table,op)
+ if AttrPermission.find_by_role_id_and_table_field_id_and_attr_operation_id(role,table,op)
+  return "checked"
+ else
+  return ""
+ end  
+end
+
+def check_relation(relation,role,action)
+ if RelationPermission.find_by_relation_id_and_role_id_and_action(relation,role,action)
+  return "checked"
+ else
+  return ""
+ end
+end
+
+end

data/helpers/test_helper.rb

@@ -0,0 +1,28 @@
+ENV["RAILS_ENV"] = "test"
+require File.expand_path(File.dirname(__FILE__) + "/../config/environment")
+require 'test_help'
+
+class Test::Unit::TestCase
+  # Transactional fixtures accelerate your tests by wrapping each test method
+  # in a transaction that's rolled back on completion.  This ensures that the
+  # test database remains unchanged so your fixtures don't have to be reloaded
+  # between every test method.  Fewer database queries means faster tests.
+  #
+  # Read Mike Clark's excellent walkthrough at
+  #   http://clarkware.com/cgi/blosxom/2005/10/24#Rails10FastTesting
+  #
+  # Every Active Record database supports transactions except MyISAM tables
+  # in MySQL.  Turn off transactional fixtures in this case; however, if you
+  # don't care one way or the other, switching from MyISAM to InnoDB tables
+  # is recommended.
+  self.use_transactional_fixtures = true
+
+  # Instantiated fixtures are slow, but give you @david where otherwise you
+  # would need people(:david).  If you don't want to migrate your existing
+  # test cases which use the @david style and don't mind the speed hit (each
+  # instantiated fixtures translates to a database query per test method),
+  # then set this back to true.
+  self.use_instantiated_fixtures  = false
+
+  # Add more helper methods to be used by all tests here...
+end

data/html/404.html

@@ -0,0 +1,30 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+       "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+
+<head>
+  <meta http-equiv="content-type" content="text/html; charset=UTF-8" />
+  <title>The page you were looking for doesn't exist (404)</title>
+	<style type="text/css">
+		body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+		div.dialog {
+			width: 25em;
+			padding: 0 4em;
+			margin: 4em auto 0 auto;
+			border: 1px solid #ccc;
+			border-right-color: #999;
+			border-bottom-color: #999;
+		}
+		h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+	</style>
+</head>
+
+<body>
+  <!-- This file lives in public/404.html -->
+  <div class="dialog">
+    <h1>The page you were looking for doesn't exist.</h1>
+    <p>You may have mistyped the address or the page may have moved.</p>
+  </div>
+</body>
+</html>

data/html/500.html

@@ -0,0 +1,30 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+       "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+
+<head>
+  <meta http-equiv="content-type" content="text/html; charset=UTF-8" />
+  <title>We're sorry, but something went wrong</title>
+	<style type="text/css">
+		body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
+		div.dialog {
+			width: 25em;
+			padding: 0 4em;
+			margin: 4em auto 0 auto;
+			border: 1px solid #ccc;
+			border-right-color: #999;
+			border-bottom-color: #999;
+		}
+		h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
+	</style>
+</head>
+
+<body>
+  <!-- This file lives in public/500.html -->
+  <div class="dialog">
+    <h1>We're sorry, but something went wrong.</h1>
+    <p>We've been notified about this issue and we'll take a look at it shortly.</p>
+  </div>
+</body>
+</html>