banken 1.0.2 → 1.1.0

data/lib/banken/authorization.rb

@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module Banken
+  # The controller mixin. Include this module, not `Banken` itself:
+  #
+  #   class ApplicationController < ActionController::Base
+  #     include Banken::Authorization
+  #   end
+  #
+  # `include Banken` keeps working, but it also makes every constant under the
+  # Banken namespace (Error, VERSION, LoyaltyFinder, Railtie, ...) resolvable
+  # inside the controller, shadowing application constants of the same name.
+  module Authorization
+    extend ActiveSupport::Concern
+
+    included do
+      if respond_to?(:helper_method)
+        helper_method :loyalty
+        helper_method :banken_user
+      end
+    end
+
+    # Rails treats every public instance method of a non-abstract controller
+    # as a routable action. Keep Banken's helpers out of that set, so a
+    # wildcard route such as `get "posts/:action"` cannot dispatch to
+    # `skip_authorization` or `verify_authorized`.
+    class_methods do
+      def action_methods
+        @_banken_action_methods ||= super - Banken::Authorization::HIDDEN_ACTIONS
+      end
+
+      def clear_action_methods!
+        @_banken_action_methods = nil
+        super
+      end
+    end
+
+    def authorize!(record=nil)
+      @_banken_authorization_performed = true
+
+      loyalty = loyalty(record)
+      query   = banken_query_name
+
+      unless banken_query(loyalty, query)
+        raise Banken::NotAuthorizedError.new(controller: banken_controller_name, query: query, loyalty: loyalty)
+      end
+
+      true
+    end
+
+    def permitted_attributes(record)
+      attributes = banken_params_for(record)
+      unless attributes.respond_to?(:permit)
+        # A scalar or an array where a hash of attributes was expected.
+        raise ActionController::ParameterMissing, banken_param_key(record)
+      end
+      attributes.permit(loyalty(record).permitted_attributes)
+    end
+
+    def loyalty(record=nil, controller_name=nil)
+      controller_name = banken_controller_name unless controller_name
+      banken_loyalty_class(controller_name).new(banken_user, record)
+    end
+
+    def banken_user
+      current_user
+    end
+
+    def skip_authorization
+      @_banken_authorization_performed = true
+    end
+
+    def verify_authorized
+      return if banken_authorization_performed?
+
+      where = [self.class.name, banken_action_name.presence].compact.join("#")
+      raise Banken::AuthorizationNotPerformedError, "#{where} did not call authorize! or skip_authorization"
+    end
+
+    def banken_authorization_performed?
+      !!@_banken_authorization_performed
+    end
+
+    # @deprecated Use banken_authorization_performed? instead.
+    def banken_loyalty_authorized?
+      Banken.deprecator.warn('banken_loyalty_authorized? is deprecated, use banken_authorization_performed? instead.')
+      banken_authorization_performed?
+    end
+
+    # The public helpers above, by name. Computed here so that it always
+    # matches what the module actually defines.
+    HIDDEN_ACTIONS = public_instance_methods(false).map(&:to_s).sort.freeze
+
+    private
+
+      # Rails sets action_name and controller_path on every controller and, unlike
+      # params[:controller] / params[:action], they cannot be supplied by the
+      # request. On a Rails controller only those are consulted: for routes that
+      # target an endpoint directly (`get "/x" => PostsController.action(:destroy)`,
+      # `mount`) and for anonymous controllers the path parameters carry no
+      # controller or action, and reading params there would let the query
+      # string choose the loyalty. params are the source only for hosts that do
+      # not provide action_name / controller_path at all (plain Ruby objects).
+      def banken_action_name
+        if respond_to?(:action_name)
+          action_name.presence
+        else
+          params[:action]
+        end
+      end
+
+      def banken_controller_name
+        if respond_to?(:controller_path)
+          controller_path.presence || raise(Banken::NotDefinedError, "#{self.class} has no controller_path (anonymous controller?); pass the controller name to loyalty explicitly")
+        else
+          params[:controller]
+        end
+      end
+
+      # Calls the query on the loyalty. A query must be defined by the loyalty
+      # itself (or a module/superclass of it below Object): ActiveSupport
+      # defines `present?` and `duplicable?` on every object and both return
+      # true, so an action named `present` would otherwise authorize everyone.
+      # Queries answered through method_missing keep working. A missing or
+      # private query raises QueryNotDefinedError instead of NoMethodError.
+      def banken_query(loyalty, query)
+        owner = banken_query_owner(loyalty, query)
+        if owner && Object <= owner
+          raise Banken::QueryNotDefinedError, "#{loyalty.class}##{query} is not defined by the loyalty (inherited from #{owner})"
+        end
+
+        loyalty.public_send(query)
+      rescue NoMethodError => e
+        # Only the NoMethodError for this very query on this very loyalty is
+        # converted; anything raised inside the query body propagates unchanged.
+        raise unless e.name.to_s == query.to_s && banken_error_receiver(e).equal?(loyalty)
+
+        if loyalty.respond_to?(query, true)
+          raise Banken::QueryNotDefinedError, "#{loyalty.class}##{query} is private; queries must be public methods"
+        end
+        raise Banken::QueryNotDefinedError, "#{loyalty.class}##{query} is not defined"
+      end
+
+      # The module that defines the query, or nil when it is not a statically
+      # defined method (method_missing, or a loyalty overriding respond_to?).
+      # Kernel#method is called unbound so a loyalty defining its own `method`
+      # cannot interfere.
+      def banken_query_owner(loyalty, query)
+        ::Kernel.instance_method(:method).bind_call(loyalty, query).owner
+      rescue NameError, TypeError
+        nil
+      end
+
+      # NameError#receiver raises ArgumentError for errors built without one.
+      def banken_error_receiver(error)
+        error.receiver
+      rescue ArgumentError
+        nil
+      end
+
+      # Resolving a loyalty class means camelizing and constantizing the controller
+      # name (a few microseconds, more for namespaced names); a view may do that
+      # dozens of times per request. Memoize the class per controller instance (i.e. per request), so
+      # code reloading in development still sees new classes on the next request.
+      # Only the class is memoized, never the instance: a loyalty is built fresh
+      # for every record and for the current banken_user.
+      def banken_loyalty_class(controller_name)
+        @_banken_loyalty_classes ||= {}
+        @_banken_loyalty_classes[controller_name.to_s] ||= Banken::LoyaltyFinder.new(controller_name).loyalty!
+      end
+
+      # The parameters that hold the attributes of `record`, before filtering.
+      # Override (keep it private) to read them from somewhere else; return an
+      # ActionController::Parameters.
+      def banken_params_for(record)
+        params.require(banken_param_key(record))
+      end
+
+      # The params key for `record`, which may be an instance, a class or a
+      # Symbol: Post / Post.new -> "post", Admin::Post -> "post", :post -> "post".
+      # Override (keep it private) to use e.g. `record.model_name.param_key`
+      # ("admin_post").
+      def banken_param_key(record)
+        return record.to_s if record.is_a?(Symbol)
+        raise ArgumentError, "cannot infer a params key for nil; pass a record, a class or a Symbol" if record.nil?
+
+        klass = record.is_a?(Class) ? record : record.class
+        name  = klass.name || raise(ArgumentError, "cannot infer a params key for an anonymous class")
+        name.demodulize.underscore
+      end
+
+      def banken_query_name
+        action = banken_action_name
+        if action.blank?
+          raise Banken::Error, "unable to infer the query: no action name is available (authorize! must run inside a controller action)"
+        end
+        "#{action}?"
+      end
+  end
+end

data/lib/banken/deprecator.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "active_support/deprecation"
+
+module Banken
+  # Banken's own deprecator. When banken is loaded after Rails (the normal
+  # Bundler.require order), Banken::Railtie registers it with
+  # `Rails.application.deprecators`, so the application's
+  # `config.active_support.deprecation` setting applies to Banken's warnings.
+  # Outside Rails, or when banken is required after Rails has initialized, it
+  # falls back to ActiveSupport's default behaviour (stderr); such apps can
+  # register it themselves: `Rails.application.deprecators[:banken] = Banken.deprecator`.
+  #
+  # Assigned eagerly rather than memoized so there is exactly one instance
+  # regardless of thread timing.
+  @deprecator = ActiveSupport::Deprecation.new("2.0", "Banken")
+
+  class << self
+    attr_reader :deprecator
+  end
+end

data/lib/banken/error.rb

@@ -1,26 +1,50 @@
+# frozen_string_literal: true
+
 module Banken
   class Error < StandardError; end
 
   class NotAuthorizedError < Error
     attr_reader :controller, :query, :loyalty
 
+    # Accepts either a message (`raise Banken::NotAuthorizedError, "must be
+    # logged in"`) or an options hash with :controller, :query, :loyalty and
+    # an optional :message.
     def initialize(options={})
-      if options.is_a? String
-        message = options
-      else
+      if options.is_a?(Hash)
         @controller = options[:controller]
         @query      = options[:query]
         @loyalty    = options[:loyalty]
 
-        message = options.fetch(:message) { "not allowed to #{query} of #{controller} by #{loyalty.inspect}" }
+        message = options.fetch(:message) { default_message }
+      else
+        message = options
       end
 
       super(message)
     end
+
+    private
+
+      # Names only the loyalty class, the query and the controller. Never
+      # inspects the loyalty: its user and record would end up in logs, error
+      # trackers and any flash built from the message.
+      def default_message
+        action = loyalty ? "#{loyalty.class}##{query}" : query.to_s
+        parts  = ["not allowed to", action, controller && "on #{controller}"]
+        parts.reject { |part| part.nil? || part.empty? }.join(" ")
+      end
   end
 
+  # The loyalty class (or the controller name needed to find it) is missing.
   class NotDefinedError < Error; end
+
+  # The loyalty exists but does not define the query (or inherits it from
+  # Object, or keeps it private). A subclass of NotDefinedError so existing
+  # rescues keep working while the two cases stay distinguishable.
+  class QueryNotDefinedError < NotDefinedError; end
+
   class AuthorizationNotPerformedError < Error; end
 
+  # Unused: Banken has no scope feature. Kept for compatibility, removed in 2.0.
   class LoyaltyScopingNotPerformedError < AuthorizationNotPerformedError; end
 end

data/lib/banken/loyalty_finder.rb

@@ -1,28 +1,46 @@
+# frozen_string_literal: true
+
 module Banken
   class LoyaltyFinder
     SUFFIX = "Loyalty"
 
-    attr_reader :controller
+    attr_reader :controller_name
 
-    def initialize(controller)
-      @controller = controller.to_s
+    def initialize(controller_name)
+      @controller_name = controller_name.to_s
     end
 
+    # Returns the loyalty class, or nil when no such constant exists (or when
+    # no controller name was given: an empty name must not resolve a
+    # top-level `Loyalty` constant).
+    #
+    # `safe_constantize` only swallows NameErrors whose name matches a segment
+    # of the loyalty name (or that carry no name at all); this includes
+    # Zeitwerk's "expected file to define constant" error. Any other error
+    # raised while the loyalty file loads, such as a NoMethodError from a typo
+    # in the class body, propagates so the real bug is visible.
     def loyalty
-      loyalty_name.constantize
-    rescue NameError
-      nil
+      return nil if controller_name.empty?
+
+      loyalty_name.safe_constantize
     end
 
     def loyalty!
-      raise NotDefinedError, "unable to find loyalty of nil" unless controller
-      loyalty || raise(NotDefinedError, "unable to find loyalty `#{loyalty_name}` for `#{controller}`")
+      loyalty || raise(NotDefinedError, not_defined_message)
     end
 
     private
 
       def loyalty_name
-        "#{controller.camelize}#{SUFFIX}"
+        "#{controller_name.camelize}#{SUFFIX}"
+      end
+
+      def not_defined_message
+        if controller_name.empty?
+          "unable to find a loyalty: no controller name was given"
+        else
+          "unable to find loyalty `#{loyalty_name}` for `#{controller_name}` (expected app/loyalties/#{controller_name}_loyalty.rb to define it)"
+        end
       end
   end
 end

data/lib/banken/railtie.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Banken
+  class Railtie < ::Rails::Railtie
+    initializer "banken.deprecator" do |app|
+      app.deprecators[:banken] = Banken.deprecator
+    end
+  end
+end

data/lib/banken/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Banken
-  VERSION = "1.0.2"
+  VERSION = "1.1.0"
 end

data/lib/banken.rb

@@ -1,27 +1,24 @@
+# frozen_string_literal: true
+
 require "active_support/concern"
 require "active_support/core_ext/string/inflections"
 require "active_support/core_ext/object/blank"
-require "active_support/core_ext/module/introspection"
 require "banken/version"
 require "banken/error"
 require "banken/loyalty_finder"
-
+require "banken/deprecator"
+require "banken/authorization"
+require "banken/railtie" if defined?(::Rails::Railtie)
+
+# Banken's controller helpers live in Banken::Authorization; include that
+# module in your controllers. Including `Banken` itself still works for
+# compatibility: it includes Banken::Authorization, but also brings every
+# constant under this namespace into the controller's constant lookup.
 module Banken
   extend ActiveSupport::Concern
 
   included do
-    if respond_to?(:helper_method)
-      helper_method :loyalty
-      helper_method :banken_user
-    end
-
-    if respond_to?(:hide_action)
-      hide_action :permitted_attributes
-      hide_action :loyalty
-      hide_action :banken_user
-      hide_action :skip_authorization
-      hide_action :verify_authorized
-    end
+    include Banken::Authorization
   end
 
   class << self
@@ -29,55 +26,4 @@ module Banken
       LoyaltyFinder.new(controller_name).loyalty!.new(user, record)
     end
   end
-
-  def authorize!(record=nil)
-    @_banken_loyalty_authorized = true
-
-    loyalty = loyalty(record)
-    unless loyalty.public_send(banken_query_name)
-      raise NotAuthorizedError.new(controller: banken_controller_name, query: banken_query_name, loyalty: loyalty)
-    end
-
-    true
-  end
-
-  def permitted_attributes(record)
-    name = record.class.to_s.demodulize.underscore
-    params.require(name).permit(loyalty(record).permitted_attributes)
-  end
-
-  def loyalty(record=nil, controller_name=nil)
-    controller_name = banken_controller_name unless controller_name
-    Banken.loyalty!(controller_name, banken_user, record)
-  end
-
-  def banken_user
-    current_user
-  end
-
-  def skip_authorization
-    @_banken_loyalty_authorized = true
-  end
-
-  def verify_authorized
-    raise AuthorizationNotPerformedError unless banken_loyalty_authorized?
-  end
-
-  def banken_loyalty_authorized?
-    !!@_banken_loyalty_authorized
-  end
-
-  private
-
-    def banken_action_name
-      params[:action]
-    end
-
-    def banken_controller_name
-      params[:controller]
-    end
-
-    def banken_query_name
-      "#{banken_action_name}?"
-    end
 end

data/lib/generators/banken/install/install_generator.rb

@@ -1,10 +1,12 @@
+# frozen_string_literal: true
+
 module Banken
   module Generators
     class InstallGenerator < ::Rails::Generators::Base
       source_root File.expand_path(File.join(File.dirname(__FILE__), 'templates'))
 
       def copy_application_loyalty
-        template 'application_loyalty.rb', 'app/loyalties/application_loyalty.rb'
+        template 'application_loyalty.rb.tt', 'app/loyalties/application_loyalty.rb'
       end
     end
   end

data/lib/generators/banken/loyalty/loyalty_generator.rb

@@ -1,13 +1,13 @@
+# frozen_string_literal: true
+
 module Banken
   module Generators
     class LoyaltyGenerator < ::Rails::Generators::NamedBase
       source_root File.expand_path(File.join(File.dirname(__FILE__), 'templates'))
 
       def create_loyalty
-        template 'loyalty.rb', File.join('app/loyalties', class_path, "#{file_name}_loyalty.rb")
+        template 'loyalty.rb.tt', File.join('app/loyalties', class_path, "#{file_name}_loyalty.rb")
       end
-
-      hook_for :test_framework
     end
   end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: banken
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - kyuden
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,84 +15,70 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '7.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '7.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '7.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '7.1'
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '7.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '7.1'
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '5.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -130,30 +115,31 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".rspec"
-- ".travis.yml"
-- CODE_OF_CONDUCT.md
-- Gemfile
+- CHANGELOG.md
 - LICENSE.txt
 - README.md
-- Rakefile
-- banken.gemspec
+- SECURITY.md
 - lib/banken.rb
+- lib/banken/authorization.rb
+- lib/banken/deprecator.rb
 - lib/banken/error.rb
 - lib/banken/loyalty_finder.rb
+- lib/banken/railtie.rb
 - lib/banken/version.rb
 - lib/generators/banken/install/USAGE
 - lib/generators/banken/install/install_generator.rb
-- lib/generators/banken/install/templates/application_loyalty.rb
+- lib/generators/banken/install/templates/application_loyalty.rb.tt
 - lib/generators/banken/loyalty/USAGE
 - lib/generators/banken/loyalty/loyalty_generator.rb
-- lib/generators/banken/loyalty/templates/loyalty.rb
+- lib/generators/banken/loyalty/templates/loyalty.rb.tt
 homepage: https://github.com/kyuden/banken
 licenses:
 - MIT
-metadata: {}
-post_install_message: 
+metadata:
+  source_code_uri: https://github.com/kyuden/banken
+  changelog_uri: https://github.com/kyuden/banken/blob/v1.1.0/CHANGELOG.md
+  bug_tracker_uri: https://github.com/kyuden/banken/issues
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -161,17 +147,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.4.5.1
-signing_key: 
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Simple and lightweight authorization solution for Rails.
 test_files: []
-has_rdoc: 

data/.gitignore

@@ -1,9 +0,0 @@
-/.bundle/
-/.yardoc
-/Gemfile.lock
-/_yardoc/
-/coverage/
-/doc/
-/pkg/
-/spec/reports/
-/tmp/

data/.rspec

@@ -1,2 +0,0 @@
---color
---order rand

data/.travis.yml

@@ -1,8 +0,0 @@
-language: ruby
-sudo: false
-script: "bundle exec rake"
-rvm:
-  - 2.0.0
-  - 2.1.5
-  - 2.2.3
-  - rbx-2