authority 3.0.0 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ccacc3926200ff8ab74076d17004787bd6cd07a6
-  data.tar.gz: 53db25b0cd740840535c40f0021603276874dd79
+  metadata.gz: 5d278f4f1f1672058635b280ec7a87a157c524a8
+  data.tar.gz: 8a71e78e7f76f8ae5a3d54c8dc16f1017c2bc6a6
 SHA512:
-  metadata.gz: c5613d4189de8606773858b417a34c29f1ce894705a65a133692251f8d01882d9cff1711ef95e9861b9d9d86a15a519f072e9d98a296540d600c70d6251db2ce
-  data.tar.gz: 59e4493c297af171339c56509808329be8dc5af60aa274cabbe033dc58eb6eb466b1cdfa6d02cb5cfb4683e432fab0c848c8918f0d1eb418bafff4924cbba2e1
+  metadata.gz: 9df1e4d9c065a21bb73555fa4839830b3407cd62603e0af3fd3c2532623c0d9744dba517e38578b62ad26e8b80fd310ba353e5e2c29bb639d08e0d5717282e5e
+  data.tar.gz: aa3af216a21af0d250831dcf643c8f171fa64b31a5cd374270693701dc5d98eb71527675f832bfd0f440a8a8f5c6a71ef5733cde22cd3e92bd0d1c5bd3c23a5a

data/.travis.yml

@@ -1,15 +1,17 @@
 language: ruby
 rvm:
   - 1.9.3
-  - 2.0.0
-  - 2.1.0
+  - 2.0
+  - 2.1
+  - 2.2
   - jruby-19mode # JRuby in 1.9 mode
-  - rbx
+  - rbx-2
 
 gemfile:
   - gemfiles/3.2.gemfile
   - gemfiles/4.0.gemfile
   - gemfiles/4.1.gemfile
+  - gemfiles/4.2.gemfile
 
 matrix:
   exclude:

data/CHANGELOG.markdown

@@ -2,6 +2,16 @@
 
 Authority does its best to use [semantic versioning](http://semver.org).
 
+## Unreleased
+
+Nothing
+
+## 3.1.0
+
+- Allow changing the logger by updating the configuration (see commit 0214d24), based on [a question](https://github.com/nathanl/authority/issues/101) from [Nate Bird](https://github.com/natebird)
+- Authorizers can now have an instance default method (`def default`), thanks to [Pascal Friederich](https://github.com/paukul)
+- Fix "wrong number of arguments" bug for Sequel users, reported by [Sebastian Porto](https://github.com/sporto) in [Issue 100](https://github.com/nathanl/authority/issues/100)
+
 ## v3.0.0
 
 Officially drop support for Ruby < 1.9.3 and Rails < 3.2.

data/Gemfile

@@ -2,5 +2,3 @@ source 'https://rubygems.org'
 
 # Specify your gem's dependencies in authority.gemspec
 gemspec
-
-gem 'rspec', '>= 2.12.0'

data/README.markdown

@@ -10,6 +10,7 @@ If you're using it with Rails controllers, it requires that you already have som
 [![Build Status](https://secure.travis-ci.org/nathanl/authority.png?branch=master)](http://travis-ci.org/nathanl/authority)
 [![Code Climate](https://codeclimate.com/github/nathanl/authority.png)](https://codeclimate.com/github/nathanl/authority)
 [![Dependency Status](https://gemnasium.com/nathanl/authority.png)](https://gemnasium.com/nathanl/authority)
+[![Join the chat at https://gitter.im/nathanl/authority](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/nathanl/authority?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 
 ## Contents
 
@@ -121,6 +122,8 @@ The authorization process generally flows like this:
 
 If the answer is `false` and the original caller was a controller, this is treated as a `SecurityViolation`. If it was a view, maybe you just don't show a link.
 
+The authorization process for instances is different in that it calls the instance's `default` method before calling the class `default` method. This allows you to define default behaviour that requires access to the model instance to be determined (eg, assume any action on a blog post is allowed if that post is marked 'wiki').
+
 (Diagrams made with [AsciiFlow](http://asciiflow.com))
 
 <a name="installation">
@@ -169,7 +172,8 @@ class Article
   # Adds `creatable_by?(user)`, etc
   include Authority::Abilities
 
-  # Without this, 'ApplicationAuthorizer' is assumed
+  # Without this, 'ArticleAuthorizer' is assumed;
+  # if that doesn't exist, 'ApplicationAuthorizer'
   self.authorizer_name = 'AdminAuthorizer'
   ...
 end
@@ -279,12 +283,12 @@ describe AdminAuthorizer do
   end
 
   describe "class" do
-    it "lets admins update in bulk" do
-      expect(AdminAuthorizer).to be_bulk_updatable_by(@admin)
+    it "lets admins update" do
+      expect(AdminAuthorizer).to be_updatable_by(@admin)
     end
 
-    it "doesn't let users update in bulk" do
-      expect(AdminAuthorizer).not_to be_bulk_updatable_by(@user)
+    it "doesn't let users update" do
+      expect(AdminAuthorizer).not_to be_updatable_by(@user)
     end
   end
 
@@ -313,12 +317,14 @@ end
 
 If you're using Rails, ActionController support will be loaded in through a Railtie. Otherwise, you'll want to integrate it into your framework yourself. [Authority's controller](https://github.com/nathanl/authority/blob/master/lib/authority/controller.rb) is an excellent starting point.
 
-Anytime a controller finds a user attempting something they're not authorized to do, a [Security Violation](#security_violations_and_logging) will result. Controllers get two ways to check authorization:
+You can check authorization in your controllers in one of two ways:
 
 - `authorize_actions_for Llama` protects multiple controller actions with a `before_filter`, which performs a **class-level** check. If the current user is never allowed to delete a `Llama`, they'll never even get to the controller's `destroy` method.
 - `authorize_action_for @llama` can be called inside a single controller action, and performs an **instance-level** check. If called inside `update`, it will check whether the current user is allowed to update this particular `@llama` instance.
 
-How does Authority know to check `deletable_by?` before the controller's `destroy` action? It checks your configuration. These mappings are configurable globally from the initializer file. Defaults are as follows:
+If either method finds a user attempting something they're not authorized to do, a [Security Violation](#security_violations_and_logging) will result.
+
+How does `authorize_actions_for` know to check `deletable_by?` before the controller's `destroy` action? It checks your configuration. These mappings are configurable globally from the initializer file. Defaults are as follows:
 
 ```ruby
 config.controller_action_map = {

data/authority.gemspec

@@ -12,6 +12,8 @@ Gem::Specification.new do |gem|
   gem.add_dependency "activesupport", ">= 3.0.0"
   gem.add_dependency "rake",          ">= 0.8.7"
 
+  gem.add_development_dependency "rspec", "~> 3.3.0"
+
   gem.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   gem.files         = `git ls-files`.split("\n")
   gem.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")

data/gemfiles/3.2.gemfile

@@ -1,6 +1,6 @@
-source "http://rubygems.org"
+source 'https://rubygems.org'
 
-gem "rails", "~> 3.2.3"
-gem 'rspec', '>= 2.8.0'
+gem 'rails', '~> 3.2.3'
+gem 'rspec', '~> 2.14.0'
 
-gemspec :path=>"../"
+gemspec path: '../'

data/gemfiles/4.0.gemfile

@@ -1,6 +1,6 @@
-source "http://rubygems.org"
+source 'https://rubygems.org'
 
-gem "rails", "~> 4.0"
-gem 'rspec', '~> 2.14'
+gem 'rails', '~> 4.0.0'
+gem 'rspec', '~> 2.14.0'
 
-gemspec :path=>"../"
+gemspec path: '../'

data/gemfiles/4.1.gemfile

@@ -1,6 +1,6 @@
-source "http://rubygems.org"
+source 'https://rubygems.org'
 
-gem "rails", "~> 4.1"
-gem 'rspec', '~> 2.14'
+gem 'rails', '~> 4.1.0'
+gem 'rspec', '~> 2.14.0'
 
-gemspec :path=>"../"
+gemspec path: '../'

data/gemfiles/4.2.gemfile

@@ -0,0 +1,6 @@
+source 'https://rubygems.org'
+
+gem 'rails', '~> 4.2.0'
+gem 'rspec', '~> 2.14.0'
+
+gemspec path: '../'

data/lib/authority.rb

@@ -58,7 +58,7 @@ module Authority
   end
 
   def self.logger
-    @logger ||= configuration.logger
+     configuration.logger
   end
 
   private

data/lib/authority/authorizer.rb

@@ -1,7 +1,5 @@
 module Authority
   class Authorizer
-    extend Forwardable
-
     # The base Authorizer class, from which all the authorizers in an app will
     # descend. Provides the authorizer with both class and instance methods
     # like `updatable_by?(user)`.
@@ -20,21 +18,30 @@ module Authority
       false
     end
 
-    # Each instance method simply calls the corresponding class method
-    Authority.adjectives.each do |adjective|
-      def_delegator :"self.class", :"#{adjective}_by?"
+    # the instance default method calls the class default method
+    def default(adjective, user, options = {})
+      user_and_maybe_options = self.class.send(:user_and_maybe_options, user, options)
+      self.class.send(:"#{adjective}_by?", *user_and_maybe_options)
     end
 
-    # Each class method simply calls the `default` method
+    # Each method simply calls the `default` method (instance or class)
     Authority.adjectives.each do |adjective|
       class_eval <<-RUBY, __FILE__, __LINE__ + 1
         def self.#{adjective}_by?(user, options = {})
-          user_and_maybe_options = [user, options].tap {|args| args.pop if args.last == {}}
+          default(:#{adjective}, *user_and_maybe_options(user, options))
+        end
+
+        def #{adjective}_by?(user, options = {})
+          user_and_maybe_options = self.class.send(:user_and_maybe_options, user, options)
           default(:#{adjective}, *user_and_maybe_options)
         end
       RUBY
     end
 
+    def self.user_and_maybe_options(user, options = {})
+      [user, options].tap {|args| args.pop if args.last == {}}
+    end
+    private_class_method :user_and_maybe_options
   end
 
   class NoAuthorizerError < StandardError ; end

data/lib/authority/controller.rb

@@ -133,12 +133,21 @@ module Authority
     # The `before_filter` that will be setup to run when the class method
     # `authorize_actions_for` is called
     def run_authorization_check
-      authorize_action_for(*instance_authority_resource)
+      if instance_authority_resource.is_a?(Array)
+        # Array includes options; pass as separate args
+        authorize_action_for(*instance_authority_resource)
+      else
+        # *resource would be interpreted as resource.to_a, which is wrong and
+        # actually triggers a query if it's a Sequel model
+        authorize_action_for(instance_authority_resource)
+      end
     end
 
     def instance_authority_resource
-      return self.class.authority_resource       if self.class.authority_resource.is_a?(Class)
-      send(self.class.authority_resource)
+      case self.class.authority_resource
+      when Class          then self.class.authority_resource
+      when String, Symbol then send(self.class.authority_resource)
+      end
     rescue NoMethodError
       raise MissingResource.new(
           "Trying to authorize actions for '#{self.class.authority_resource}', but can't. \

data/lib/authority/version.rb

@@ -1,3 +1,3 @@
 module Authority
-  VERSION = "3.0.0"
+  VERSION = "3.1.0"
 end

data/spec/authority/abilities_spec.rb

@@ -71,13 +71,13 @@ describe Authority::Abilities do
 
       it "constantizes the authorizer name as the authorizer" do
         resource_class.instance_variable_set(:@authorizer, nil)
-        resource_class.authorizer_name.should_receive(:constantize)
+        expect(resource_class.authorizer_name).to receive(:constantize)
         resource_class.authorizer
       end
 
       it "memoizes the authorizer to avoid reconstantizing" do
         resource_class.authorizer
-        resource_class.authorizer_name.should_not_receive(:constantize)
+        expect(resource_class.authorizer_name).not_to receive(:constantize)
         resource_class.authorizer
       end
 
@@ -106,7 +106,7 @@ describe Authority::Abilities do
         context "when given an options hash" do
 
           it "delegates `#{method_name}` to its authorizer class, passing the options" do
-            resource_class.authorizer.should_receive(method_name).with(user, :lacking => 'nothing')
+            expect(resource_class.authorizer).to receive(method_name).with(user, :lacking => 'nothing')
             resource_class.send(method_name, user, :lacking => 'nothing')
           end
 
@@ -115,7 +115,7 @@ describe Authority::Abilities do
         context "when not given an options hash" do
 
           it "delegates `#{method_name}` to its authorizer class, passing no options" do
-            resource_class.authorizer.should_receive(method_name).with(user)
+            expect(resource_class.authorizer).to receive(method_name).with(user)
             resource_class.send(method_name, user)
           end
 
@@ -147,8 +147,8 @@ describe Authority::Abilities do
         context "when given an options hash" do
 
           it "delegates `#{method_name}` to a new authorizer instance, passing the options" do
-            resource_class.authorizer.stub(:new).and_return(@authorizer)
-            @authorizer.should_receive(method_name).with(user, :with => 'mayo')
+            allow(resource_class.authorizer).to receive(:new).and_return(@authorizer)
+            expect(@authorizer).to receive(method_name).with(user, :with => 'mayo')
             resource_instance.send(method_name, user, :with => 'mayo')
           end
 
@@ -157,8 +157,8 @@ describe Authority::Abilities do
         context "when not given an options hash" do
 
           it "delegates `#{method_name}` to a new authorizer instance, passing no options" do
-            resource_class.authorizer.stub(:new).and_return(@authorizer)
-            @authorizer.should_receive(method_name).with(user)
+            allow(resource_class.authorizer).to receive(:new).and_return(@authorizer)
+            expect(@authorizer).to receive(method_name).with(user)
             resource_instance.send(method_name, user)
           end
 
@@ -176,7 +176,7 @@ describe Authority::Abilities do
     # instance of the authorizer. Otherwise, you might check, make a change to the
     # model instance, check again, and get an outdated answer.
     it "always creates a new authorizer instance when accessing the authorizer" do
-      resource_instance.class.authorizer.should_receive(:new).with(resource_instance).twice
+      expect(resource_instance.class.authorizer).to receive(:new).with(resource_instance).twice
       2.times { resource_instance.authorizer }
     end
 

data/spec/authority/authorizer_spec.rb

@@ -13,6 +13,20 @@ describe Authority::Authorizer do
 
   describe "instance methods" do
 
+    it "calls the instance default method if no instance method is defined" do
+      expect(authorizer).to receive(:default)
+      authorizer.creatable_by?(user)
+    end
+
+    context "the instance default method" do
+
+      it "delegates to the class default method" do
+        expect(authorizer.class).to receive(:default)
+        authorizer.default(:creatable, user)
+      end
+
+    end
+
     Authority.adjectives.each do |adjective|
       method_name = "#{adjective}_by?"
 
@@ -25,7 +39,7 @@ describe Authority::Authorizer do
         context "when given an options hash" do
 
           it "delegates `#{method_name}` to the corresponding class method, passing the options" do
-            authorizer.class.should_receive(method_name).with(user, :under => 'God')
+            expect(authorizer.class).to receive(method_name).with(user, :under => 'God')
             authorizer.send(method_name, user, :under => 'God')
           end
 
@@ -34,7 +48,7 @@ describe Authority::Authorizer do
         context "when not given an options hash" do
 
           it "delegates `#{method_name}` to the corresponding class method, passing no options" do
-            authorizer.class.should_receive(method_name).with(user)
+            expect(authorizer.class).to receive(method_name).with(user)
             authorizer.send(method_name, user)
           end
 
@@ -61,7 +75,7 @@ describe Authority::Authorizer do
 
           it "delegates `#{method_name}` to the authorizer's `default` method, passing the options" do
             able = method_name.sub('_by?', '').to_sym
-            Authority::Authorizer.should_receive(:default).with(able, user, :with => 'gusto')
+            expect(Authority::Authorizer).to receive(:default).with(able, user, :with => 'gusto')
             Authority::Authorizer.send(method_name, user, :with => 'gusto')
           end
 
@@ -71,7 +85,7 @@ describe Authority::Authorizer do
 
           it "delegates `#{method_name}` to the authorizer's `default` method, passing no options" do
             able = method_name.sub('_by?', '').to_sym
-            Authority::Authorizer.should_receive(:default).with(able, user)
+            expect(Authority::Authorizer).to receive(:default).with(able, user)
             Authority::Authorizer.send(method_name, user)
           end
 
@@ -88,14 +102,14 @@ describe Authority::Authorizer do
     context "when given an options hash" do
 
       it "returns false" do
-        expect(Authority::Authorizer.default(:implodable, user, {:for => "my_object"})).to be_false
+        expect(Authority::Authorizer.default(:implodable, user, {:for => "my_object"})).to eq(false)
       end
     end
 
     context "when not given an options hash" do
 
       it "returns false" do
-        expect(Authority::Authorizer.default(:implodable, user)).to be_false
+        expect(Authority::Authorizer.default(:implodable, user)).to eq(false)
       end
 
     end

data/spec/authority/configuration_spec.rb

@@ -17,7 +17,7 @@ describe Authority::Configuration do
         Authority.instance_variable_set :@configuration, nil
         null = File.exists?('/dev/null') ? '/dev/null' : 'NUL:' # Allow for Windows
         logger = Logger.new(null)
-        Logger.should_receive(:new).with(STDERR).and_return(logger)
+        expect(Logger).to receive(:new).with(STDERR).and_return(logger)
         Authority.configure
         Authority.logger
       end

data/spec/authority/controller_spec.rb

@@ -16,7 +16,7 @@ describe Authority::Controller do
   context "when including" do
 
     before :each do
-      Authority::Controller.stub(:security_violation_callback).and_return(Proc.new {|exception| })
+      allow(Authority::Controller).to receive(:security_violation_callback).and_return(Proc.new {|exception| })
     end
 
     after :each do
@@ -24,7 +24,7 @@ describe Authority::Controller do
     end
 
     it "specifies rescuing security violations with a standard callback" do
-      controller_class.should_receive(:rescue_from).with(
+      expect(controller_class).to receive(:rescue_from).with(
         Authority::SecurityViolation, :with => Authority::Controller.security_violation_callback
       )
     end
@@ -55,7 +55,7 @@ describe Authority::Controller do
         # this test, so I'm stealing that behavior.
 
         Authority.configuration.security_violation_handler = :fire_ze_missiles
-        controller_instance.should_receive(:fire_ze_missiles).with(fake_exception)
+        expect(controller_instance).to receive(:fire_ze_missiles).with(fake_exception)
         controller_instance.instance_exec(fake_exception, &Authority::Controller.security_violation_callback)
 
       end
@@ -101,7 +101,7 @@ describe Authority::Controller do
 
         it "sets up a before_filter, passing the options it was given" do
           filter_options = {:only => [:show, :edit, :update]}
-          controller_class.should_receive(:before_filter).with(:run_authorization_check, filter_options)
+          expect(controller_class).to receive(:before_filter).with(:run_authorization_check, filter_options)
           controller_class.authorize_actions_for(resource_class, filter_options)
         end
 
@@ -109,12 +109,12 @@ describe Authority::Controller do
           overridden_action_map = controller_class.authority_action_map
           overridden_action_map.update(overridden_action_map) {|k,v| v = :annihilate}
           child_controller.authorize_actions_for(resource_class, :all_actions => :annihilate)
-          child_controller.authority_action_map.should eq(overridden_action_map)
+          expect(child_controller.authority_action_map).to eq(overridden_action_map)
         end
 
         it "passes the action hash to the `add_actions` method" do
           new_actions = {:synthesize => :create, :annihilate => 'delete'}
-          child_controller.should_receive(:add_actions).with(new_actions)
+          expect(child_controller).to receive(:add_actions).with(new_actions)
           child_controller.authorize_actions_for(resource_class, :actions => new_actions)
         end
 
@@ -190,52 +190,52 @@ describe Authority::Controller do
         let(:controller_instance) { controller_class.new }
 
         before(:each) do
-          controller_instance.stub(:class).and_return("FooController")
-          controller_instance.stub(:action_name).and_return(:bar)
+          allow(controller_instance).to receive(:class).and_return("FooController")
+          allow(controller_instance).to receive(:action_name).and_return(:bar)
         end
 
         it "sets up an after_filter, passing the options it was given" do
           filter_options = {:only => [:show, :edit, :update]}
-          controller_class.should_receive(:after_filter).with(filter_options)
+          expect(controller_class).to receive(:after_filter).with(filter_options)
           controller_class.ensure_authorization_performed(filter_options)
         end
 
         it "triggers AuthorizationNotPerformed in after filter" do
-          controller_class.stub(:after_filter).and_yield(controller_instance)
-          lambda {
+          allow(controller_class).to receive(:after_filter).and_yield(controller_instance)
+          expect {
             controller_class.ensure_authorization_performed
-          }.should raise_error(Authority::Controller::AuthorizationNotPerformed)
+          }.to raise_error(Authority::Controller::AuthorizationNotPerformed)
         end
 
         it "AuthorizationNotPerformed error has meaningful message" do
-          controller_class.stub(:after_filter).and_yield(controller_instance)
-          lambda {
+          allow(controller_class).to receive(:after_filter).and_yield(controller_instance)
+          expect {
             controller_class.ensure_authorization_performed
-          }.should raise_error("No authorization was performed for FooController#bar")
+          }.to raise_error("No authorization was performed for FooController#bar")
         end
 
         it "does not trigger AuthorizationNotPerformed when :if is false" do
-          controller_instance.stub(:authorize?) { false }
-          controller_class.stub(:after_filter).with({}).and_yield(controller_instance)
-          lambda {
+          allow(controller_instance).to receive(:authorize?) { false }
+          allow(controller_class).to receive(:after_filter).with({}).and_yield(controller_instance)
+          expect {
             controller_class.ensure_authorization_performed(:if => :authorize?)
-          }.should_not raise_error()
+          }.not_to raise_error()
         end
 
         it "does not trigger AuthorizationNotPerformed when :unless is true" do
-          controller_instance.stub(:skip_authorization?) { true }
-          controller_class.stub(:after_filter).with({}).and_yield(controller_instance)
-          lambda {
+          allow(controller_instance).to receive(:skip_authorization?) { true }
+          allow(controller_class).to receive(:after_filter).with({}).and_yield(controller_instance)
+          expect {
             controller_class.ensure_authorization_performed(:unless => :skip_authorization?)
-          }.should_not raise_error()
+          }.not_to raise_error()
         end
 
         it "does not raise error when #authorization_performed is true" do
           controller_instance.authorization_performed = true
-          controller_class.stub(:after_filter).with({}).and_yield(controller_instance)
-          lambda {
+          allow(controller_class).to receive(:after_filter).with({}).and_yield(controller_instance)
+          expect {
             controller_class.ensure_authorization_performed
-          }.should_not raise_error()
+          }.not_to raise_error()
         end
 
       end
@@ -253,7 +253,7 @@ describe Authority::Controller do
 
       let(:controller_instance) do
         controller_class.new.tap do |cc|
-          cc.stub(Authority.configuration.user_method).and_return(user)
+          allow(cc).to receive(Authority.configuration.user_method).and_return(user)
         end
       end
 
@@ -264,7 +264,7 @@ describe Authority::Controller do
         context "if a resource class was specified" do
 
           it "checks authorization on the model specified" do
-            controller_instance.should_receive(:authorize_action_for).with(resource_class)
+            expect(controller_instance).to receive(:authorize_action_for).with(resource_class)
             controller_instance.send(:run_authorization_check)
           end
 
@@ -284,11 +284,18 @@ describe Authority::Controller do
 
             context "and the method returns a class" do
               before :each do
-                controller_instance.stub(:method_to_find_class).and_return(resource_class)
+                allow(controller_instance).to receive(:method_to_find_class).and_return(resource_class)
               end
 
               it "checks authorization on that class" do
-                controller_instance.should_receive(:authorize_action_for).with(resource_class)
+                expect(controller_instance).to receive(:authorize_action_for).with(resource_class)
+                controller_instance.send(:run_authorization_check)
+              end
+
+              it "does not call to_a on that class" do
+                expect(controller_instance).to receive(:authorize_action_for).with(resource_class)
+                # *resource is syntactic sugar for resource.to_a
+                expect(resource_class).not_to receive(:to_a)
                 controller_instance.send(:run_authorization_check)
               end
             end
@@ -297,11 +304,11 @@ describe Authority::Controller do
               let(:some_options) { { :a => 1, :b => 2 } }
 
               before :each do
-                controller_instance.stub(:method_to_find_class).and_return([resource_class, some_options])
+                allow(controller_instance).to receive(:method_to_find_class).and_return([resource_class, some_options])
               end
 
               it "checks authorization on that class and passes the options" do
-                controller_instance.should_receive(:authorize_action_for).with(resource_class, some_options)
+                expect(controller_instance).to receive(:authorize_action_for).with(resource_class, some_options)
                 controller_instance.send(:run_authorization_check)
               end
             end
@@ -321,7 +328,7 @@ describe Authority::Controller do
         end
 
         it "raises a MissingAction if there is no corresponding action for the controller" do
-          controller_instance.stub(:action_name).and_return('sculpt')
+          allow(controller_instance).to receive(:action_name).and_return('sculpt')
           expect { controller_instance.send(:run_authorization_check) }.to raise_error(
             Authority::Controller::MissingAction
           )
@@ -331,23 +338,23 @@ describe Authority::Controller do
 
       describe "authorize_action_for" do
 
-        before(:each) { controller_instance.stub(:action_name).and_return(:destroy) }
+        before(:each) { allow(controller_instance).to receive(:action_name).and_return(:destroy) }
 
         it "calls Authority.enforce to authorize the action" do
-          Authority.should_receive(:enforce)
+          expect(Authority).to receive(:enforce)
           controller_instance.send(:authorize_action_for, resource_class)
         end
 
         it "passes along any options it was given" do
           options = {:for => 'insolence'}
-          Authority.should_receive(:enforce).with('delete', resource_class, user, options)
+          expect(Authority).to receive(:enforce).with('delete', resource_class, user, options)
           controller_instance.send(:authorize_action_for, resource_class, options)
         end
 
         it "sets correct authorization flag" do
-          Authority.stub(:enforce)
+          allow(Authority).to receive(:enforce)
           controller_instance.send(:authorize_action_for, resource_class)
-          controller_instance.authorization_performed?.should be_true
+          expect(controller_instance.authorization_performed?).to eq(true)
         end
 
       end
@@ -355,7 +362,7 @@ describe Authority::Controller do
       describe "authority_user" do
 
         it "gets the user for the current request from the configured user_method" do
-          controller_instance.should_receive(Authority.configuration.user_method)
+          expect(controller_instance).to receive(Authority.configuration.user_method)
           controller_instance.send(:authority_user)
         end
 
@@ -366,15 +373,15 @@ describe Authority::Controller do
         let(:mock_error) { double(:message => 'oh noes! an error!') }
 
         it "logs an error" do
-          Authority.logger.should_receive(:warn)
-          controller_instance.stub(:render)
+          expect(Authority.logger).to receive(:warn)
+          allow(controller_instance).to receive(:render)
           controller_instance.send(:authority_forbidden, mock_error)
         end
 
         it "renders the public/403.html file" do
           forbidden_page = Rails.root.join('public/403.html')
-          Authority.logger.stub(:warn)
-          controller_instance.should_receive(:render).with(:file => forbidden_page, :status => 403, :layout => false)
+          allow(Authority.logger).to receive(:warn)
+          expect(controller_instance).to receive(:render).with(:file => forbidden_page, :status => 403, :layout => false)
           controller_instance.send(:authority_forbidden, mock_error)
         end
 

data/spec/authority/integration_spec.rb

@@ -19,7 +19,7 @@ describe "integration from user through model to authorizer" do
         describe "if given an options hash" do
 
           it "delegates `#{adjective_method}` to its authorizer class, passing the options" do
-            resource_class.authorizer.should_receive(adjective_method).with(user, :lacking => 'nothing')
+            expect(resource_class.authorizer).to receive(adjective_method).with(user, :lacking => 'nothing')
             user.send(verb_method, resource_class, :lacking => 'nothing')
           end
 
@@ -28,7 +28,7 @@ describe "integration from user through model to authorizer" do
         describe "if not given an options hash" do
 
           it "delegates `#{adjective_method}` to its authorizer class, passing no options" do
-            resource_class.authorizer.should_receive(adjective_method).with(user)
+            expect(resource_class.authorizer).to receive(adjective_method).with(user)
             user.send(verb_method, resource_instance)
           end
 
@@ -45,7 +45,7 @@ describe "integration from user through model to authorizer" do
     let!(:authorizer_instance) { resource_class.authorizer.new(resource_instance) }
 
     before :each do
-      resource_class.authorizer.stub(:new).and_return(authorizer_instance)
+      allow(resource_class.authorizer).to receive(:new).and_return(authorizer_instance)
     end
 
     Authority.verbs.each do |verb|
@@ -58,7 +58,7 @@ describe "integration from user through model to authorizer" do
         describe "if given an options hash" do
 
           it "delegates `#{adjective_method}` to a new authorizer instance, passing the options" do
-            authorizer_instance.should_receive(adjective_method).with(user, :consistency => 'mushy')
+            expect(authorizer_instance).to receive(adjective_method).with(user, :consistency => 'mushy')
             user.send(verb_method, resource_instance, :consistency => 'mushy')
           end
 
@@ -67,7 +67,7 @@ describe "integration from user through model to authorizer" do
         describe "if not given an options hash" do
 
           it "delegates `#{adjective_method}` to a new authorizer instance, passing no options" do
-            authorizer_instance.should_receive(adjective_method).with(user)
+            expect(authorizer_instance).to receive(adjective_method).with(user)
             user.send(verb_method, resource_instance)
           end
 

data/spec/authority/user_abilities_spec.rb

@@ -18,7 +18,7 @@ describe Authority::UserAbilities do
       describe "if given options" do
 
         it "delegates the authorization check to the resource, passing the options" do
-          resource_instance.should_receive("#{Authority.abilities[verb]}_by?").with(user, :size => 'wee')
+          expect(resource_instance).to receive("#{Authority.abilities[verb]}_by?").with(user, :size => 'wee')
           user.send(method_name, resource_instance, :size => 'wee')
         end
 
@@ -27,7 +27,7 @@ describe Authority::UserAbilities do
       describe "if not given options" do
 
         it "delegates the authorization check to the resource, passing no options" do
-          resource_instance.should_receive("#{Authority.abilities[verb]}_by?").with(user)
+          expect(resource_instance).to receive("#{Authority.abilities[verb]}_by?").with(user)
           user.send(method_name, resource_instance)
         end
 
@@ -42,7 +42,7 @@ describe Authority::UserAbilities do
     context "when ApplicationAuthorizer responds to a matching `authorizes_to?` call" do
 
       before :each do
-        ApplicationAuthorizer.stub(:authorizes_to_mimic_lemurs?).and_return('yessir')
+        allow(ApplicationAuthorizer).to receive(:authorizes_to_mimic_lemurs?).and_return('yessir')
       end
 
       it "uses the `authorizes_to` return value" do
@@ -50,12 +50,12 @@ describe Authority::UserAbilities do
       end
 
       it "passes along options if any were given" do
-        ApplicationAuthorizer.should_receive(:authorizes_to_mimic_lemurs?).with(user, :for => :academic_credit)
+        expect(ApplicationAuthorizer).to receive(:authorizes_to_mimic_lemurs?).with(user, :for => :academic_credit)
         user.can?(:mimic_lemurs, :for => :academic_credit)
       end
 
       it "doesn't pass along options if none were given" do
-        ApplicationAuthorizer.should_receive(:authorizes_to_mimic_lemurs?).with(user)
+        expect(ApplicationAuthorizer).to receive(:authorizes_to_mimic_lemurs?).with(user)
         user.can?(:mimic_lemurs)
       end
 
@@ -64,14 +64,14 @@ describe Authority::UserAbilities do
     context "when ApplicationAuthorizer does not respond to a matching `authorizes_to?` call" do
 
       before :each do
-        ApplicationAuthorizer.stub(:authorizes_to_mimic_lemurs?).and_raise(NoMethodError.new('eh?'))
+        allow(ApplicationAuthorizer).to receive(:authorizes_to_mimic_lemurs?).and_raise(NoMethodError.new('eh?'))
       end
 
       context "when ApplicationAuthorizer responds to a matching `can` call" do
 
         before :each do
-          ApplicationAuthorizer.stub(:can_mimic_lemurs?).and_return('thumbs up!')
-          Authority.logger.stub(:warn)
+          allow(ApplicationAuthorizer).to receive(:can_mimic_lemurs?).and_return('thumbs up!')
+          allow(Authority.logger).to receive(:warn)
         end
 
         it "uses the `can` return value (for backwards compatibility)" do
@@ -79,7 +79,7 @@ describe Authority::UserAbilities do
         end
 
         it "sends a deprecation warning" do
-          Authority.logger.should_receive(:warn).with(
+          expect(Authority.logger).to receive(:warn).with(
             "DEPRECATION WARNING: Please rename `ApplicationAuthorizer.can_mimic_lemurs?` to `authorizes_to_mimic_lemurs?`"
           )
           user.can?(:mimic_lemurs)
@@ -90,7 +90,7 @@ describe Authority::UserAbilities do
       context "when ApplicationAuthorizer does not respond to a matching `can` call" do
 
         before(:each) do
-          ApplicationAuthorizer.stub(:can_mimic_lemurs?).and_raise(NoMethodError.new('whaaa?'))
+          allow(ApplicationAuthorizer).to receive(:can_mimic_lemurs?).and_raise(NoMethodError.new('whaaa?'))
         end
 
         it "re-raises the NoMethodError from the missing `authorizes_to?`" do

data/spec/authority_spec.rb

@@ -32,9 +32,24 @@ describe Authority do
     end
 
     it "requires the remainder of library internals after configuration" do
-      Authority.should_receive(:require_authority_internals!)
+      expect(Authority).to receive(:require_authority_internals!)
       Authority.configure
     end
+
+    it "allows changing the logger" do
+      starting_config = Authority.configuration
+      logger1 = Object.new
+      logger2 = Object.new
+      config = Authority::Configuration.new
+      Authority.configuration = config
+
+      config.logger = logger1
+      expect(Authority.logger).to eq(logger1)
+
+      config.logger = logger2
+      expect(Authority.logger).to eq(logger2)
+      Authority.configuration = starting_config
+    end
   end
 
   describe "enforcement" do
@@ -49,7 +64,7 @@ describe Authority do
 
         it "checks the user's authorization, passing along the options" do
           options = { :for => 'context' }
-          user.should_receive(:can_delete?).with(resource_class, options).and_return(true)
+          expect(user).to receive(:can_delete?).with(resource_class, options).and_return(true)
           Authority.enforce(:delete, resource_class, user, options)
         end
 
@@ -58,7 +73,7 @@ describe Authority do
       describe "when not given options" do
 
         it "checks the user's authorization, passing no options" do
-          user.should_receive(:can_delete?).with(resource_class).and_return(true)
+          expect(user).to receive(:can_delete?).with(resource_class).and_return(true)
           Authority.enforce(:delete, resource_class, user)
         end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authority
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.0
 platform: ruby
 authors:
 - Nathan Long
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-04-19 00:00:00.000000000 Z
+date: 2015-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -39,6 +39,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.8.7
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.3.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.3.0
 description: Authority helps you authorize actions in your Rails app. It's ORM-neutral
   and has very little fancy syntax; just group your models under one or more Authorizer
   classes and write plain Ruby methods on them.
@@ -63,6 +77,7 @@ files:
 - gemfiles/3.2.gemfile
 - gemfiles/4.0.gemfile
 - gemfiles/4.1.gemfile
+- gemfiles/4.2.gemfile
 - lib/authority.rb
 - lib/authority/abilities.rb
 - lib/authority/authorizer.rb