authoreyes 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c692f2b44a5992e6ed48d9edb77cda2accfa2bc1
-  data.tar.gz: 63e2a6282929830fa130217e901c2a55e1c9897e
+  metadata.gz: 2043aee1461c027a8e709798ca08a034bef0730a
+  data.tar.gz: fc7c8229de1c9edbe95af17b27e12c617a149be7
 SHA512:
-  metadata.gz: 7086240162b0a8734af9922554d20b9867706bbe9619917642d72f2531596c13229a97d16f59831fac56820bd94547bc367c6c3862f525ac248cbca8a58ec1f9
-  data.tar.gz: 77bb72a8bf572b7c06595993985f48e896c68327681b563cb6cd2fd1429da4af2fe2b4c77a710e94364d626a6d1d34f1430aade2b56eda9ef6bebd50caf45313
+  metadata.gz: 64f245dae1fd0a68e7044e653788d1e799d28116c746e63de7398e8b250a5f2e644845baa4969b45670ff5f793a75e5b3e243d7c221951f260b8d8cd0b926513
+  data.tar.gz: 8cee745304c642ca106f61d528ad563c067bcd1661d9fc0ae49c45727af8771e7699bb3551d3a56315917dc32683013d0eaae0cb2a015674c23244386a38846b

data/.gitignore

@@ -7,4 +7,6 @@
 /pkg/
 /spec/reports/
 /tmp/
+/test/dummy/tmp/
+/test/dummy/log/
 *.gem

data/Gemfile

@@ -6,4 +6,10 @@ gem 'rails', '~> 5.0'
 
 group :test do
   gem "codeclimate-test-reporter", require: nil
+  gem 'minitest-spec-rails'
+  gem 'minitest-rails-capybara'
+  gem 'capybara_minitest_spec'
+  gem 'minitest-reporters'
+  gem 'factory_girl', '~> 4.0'
+  gem 'faker'
 end

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright 2016 Xavier Bick
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -1,6 +1,7 @@
 # Authoreyes
 
-[![Gem Version](https://badge.fury.io/rb/authoreyes.svg)](https://badge.fury.io/rb/authoreyes) [![Build Status](https://travis-ci.org/tektite-software/authoreyes.svg?branch=master)](https://travis-ci.org/tektite-software/authoreyes) [![Code Climate](https://codeclimate.com/github/tektite-software/authoreyes/badges/gpa.svg)](https://codeclimate.com/github/tektite-software/authoreyes) [![Test Coverage](https://codeclimate.com/github/tektite-software/authoreyes/badges/coverage.svg)](https://codeclimate.com/github/tektite-software/authoreyes/coverage) [![Inline docs](http://inch-ci.org/github/tektite-software/authoreyes.svg?branch=master)](http://inch-ci.org/github/tektite-software/authoreyes)
+[![Gem Version](https://badge.fury.io/rb/authoreyes.svg)](https://badge.fury.io/rb/authoreyes) [![Build Status](https://travis-ci.org/tektite-software/authoreyes.svg?branch=master)](https://travis-ci.org/tektite-software/authoreyes) [![Dependency Status](https://gemnasium.com/badges/github.com/tektite-software/authoreyes.svg)](https://gemnasium.com/github.com/tektite-software/authoreyes)
+ [![Code Climate](https://codeclimate.com/github/tektite-software/authoreyes/badges/gpa.svg)](https://codeclimate.com/github/tektite-software/authoreyes) [![Test Coverage](https://codeclimate.com/github/tektite-software/authoreyes/badges/coverage.svg)](https://codeclimate.com/github/tektite-software/authoreyes/coverage) [![Inline docs](http://inch-ci.org/github/tektite-software/authoreyes.svg?branch=master)](http://inch-ci.org/github/tektite-software/authoreyes)
 
 #### Warning! This gem is an alpha!
 
@@ -29,11 +30,10 @@ For Rails authorization in Rails versions 4 and below, please use [Declarative A
 __Warning! This gem is not finished!__ Although authorization functionality _does_ work, you will need to do a few things to actually use it in your application...
 
 At this point, to use Authoreyes, you must do the following:
-  1. Add an `authorization_rules.rb` file.
-  2. Create an Authoreyes DSL Parser object.
-  3. Use the DSL Parser object to parse your authorization rules.
-  4. Create an Authoreyes Authorization Engine object passing in the Parser object.
-  5. Use the Engine's `permit!` and `permit?` methods in your application.
+  1. Add an `authorization_rules.rb` file.  See the included one for an example.
+  2. Define privileges for every single action you want to be accessed.  As of now, Authoreyes has only one mode: authorize everything.
+
+If you want to customize authorization behavior, in your ApplicationController override Authoreyes's `redirect_if_unauthorized` before_action and `set_unauthorized_status_code` after_action.  See `lib/authoreyes/helpers/in_controller` for details.
 
 ## Contributing
 

data/Rakefile

@@ -1,10 +1,34 @@
+begin
+  require 'bundler/setup'
+rescue LoadError
+  puts 'You must `gem install bundler` and `bundle install` to run rake tasks'
+end
+
+require 'rdoc/task'
+
+RDoc::Task.new(:rdoc) do |rdoc|
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title    = 'Authoreyes'
+  rdoc.options << '--line-numbers'
+  rdoc.rdoc_files.include('README.md')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end
+
+
+
+
+
+
 require 'bundler/gem_tasks'
+
 require 'rake/testtask'
 
 Rake::TestTask.new(:test) do |t|
-  t.libs << 'test'
   t.libs << 'lib'
-  t.test_files = FileList['test/**/*_test.rb']
+  t.libs << 'test'
+  t.pattern = 'test/**/*_test.rb'
+  t.verbose = false
 end
 
-task :default => :test
+
+task default: :test

data/authoreyes.gemspec

@@ -23,7 +23,15 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
+  spec.required_ruby_version = '>= 2.3'
+
+  spec.add_dependency 'rails', '~> 5.0'
+
   spec.add_development_dependency 'bundler', '~> 1.12'
   spec.add_development_dependency 'rake', '~> 10.0'
   spec.add_development_dependency 'minitest', '~> 5.0'
+  spec.add_development_dependency 'sqlite3'
+  spec.add_development_dependency 'devise'
+  spec.add_development_dependency 'byebug'
+
 end

data/authorization_rules.dist.rb

@@ -3,7 +3,7 @@ authorization do
     # add permissions for guests here, e.g.
     #has_permission_on :conferences, :to => :read
   end
-  
+
   # permissions on other roles, such as
   #role :admin do
   #  has_permission_on :conferences, :to => :manage

data/bin/test

@@ -0,0 +1,9 @@
+#!/usr/bin/env ruby
+$: << File.expand_path(File.expand_path('../../test', __FILE__))
+
+require 'bundler/setup'
+require 'rails/test_unit/minitest_plugin'
+
+Rails::TestUnitReporter.executable = 'bin/test'
+
+exit Minitest.run(ARGV)

data/lib/authoreyes.rb

@@ -1,7 +1,17 @@
+require 'rails'
 require 'authoreyes/version'
-require 'authoreyes/authorization'
 require 'authoreyes/parser'
+require 'authoreyes/authorization'
+require 'authoreyes/railtie'
 
 module Authoreyes
-  # Your code goes here...
+  class Railtie
+    # Require helpers after Rails initialization
+    config.after_initialize do
+      require 'authoreyes/helpers/in_controller'
+
+      # Include Controller helpers
+      ActionController::Base.include Authoreyes::Helpers::InController
+    end
+  end
 end

data/lib/authoreyes/authorization.rb

@@ -1,5 +1,4 @@
 # Authorization
-require 'rails'
 require 'authoreyes/authorization/engine'
 require 'authoreyes/authorization/authorization_rule_set'
 require 'authoreyes/authorization/authorization_rule'
@@ -7,56 +6,57 @@ require 'authoreyes/authorization/attribute'
 require 'authoreyes/authorization/attribute_with_permission'
 require 'authoreyes/authorization/anonymous_user'
 
-require "set"
-require "forwardable"
+require 'set'
+require 'forwardable'
 
 module Authoreyes
   module Authorization
     # An exception raised if anything goes wrong in the Authorization realm
-    class AuthorizationError < StandardError ; end
+    class AuthorizationError < StandardError; end
     # NotAuthorized is raised if the current user is not allowed to perform
     # the given operation possibly on a specific object.
-    class NotAuthorized < AuthorizationError ; end
+    class NotAuthorized < AuthorizationError; end
     # AttributeAuthorizationError is more specific than NotAuthorized, signaling
     # that the access was denied on the grounds of attribute conditions.
-    class AttributeAuthorizationError < NotAuthorized ; end
+    class AttributeAuthorizationError < NotAuthorized; end
     # AuthorizationUsageError is used whenever a situation is encountered
     # in which the application misused the plugin.  That is, if, e.g.,
     # authorization rules may not be evaluated.
-    class AuthorizationUsageError < AuthorizationError ; end
+    class AuthorizationUsageError < AuthorizationError; end
     # NilAttributeValueError is raised by Attribute#validate? when it hits a nil attribute value.
     # The exception is raised to ensure that the entire rule is invalidated.
-    class NilAttributeValueError < AuthorizationError ; end
+    class NilAttributeValueError < AuthorizationError; end
 
-    AUTH_DSL_FILES = [Pathname.new(Rails.root || '').join("config", "authorization_rules.rb").to_s] unless defined? AUTH_DSL_FILES
+    AUTH_DSL_FILES = [Pathname.new(Rails.root || '').join('config', 'authorization_rules.rb').to_s].freeze unless defined? AUTH_DSL_FILES
 
     # Controller-independent method for retrieving the current user.
     # Needed for model security where the current controller is not available.
     def self.current_user
-      Thread.current["current_user"] || AnonymousUser.new
+      # TODO: get rid of Thread usage
+      Thread.current['current_user'] || AnonymousUser.new
     end
 
     # Controller-independent method for setting the current user.
     def self.current_user=(user)
-      Thread.current["current_user"] = user
+      Thread.current['current_user'] = user
     end
 
     # For use in test cases only
     def self.ignore_access_control(state = nil) # :nodoc:
-      Thread.current["ignore_access_control"] = state unless state.nil?
-      Thread.current["ignore_access_control"] || false
+      Thread.current['ignore_access_control'] = state unless state.nil?
+      Thread.current['ignore_access_control'] || false
     end
 
     def self.activate_authorization_rules_browser? # :nodoc:
       ::Rails.env.development?
     end
 
-    @@dot_path = "dot"
+    @@dot_path = 'dot'
     def self.dot_path
       @@dot_path
     end
 
-    def self.dot_path= (path)
+    def self.dot_path=(path)
       @@dot_path = path
     end
 
@@ -65,12 +65,12 @@ module Authoreyes
       @@default_role
     end
 
-    def self.default_role= (role)
+    def self.default_role=(role)
       @@default_role = role.to_sym
     end
 
-    def self.is_a_association_proxy? (object)
-      if Rails.version < "3.2"
+    def self.is_a_association_proxy?(object)
+      if Rails.version < '3.2'
         object.respond_to?(:proxy_reflection)
       else
         object.respond_to?(:proxy_association)

data/lib/authoreyes/authorization/engine.rb

@@ -89,6 +89,11 @@ module Authoreyes
                     privilege.flatten.collect { |priv| priv.to_sym } :
                     privilege.to_sym
 
+        # Convert context to symbol as well
+        unless options[:context].nil?
+          options[:context] = options[:context].to_sym
+        end
+
         #
         # If the object responds to :proxy_reflection, we're probably working with
         # an association proxy.  Use 'new' to leverage ActiveRecord's builder

data/lib/authoreyes/helpers.rb

@@ -0,0 +1,6 @@
+module Authoreyes
+  # This module contains all helpers for views, controllers, and models
+  module Helpers
+
+  end
+end

data/lib/authoreyes/helpers/in_controller.rb

@@ -0,0 +1,95 @@
+module Authoreyes
+  module Helpers
+    # This module handles authorization at the Controller level.  It allows
+    # various actions within the controller to be configured to work with
+    # Authoreyes, only permitting access to that action if certain
+    # conditions are met, according to the defined Authorization Rules.
+    module InController
+      extend ActiveSupport::Concern
+      # ActiveSupport.on_load :action_controller do
+      #   extend
+      # end
+
+      ApplicationController.send :before_action, :redirect_if_unauthorized
+
+      # TODO: Implement this!
+      def filter_resource_access(options = {})
+
+      end
+
+      def redirect_if_unauthorized
+        unless permitted_to? action_name
+          session[:request_unauthorized] = true
+          redirect_back fallback_location: root_path,
+                        status: :found,
+                        alert: 'You are not allowed to do that.'
+        end
+      end
+
+      def set_unauthorized_status_code
+        if session[:request_unauthorized] == true
+          session.delete :request_unauthorized
+          response.status = :forbidden
+        end
+      end
+
+      # If the current user meets the given privilege, permitted_to? returns true
+      # and yields to the optional block.  The attribute checks that are defined
+      # in the authorization rules are only evaluated if an object is given
+      # for context.
+      #
+      # See examples for Authorization::AuthorizationHelper #permitted_to?
+      #
+      # If no object or context is specified, the controller_name is used as
+      # context.
+      # TODO: Use permit? instead of permit!
+      # +privelege+ is the symbol name of the privele checked
+      # +object_or_symbol+ is the object the privelege is checked on
+      def permitted_to?(privelege, object_or_symbol = nil, options = {})
+        if Authoreyes::ENGINE.permit!(
+          privelege, options_for_permit(object_or_symbol, options, false)
+        )
+          yield if block_given?
+          true
+        else
+          false
+        end
+      end
+
+      # Works similar to the permitted_to? method, but
+      # throws the authorization exceptions, just like Engine#permit!
+      # +privelege+ is the symbol name of the privele checked
+      # +object_or_symbol+ is the object the privelege is checked on
+      def permitted_to!(privelege, object_or_symbol = nil, options = {})
+        Authoreyes::ENGINE.permit!(
+          privelege, options_for_permit(object_or_symbol, options, true)
+        )
+      end
+
+      private
+
+      # Create hash of options to be used with ENGINE's permit methods
+      def options_for_permit(object_or_sym = nil, options = {}, bang = true)
+        context = object = nil
+        if object_or_sym.nil?
+          context = controller_name.to_sym
+        elsif !Authorization.is_a_association_proxy?(object_or_sym) and object_or_sym.is_a?(Symbol)
+          context = object_or_sym
+        else
+          object = object_or_sym
+        end
+
+        result = {:object => object,
+          :context => context,
+          :skip_attribute_test => object.nil?,
+          :bang => bang}.merge(options)
+        result[:user] = current_user unless result.key?(:user)
+        result
+      end
+
+      class_methods do
+
+      end
+    end
+  end
+end

data/lib/authoreyes/railtie.rb

@@ -0,0 +1,51 @@
+module Authoreyes
+  # Authoreyes sets up a Railtie to create its authorization engine
+  # as a constant during the rails initialization.  Middleware is also
+  # configured here.
+  class Railtie < Rails::Railtie
+    # Error for bad configuration
+    class InvalidConfigurationOption < StandardError; end
+
+    # Allow users to configure Authoreyes in an initializer file
+    # +auth_rules_file+ is the path of the authorization rules file.
+    config.authoreyes = ActiveSupport::OrderedOptions.new
+
+    initializer 'authoreyes.setup', before: 'authoreyes.engine' do |app|
+      # Set default Authoreyes options
+      default_options = ActiveSupport::OrderedOptions.new
+      default_options.auth_rules_file =
+        File.path("#{Rails.root}/config/authorization_rules.rb")
+      default_options.mode = :whitelist
+
+      # Validates options
+      unless [nil, :whitelist, :blacklist].include? config.authoreyes.mode
+        raise InvalidConfigurationOption,
+          "Unrecognized mode.  Valid options are :whitelist and :blacklist"
+      end
+
+      # Merge user options with defaults
+      config.authoreyes = default_options.merge(config.authoreyes)
+    end
+
+    # Controller integration
+    initializer 'authoreyes.in_controller' do |app|
+      ActiveSupport.on_load :action_controller do
+        before_action :redirect_if_unauthorized
+        after_action :set_unauthorized_status_code
+      end
+    end
+
+    # Set up the Authoreyes ENGINE
+    initializer 'authoreyes.engine' do |app|
+      config.before_initialize do
+        # Set up parser and parse rules
+        parser = Authoreyes::Parser::DSLParser.new
+        parser.load! app.config.authoreyes.auth_rules_file
+
+        # Create new engine using parsed rules an make constant
+        engine = Authoreyes::Authorization::Engine.new reader: parser
+        Authoreyes::ENGINE = engine
+      end
+    end
+  end
+end

data/lib/authoreyes/version.rb

@@ -1,3 +1,3 @@
 module Authoreyes
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

data/lib/tasks/authoreyes_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :authoreyes do
+#   # Task goes here
+# end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authoreyes
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Tektite Software
@@ -9,8 +9,22 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-07-06 00:00:00.000000000 Z
+date: 2016-07-30 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -53,6 +67,48 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: devise
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: |-
   A powerful, modern authorization plugin for Ruby on
                           Rails featuring a declarative DSL for centralized
@@ -68,12 +124,14 @@ files:
 - ".travis.yml"
 - Gemfile
 - LICENSE.txt
+- MIT-LICENSE
 - README.md
 - Rakefile
 - authoreyes.gemspec
 - authorization_rules.dist.rb
 - bin/console
 - bin/setup
+- bin/test
 - lib/authoreyes.rb
 - lib/authoreyes/authorization.rb
 - lib/authoreyes/authorization/anonymous_user.rb
@@ -82,11 +140,15 @@ files:
 - lib/authoreyes/authorization/authorization_rule.rb
 - lib/authoreyes/authorization/authorization_rule_set.rb
 - lib/authoreyes/authorization/engine.rb
+- lib/authoreyes/helpers.rb
+- lib/authoreyes/helpers/in_controller.rb
 - lib/authoreyes/parser.rb
 - lib/authoreyes/parser/authorization_rules_parser.rb
 - lib/authoreyes/parser/dsl_parser.rb
 - lib/authoreyes/parser/priveleges_reader.rb
+- lib/authoreyes/railtie.rb
 - lib/authoreyes/version.rb
+- lib/tasks/authoreyes_tasks.rake
 homepage: https://www.github.com/tektite-software/authoreyes
 licenses:
 - MIT
@@ -99,7 +161,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="