authorize_action 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: ea616d0e04fe1d10782138a9703afd606c193fd8
+  data.tar.gz: 5b0e67d8cb38d9863cd5336871f4351057241662
+SHA512:
+  metadata.gz: af325e32de44eacb20318980a019f6725ba5e0e69e109e4e8c7e5b4f52417d71a09c127d4b69248c0a70f8f913a500a678ee0c187fa11b7f9c417b16822ea768
+  data.tar.gz: d0089969c565d7dc1d3860a3e329c0a9287f5c62efaa1b49b640315aff10cc4520408be5cff15d30eb8d551918815889a1e204ef535d798feac0be9e57964109

data/.gitignore

@@ -0,0 +1,14 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+*.bundle
+*.so
+*.o
+*.a
+mkmf.log

data/.travis.yml

@@ -0,0 +1,11 @@
+rvm:
+ - 2.0.0
+ - 2.1.6
+ - 2.2.2
+ - ruby-head
+notifications:
+  recipients:
+    - jarmo.p@gmail.com
+matrix:
+  allow_failures:
+    - rvm: ruby-head

data/CHANGES.md

@@ -0,0 +1,3 @@
+### 1.0.0 - 2015/07/05
+
+* Initial release.

data/Gemfile

@@ -0,0 +1,6 @@
+source 'https://rubygems.org'
+
+gemspec
+
+gem "byebug", require: false
+gem "coveralls", require: false

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) Jarmo Pertman
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,267 @@
+# AuthorizeAction
+
+[![Gem Version](https://badge.fury.io/rb/authorize_action.svg)](http://badge.fury.io/rb/authorize_action)
+[![Build Status](https://api.travis-ci.org/jarmo/authorize_action.png)](http://travis-ci.org/jarmo/authorize_action)
+[![Coverage Status](https://coveralls.io/repos/jarmo/authorize_action/badge.svg?branch=master)](https://coveralls.io/r/jarmo/authorize_action?branch=master)
+[![Dependency Status](https://gemnasium.com/jarmo/authorize_action.png)](https://gemnasium.com/jarmo/authorize_action)
+[![Code Climate](https://codeclimate.com/github/jarmo/authorize_action/badges/gpa.svg)](https://codeclimate.com/github/jarmo/authorize_action)
+
+Really **secure** and **simple** authorization library for your [Rails](http://rubyonrails.org/), [Sinatra](http://www.sinatrarb.com/) or whatever web framework, which doesn't suck.
+
+According to [Ruby Toolbox](https://www.ruby-toolbox.com/categories/rails_authorization) there are
+at least 28 authorization libraries/frameworks available just for Rails. And yet, they all suck.
+At least that's why I've never used any of them in my projects.
+All of this is the reason I've finally decided to create my own library to solve
+the problem of authorization once and for all for all Ruby (web) frameworks.
+
+Here are a few reasons, why [authorize_action](https://github.com/jarmo/authorize_action) is better
+compared to all the rest:
+
+* Is **secure** by default
+  * _authorize_action_ uses a **white-list** approach, which means that all controller actions 
+    are forbidden by default. No more security breaches when you forget to write an authorization rule.
+  
+* Does only **one** thing and does it well
+  * _authorize_action_ doesn't deal with any other thing except **authorization**.
+    It does not provide any authentication (see [Devise](https://github.com/plataformatec/devise) for that),
+    roles or permissions functionality. It just checks if a user has access to a controller action or not. That's it.
+
+* Has a really **simple** API
+  * _authorize_action_ doesn't have _gazillion_ different API methods, separate DSL
+    or _"Getting Started"_ wiki pages. It just has a **few methods** to do all the heavy lifting.
+    And it's really easy to understand by looking at the code in your project,
+    who has access to which controller action.
+
+* Is **framework-agnostic**
+  * Although _authorize_action_ is made to work with _Rails_ and _Sinatra_ by default,
+    it has an **easy** way to add support for whatever framework.
+
+* No **database/ORM** dependencies
+  * _authorize_action_ **doesn't force** you to use any database/ORM - handle
+     your roles/permissions however you like.
+
+* No **external** dependencies
+  * _authorize_action_ doesn't have any direct external dependencies, which
+    makes auditing its code and upgrading it really **painless**.
+
+* Has a **lightweight** codebase
+  * Due to the simplicity of _authorize_action_ its codebase is really simple, clean and foolproof.
+    Entire codebase used in _production_ is under **100 lines**.
+    If you're not sure what exactly happens when you use _authorize_action_ in your project
+    then you can understand it all quickly by looking at [the code](https://github.com/jarmo/authorize_action/tree/master/lib).
+
+* Is thoroughly **tested**
+  * _authorize_action_ has **100% code-coverage** and all tests are ran automatically
+    prior to each release making it impossible to ship a faulty version accidentally.
+
+* Follows **Semantic Versioning**
+  * Although _authorize_action_ is a relatively new library for now,
+    it's going to follow [Semantic Versioning](http://semver.org/),
+    which adds some additional guarantees to developers.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'authorize_action'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install authorize_action
+
+## Usage
+
+* Load _authorize_action_ gem
+* Include framework specific module into base controller
+* Define authorization rules for each controller/class
+* Call `#authorize_action!` method before executing action
+
+### Rails
+
+```ruby
+class ApplicationController < ActionController::Base
+  # Include authorize_action methods
+  include AuthorizeAction::Rails
+  
+  # Check action authorization before action.
+  # By default all actions are forbidden!
+  before_action :authorize_action!
+  
+  protected
+  
+  # Helper method for administrator role
+  def admin?
+    # ...
+  end
+end
+
+class PostsController < ApplicationController
+  # Everyone has access to :index
+  def index
+    # ...
+  end
+  
+  # Only post owner has access to :edit 
+  def edit
+    # ...
+  end
+  
+  # Authorization rules have to be defined for each controller
+  # action to specify the actual access rules.
+  self.authorization_rules = {
+    # Calling Proc object for :index action returns true
+    # thus everyone will have access to that action
+    index: -> { true },
+   
+    # Calling Proc object for :edit action returns true only
+    # when Post owner matches current_user
+    edit: -> { Post.find(params[:id]).owner == current_user },
+    
+    # Calling referenced #admin? method for :destroy action
+    # returns true only for administrators
+    destroy: -> :admin?
+  }
+end
+```
+
+### Sinatra
+
+```ruby
+require "authorize_action"
+
+class Blog < Sinatra::Base
+  # Include authorize_action methods
+  include AuthorizeAction::Sinatra
+  
+  # Check action authorization before action.
+  # By default all actions are forbidden.
+  # Allow requests to `public/` directory if you want.
+  before { authorize_action! unless request.path_info.start_with?(settings.public_folder) }
+  
+  # Everyone has access to reading posts
+  get "/posts" do
+    # ...
+  end
+  
+  # Only post owner has access to editing post
+  get "/posts/:id/edit" do
+    # ...
+  end
+  
+  # Only administrator can delete posts
+  delete "/posts/:id" do
+    # ...
+  end
+  
+  # Authorization rules have to be defined for each route
+  # to specify the actual access rules.
+  self.authorization_rules = {
+    # Calling Proc object for `GET /posts` action returns true
+    # thus everyone will have access to that action
+    action(:get, "/posts") => -> { true },
+    
+    # Calling Proc object for `GET /posts/:id/edit` action
+    # returns true only when Post owner matches current_user
+    action(:get, "/posts/:id/edit") => -> { Post.find(params[:id]).owner == current_user },
+    
+    # Calling referenced #admin? method for `DELETE /posts/:id` action
+    # returns true only for administrators
+    action(:delete, "/posts/:id") => :admin?
+  }
+  
+  # Helper method for administrator role
+  def admin?
+    # ...
+  end
+
+end
+```
+
+### Other
+
+```ruby
+class BaseController
+  # Include authorize_action generic methods
+  include AuthorizeAction
+  
+  # Call #authorize_action! before executing any controller actions.
+  before_any_action :authorize_action!
+  
+  private
+  
+  # Override AuthorizeAction#current_action_name to implement it.
+  # It is expected to return a Symbol/String object with an unique
+  # controller action identifier.
+  def current_action_name
+    # ...
+  end
+  
+  # Override AuthorizeAction#forbid_action! to halt execution 
+  # of controller action by rendering HTTP 403.
+  def forbid_action!
+    # ...
+  end
+  
+  # Set authorization rules where keys are in the exact same format
+  # as returned by #current_action_name
+  # and values are Proc objects returning booleans.
+  self.authorization_rules = {
+    # ...
+  }
+end
+```
+
+## Tips & Tricks
+
+### Administrator Has Access to Every Action
+
+There is no API for giving access to administrator for every possible action.
+Nevertheless it can be achieved easily by just following
+object-oriented programming principles.
+
+Example below is based on Rails and Devise, but
+the idea is the same for whatever framework:
+
+```ruby
+class ApplicationController < ActionController::Base
+  include AuthorizeAction::Rails
+  
+  before_action :authorize_action!
+  
+  # Override AuthorizeAction#authorize_action! to
+  # give access to administrator for every action or
+  # fall back to default AuthorizeAction behavior.
+  def authorize_action!
+    current_user.admin? || super
+  end
+end
+```
+
+Please make sure that you really-really need to do that!
+
+### Protecting Your Views
+
+You have protected your actions with _authorize_action_ and your models with [Strong Parameters](https://github.com/rails/strong_parameters) (or something similar), but what about views?
+
+Again, there is no separate API for that, but why not use regular Ruby methods to do that?
+
+Here's an example:
+```ruby
+# views/posts/edit.html.erb
+
+<% if current_user.admin? %>
+  <%= link_to "Delete", @post, method: :delete
+<% end %>
+```
+
+Next step would be to create some helper class or module for roles.
+
+## License
+
+Copyright (c) Jarmo Pertman (jarmo.p@gmail.com). See [LICENSE](https://github.com/jarmo/authorize_action/blob/master/LICENSE.txt) for details.

data/Rakefile

@@ -0,0 +1,7 @@
+require "bundler/gem_tasks"
+
+require "rspec/core/rake_task"
+RSpec::Core::RakeTask.new(:spec)
+
+task default: :spec
+task build: :spec

data/authorize_action.gemspec

@@ -0,0 +1,22 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+
+Gem::Specification.new do |spec|
+  spec.name          = "authorize_action"
+  spec.version       = "1.0.0"
+  spec.authors       = ["Jarmo Pertman"]
+  spec.email         = ["jarmo.p@gmail.com"]
+  spec.summary       = %q{Really secure and simple authorization library for your Rails, Sinatra or whatever web framework, which doesn't suck.}
+  spec.homepage      = "https://github.com/jarmo/authorize_action"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files -z`.split("\x0")
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "bundler", "~> 1.7"
+  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "rspec", "~> 3.1.0"
+end

data/lib/authorize_action.rb

@@ -0,0 +1,31 @@
+module AuthorizeAction
+  autoload :Rails, File.expand_path("authorize_action/rails", __dir__)
+  autoload :Sinatra, File.expand_path("authorize_action/sinatra", __dir__)
+
+  def authorize_action!
+    authorization_rule = self.class.authorization_rules && self.class.authorization_rules[current_action_name]
+    action_permitted = case authorization_rule 
+                       when Proc then instance_exec(&authorization_rule)
+                       when Symbol then send(authorization_rule)
+                       end
+    forbid_action! unless action_permitted
+  end
+
+  def self.included(base)
+    base.extend(ClassMethods)
+  end
+
+  module ClassMethods
+    attr_accessor :authorization_rules
+  end
+
+  private
+
+  def forbid_action!
+    raise NotImplementedError
+  end
+
+  def current_action_name
+    raise NotImplementedError
+  end
+end

data/lib/authorize_action/rails.rb

@@ -0,0 +1,19 @@
+module AuthorizeAction
+  module Rails
+    include AuthorizeAction
+
+    def self.included(base)
+      AuthorizeAction.included(base)
+    end
+
+    private
+
+    def forbid_action!
+      head(:forbidden)
+    end
+
+    def current_action_name
+      action_name.to_sym
+    end
+  end
+end

data/lib/authorize_action/sinatra.rb

@@ -0,0 +1,29 @@
+module AuthorizeAction
+  module Sinatra
+    include AuthorizeAction
+
+    def self.included(base)
+      AuthorizeAction.included(base)
+      base.extend(ClassMethods)
+    end
+
+    module ClassMethods
+      def action(request_method, request_path)
+        request_method = request_method.to_s.upcase
+        *_, route = routes[request_method].find {|pattern, _| request_path.match(pattern) }
+        route && route.instance_variable_get(:@route_name) && route.instance_variable_get(:@route_name).to_sym || "#{request_method} #{request_path}".to_sym
+      end
+    end
+
+    private
+
+    def forbid_action!
+      halt(403)
+    end
+
+    def current_action_name
+      self.class.action(request.request_method, request.path_info)
+    end
+  end
+end
+

data/spec/authorize_action/rails_spec.rb

@@ -0,0 +1,24 @@
+require "spec_helper"
+
+describe AuthorizeAction::Rails do
+  let(:authorizator) { Class.new { include AuthorizeAction::Rails }.new }
+
+  it "#authorize_action! delegates to AuthorizeAction#authorize_action!" do
+    expect_any_instance_of(AuthorizeAction).to receive(:authorize_action!)
+
+    authorizator.authorize_action!
+  end
+
+  it "#forbid_action! calls Rails' #head(:forbidden)" do
+    expect(authorizator).to receive(:head).with(:forbidden).and_return(:forbidden_result)
+
+    expect(authorizator.send(:forbid_action!)).to eq(:forbidden_result)
+  end
+
+  it "#current_action_name calls Rails' #action_name" do
+    expect(authorizator).to receive(:action_name).and_return("action-name")
+
+    expect(authorizator.send(:current_action_name)).to eq("action-name".to_sym)
+  end
+  
+end

data/spec/authorize_action/sinatra_spec.rb

@@ -0,0 +1,92 @@
+require "spec_helper"
+
+describe AuthorizeAction::Sinatra do
+  let(:authorizator) { Class.new { include AuthorizeAction::Sinatra }.new }
+
+  it "#authorize_action! delegates to AuthorizeAction#authorize_action!" do
+    expect_any_instance_of(AuthorizeAction).to receive(:authorize_action!)
+
+    authorizator.authorize_action!
+  end
+
+  it "#forbid_action! calls Sintra's #halt(403)" do
+    expect(authorizator).to receive(:halt).with(403).and_return(:forbidden_result)
+
+    expect(authorizator.send(:forbid_action!)).to eq(:forbidden_result)
+  end
+
+  it "#current_action_name finds Sinatra's action name from request" do
+    request = double("request", request_method: "GET", path_info: "/foo/bar")
+    allow(authorizator).to receive(:request).and_return(request)
+    expect(authorizator.class).to receive(:action).and_return("action-name".to_sym)
+
+    expect(authorizator.send(:current_action_name)).to eq("action-name".to_sym)
+  end
+
+  context "#action" do
+    it "returns request path when no Sinatra route found" do
+      route_handler = -> {}
+      route_handler.instance_variable_set(:@route_name, "GET /foo/:bar")
+      routes = {
+        "GET" => [
+          # /foo/:bar
+          [/\A\/foo\/([^\/?#]+)\z/, ["bar"], [], route_handler]
+        ]
+      }
+      expect(authorizator.class).to receive(:routes).and_return(routes)
+
+      expect(authorizator.class.action(:get, "/bar/baz")).to eq("GET /bar/baz".to_sym)
+    end
+
+    it "returns request path when Sinatra route found, but no route name exists" do
+      route_handler = -> {}
+      route_handler.instance_variable_set(:@route_name, nil)
+      routes = {
+        "GET" => [
+          # /foo/:bar
+          [/\A\/foo\/([^\/?#]+)\z/, ["bar"], [], route_handler]
+        ]
+      }
+      expect(authorizator.class).to receive(:routes).and_return(routes)
+
+      expect(authorizator.class.action(:get, "/foo/baz")).to eq("GET /foo/baz".to_sym)
+    end
+
+    it "returns Sinatra's GET method route name" do
+      route_handler1 = -> {}
+      route_handler1.instance_variable_set(:@route_name, "GET /bar/:baz")
+      route_handler2 = -> {}
+      route_handler2.instance_variable_set(:@route_name, "GET /foo/:bar")
+      routes = {
+        "GET" => [
+          # /bar/:baz
+          [/\A\/bar\/([^\/?#]+)\z/, ["baz"], [], route_handler1],
+          # /foo/:bar
+          [/\A\/foo\/([^\/?#]+)\z/, ["bar"], [], route_handler2]
+        ]
+      }
+      expect(authorizator.class).to receive(:routes).and_return(routes)
+
+      expect(authorizator.class.action(:get, "/foo/baz")).to eq("GET /foo/:bar".to_sym)
+    end
+
+    it "returns Sinatra's POST method route name" do
+      route_handler1 = -> {}
+      route_handler1.instance_variable_set(:@route_name, "POST /bar/:baz")
+      route_handler2 = -> {}
+      route_handler2.instance_variable_set(:@route_name, "POST /foo/:bar")
+      routes = {
+        "POST" => [
+          # /bar/:baz
+          [/\A\/bar\/([^\/?#]+)\z/, ["baz"], [], route_handler1],
+          # /foo/:bar
+          [/\A\/foo\/([^\/?#]+)\z/, ["bar"], [], route_handler2]
+        ]
+      }
+      expect(authorizator.class).to receive(:routes).and_return(routes)
+
+      expect(authorizator.class.action(:post, "/foo/baz")).to eq("POST /foo/:bar".to_sym)
+    end
+  end
+
+end

data/spec/authorize_action_spec.rb

@@ -0,0 +1,77 @@
+require "spec_helper"
+
+describe AuthorizeAction do
+  let(:authorizator) { Class.new { include AuthorizeAction }.new }
+
+  context "#authorize_action!" do
+    it "forbids action when authorization rules are not defined" do
+      allow(authorizator).to receive(:current_action_name).and_return(:action)
+      expect(authorizator).to receive(:forbid_action!)
+
+      authorizator.class.authorization_rules = nil
+      authorizator.authorize_action!
+    end
+
+    it "forbids action when authorization rules are empty" do
+      allow(authorizator).to receive(:current_action_name).and_return(:action)
+      expect(authorizator).to receive(:forbid_action!)
+
+      authorizator.class.authorization_rules = {}
+      authorizator.authorize_action!
+    end
+
+    it "forbids action when authorization rule is not defined for current action" do
+      allow(authorizator).to receive(:current_action_name).and_return(:action)
+      expect(authorizator).to receive(:forbid_action!)
+
+      authorizator.class.authorization_rules = {other_action: -> { false }}
+      authorizator.authorize_action!
+    end
+
+    it "forbids action when authorization rule returns false" do
+      allow(authorizator).to receive(:current_action_name).and_return(:action)
+      expect(authorizator).to receive(:forbid_action!)
+
+      authorizator.class.authorization_rules = {action: -> { false }}
+      authorizator.authorize_action!
+    end
+
+    it "allows action when authorization rule returns true" do
+      allow(authorizator).to receive(:current_action_name).and_return(:action)
+      expect(authorizator).to_not receive(:forbid_action!)
+
+      authorizator.class.authorization_rules = {action: -> { true }}
+      authorizator.authorize_action!
+    end
+
+    it "allows action when authorization rule returns truthy value" do
+      allow(authorizator).to receive(:current_action_name).and_return(:action)
+      expect(authorizator).to_not receive(:forbid_action!)
+
+      authorizator.class.authorization_rules = {action: -> { "truthy" }}
+      authorizator.authorize_action!
+    end
+
+    it "executes instance method if authorization rule is defined as Symbol" do
+      allow(authorizator).to receive(:current_action_name).and_return(:action)
+      expect(authorizator).to receive(:admin?).and_return(true)
+      expect(authorizator).to_not receive(:forbid_action!)
+
+      authorizator.class.authorization_rules = {action: :admin?}
+      authorizator.authorize_action!
+    end
+  end
+
+  it "#authorization_rules are not defined by default" do
+    expect(authorizator.class.authorization_rules).to be_nil
+  end
+
+  it "#forbid_action! is not implemented by default" do
+    expect { authorizator.send(:forbid_action!) }.to raise_error(NotImplementedError)
+  end
+
+  it "#current_action_name is not implemented by default" do
+    expect { authorizator.send(:current_action_name) }.to raise_error(NotImplementedError)
+  end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,12 @@
+require "simplecov"
+require "coveralls"
+
+SimpleCov.formatter = Coveralls::SimpleCov::Formatter
+SimpleCov.start 
+
+require File.expand_path("../lib/authorize_action", __dir__)
+
+RSpec.configure do |config|
+  config.order = :random
+  config.color = true
+end

metadata

@@ -0,0 +1,106 @@
+--- !ruby/object:Gem::Specification
+name: authorize_action
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Jarmo Pertman
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-07-05 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.1.0
+description: 
+email:
+- jarmo.p@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".travis.yml"
+- CHANGES.md
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- authorize_action.gemspec
+- lib/authorize_action.rb
+- lib/authorize_action/rails.rb
+- lib/authorize_action/sinatra.rb
+- spec/authorize_action/rails_spec.rb
+- spec/authorize_action/sinatra_spec.rb
+- spec/authorize_action_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/jarmo/authorize_action
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.5
+signing_key: 
+specification_version: 4
+summary: Really secure and simple authorization library for your Rails, Sinatra or
+  whatever web framework, which doesn't suck.
+test_files:
+- spec/authorize_action/rails_spec.rb
+- spec/authorize_action/sinatra_spec.rb
+- spec/authorize_action_spec.rb
+- spec/spec_helper.rb