cancan 1.6.0 → 1.6.10

data/lib/cancan/model_adapters/active_record_adapter.rb

@@ -66,11 +66,22 @@ module CanCan
         return conditions unless conditions.kind_of? Hash
         conditions.inject({}) do |result_hash, (name, value)|
           if value.kind_of? Hash
+            value = value.dup
             association_class = model_class.reflect_on_association(name).class_name.constantize
-            name = model_class.reflect_on_association(name).table_name.to_sym
-            value = tableized_conditions(value, association_class)
+            nested = value.inject({}) do |nested,(k,v)|
+              if v.kind_of? Hash
+                value.delete(k)
+                nested[k] = v
+              else
+                name = model_class.reflect_on_association(name).table_name.to_sym
+                result_hash[name] = value
+              end
+              nested
+            end
+            result_hash.merge!(tableized_conditions(nested,association_class))
+          else
+            result_hash[name] = value
           end
-          result_hash[name] = value
           result_hash
         end
       end
@@ -87,9 +98,14 @@ module CanCan
 
       def database_records
         if override_scope
-          override_scope
+          @model_class.scoped.merge(override_scope)
         elsif @model_class.respond_to?(:where) && @model_class.respond_to?(:joins)
-          @model_class.where(conditions).joins(joins)
+          mergeable_conditions = @rules.select {|rule| rule.unmergeable? }.blank?
+          if mergeable_conditions
+            @model_class.where(conditions).joins(joins)
+          else
+            @model_class.where(*(@rules.map(&:conditions))).joins(joins)
+          end
         else
           @model_class.scoped(:conditions => conditions, :joins => joins)
         end
@@ -99,7 +115,7 @@ module CanCan
 
       def override_scope
         conditions = @rules.map(&:conditions).compact
-        if conditions.any? { |c| c.kind_of?(ActiveRecord::Relation) }
+        if defined?(ActiveRecord::Relation) && conditions.any? { |c| c.kind_of?(ActiveRecord::Relation) }
           if conditions.size == 1
             conditions.first
           else
@@ -140,8 +156,8 @@ module CanCan
       # Takes two hashes and does a deep merge.
       def merge_joins(base, add)
         add.each do |name, nested|
-          if base[name].is_a?(Hash) && !nested.empty?
-            merge_joins(base[name], nested)
+          if base[name].is_a?(Hash)
+            merge_joins(base[name], nested) unless nested.empty?
           else
             base[name] = nested
           end

data/lib/cancan/model_adapters/data_mapper_adapter.rb

@@ -5,29 +5,30 @@ module CanCan
         model_class <= DataMapper::Resource
       end
 
+      def self.find(model_class, id)
+        model_class.get(id)
+      end
+
       def self.override_conditions_hash_matching?(subject, conditions)
         conditions.any? { |k,v| !k.kind_of?(Symbol) }
       end
 
       def self.matches_conditions_hash?(subject, conditions)
-        subject.class.all(:conditions => conditions).include?(subject) # TODO don't use a database query here for performance and other instances
+        collection = DataMapper::Collection.new(subject.query, [ subject ])
+        !!collection.first(conditions)
       end
 
       def database_records
-        scope = @model_class.all(:conditions => ["0=1"])
-        conditions.each do |condition|
-          scope += @model_class.all(:conditions => condition)
-        end
+        scope = @model_class.all(:conditions => ["0 = 1"])
+        cans, cannots = @rules.partition { |r| r.base_behavior }
+        return scope if cans.empty?
+        # apply unions first, then differences. this mean cannot overrides can
+        cans.each    { |r| scope += @model_class.all(:conditions => r.conditions) }
+        cannots.each { |r| scope -= @model_class.all(:conditions => r.conditions) }
         scope
       end
+    end # class DataMapper
+  end # module ModelAdapters
+end # module CanCan
 
-      def conditions
-        @rules.map(&:conditions)
-      end
-    end
-  end
-end
-
-DataMapper::Model.class_eval do
-  include CanCan::ModelAdditions::ClassMethods
-end
+DataMapper::Model.append_extensions(CanCan::ModelAdditions::ClassMethods)

data/lib/cancan/model_adapters/mongoid_adapter.rb

@@ -6,7 +6,14 @@ module CanCan
       end
 
       def self.override_conditions_hash_matching?(subject, conditions)
-        conditions.any? { |k,v| !k.kind_of?(Symbol) }
+        conditions.any? do |k,v|
+          key_is_not_symbol = lambda { !k.kind_of?(Symbol) }
+          subject_value_is_array = lambda do
+            subject.respond_to?(k) && subject.send(k).is_a?(Array)
+          end
+
+          key_is_not_symbol.call || subject_value_is_array.call
+        end
       end
 
       def self.matches_conditions_hash?(subject, conditions)
@@ -16,14 +23,23 @@ module CanCan
       end
 
       def database_records
-        if @rules.size == 0  
+        if @rules.size == 0
           @model_class.where(:_id => {'$exists' => false, '$type' => 7}) # return no records in Mongoid
+        elsif @rules.size == 1 && @rules[0].conditions.is_a?(Mongoid::Criteria)
+          @rules[0].conditions
         else
-          @rules.inject(@model_class.all) do |records, rule|
-            if rule.base_behavior
-              records.or(rule.conditions)
+          # we only need to process can rules if
+          # there are no rules with empty conditions
+          rules = @rules.reject { |rule| rule.conditions.empty? && rule.base_behavior }
+          process_can_rules = @rules.count == rules.count
+
+          rules.inject(@model_class.all) do |records, rule|
+            if process_can_rules && rule.base_behavior
+              records.or rule.conditions
+            elsif !rule.base_behavior
+              records.excludes rule.conditions
             else
-              records.excludes(rule.conditions)
+              records
             end
           end
         end
@@ -35,4 +51,4 @@ end
 # simplest way to add `accessible_by` to all Mongoid Documents
 module Mongoid::Document::ClassMethods
   include CanCan::ModelAdditions::ClassMethods
-end
+end

data/lib/cancan/model_additions.rb

@@ -4,7 +4,7 @@ module CanCan
   module ModelAdditions
     module ClassMethods
       # Returns a scope which fetches only the records that the passed ability
-      # can perform a given action on. The action defaults to :read. This
+      # can perform a given action on. The action defaults to :index. This
       # is usually called from a controller and passed the +current_ability+.
       #
       #   @articles = Article.accessible_by(current_ability)
@@ -19,7 +19,7 @@ module CanCan
       #   @articles = Article.accessible_by(current_ability, :update)
       #
       # Here only the articles which the user can update are returned.
-      def accessible_by(ability, action = :read)
+      def accessible_by(ability, action = :index)
         ability.model_adapter(self, action).database_records
       end
     end

data/lib/cancan/rule.rb

@@ -54,6 +54,11 @@ module CanCan
       @conditions == {} || @conditions.nil?
     end
 
+    def unmergeable?
+      @conditions.respond_to?(:keys) && @conditions.present? &&
+        (!@conditions.keys.first.kind_of? Symbol)
+    end
+
     def associations_hash(conditions = @conditions)
       hash = {}
       conditions.map do |name, value|
@@ -109,9 +114,9 @@ module CanCan
                 if attribute.kind_of? Array
                   attribute.any? { |element| matches_conditions_hash? element, value }
                 else
-                  matches_conditions_hash? attribute, value
+                  !attribute.nil? && matches_conditions_hash?(attribute, value)
                 end
-              elsif value.kind_of?(Array) || value.kind_of?(Range)
+              elsif !value.is_a?(String) && value.kind_of?(Enumerable)
                 value.include? attribute
               else
                 attribute == value
@@ -123,7 +128,7 @@ module CanCan
     end
 
     def nested_subject_matches_conditions?(subject_hash)
-      parent, child = subject_hash.shift
+      parent, child = subject_hash.first
       matches_conditions_hash?(parent, @conditions[parent.class.name.downcase.to_sym] || {})
     end
 
@@ -136,7 +141,7 @@ module CanCan
     end
 
     def model_adapter(subject)
-      ModelAdapters::AbstractAdapter.adapter_class(subject_class?(subject) ? subject : subject.class)
+      CanCan::ModelAdapters::AbstractAdapter.adapter_class(subject_class?(subject) ? subject : subject.class)
     end
   end
 end

data/lib/cancan.rb

@@ -10,4 +10,4 @@ require 'cancan/model_adapters/abstract_adapter'
 require 'cancan/model_adapters/default_adapter'
 require 'cancan/model_adapters/active_record_adapter' if defined? ActiveRecord
 require 'cancan/model_adapters/data_mapper_adapter' if defined? DataMapper
-require 'cancan/model_adapters/mongoid_adapter' if defined? Mongoid
+require 'cancan/model_adapters/mongoid_adapter' if defined?(Mongoid) && defined?(Mongoid::Document)

data/lib/generators/cancan/ability/templates/ability.rb

@@ -11,18 +11,22 @@ class Ability
     #     can :read, :all
     #   end
     #
-    # The first argument to `can` is the action you are giving the user permission to do.
-    # If you pass :manage it will apply to every action. Other common actions here are
-    # :read, :create, :update and :destroy.
+    # The first argument to `can` is the action you are giving the user 
+    # permission to do.
+    # If you pass :manage it will apply to every action. Other common actions
+    # here are :read, :create, :update and :destroy.
     #
-    # The second argument is the resource the user can perform the action on. If you pass
-    # :all it will apply to every resource. Otherwise pass a Ruby class of the resource.
+    # The second argument is the resource the user can perform the action on. 
+    # If you pass :all it will apply to every resource. Otherwise pass a Ruby
+    # class of the resource.
     #
-    # The third argument is an optional hash of conditions to further filter the objects.
+    # The third argument is an optional hash of conditions to further filter the
+    # objects.
     # For example, here the user can only update published articles.
     #
     #   can :update, Article, :published => true
     #
-    # See the wiki for details: https://github.com/ryanb/cancan/wiki/Defining-Abilities
+    # See the wiki for details:
+    # https://github.com/ryanb/cancan/wiki/Defining-Abilities
   end
 end

data/spec/cancan/ability_spec.rb

@@ -87,6 +87,10 @@ describe CanCan::Ability do
     @ability.can?(:increment, 123).should be_true
   end
 
+  it "should raise an Error if alias target is an exist action" do
+    lambda{ @ability.alias_action :show, :to => :show }.should raise_error(CanCan::Error, "You can't specify target (show) as alias because it is real action name")
+  end
+
   it "should always call block with arguments when passing no arguments to can" do
     @ability.can do |action, object_class, object|
       action.should == :foo
@@ -250,6 +254,27 @@ describe CanCan::Ability do
     @ability.can?(:read, 4..6).should be_false
   end
 
+  it "should accept a set as a condition value" do
+    mock(object_with_foo_2 = Object.new).foo { 2 }
+    mock(object_with_foo_3 = Object.new).foo { 3 }
+    @ability.can :read, Object, :foo => [1, 2, 5].to_set
+    @ability.can?(:read, object_with_foo_2).should be_true
+    @ability.can?(:read, object_with_foo_3).should be_false
+  end
+
+  it "should not match subjects return nil for methods that must match nested a nested conditions hash" do
+    mock(object_with_foo = Object.new).foo { :bar }
+    @ability.can :read, Array, :first => { :foo => :bar }
+    @ability.can?(:read, [object_with_foo]).should be_true
+    @ability.can?(:read, []).should be_false
+  end
+
+  it "should match strings but not substrings specified in a conditions hash" do
+    @ability.can :read, String, :presence => "declassified"
+    @ability.can?(:read, "declassified").should be_true
+    @ability.can?(:read, "classified").should be_false
+  end
+
   it "should not stop at cannot definition when comparing class" do
     @ability.can :read, Range
     @ability.cannot :read, Range, :begin => 1
@@ -290,7 +315,15 @@ describe CanCan::Ability do
     @ability.can?(:read, "foobar" => Range).should be_false
     @ability.can?(:read, 123 => Range).should be_true
   end
-  
+
+  it "passing a hash of subjects with multiple definitions should check permissions correctly" do
+    @ability.can :read, Range, :string => {:length => 4}
+    @ability.can [:create, :read], Range, :string => {:upcase => 'FOO'}
+    @ability.can?(:read, "foo" => Range).should be_true
+    @ability.can?(:read, "foobar" => Range).should be_false
+    @ability.can?(:read, 1234 => Range).should be_true
+  end
+
   it "should allow to check ability on Hash-like object" do
     class Container < Hash; end
     @ability.can :read, Container
@@ -317,9 +350,11 @@ describe CanCan::Ability do
     end
   end
 
-  it "should not raise access denied exception if ability is authorized to perform an action" do
+  it "should not raise access denied exception if ability is authorized to perform an action and return subject" do
     @ability.can :read, :foo
-    lambda { @ability.authorize!(:read, :foo) }.should_not raise_error
+    lambda {
+      @ability.authorize!(:read, :foo).should == :foo
+    }.should_not raise_error
   end
 
   it "should know when block is used in conditions" do
@@ -407,4 +442,17 @@ describe CanCan::Ability do
       @ability.unauthorized_message(:edit, 1..3).should == "edit range"
     end
   end
+
+  describe "#merge" do
+    it "should add the rules from the given ability" do
+      @ability.can :use, :tools
+      another_ability = Object.new
+      another_ability.extend(CanCan::Ability)
+      another_ability.can :use, :search
+
+      @ability.merge(another_ability)
+      @ability.can?(:use, :search).should be_true
+      @ability.send(:rules).size.should == 2
+    end
+  end
 end

data/spec/cancan/controller_additions_spec.rb

@@ -6,7 +6,7 @@ describe CanCan::ControllerAdditions do
     @controller = @controller_class.new
     stub(@controller).params { {} }
     stub(@controller).current_user { :current_user }
-    mock(@controller_class).helper_method(:can?, :cannot?)
+    mock(@controller_class).helper_method(:can?, :cannot?, :current_ability)
     @controller_class.send(:include, CanCan::ControllerAdditions)
   end
 
@@ -49,14 +49,14 @@ describe CanCan::ControllerAdditions do
 
   it "authorize_resource should setup a before filter which passes call to ControllerResource" do
     stub(CanCan::ControllerResource).new(@controller, nil, :foo => :bar).mock!.authorize_resource
-    mock(@controller_class).before_filter(:except => :show) { |options, block| block.call(@controller) }
-    @controller_class.authorize_resource :foo => :bar, :except => :show
+    mock(@controller_class).before_filter(:except => :show, :if => true) { |options, block| block.call(@controller) }
+    @controller_class.authorize_resource :foo => :bar, :except => :show, :if => true
   end
 
   it "load_resource should setup a before filter which passes call to ControllerResource" do
     stub(CanCan::ControllerResource).new(@controller, nil, :foo => :bar).mock!.load_resource
-    mock(@controller_class).before_filter(:only => [:show, :index]) { |options, block| block.call(@controller) }
-    @controller_class.load_resource :foo => :bar, :only => [:show, :index]
+    mock(@controller_class).before_filter(:only => [:show, :index], :unless => false) { |options, block| block.call(@controller) }
+    @controller_class.load_resource :foo => :bar, :only => [:show, :index], :unless => false
   end
 
   it "skip_authorization_check should set up a before filter which sets @_authorized to true" do