cancan 1.4.1 → 1.5.0

data/lib/cancan/model_adapters/data_mapper_adapter.rb

@@ -0,0 +1,33 @@
+module CanCan
+  module ModelAdapters
+    class DataMapperAdapter < AbstractAdapter
+      def self.for_class?(model_class)
+        model_class <= DataMapper::Resource
+      end
+
+      def self.override_conditions_hash_matching?(subject, conditions)
+        conditions.any? { |k,v| !k.kind_of?(Symbol) }
+      end
+
+      def self.matches_conditions_hash?(subject, conditions)
+        subject.class.all(:conditions => conditions).include?(subject) # TODO don't use a database query here for performance and other instances
+      end
+
+      def database_records
+        scope = @model_class.all(:conditions => ["0=1"])
+        conditions.each do |condition|
+          scope += @model_class.all(:conditions => condition)
+        end
+        scope
+      end
+
+      def conditions
+        @rules.map(&:conditions)
+      end
+    end
+  end
+end
+
+DataMapper::Model.class_eval do
+  include CanCan::ModelAdditions::ClassMethods
+end

data/lib/cancan/model_adapters/default_adapter.rb

@@ -0,0 +1,7 @@
+module CanCan
+  module ModelAdapters
+    class DefaultAdapter < AbstractAdapter
+      # This adapter is used when no matching adapter is found
+    end
+  end
+end

data/lib/cancan/model_adapters/mongoid_adapter.rb

@@ -0,0 +1,41 @@
+module CanCan
+  module ModelAdapters
+    class MongoidAdapter < AbstractAdapter
+      def self.for_class?(model_class)
+        model_class <= Mongoid::Document
+      end
+
+      def self.override_conditions_hash_matching?(subject, conditions)
+        conditions.any? { |k,v| !k.kind_of?(Symbol) }
+      end
+
+      def self.matches_conditions_hash?(subject, conditions)
+        # To avoid hitting the db, retrieve the raw Mongo selector from
+        # the Mongoid Criteria and use Mongoid::Matchers#matches?
+        subject.matches?( subject.class.where(conditions).selector )
+      end
+
+      def database_records
+        @model_class.where(conditions)
+      end
+
+      def conditions
+        if @rules.size == 0
+          false_query
+        else
+          @rules.first.conditions
+        end
+      end
+
+      def false_query
+        # this query is sure to return no results
+        {:_id => {'$exists' => false, '$type' => 7}}  # type 7 is an ObjectID (default for _id)
+      end
+    end
+  end
+end
+
+# simplest way to add `accessible_by` to all Mongoid Documents
+module Mongoid::Document::ClassMethods
+  include CanCan::ModelAdditions::ClassMethods
+end

data/lib/cancan/{active_record_additions.rb → model_additions.rb}

@@ -1,6 +1,7 @@
 module CanCan
-  # This module is automatically included into all Active Record models.
-  module ActiveRecordAdditions
+
+  # This module adds the accessible_by class method to a model. It is included in the model adapters.
+  module ModelAdditions
     module ClassMethods
       # Returns a scope which fetches only the records that the passed ability
       # can perform a given action on. The action defaults to :read. This
@@ -17,15 +18,9 @@ module CanCan
       #
       #   @articles = Article.accessible_by(current_ability, :update)
       #
-      # Here only the articles which the user can update are returned. This
-      # internally uses Ability#conditions method, see that for more information.
+      # Here only the articles which the user can update are returned.
       def accessible_by(ability, action = :read)
-        query = ability.query(action, self)
-        if respond_to?(:where) && respond_to?(:joins)
-          where(query.conditions).joins(query.joins)
-        else
-          scoped(:conditions => query.conditions, :joins => query.joins)
-        end
+        ability.model_adapter(self, action).database_records
       end
     end
 
@@ -34,9 +29,3 @@ module CanCan
     end
   end
 end
-
-if defined? ActiveRecord
-  ActiveRecord::Base.class_eval do
-    include CanCan::ActiveRecordAdditions
-  end
-end

data/lib/cancan/{can_definition.rb → rule.rb}

@@ -2,8 +2,8 @@ module CanCan
   # This class is used internally and should only be called through Ability.
   # it holds the information about a "can" call made on Ability and provides
   # helpful methods to determine permission checking and conditions hash generation.
-  class CanDefinition # :nodoc:
-    attr_reader :base_behavior, :actions
+  class Rule # :nodoc:
+    attr_reader :base_behavior, :actions, :conditions
     attr_writer :expanded_actions
 
     # The first argument when initializing is the base_behavior which is a true/false
@@ -41,18 +41,6 @@ module CanCan
       end
     end
 
-    def tableized_conditions(conditions = @conditions)
-      return conditions unless conditions.kind_of? Hash
-      conditions.inject({}) do |result_hash, (name, value)|
-        if value.kind_of? Hash
-          name = name.to_s.tableize.to_sym
-          value = tableized_conditions(value)
-        end
-        result_hash[name] = value
-        result_hash
-      end
-    end
-
     def only_block?
       conditions_empty? && !@block.nil?
     end
@@ -100,19 +88,31 @@ module CanCan
       @subjects.any? { |sub| sub.kind_of?(Module) && (subject.kind_of?(sub) || subject.class.to_s == sub.to_s || subject.kind_of?(Module) && subject.ancestors.include?(sub)) }
     end
 
+    # Checks if the given subject matches the given conditions hash.
+    # This behavior can be overriden by a model adapter by defining two class methods:
+    # override_matching_for_conditions?(subject, conditions) and
+    # matches_conditions_hash?(subject, conditions)
     def matches_conditions_hash?(subject, conditions = @conditions)
-      conditions.all? do |name, value|
-        attribute = subject.send(name)
-        if value.kind_of?(Hash)
-          if attribute.kind_of? Array
-            attribute.any? { |element| matches_conditions_hash? element, value }
-          else
-            matches_conditions_hash? attribute, value
-          end
-        elsif value.kind_of?(Array) || value.kind_of?(Range)
-          value.include? attribute
+      if conditions.empty?
+        true
+      else
+        if model_adapter(subject).override_conditions_hash_matching? subject, conditions
+          model_adapter(subject).matches_conditions_hash? subject, conditions
         else
-          attribute == value
+          conditions.all? do |name, value|
+            attribute = subject.send(name)
+            if value.kind_of?(Hash)
+              if attribute.kind_of? Array
+                attribute.any? { |element| matches_conditions_hash? element, value }
+              else
+                matches_conditions_hash? attribute, value
+              end
+            elsif value.kind_of?(Array) || value.kind_of?(Range)
+              value.include? attribute
+            else
+              attribute == value
+            end
+          end
         end
       end
     end
@@ -129,5 +129,9 @@ module CanCan
         @block.call(action, subject.class, subject, *extra_args)
       end
     end
+
+    def model_adapter(subject)
+      ModelAdapters::AbstractAdapter.adapter_class(subject_class?(subject) ? subject : subject.class)
+    end
   end
 end

data/lib/cancan.rb

@@ -1,8 +1,13 @@
 require 'cancan/ability'
-require 'cancan/can_definition'
+require 'cancan/rule'
 require 'cancan/controller_resource'
 require 'cancan/controller_additions'
-require 'cancan/active_record_additions'
+require 'cancan/model_additions'
 require 'cancan/exceptions'
-require 'cancan/query'
 require 'cancan/inherited_resource'
+
+require 'cancan/model_adapters/abstract_adapter'
+require 'cancan/model_adapters/default_adapter'
+require 'cancan/model_adapters/active_record_adapter' if defined? ActiveRecord
+require 'cancan/model_adapters/data_mapper_adapter' if defined? DataMapper
+require 'cancan/model_adapters/mongoid_adapter' if defined? Mongoid

data/lib/generators/cancan/ability/USAGE

@@ -0,0 +1,4 @@
+Description:
+  The cancan:ability generator creates an Ability class in the models
+  directory. You can move this file anywhere you want as long as it
+  is in the load path.

data/lib/generators/cancan/ability/ability_generator.rb

@@ -0,0 +1,11 @@
+module Cancan
+  module Generators
+    class AbilityGenerator < Rails::Generators::Base
+      source_root File.expand_path('../templates', __FILE__)
+
+      def generate_ability
+        copy_file "ability.rb", "app/models/ability.rb"
+      end
+    end
+  end
+end

data/lib/generators/cancan/ability/templates/ability.rb

@@ -0,0 +1,28 @@
+class Ability
+  include CanCan::Ability
+
+  def initialize(user)
+    # Define abilities for the passed in user here. For example:
+    #
+    #   user ||= User.new # guest user (not logged in)
+    #   if user.admin?
+    #     can :manage, :all
+    #   else
+    #     can :read, :all
+    #   end
+    #
+    # The first argument to `can` is the action you are giving the user permission to do.
+    # If you pass :manage it will apply to every action. Other common actions here are
+    # :read, :create, :update and :destroy.
+    #
+    # The second argument is the resource the user can perform the action on. If you pass
+    # :all it will apply to every resource. Otherwise pass a Ruby class of the resource.
+    #
+    # The third argument is an optional hash of conditions to further filter the objects.
+    # For example, here the user can only update published articles.
+    #
+    #   can :update, Article, :published => true
+    #
+    # See the wiki for details: https://github.com/ryanb/cancan/wiki/Defining-Abilities
+  end
+end

data/spec/README.rdoc

@@ -0,0 +1,28 @@
+= CanCan Specs
+
+== Running the specs
+
+To run the specs first run the +bundle+ command to install the necessary gems and the +rake+ command to run the specs.
+
+  bundle
+  rake
+
+The specs currently require Ruby 1.8.7. Ruby 1.9.2 support will be coming soon.
+
+
+== Model Adapters
+
+CanCan offers separate specs for different model adapters (such as Mongoid and Data Mapper). By default it will use Active Record but you can change this by setting the +MODEL_ADAPTER+ environment variable before running. You can run the +bundle+ command with this as well to ensure you have the installed gems.
+
+  MODEL_ADAPTER=data_mapper bundle
+  MODEL_ADAPTER=data_mapper rake
+
+The different model adapters you can specify are:
+
+* active_record (default)
+* data_mapper
+* mongoid
+
+You can also run the +spec_all+ rake task to run specs for each adapter.
+
+  rake spec_all

data/spec/cancan/ability_spec.rb

@@ -32,7 +32,7 @@ describe CanCan::Ability do
     @ability.can?(:read, Symbol).should be_true
   end
 
-  it "should pass to previous can definition, if block returns false or nil" do
+  it "should pass to previous rule, if block returns false or nil" do
     @ability.can :read, Symbol
     @ability.can :read, Integer do |i|
       i < 5
@@ -144,7 +144,7 @@ describe CanCan::Ability do
     @ability.can?(:update, 123).should be_false
   end
 
-  it "should support custom objects in the can definition" do
+  it "should support custom objects in the rule" do
     @ability.can :read, :stats
     @ability.can?(:read, :stats).should be_true
     @ability.can?(:update, :stats).should be_false
@@ -165,7 +165,7 @@ describe CanCan::Ability do
     @ability.can?(:read, 123).should be_false
   end
 
-  it "should pass to previous can definition, if block returns false or nil" do
+  it "should pass to previous rule, if block returns false or nil" do
     @ability.can :read, :all
     @ability.cannot :read, Integer do |int|
       int > 10 ? nil : ( int > 5 )
@@ -343,6 +343,14 @@ describe CanCan::Ability do
     end
   end
 
+  it "should determine model adapter class by asking AbstractAdapter" do
+    model_class = Object.new
+    adapter_class = Object.new
+    stub(CanCan::ModelAdapters::AbstractAdapter).adapter_class(model_class) { adapter_class }
+    stub(adapter_class).new(model_class, []) { :adapter_instance }
+    @ability.model_adapter(model_class, :read).should == :adapter_instance
+  end
+
   describe "unauthorized message" do
     after(:each) do
       I18n.backend = nil

data/spec/cancan/controller_additions_spec.rb

@@ -83,4 +83,34 @@ describe CanCan::ControllerAdditions do
     stub(@controller.class).ancestors { ["InheritedResources::Actions"] }
     @controller.class.cancan_resource_class.should == CanCan::InheritedResource
   end
+
+  it "cancan_skipper should be an empty hash with :authorize and :load options and remember changes" do
+    @controller_class.cancan_skipper.should == {:authorize => {}, :load => {}}
+    @controller_class.cancan_skipper[:load] = true
+    @controller_class.cancan_skipper[:load].should == true
+  end
+
+  it "skip_authorize_resource should add itself to the cancan skipper with given model name and options" do
+    @controller_class.skip_authorize_resource(:project, :only => [:index, :show])
+    @controller_class.cancan_skipper[:authorize][:project].should == {:only => [:index, :show]}
+    @controller_class.skip_authorize_resource(:only => [:index, :show])
+    @controller_class.cancan_skipper[:authorize][nil].should == {:only => [:index, :show]}
+    @controller_class.skip_authorize_resource(:article)
+    @controller_class.cancan_skipper[:authorize][:article].should == {}
+  end
+
+  it "skip_load_resource should add itself to the cancan skipper with given model name and options" do
+    @controller_class.skip_load_resource(:project, :only => [:index, :show])
+    @controller_class.cancan_skipper[:load][:project].should == {:only => [:index, :show]}
+    @controller_class.skip_load_resource(:only => [:index, :show])
+    @controller_class.cancan_skipper[:load][nil].should == {:only => [:index, :show]}
+    @controller_class.skip_load_resource(:article)
+    @controller_class.cancan_skipper[:load][:article].should == {}
+  end
+
+  it "skip_load_and_authore_resource should add itself to the cancan skipper with given model name and options" do
+    @controller_class.skip_load_and_authorize_resource(:project, :only => [:index, :show])
+    @controller_class.cancan_skipper[:load][:project].should == {:only => [:index, :show]}
+    @controller_class.cancan_skipper[:authorize][:project].should == {:only => [:index, :show]}
+  end
 end

data/spec/cancan/controller_resource_spec.rb

@@ -3,10 +3,12 @@ require "spec_helper"
 describe CanCan::ControllerResource do
   before(:each) do
     @params = HashWithIndifferentAccess.new(:controller => "projects")
-    @controller = Object.new # simple stub for now
+    @controller_class = Class.new
+    @controller = @controller_class.new
     @ability = Ability.new(nil)
     stub(@controller).params { @params }
     stub(@controller).current_ability { @ability }
+    stub(@controller_class).cancan_skipper { {:authorize => {}, :load => {}} }
   end
 
   it "should load the resource into an instance variable if params[:id] is specified" do
@@ -91,6 +93,22 @@ describe CanCan::ControllerResource do
     @controller.instance_variable_defined?(:@projects).should be_false
   end
 
+  it "should not authorize single resource in collection action" do
+    @params[:action] = "index"
+    @controller.instance_variable_set(:@project, :some_project)
+    stub(@controller).authorize!(:index, Project) { raise CanCan::AccessDenied }
+    resource = CanCan::ControllerResource.new(@controller)
+    lambda { resource.authorize_resource }.should raise_error(CanCan::AccessDenied)
+  end
+
+  it "should authorize parent resource in collection action" do
+    @params[:action] = "index"
+    @controller.instance_variable_set(:@category, :some_category)
+    stub(@controller).authorize!(:read, :some_category) { raise CanCan::AccessDenied }
+    resource = CanCan::ControllerResource.new(@controller, :category, :parent => true)
+    lambda { resource.authorize_resource }.should raise_error(CanCan::AccessDenied)
+  end
+
   it "should perform authorization using controller action and loaded model" do
     @params[:action] = "show"
     @controller.instance_variable_set(:@project, :some_project)
@@ -245,7 +263,7 @@ describe CanCan::ControllerResource do
     @params.merge!(:action => "create", :project => {:name => "foobar"})
     category = Object.new
     @controller.instance_variable_set(:@category, category)
-    stub(category).build_project { Project.new }
+    stub(category).build_project { |attributes| Project.new(attributes) }
     resource = CanCan::ControllerResource.new(@controller, :through => :category, :singleton => true)
     resource.load_resource
     @controller.instance_variable_get(:@project).name.should == "foobar"
@@ -323,4 +341,52 @@ describe CanCan::ControllerResource do
       CanCan::ControllerResource.new(@controller, :nested => :project)
     }.should raise_error(CanCan::ImplementationRemoved)
   end
+
+  it "should skip resource behavior for :only actions in array" do
+    stub(@controller_class).cancan_skipper { {:load => {nil => {:only => [:index, :show]}}} }
+    @params.merge!(:action => "index")
+    CanCan::ControllerResource.new(@controller).skip?(:load).should be_true
+    CanCan::ControllerResource.new(@controller, :some_resource).skip?(:load).should be_false
+    @params.merge!(:action => "show")
+    CanCan::ControllerResource.new(@controller).skip?(:load).should be_true
+    @params.merge!(:action => "other_action")
+    CanCan::ControllerResource.new(@controller).skip?(:load).should be_false
+  end
+
+  it "should skip resource behavior for :only one action on resource" do
+    stub(@controller_class).cancan_skipper { {:authorize => {:project => {:only => :index}}} }
+    @params.merge!(:action => "index")
+    CanCan::ControllerResource.new(@controller).skip?(:authorize).should be_false
+    CanCan::ControllerResource.new(@controller, :project).skip?(:authorize).should be_true
+    @params.merge!(:action => "other_action")
+    CanCan::ControllerResource.new(@controller, :project).skip?(:authorize).should be_false
+  end
+
+  it "should skip resource behavior :except actions in array" do
+    stub(@controller_class).cancan_skipper { {:load => {nil => {:except => [:index, :show]}}} }
+    @params.merge!(:action => "index")
+    CanCan::ControllerResource.new(@controller).skip?(:load).should be_false
+    @params.merge!(:action => "show")
+    CanCan::ControllerResource.new(@controller).skip?(:load).should be_false
+    @params.merge!(:action => "other_action")
+    CanCan::ControllerResource.new(@controller).skip?(:load).should be_true
+    CanCan::ControllerResource.new(@controller, :some_resource).skip?(:load).should be_false
+  end
+
+  it "should skip resource behavior :except one action on resource" do
+    stub(@controller_class).cancan_skipper { {:authorize => {:project => {:except => :index}}} }
+    @params.merge!(:action => "index")
+    CanCan::ControllerResource.new(@controller, :project).skip?(:authorize).should be_false
+    @params.merge!(:action => "other_action")
+    CanCan::ControllerResource.new(@controller).skip?(:authorize).should be_false
+    CanCan::ControllerResource.new(@controller, :project).skip?(:authorize).should be_true
+  end
+
+  it "should skip loading and authorization" do
+    stub(@controller_class).cancan_skipper { {:authorize => {nil => {}}, :load => {nil => {}}} }
+    @params.merge!(:action => "new")
+    resource = CanCan::ControllerResource.new(@controller)
+    lambda { resource.load_and_authorize_resource }.should_not raise_error
+    @controller.instance_variable_get(:@project).should be_nil
+  end
 end

data/spec/cancan/inherited_resource_spec.rb

@@ -3,10 +3,12 @@ require "spec_helper"
 describe CanCan::InheritedResource do
   before(:each) do
     @params = HashWithIndifferentAccess.new(:controller => "projects")
-    @controller = Object.new # simple stub for now
+    @controller_class = Class.new
+    @controller = @controller_class.new
     @ability = Ability.new(nil)
     stub(@controller).params { @params }
     stub(@controller).current_ability { @ability }
+    stub(@controller_class).cancan_skipper { {:authorize => {}, :load => {}} }
   end
 
   it "show should load resource through @controller.resource" do

data/spec/cancan/model_adapters/active_record_adapter_spec.rb

@@ -0,0 +1,185 @@
+if ENV["MODEL_ADAPTER"].nil? || ENV["MODEL_ADAPTER"] == "active_record"
+  require "spec_helper"
+
+  RSpec.configure do |config|
+    config.extend WithModel
+  end
+
+  ActiveRecord::Base.establish_connection(:adapter => "sqlite3", :database => ":memory:")
+
+  describe CanCan::ModelAdapters::ActiveRecordAdapter do
+    with_model :article do
+      table do |t|
+        t.boolean "published"
+        t.boolean "secret"
+      end
+      model do
+        has_many :comments
+      end
+    end
+
+    with_model :comment do
+      table do |t|
+        t.boolean "spam"
+        t.integer "article_id"
+      end
+      model do
+        belongs_to :article
+      end
+    end
+
+    before(:each) do
+      Article.delete_all
+      Comment.delete_all
+      @ability = Object.new
+      @ability.extend(CanCan::Ability)
+      @article_table = Article.table_name
+      @comment_table = Comment.table_name
+    end
+
+    it "should be for only active record classes" do
+      CanCan::ModelAdapters::ActiveRecordAdapter.should_not be_for_class(Object)
+      CanCan::ModelAdapters::ActiveRecordAdapter.should be_for_class(Article)
+      CanCan::ModelAdapters::AbstractAdapter.adapter_class(Article).should == CanCan::ModelAdapters::ActiveRecordAdapter
+    end
+
+    it "should not fetch any records when no abilities are defined" do
+      Article.create!
+      Article.accessible_by(@ability).should be_empty
+    end
+
+    it "should fetch all articles when one can read all" do
+      @ability.can :read, Article
+      article = Article.create!
+      Article.accessible_by(@ability).should == [article]
+    end
+
+    it "should fetch only the articles that are published" do
+      @ability.can :read, Article, :published => true
+      article1 = Article.create!(:published => true)
+      article2 = Article.create!(:published => false)
+      Article.accessible_by(@ability).should == [article1]
+    end
+
+    it "should fetch any articles which are published or secret" do
+      @ability.can :read, Article, :published => true
+      @ability.can :read, Article, :secret => true
+      article1 = Article.create!(:published => true, :secret => false)
+      article2 = Article.create!(:published => true, :secret => true)
+      article3 = Article.create!(:published => false, :secret => true)
+      article4 = Article.create!(:published => false, :secret => false)
+      Article.accessible_by(@ability).should == [article1, article2, article3]
+    end
+
+    it "should fetch only the articles that are published and not secret" do
+      @ability.can :read, Article, :published => true
+      @ability.cannot :read, Article, :secret => true
+      article1 = Article.create!(:published => true, :secret => false)
+      article2 = Article.create!(:published => true, :secret => true)
+      article3 = Article.create!(:published => false, :secret => true)
+      article4 = Article.create!(:published => false, :secret => false)
+      Article.accessible_by(@ability).should == [article1]
+    end
+
+    it "should only read comments for articles which are published" do
+      @ability.can :read, Comment, :article => { :published => true }
+      comment1 = Comment.create!(:article => Article.create!(:published => true))
+      comment2 = Comment.create!(:article => Article.create!(:published => false))
+      Comment.accessible_by(@ability).should == [comment1]
+    end
+
+    it "should allow conditions in SQL and merge with hash conditions" do
+      @ability.can :read, Article, :published => true
+      @ability.can :read, Article, ["secret=?", true]
+      article1 = Article.create!(:published => true, :secret => false)
+      article4 = Article.create!(:published => false, :secret => false)
+      Article.accessible_by(@ability).should == [article1]
+    end
+
+    it "should not allow to fetch records when ability with just block present" do
+      @ability.can :read, Article do
+        false
+      end
+      lambda { Article.accessible_by(@ability) }.should raise_error(CanCan::Error)
+    end
+
+    it "should not allow to check ability on object against SQL conditions without block" do
+      @ability.can :read, Article, ["secret=?", true]
+      lambda { @ability.can? :read, Article.new }.should raise_error(CanCan::Error)
+    end
+
+    it "should have false conditions if no abilities match" do
+      @ability.model_adapter(Article, :read).conditions.should == "'t'='f'"
+    end
+
+    it "should return false conditions for cannot clause" do
+      @ability.cannot :read, Article
+      @ability.model_adapter(Article, :read).conditions.should == "'t'='f'"
+    end
+
+    it "should return SQL for single `can` definition in front of default `cannot` condition" do
+      @ability.cannot :read, Article
+      @ability.can :read, Article, :published => false, :secret => true
+      @ability.model_adapter(Article, :read).conditions.should orderlessly_match(%Q["#{@article_table}"."published" = 'f' AND "#{@article_table}"."secret" = 't'])
+    end
+
+    it "should return true condition for single `can` definition in front of default `can` condition" do
+      @ability.can :read, Article
+      @ability.can :read, Article, :published => false, :secret => true
+      @ability.model_adapter(Article, :read).conditions.should  == "'t'='t'"
+    end
+
+    it "should return `false condition` for single `cannot` definition in front of default `cannot` condition" do
+      @ability.cannot :read, Article
+      @ability.cannot :read, Article, :published => false, :secret => true
+      @ability.model_adapter(Article, :read).conditions.should  == "'t'='f'"
+    end
+
+    it "should return `not (sql)` for single `cannot` definition in front of default `can` condition" do
+      @ability.can :read, Article
+      @ability.cannot :read, Article, :published => false, :secret => true
+      @ability.model_adapter(Article, :read).conditions.should orderlessly_match(%Q["not (#{@article_table}"."published" = 'f' AND "#{@article_table}"."secret" = 't')])
+    end
+
+    it "should return appropriate sql conditions in complex case" do
+      @ability.can :read, Article
+      @ability.can :manage, Article, :id => 1
+      @ability.can :update, Article, :published => true
+      @ability.cannot :update, Article, :secret => true
+      @ability.model_adapter(Article, :update).conditions.should == %Q[not ("#{@article_table}"."secret" = 't') AND (("#{@article_table}"."published" = 't') OR ("#{@article_table}"."id" = 1))]
+      @ability.model_adapter(Article, :manage).conditions.should == {:id => 1}
+      @ability.model_adapter(Article, :read).conditions.should == "'t'='t'"
+    end
+
+    it "should not forget conditions when calling with SQL string" do
+      @ability.can :read, Article, :published => true
+      @ability.can :read, Article, ['secret=?', false]
+      adapter = @ability.model_adapter(Article, :read)
+      2.times do
+        adapter.conditions.should == %Q[(secret='f') OR ("#{@article_table}"."published" = 't')]
+      end
+    end
+
+    it "should have nil joins if no rules" do
+      @ability.model_adapter(Article, :read).joins.should be_nil
+    end
+
+    it "should have nil joins if no nested hashes specified in conditions" do
+      @ability.can :read, Article, :published => false
+      @ability.can :read, Article, :secret => true
+      @ability.model_adapter(Article, :read).joins.should be_nil
+    end
+
+    it "should merge separate joins into a single array" do
+      @ability.can :read, Article, :project => { :blocked => false }
+      @ability.can :read, Article, :company => { :admin => true }
+      @ability.model_adapter(Article, :read).joins.inspect.should orderlessly_match([:company, :project].inspect)
+    end
+
+    it "should merge same joins into a single array" do
+      @ability.can :read, Article, :project => { :blocked => false }
+      @ability.can :read, Article, :project => { :admin => true }
+      @ability.model_adapter(Article, :read).joins.should == [:project]
+    end
+  end
+end