authorizy 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1bdbf8fe26ec2fa456858b922f21efa63830f329018f07d6c2bed196d7e5cd8a
-  data.tar.gz: 49ad3862405c7707a3ab83c458e8c950d4fcf8b3e6488d7edc6fa6416e912cd9
+  metadata.gz: d5aa4cb2402214093d2887dcd0760f1087586e28d558c52bfcb4999ff18f72cc
+  data.tar.gz: e189e2a283e745c6cb37ddab2683b362d86a4355d776866f031d4cc2c2913079
 SHA512:
-  metadata.gz: 88568952618d7984a5ec9b548a74adaa64a263d4bfecdae71ec5e28225df8a5a93d5febf6aedb5a27a87f22ced4c066da8b330a5e8c96bc77abc7cea71cbde20
-  data.tar.gz: 2be439b99e310b42fca0122ba1a2c7bdf79d932a38be47e09722f6308763f73f25f76ad3481874ac0f7bd3b3e6ea7f33728c1605d372aba71a15c6de8143ffc7
+  metadata.gz: bc846ae164fabea516698ef5ddfaec65618a30f2949ec59cc8d93a7b380f240a1a1e25afd53ea6cdfb4f0db7b43cb5a1b26fdd8f87220ef47f9de0d8064b4508
+  data.tar.gz: 24e3e907dc28f062932bcc41387f5075ca3865b3406dc80cef0da09439c9db47a52d9c1b3d6ef1871138292f888e43608711e0fc3167a02da5e0d439fcc83091

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+# v0.4.0
+
+## Fixes
+
+- Returns `403` status code, to represent recognized but not authorized, instead `401`;
+
+## Features
+
+- Added `denied` callback allowing a custom acess denied treatment;
+
 # v0.3.0
 
 ## Features

data/README.md

@@ -8,10 +8,6 @@
 
 A JSON based Authorization.
 
-##### Why not [cancancan](https://github.com/CanCanCommunity/cancancan)?
-
-I have been working with cancan/cancancan for years. Since the beginning with [database access](https://github.com/CanCanCommunity/cancancan/blob/develop/docs/Abilities-in-Database.md). After a while, I realised I built a couple of abstractions around `ability` class and suddenly migrated to JSON for better performance. As I need a full role admin I decided to start to extract this logic to a gem.
-
 ## Install
 
 Add the following code on your `Gemfile` and run `bundle install`:
@@ -142,6 +138,14 @@ Authorizy.configure do |config|
 end
 ```
 
+### Denied
+
+When some access is denied, by default, Authorizy checks if it is a XHR request or not and then redirect or serializes a message with status code `403`. You can rescue it by yourself:
+
+```ruby
+config.denied = ->(context) { context.redirect_to(subscription_path, info: 'Subscription expired!') }
+```
+
 ### Dependencies
 
 You can allow access to one or more controllers and actions based on your permissions. It'll consider not only the `action`, like [aliases](#aliases) but the controller either.

data/lib/authorizy/config.rb

@@ -2,12 +2,21 @@
 
 module Authorizy
   class Config
-    attr_accessor :aliases, :cop, :current_user, :dependencies, :field, :redirect_url
+    attr_accessor :aliases, :cop, :current_user, :denied, :dependencies, :field, :redirect_url
 
     def initialize
       @aliases      = {}
       @cop          = Authorizy::BaseCop
       @current_user = ->(context) { context.respond_to?(:current_user) ? context.current_user : nil }
+
+      @denied = lambda { |context|
+        info = I18n.t('authorizy.denied', controller: context.params[:controller], action: context.params[:action])
+
+        return context.render(json: { message: info }, status: 403) if context.request.xhr?
+
+        context.redirect_to(redirect_url.call(self), info: info)
+      }
+
       @dependencies = {}
       @field        = ->(current_user) { current_user.respond_to?(:authorizy) ? current_user.authorizy : {} }
       @redirect_url = ->(context) { context.respond_to?(:root_url) ? context.root_url : '/' }

data/lib/authorizy/extension.rb

@@ -10,11 +10,7 @@ module Authorizy
       def authorizy
         return if Authorizy::Core.new(authorizy_user, params, session, cop: authorizy_cop).access?
 
-        info = I18n.t('authorizy.denied', controller: params[:controller], action: params[:action])
-
-        return render(json: { message: info }, status: 401) if request.xhr?
-
-        redirect_to Authorizy.config.redirect_url.call(self), info: info
+        Authorizy.config.denied.call(self)
       end
 
       def authorizy?(controller, action)

data/lib/authorizy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Authorizy
-  VERSION = '0.3.0'
+  VERSION = '0.4.0'
 end

data/lib/generators/authorizy/templates/config/initializers/authorizy.rb

@@ -9,14 +9,28 @@ Authorizy.configure do |config|
   # https://github.com/wbotelhos/authorizy#cop
   # config.cop = Authorizy::BaseCop
 
-  # The current user from we fetch the permissions
+  # The current user from where we fetch the permissions
   # https://github.com/wbotelhos/authorizy#current-user
   # config.current_user = -> (context) { context.respond_to?(:current_user) ? context.current_user : nil }
 
+  # Callback called when access is denied
+  # https://github.com/wbotelhos/authorizy#denied
+  # config.denied = lambda { |context|
+  #   info = I18n.t('authorizy.denied', controller: context.params[:controller], action: context.params[:action])
+
+  #   return context.render(json: { message: info }, status: 403) if context.request.xhr?
+
+  #   context.redirect_to(redirect_url.call(self), info: info)
+  # }
+
   # Inherited permissions from some other permission the user already has
   # https://github.com/wbotelhos/authorizy#dependencies
   # config.dependencies = {}
 
+  # Field used to fetch the Authorizy permissions
+  # https://github.com/wbotelhos/authorizy#field
+  # config.field = ->(current_user) { current_user.respond_to?(:authorizy) ? current_user.authorizy : {} }
+
   # URL to be redirect when user has no permission to access some resource
   # https://github.com/wbotelhos/authorizy#dependencies
   # config.redirect_url = -> (context) { context.respond_to?(:root_url) ? context.root_url : '/' }

data/spec/authorizy/config/denied_spec.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+RSpec.describe Authorizy::Config, '#denied' do
+  let!(:config) { described_class.new }
+
+  context 'with default denied callback' do
+    context 'when is a xhr request' do
+      let!(:context) do
+        double('context',
+          params: { controller: 'users', action: 'index' },
+          request: OpenStruct.new(xhr?: true)
+        )
+      end
+
+      it 'renders' do
+        allow(context).to receive(:render)
+
+        config.denied.call(context)
+
+        expect(context).to have_received(:render).with(json: { message: 'Action denied for users#index' }, status: 403)
+      end
+    end
+
+    context 'when is not a xhr request' do
+      let!(:context) do
+        double('context',
+          params: { controller: 'users', action: 'index' },
+          request: OpenStruct.new(xhr?: false)
+        )
+      end
+
+      it 'renders' do
+        allow(context).to receive(:redirect_to)
+
+        config.denied.call(context)
+
+        expect(context).to have_received(:redirect_to).with('/', info: 'Action denied for users#index')
+      end
+    end
+  end
+
+  context 'with custom denied callback' do
+    it 'calls the callback' do
+      config.denied = ->(context) { context[:key] }
+
+      expect(config.denied.call(key: :value)).to eq(:value)
+    end
+  end
+end

data/spec/authorizy/config/redirect_url_spec.rb

@@ -23,9 +23,9 @@ RSpec.describe Authorizy::Config, '#redirect_url' do
 
   context 'when uses custom value' do
     it 'executes what you want' do
-      config.redirect_url = ->(context) { context[:value] }
+      config.redirect_url = ->(context) { context[:key] }
 
-      expect(config.redirect_url.call({ value: 'value' })).to eq('value')
+      expect(config.redirect_url.call({ key: :value })).to eq(:value)
     end
   end
 end

data/spec/authorizy/extension/authorizy_spec.rb

@@ -3,18 +3,15 @@
 require 'support/controllers/dummy_controller'
 
 RSpec.describe DummyController, '#authorizy', type: :controller do
-  let!(:config) { Authorizy.config }
   let!(:parameters) { ActionController::Parameters.new(key: 'value', controller: 'dummy', action: 'action') }
   let!(:user) { nil }
 
-  before { allow(Authorizy).to receive(:config).and_return(config) }
-
   context 'when user has access' do
     let!(:authorizy_core) { instance_double('Authorizy::Core', access?: true) }
 
     before do
       allow(Authorizy::Core).to receive(:new)
-        .with(user, parameters, session, cop: config.cop)
+        .with(user, parameters, session, cop: Authorizy.config.cop)
         .and_return(authorizy_core)
     end
 
@@ -42,27 +39,16 @@ RSpec.describe DummyController, '#authorizy', type: :controller do
 
     before do
       allow(Authorizy::Core).to receive(:new)
-        .with(user, parameters, session, cop: config.cop)
+        .with(user, parameters, session, cop: Authorizy.config.cop)
         .and_return(authorizy_core)
     end
 
-    context 'when is a xhr request' do
-      it 'receives the default values and denied the access' do
-        get :action, xhr: true, params: { key: 'value' }
+    it 'calls denied callback' do
+      allow(Authorizy.config.denied).to receive(:call)
 
-        expect(response.body).to   eq('{"message":"Action denied for dummy#action"}')
-        expect(response.status).to be(401)
-      end
-    end
+      get :action, xhr: true, params: { key: 'value' }
 
-    context 'when is a html request' do
-      it 'receives the default values and do not denied the access' do
-        get :action, params: { key: 'value' }
-
-        expect(response).to redirect_to '/'
-
-        # expect(flash[:info]).to eq('Action denied for dummy#action') # TODO: get flash message
-      end
+      expect(Authorizy.config.denied).to have_received(:call).with(subject)
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authorizy
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Washington Botelho
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-09-07 00:00:00.000000000 Z
+date: 2021-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -163,6 +163,7 @@ files:
 - spec/authorizy/config/aliases_spec.rb
 - spec/authorizy/config/cop_spec.rb
 - spec/authorizy/config/current_user_spec.rb
+- spec/authorizy/config/denied_spec.rb
 - spec/authorizy/config/dependencies_spec.rb
 - spec/authorizy/config/field_spec.rb
 - spec/authorizy/config/initialize_spec.rb
@@ -217,6 +218,7 @@ test_files:
 - spec/authorizy/config/aliases_spec.rb
 - spec/authorizy/config/cop_spec.rb
 - spec/authorizy/config/current_user_spec.rb
+- spec/authorizy/config/denied_spec.rb
 - spec/authorizy/config/dependencies_spec.rb
 - spec/authorizy/config/field_spec.rb
 - spec/authorizy/config/initialize_spec.rb