cancan 1.3.4 → 1.4.1

data/lib/cancan/controller_additions.rb

@@ -12,14 +12,18 @@ module CanCan
       #   end
       #
       def load_and_authorize_resource(*args)
-        ControllerResource.add_before_filter(self, :load_and_authorize_resource, *args)
+        cancan_resource_class.add_before_filter(self, :load_and_authorize_resource, *args)
       end
 
       # Sets up a before filter which loads the model resource into an instance variable.
       # For example, given an ArticlesController it will load the current article into the @article
       # instance variable. It does this by either calling Article.find(params[:id]) or
-      # Article.new(params[:article]) depending upon the action. It does nothing for the "index"
-      # action.
+      # Article.new(params[:article]) depending upon the action. The index action will
+      # automatically set @articles to Article.accessible_by(current_ability).
+      #
+      # If a conditions hash is used in the Ability, the +new+ and +create+ actions will set
+      # the initial attributes based on these conditions. This way these actions will satisfy
+      # the ability restrictions.
       #
       # Call this method directly on the controller class.
       #
@@ -65,7 +69,14 @@ module CanCan
       #   Does not apply before filter to given actions.
       #
       # [:+through+]
-      #   Load this resource through another one. This should match the name of the parent instance variable.
+      #   Load this resource through another one. This should match the name of the parent instance variable or method.
+      #
+      # [:+through_association+]
+      #   The name of the association to fetch the child records through the parent resource. This is normally not needed
+      #   because it defaults to the pluralized resource name.
+      #
+      # [:+shallow+]
+      #   Pass +true+ to allow this resource to be loaded directly when parent is +nil+. Defaults to +false+.
       #
       # [:+singleton+]
       #   Pass +true+ if this is a singleton resource through a +has_one+ association.
@@ -99,7 +110,7 @@ module CanCan
       #     load_resource :new => :build
       #
       def load_resource(*args)
-        ControllerResource.add_before_filter(self, :load_resource, *args)
+        cancan_resource_class.add_before_filter(self, :load_resource, *args)
       end
 
       # Sets up a before filter which authorizes the resource using the instance variable.
@@ -148,8 +159,55 @@ module CanCan
       # [:+instance_name+]
       #   The name of the instance variable for this resource.
       #
+      # [:+through+]
+      #   Authorize conditions on this parent resource when instance isn't available.
+      #
       def authorize_resource(*args)
-        ControllerResource.add_before_filter(self, :authorize_resource, *args)
+        cancan_resource_class.add_before_filter(self, :authorize_resource, *args)
+      end
+
+      # Add this to a controller to ensure it performs authorization through +authorized+! or +authorize_resource+ call.
+      # If neither of these authorization methods are called, a CanCan::AuthorizationNotPerformed exception will be raised.
+      # This is normally added to the ApplicationController to ensure all controller actions do authorization.
+      #
+      #   class ApplicationController < ActionController::Base
+      #     check_authorization
+      #   end
+      #
+      # Any arguments are passed to the +after_filter+ it triggers.
+      #
+      # See skip_authorization_check to bypass this check on specific controller actions.
+      def check_authorization(*args)
+        self.after_filter(*args) do |controller|
+          unless controller.instance_variable_defined?(:@_authorized)
+            raise AuthorizationNotPerformed, "This action failed the check_authorization because it does not authorize_resource. Add skip_authorization_check to bypass this check."
+          end
+        end
+      end
+
+      # Call this in the class of a controller to skip the check_authorization behavior on the actions.
+      #
+      #   class HomeController < ApplicationController
+      #     skip_authorization_check :only => :index
+      #   end
+      #
+      # Any arguments are passed to the +before_filter+ it triggers.
+      def skip_authorization_check(*args)
+        self.before_filter(*args) do |controller|
+          controller.instance_variable_set(:@_authorized, true)
+        end
+      end
+
+      def skip_authorization(*args)
+        raise ImplementationRemoved, "The CanCan skip_authorization method has been renamed to skip_authorization_check. Please update your code."
+      end
+
+      def cancan_resource_class
+        if ancestors.map(&:to_s).include? "InheritedResources::Actions"
+          InheritedResource
+        else
+          ControllerResource
+        end
       end
     end
 
@@ -171,6 +229,16 @@ module CanCan
     #
     #   authorize! :read, @article, :message => "Not authorized to read #{@article.name}"
     #
+    # You can also use I18n to customize the message. Action aliases defined in Ability work here.
+    #
+    #   en:
+    #     unauthorized:
+    #       manage:
+    #         all: "Not authorized to %{action} %{subject}."
+    #         user: "Not allowed to manage other user accounts."
+    #       update:
+    #         project: "Not allowed to update this project."
+    #
     # You can rescue from the exception in the controller to customize how unauthorized
     # access is displayed to the user.
     #
@@ -185,12 +253,9 @@ module CanCan
     #
     # See the load_and_authorize_resource method to automatically add the authorize! behavior
     # to the default RESTful actions.
-    def authorize!(action, subject, *args)
-      message = nil
-      if args.last.kind_of?(Hash) && args.last.has_key?(:message)
-        message = args.pop[:message]
-      end
-      raise AccessDenied.new(message, action, subject) if cannot?(action, subject, *args)
+    def authorize!(*args)
+      @_authorized = true
+      current_ability.authorize!(*args)
     end
 
     def unauthorized!(message = nil)
@@ -223,6 +288,13 @@ module CanCan
     #     <%= link_to "New Project", new_project_path %>
     #   <% end %>
     #
+    # If it's a nested resource, you can pass the parent instance in a hash. This way it will
+    # check conditions which reach through that association.
+    #
+    #   <% if can? :create, @category => Project %>
+    #     <%= link_to "New Project", new_project_path %>
+    #   <% end %>
+    #
     # This simply calls "can?" on the current_ability. See Ability#can?.
     def can?(*args)
       current_ability.can?(*args)

data/lib/cancan/controller_resource.rb

@@ -6,7 +6,7 @@ module CanCan
       options = args.extract_options!
       resource_name = args.first
       controller_class.before_filter(options.slice(:only, :except)) do |controller|
-        ControllerResource.new(controller, resource_name, options.except(:only, :except)).send(method)
+        controller.class.cancan_resource_class.new(controller, resource_name, options.except(:only, :except)).send(method)
       end
     end
 
@@ -26,20 +26,22 @@ module CanCan
     end
 
     def load_resource
-      if !resource_instance && (parent? || member_action?)
-        @controller.instance_variable_set("@#{instance_name}", load_resource_instance)
+      if parent? || member_action?
+        self.resource_instance ||= load_resource_instance
+      elsif load_collection?
+        self.collection_instance ||= load_collection
       end
     end
 
     def authorize_resource
-      @controller.authorize!(authorization_action, resource_instance || resource_class)
+      @controller.authorize!(authorization_action, resource_instance || resource_class_with_parent)
     end
 
     def parent?
       @options.has_key?(:parent) ? @options[:parent] : @name && @name != name_from_controller.to_sym
     end
 
-    private
+    protected
 
     def load_resource_instance
       if !parent? && new_actions.include?(@params[:action].to_sym)
@@ -49,13 +51,34 @@ module CanCan
       end
     end
 
+    def load_collection?
+      resource_base.respond_to?(:accessible_by) &&
+      !current_ability.has_block?(authorization_action, resource_class)
+    end
+
+    def load_collection
+      resource_base.accessible_by(current_ability)
+    end
+
     def build_resource
-      method_name = @options[:singleton] ? "build_#{name}" : "new"
-      resource_base.send(*[method_name, @params[name]].compact)
+      if @options[:singleton] && resource_base.respond_to?("build_#{name}")
+        resource = resource_base.send("build_#{name}")
+      else
+        resource = resource_base.send("new")
+      end
+      initial_attributes.each do |name, value|
+        resource.send("#{name}=", value)
+      end
+      resource.attributes = @params[name] if @params[name]
+      resource
+    end
+
+    def initial_attributes
+      current_ability.attributes_for(@params[:action].to_sym, resource_class)
     end
 
     def find_resource
-      if @options[:singleton]
+      if @options[:singleton] && resource_base.respond_to?(name)
         resource_base.send(name)
       else
         @options[:find_by] ? resource_base.send("find_by_#{@options[:find_by]}!", id_param) : resource_base.find(id_param)
@@ -86,24 +109,59 @@ module CanCan
       end
     end
 
+    def resource_class_with_parent
+      parent_resource ? {parent_resource => resource_class} : resource_class
+    end
+
+    def resource_instance=(instance)
+      @controller.instance_variable_set("@#{instance_name}", instance)
+    end
+
     def resource_instance
       @controller.instance_variable_get("@#{instance_name}")
     end
 
+    def collection_instance=(instance)
+      @controller.instance_variable_set("@#{instance_name.to_s.pluralize}", instance)
+    end
+
+    def collection_instance
+      @controller.instance_variable_get("@#{instance_name.to_s.pluralize}")
+    end
+
     # The object that methods (such as "find", "new" or "build") are called on.
     # If the :through option is passed it will go through an association on that instance.
+    # If the :shallow option is passed it will use the resource_class if there's no parent
     # If the :singleton option is passed it won't use the association because it needs to be handled later.
     def resource_base
-      if through_resource
-        @options[:singleton] ? through_resource : through_resource.send(name.to_s.pluralize)
+      if @options[:through]
+        if parent_resource
+          @options[:singleton] ? parent_resource : parent_resource.send(@options[:through_association] || name.to_s.pluralize)
+        elsif @options[:shallow]
+          resource_class
+        else
+          raise AccessDenied # maybe this should be a record not found error instead?
+        end
       else
         resource_class
       end
     end
 
     # The object to load this resource through.
-    def through_resource
-      @options[:through] && [@options[:through]].flatten.map { |i| @controller.instance_variable_get("@#{i}") }.compact.first
+    def parent_resource
+      @options[:through] && [@options[:through]].flatten.map { |i| fetch_parent(i) }.compact.first
+    end
+
+    def fetch_parent(name)
+      if @controller.instance_variable_defined? "@#{name}"
+        @controller.instance_variable_get("@#{name}")
+      elsif @controller.respond_to? name
+        @controller.send(name)
+      end
+    end
+
+    def current_ability
+      @controller.send(:current_ability)
     end
 
     def name

data/lib/cancan/exceptions.rb

@@ -5,6 +5,9 @@ module CanCan
   # Raised when removed code is called, an alternative solution is provided in message.
   class ImplementationRemoved < Error; end
 
+  # Raised when using check_authorization without calling authorized!
+  class AuthorizationNotPerformed < Error; end
+
   # This error is raised when a user isn't allowed to access a given controller action.
   # This usually happens within a call to ControllerAdditions#authorize! but can be
   # raised manually.
@@ -24,7 +27,8 @@ module CanCan
   #   exception.default_message = "Default error message"
   #   exception.message # => "Default error message"
   #
-  # See ControllerAdditions#authorized! for more information on rescuing from this exception.
+  # See ControllerAdditions#authorized! for more information on rescuing from this exception
+  # and customizing the message using I18n.
   class AccessDenied < Error
     attr_reader :action, :subject
     attr_writer :default_message

data/lib/cancan/inherited_resource.rb

@@ -0,0 +1,18 @@
+module CanCan
+  # For use with Inherited Resources
+  class InheritedResource < ControllerResource # :nodoc:
+    def load_resource_instance
+      if parent?
+        @controller.send :parent
+      elsif new_actions.include? @params[:action].to_sym
+        @controller.send :build_resource
+      else
+        @controller.send :resource
+      end
+    end
+
+    def resource_base
+      @controller.send :end_of_association_chain
+    end
+  end
+end

data/lib/cancan.rb

@@ -5,3 +5,4 @@ require 'cancan/controller_additions'
 require 'cancan/active_record_additions'
 require 'cancan/exceptions'
 require 'cancan/query'
+require 'cancan/inherited_resource'

data/spec/cancan/ability_spec.rb

@@ -24,6 +24,14 @@ describe CanCan::Ability do
     @ability.can?(:read, :some_symbol).should == true
   end
 
+  it "should pass nil to a block when no instance is passed" do
+    @ability.can :read, Symbol do |sym|
+      sym.should be_nil
+      true
+    end
+    @ability.can?(:read, Symbol).should be_true
+  end
+
   it "should pass to previous can definition, if block returns false or nil" do
     @ability.can :read, Symbol
     @ability.can :read, Integer do |i|
@@ -38,9 +46,8 @@ describe CanCan::Ability do
     @ability.can?(:read, 6).should be_false
   end
 
-  it "should pass class with object if :all objects are accepted" do
-    @ability.can :preview, :all do |object_class, object|
-      object_class.should == Fixnum
+  it "should not pass class with object if :all objects are accepted" do
+    @ability.can :preview, :all do |object|
       object.should == 123
       @block_called = true
     end
@@ -48,23 +55,21 @@ describe CanCan::Ability do
     @block_called.should be_true
   end
 
-  it "should pass class with no object if :all objects are accepted and class is passed directly" do
-    @ability.can :preview, :all do |object_class, object|
-      object_class.should == Hash
-      object.should be_nil
+  it "should not call block when only class is passed, only return true" do
+    @block_called = false
+    @ability.can :preview, :all do |object|
       @block_called = true
     end
-    @ability.can?(:preview, Hash)
-    @block_called.should be_true
+    @ability.can?(:preview, Hash).should be_true
+    @block_called.should be_false
   end
 
-  it "should pass action and object for global manage actions" do
-    @ability.can :manage, Array do |action, object|
-      action.should == :stuff
-      object.should == [1, 2]
+  it "should pass only object for global manage actions" do
+    @ability.can :manage, String do |object|
+      object.should == "foo"
       @block_called = true
     end
-    @ability.can?(:stuff, [1, 2]).should
+    @ability.can?(:stuff, "foo").should
     @block_called.should be_true
   end
 
@@ -82,10 +87,10 @@ describe CanCan::Ability do
     @ability.can?(:increment, 123).should be_true
   end
 
-  it "should return block result for action, object_class, and object for any action" do
-    @ability.can :manage, :all do |action, object_class, object|
+  it "should always call block with arguments when passing no arguments to can" do
+    @ability.can do |action, object_class, object|
       action.should == :foo
-      object_class.should == Fixnum
+      object_class.should == 123.class
       object.should == 123
       @block_called = true
     end
@@ -93,6 +98,17 @@ describe CanCan::Ability do
     @block_called.should be_true
   end
 
+  it "should pass nil to object when comparing class with can check" do
+    @ability.can do |action, object_class, object|
+      action.should == :foo
+      object_class.should == Hash
+      object.should be_nil
+      @block_called = true
+    end
+    @ability.can?(:foo, Hash)
+    @block_called.should be_true
+  end
+
   it "should automatically alias index and show into read calls" do
     @ability.can :read, :all
     @ability.can?(:index, 123).should be_true
@@ -122,9 +138,9 @@ describe CanCan::Ability do
   end
 
   it "should be able to specify multiple classes and match any" do
-    @ability.can :update, [String, Array]
+    @ability.can :update, [String, Range]
     @ability.can?(:update, "foo").should be_true
-    @ability.can?(:update, []).should be_true
+    @ability.can?(:update, 1..3).should be_true
     @ability.can?(:update, 123).should be_false
   end
 
@@ -149,18 +165,7 @@ describe CanCan::Ability do
     @ability.can?(:read, 123).should be_false
   end
 
-  it "should support block on 'cannot' method" do
-    @ability.can :read, :all
-    @ability.cannot :read, Integer do |int|
-      int > 5
-    end
-    @ability.can?(:read, "foo").should be_true
-    @ability.can?(:read, 3).should be_true
-    @ability.can?(:read, 123).should be_false
-  end
-
   it "should pass to previous can definition, if block returns false or nil" do
-    #same as previous
     @ability.can :read, :all
     @ability.cannot :read, Integer do |int|
       int > 10 ? nil : ( int > 5 )
@@ -169,7 +174,6 @@ describe CanCan::Ability do
     @ability.can?(:read, 3).should be_true
     @ability.can?(:read, 8).should be_false
     @ability.can?(:read, 123).should be_true
-
   end
 
   it "should always return `false` for single cannot definition" do
@@ -214,49 +218,170 @@ describe CanCan::Ability do
   end
 
   it "should use conditions as third parameter and determine abilities from it" do
-    @ability.can :read, Array, :first => 1, :last => 3
-    @ability.can?(:read, [1, 2, 3]).should be_true
-    @ability.can?(:read, [1, 2, 3, 4]).should be_false
-    @ability.can?(:read, Array).should be_true
+    @ability.can :read, Range, :begin => 1, :end => 3
+    @ability.can?(:read, 1..3).should be_true
+    @ability.can?(:read, 1..4).should be_false
+    @ability.can?(:read, Range).should be_true
   end
 
   it "should allow an array of options in conditions hash" do
-    @ability.can :read, Array, :first => [1, 3, 5]
-    @ability.can?(:read, [1, 2, 3]).should be_true
-    @ability.can?(:read, [2, 3]).should be_false
-    @ability.can?(:read, [3, 4]).should be_true
+    @ability.can :read, Range, :begin => [1, 3, 5]
+    @ability.can?(:read, 1..3).should be_true
+    @ability.can?(:read, 2..4).should be_false
+    @ability.can?(:read, 3..5).should be_true
   end
 
   it "should allow a range of options in conditions hash" do
-    @ability.can :read, Array, :first => 1..3
-    @ability.can?(:read, [1, 2, 3]).should be_true
-    @ability.can?(:read, [3, 4]).should be_true
-    @ability.can?(:read, [4, 5]).should be_false
+    @ability.can :read, Range, :begin => 1..3
+    @ability.can?(:read, 1..10).should be_true
+    @ability.can?(:read, 3..30).should be_true
+    @ability.can?(:read, 4..40).should be_false
   end
 
   it "should allow nested hashes in conditions hash" do
-    @ability.can :read, Array, :first => { :length => 5 }
-    @ability.can?(:read, ["foo", "bar"]).should be_false
-    @ability.can?(:read, ["test1", "foo"]).should be_true
+    @ability.can :read, Range, :begin => { :to_i => 5 }
+    @ability.can?(:read, 5..7).should be_true
+    @ability.can?(:read, 6..8).should be_false
   end
 
-  it "should allow nested hash of arrays and match any element" do
-    @ability.can :read, Array, :first => { :to_i => 3 }
-    @ability.can?(:read, [[1, 2, 3]]).should be_true
-    @ability.can?(:read, [[4, 5, 6]]).should be_false
+  it "should match any element passed in to nesting if it's an array (for has_many associations)" do
+    @ability.can :read, Range, :to_a => { :to_i => 3 }
+    @ability.can?(:read, 1..5).should be_true
+    @ability.can?(:read, 4..6).should be_false
   end
 
   it "should not stop at cannot definition when comparing class" do
-    @ability.can :read, Array
-    @ability.cannot :read, Array, :first => 1
-    @ability.can?(:read, [2, 3, 5]).should be_true
-    @ability.can?(:read, [1, 3, 5]).should be_false
-    @ability.can?(:read, Array).should be_true
+    @ability.can :read, Range
+    @ability.cannot :read, Range, :begin => 1
+    @ability.can?(:read, 2..5).should be_true
+    @ability.can?(:read, 1..5).should be_false
+    @ability.can?(:read, Range).should be_true
+  end
+
+  it "should stop at cannot definition when no hash is present" do
+    @ability.can :read, :all
+    @ability.cannot :read, Range
+    @ability.can?(:read, 1..5).should be_false
+    @ability.can?(:read, Range).should be_false
   end
 
-  it "should has eated cheezburger" do
-    lambda {
-      @ability.can? :has, :cheezburger
-    }.should raise_error(CanCan::Error, "Nom nom nom. I eated it.")
+  it "should allow to check ability for Module" do
+    module B; end
+    class A; include B; end
+    @ability.can :read, B
+    @ability.can?(:read, A).should be_true
+    @ability.can?(:read, A.new).should be_true
+  end
+
+  it "should pass nil to a block for ability on Module when no instance is passed" do
+    module B; end
+    class A; include B; end
+    @ability.can :read, B do |sym|
+      sym.should be_nil
+      true
+    end
+    @ability.can?(:read, B).should be_true
+    @ability.can?(:read, A).should be_true
+  end
+
+  it "passing a hash of subjects should check permissions through association" do
+    @ability.can :read, Range, :string => {:length => 3}
+    @ability.can?(:read, "foo" => Range).should be_true
+    @ability.can?(:read, "foobar" => Range).should be_false
+    @ability.can?(:read, 123 => Range).should be_true
+  end
+
+  it "should have initial attributes based on hash conditions of 'new' action" do
+    @ability.can :manage, Range, :foo => "foo", :hash => {:skip => "hashes"}
+    @ability.can :create, Range, :bar => 123, :array => %w[skip arrays]
+    @ability.can :new, Range, :baz => "baz", :range => 1..3
+    @ability.cannot :new, Range, :ignore => "me"
+    @ability.attributes_for(:new, Range).should == {:foo => "foo", :bar => 123, :baz => "baz"}
+  end
+
+  it "should raise access denied exception if ability us unauthorized to perform a certain action" do
+    begin
+      @ability.authorize! :read, :foo, 1, 2, 3, :message => "Access denied!"
+    rescue CanCan::AccessDenied => e
+      e.message.should == "Access denied!"
+      e.action.should == :read
+      e.subject.should == :foo
+    else
+      fail "Expected CanCan::AccessDenied exception to be raised"
+    end
+  end
+
+  it "should not raise access denied exception if ability is authorized to perform an action" do
+    @ability.can :read, :foo
+    lambda { @ability.authorize!(:read, :foo) }.should_not raise_error
+  end
+
+  it "should know when block is used in conditions" do
+    @ability.can :read, :foo
+    @ability.should_not have_block(:read, :foo)
+    @ability.can :read, :foo do |foo|
+      false
+    end
+    @ability.should have_block(:read, :foo)
+  end
+
+  it "should know when raw sql is used in conditions" do
+    @ability.can :read, :foo
+    @ability.should_not have_raw_sql(:read, :foo)
+    @ability.can :read, :foo, 'false'
+    @ability.should have_raw_sql(:read, :foo)
+  end
+
+  it "should raise access denied exception with default message if not specified" do
+    begin
+      @ability.authorize! :read, :foo
+    rescue CanCan::AccessDenied => e
+      e.default_message = "Access denied!"
+      e.message.should == "Access denied!"
+    else
+      fail "Expected CanCan::AccessDenied exception to be raised"
+    end
+  end
+
+  describe "unauthorized message" do
+    after(:each) do
+      I18n.backend = nil
+    end
+
+    it "should use action/subject in i18n" do
+      I18n.backend.store_translations :en, :unauthorized => {:update => {:array => "foo"}}
+      @ability.unauthorized_message(:update, Array).should == "foo"
+      @ability.unauthorized_message(:update, [1, 2, 3]).should == "foo"
+      @ability.unauthorized_message(:update, :missing).should be_nil
+    end
+
+    it "should use symbol as subject directly" do
+      I18n.backend.store_translations :en, :unauthorized => {:has => {:cheezburger => "Nom nom nom. I eated it."}}
+      @ability.unauthorized_message(:has, :cheezburger).should == "Nom nom nom. I eated it."
+    end
+
+    it "should fall back to 'manage' and 'all'" do
+      I18n.backend.store_translations :en, :unauthorized => {
+        :manage => {:all => "manage all", :array => "manage array"},
+        :update => {:all => "update all", :array => "update array"}
+      }
+      @ability.unauthorized_message(:update, Array).should == "update array"
+      @ability.unauthorized_message(:update, Hash).should == "update all"
+      @ability.unauthorized_message(:foo, Array).should == "manage array"
+      @ability.unauthorized_message(:foo, Hash).should == "manage all"
+    end
+
+    it "should follow aliased actions" do
+      I18n.backend.store_translations :en, :unauthorized => {:modify => {:array => "modify array"}}
+      @ability.alias_action :update, :to => :modify
+      @ability.unauthorized_message(:update, Array).should == "modify array"
+      @ability.unauthorized_message(:edit, Array).should == "modify array"
+    end
+
+    it "should have variables for action and subject" do
+      I18n.backend.store_translations :en, :unauthorized => {:manage => {:all => "%{action} %{subject}"}} # old syntax for now in case testing with old I18n
+      @ability.unauthorized_message(:update, Array).should == "update array"
+      @ability.unauthorized_message(:edit, 1..3).should == "edit range"
+    end
   end
 end