authority 2.8.1 → 2.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 78956bd3adcf1276d5e54a6ed16dcf58efadfc42
-  data.tar.gz: e5dabb9b9806e790713e9f73e903ba1453fc2490
+  metadata.gz: 49f7f09d33ece9e1d0f128c629d5963fbcf55c5b
+  data.tar.gz: 7978825534fc7412ed65cba9a531b0733d331100
 SHA512:
-  metadata.gz: fd3b8f16795dbceaa0b6282a038e6df139c3ca7a5abde3ff37f7decd23910405a96c9bbfce84081840dd8e6e18577f10b758541fc5a82c9c3c6a79ad8f1559a2
-  data.tar.gz: 64ffd79650035946a337270a17ba1abb4cae2e3b7f266d0bd716d1e2e0d8c8df67b871c1cbb6f69868a82d325fcc5e69bbed5c38539b4410d8ef6ca57c9027b2
+  metadata.gz: dd93e0ddda2bec80acf414af069344af29ee3ee287b1143d9bd7fff623bbf3bcdee6d2ca582665c8f9e60ccbbf4c6a3e223fb0414d4ec99bd840543864455ea0
+  data.tar.gz: a499cccc078b3777bf4543266976eb0d1df26951fca5a4419b7c7b813a1bbcae279b7ac4c0a03c03b3c54f4230fcb67d8c0d163deb16e9162579adeef39cab20

data/CHANGELOG.markdown

@@ -2,9 +2,13 @@
 
 Authority does its best to use [semantic versioning](http://semver.org).
 
+## v2.9.0
+
+Add `all_actions` option for `authorize_actions_for`, thanks to [Igor Davydov](https://github.com/div). 
+
 ## v2.8.1
 
-Add license to gemspec, thanks to notice from Benjamin Fleischer - see [his blog post](http://www.benjaminfleischer.com/2013/07/12/make-the-world-a-better-place-put-a-license-in-your-gemspec/)
+Add license to gemspec, thanks to notice from [Benjamin Fleischer](https://github.com/bf4) - see [his blog post](http://www.benjaminfleischer.com/2013/07/12/make-the-world-a-better-place-put-a-license-in-your-gemspec/)
 
 ## v2.8.0
 
@@ -12,12 +16,12 @@ New controller method `ensure_authorization_performed`, thanks to [Igor Davydov]
 
 ## 2.7.0
 
-Allows setting authorizer by class (`authorizer = FooAuthorizer`) as well as by name (`authorizer_name = 'FooAuthorizer'`), thanks to [mguymon](https://github.com/mguymon)
+Allows setting authorizer by class (`authorizer = FooAuthorizer`) as well as by name (`authorizer_name = 'FooAuthorizer'`), thanks to [Michael Guymon](https://github.com/mguymon)
 
 ## v2.6.0
 
-- Now dependent on ActiveSupport, not all of Rails, as a step toward easier use with other frameworks. Thanks to [christhekeele](https://github.com/christhekeele)
-- Testing with Rails 4.0, thanks to [sanemat](https://github.com/sanemat)
+- Now dependent on ActiveSupport, not all of Rails, as a step toward easier use with other frameworks. Thanks to [Christopher Keele](https://github.com/christhekeele)
+- Testing with Rails 4.0, thanks to [Murahashi Sanemat Kenichi](https://github.com/sanemat)
 - Clearer backtraces in certain situations
 
 ## v2.5.0
@@ -56,7 +60,7 @@ Controller method `authorize_actions_for` can now be given a method name to dyna
 
 ## v2.2.0
 
-Allow passing options hash to `authorize_action_for`, like `authorize_action_for(@llama, :sporting => @hat_style)`. Thanks to [MP211](https://github.com/MP211).
+Allow passing options hash to `authorize_action_for`, like `authorize_action_for(@llama, :sporting => @hat_style)`. Thanks to [Mike Paulo](https://github.com/MP211).
 
 ## v2.1.0
 
@@ -73,7 +77,7 @@ Documentation and test cleanup.
 
 ## v1.1.0
 
-- Added `Authority::Authorizer.default` class method which is called before the `default_strategy` proc and delegates to that proc. This can be overridden per authorizer. Thanks to [kevmoo](https://github.com/kevmoo)
+- Added `Authority::Authorizer.default` class method which is called before the `default_strategy` proc and delegates to that proc. This can be overridden per authorizer. Thanks to [Kevin Moore](https://github.com/kevmoo)
 
 ## v1.0.0
 

data/README.markdown

@@ -397,6 +397,18 @@ class LlamasController < ApplicationController
 end
 ```
 
+If you want to authorize all actions the same way, use the special `all_actions` hash key. For instance, if you have nested resources, you might say "you're allowed to do anything you like with an employee if you're allowed to update their organization".
+
+```ruby
+class EmployeesController < ApplicationController
+  authorize_actions_for :parent_resource, all_actions: :update
+  private
+  def parent_resource
+    Employer.find(params[:employer_id])
+  end
+end
+```
+
 Finally, you can enforce that every controller action runs an authorization check using the class method `ensure_authorization_performed`, which sets up an `after_filter` to raise an exception if it wasn't. Any `only` or `except` arguments will be passed to `after_filter`. You can also use `if` or `unless` to specify the name of a controller method which determines whether it's necessary.
 
 Since this runs in an `after_filter`, it obviously doesn't prevent the action, it just alerts you that no authorization was performed. Therefore, it's most useful in development. An example usage might be:

data/lib/authority/controller.rb

@@ -43,7 +43,7 @@ module Authority
       # ones and any other options applicable to a before_filter
       def authorize_actions_for(resource_or_finder, options = {})
         self.authority_resource = resource_or_finder
-        authority_actions(options[:actions] || {})
+        authority_actions(overridden_actions(options))
         before_filter :run_authorization_check, options
       end
 
@@ -51,6 +51,7 @@ module Authority
       #
       # @param [Hash] action_map - controller actions and methods, to be merged with existing action_map
       def authority_actions(action_map)
+        authority_action_map.merge!(overridden_actions(action_map))
         authority_action_map.merge!(action_map.symbolize_keys)
       end
 
@@ -77,6 +78,13 @@ module Authority
         @authority_action_map ||= Authority.configuration.controller_action_map.dup
       end
 
+      def overridden_actions(options = {})
+        if forced_action = options.fetch(:all_actions, false)
+          overridden_actions = authority_action_map.inject({}) { |hash, (key, val)| hash.tap { |h| h[key] = forced_action } }
+        end
+        overridden_actions || options.fetch(:actions, {})
+      end
+
     end
 
     protected
@@ -118,7 +126,7 @@ module Authority
     def instance_authority_resource
       return self.class.authority_resource       if self.class.authority_resource.is_a?(Class)
       send(self.class.authority_resource)
-    rescue NoMethodError => e
+    rescue NoMethodError
       raise MissingResource.new(
           "Trying to authorize actions for '#{self.class.authority_resource}', but can't. \
           Must be either a resource class OR the name of a controller instance method that \

data/lib/authority/version.rb

@@ -1,3 +1,3 @@
 module Authority
-  VERSION = "2.8.1"
+  VERSION = "2.9.0"
 end

data/spec/authority/controller_spec.rb

@@ -2,6 +2,7 @@ require 'spec_helper'
 require 'support/example_classes'
 require 'support/mock_rails'
 require 'active_support/core_ext/proc'
+require 'set'
 
 describe Authority::Controller do
 
@@ -87,6 +88,8 @@ describe Authority::Controller do
 
       describe "authorize_actions_for" do
 
+        let(:child_controller) { Class.new(controller_class) }
+
         it "allows specifying the class of the model to protect" do
           controller_class.authorize_actions_for(resource_class)
           expect(controller_class.authority_resource).to eq(resource_class)
@@ -103,8 +106,14 @@ describe Authority::Controller do
           controller_class.authorize_actions_for(resource_class, filter_options)
         end
 
-        it "passes the action hash to the `authority_action` method" do
-          child_controller = Class.new(controller_class)
+        it "if :all_actions option is given, it overrides the action hash to use the action given" do
+          overridden_action_map = controller_class.authority_action_map
+          overridden_action_map.update(overridden_action_map) {|k,v| v = :annihilate}
+          child_controller.should_receive(:authority_actions).with(overridden_action_map)
+          child_controller.authorize_actions_for(resource_class, :all_actions => :annihilate)
+        end
+
+        it "passes the action hash to the `authority_actions` method" do
           new_actions = {:synthesize => :create, :annihilate => 'delete'}
           child_controller.should_receive(:authority_actions).with(new_actions)
           child_controller.authorize_actions_for(resource_class, :actions => new_actions)
@@ -137,7 +146,7 @@ describe Authority::Controller do
 
       end
 
-      describe "authority_action" do
+      describe "authority_actions" do
 
         it "modifies this controller's authority action map" do
           new_actions = {:show => :display, :synthesize => :create, :annihilate => 'delete'}
@@ -147,6 +156,20 @@ describe Authority::Controller do
           )
         end
 
+        it "forces to use a single method when :all_actions option is given" do
+          force_actions = {:all_actions => :utilize}
+          controller_class.authority_actions(force_actions)
+          expect(controller_class.authority_action_map.values.uniq).to eq([:utilize])
+        end
+
+        it "can be used multiple times; each usage appends methods to authority_action_map" do
+          controller_class.authority_actions({:all_actions  => :utilize})
+          controller_class.authority_actions({:synthesize   => :create})
+          controller_class.authority_actions({:transmogrify => :update})
+          expect(controller_class.authority_action_map.values.uniq.to_set).to eq([:create, :update, :utilize].to_set)
+          expect(controller_class.authority_action_map[:synthesize]).to eq(:create)
+        end
+
         it "does not modify any other controller" do
           child_controller = Class.new(controller_class)
           child_controller.authority_actions(:smite => 'delete')
@@ -155,6 +178,25 @@ describe Authority::Controller do
 
       end
 
+      describe "overridden_actions" do
+
+        it "overrides authority action map if option :all_actions is present" do
+          options = { :all_actions => :display, :actions => {:show => :display, :synthesize => :create} }
+          expect(controller_class.overridden_actions(options).values.uniq).to eq([:display])
+        end
+
+        it "returns :actions hash if option :all_actions is not present" do
+          options = { :actions => {:show => :display, :synthesize => :create, :annihilate => 'delete'} }
+          expect(controller_class.overridden_actions(options)).to eq(options[:actions])
+        end
+
+        it "returns an empty hash if no :all_actions nor :actions options present" do
+          options = { :show => :display, :synthesize => :create, :annihilate => 'delete' }
+          expect(controller_class.overridden_actions(options)).to eq({})
+        end
+
+      end
+
       describe "ensure_authorization_performed" do
 
         let(:controller_instance) { controller_class.new }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authority
 version: !ruby/object:Gem::Version
-  version: 2.8.1
+  version: 2.9.0
 platform: ruby
 authors:
 - Nathan Long
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-09-30 00:00:00.000000000 Z
+date: 2013-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport