cancan 0.1.0

data/CHANGELOG.rdoc

@@ -0,0 +1,3 @@
+*0.1.0* (Nov 16th, 2009)
+
+* initial release

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2009 Ryan Bates
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,187 @@
+= CanCan
+
+This is a simple authorization solution for Rails which is completely decoupled from how you set up the user's roles. All permissions are stored in a single location for convenience.
+
+This assumes you already have an authentication solution (such as Authlogic) which proves a current_user model.
+
+
+== Installation
+
+Install it as a Rails plugin.
+
+  script/plugin install git://github.com/ryanb/cancan.git
+
+It will be available as a gem soon.
+
+
+== Setup
+
+First define a class called Ability, place it in "models/ability.rb".
+
+  class Ability
+    include CanCan::Ability
+  
+    def prepare(user)
+      if user.admin?
+        can :manage, :all
+      else
+        can :read, :all
+      end
+    end
+  end
+
+This class is where all permissions will go. See the "Defining Abilities" section below for more information.
+
+In the view layer you can access the current permissions at any point using the "can?" method. See "Checking Abilities" section below.
+
+  <% if can? :update, @article %>
+    <%= link_to "Edit", edit_article_path(@article) %>
+  <% end %>
+
+You can also use this method in the controller layer along with the "unauthorized!" method to restrict access.
+
+  def show
+    @article = Article.find(params[:id])
+    unauthorized! unless can? :read, @article
+  end
+
+Setting this for every action can be tedious, therefore a before filter is also provided for automatically applying this setting to a RESTful style resource controller.
+
+  class ArticlesController < ApplicationController
+    before_filter :load_and_authorize_resource
+    
+    def show
+      # @article is already loaded
+    end
+  end
+
+If the user authorization fails, a CanCan::AccessDenied exception will be raised. You can catch this and modify its behavior.
+
+  class ApplicationController < ActionController::Base
+    rescue_from CanCan::AccessDenied, :with => :access_denied
+  
+    protected
+  
+    def access_denied
+      flash[:error] = "Sorry, you are not allowed to access that page."
+      redirect_to root_url
+    end
+  end
+
+
+== Defining Abilities
+
+As shown above, the Ability#prepare method is where all user permissions are defined. The user model is passed into this method so you are free to modify the permissions based on the user's attributes. This way CanCan is completely decoupled with how you choose to handle roles.
+
+The "can" method accepts two arguments, the first one is the action you're setting the permission for, the second one is the class of object you're setting it on.
+
+  can :update, Article
+
+You can pass an array for either of these parameters to match any one.
+
+  can [:update, :destroy], [Article, Comment]
+
+In this case the user has the ability to update or destroy both articles and comments.
+
+You can pass a block to provide logic based on the article's attributes. For example:
+
+  can :update, Article do |article|
+    article && article.user == user
+  end
+
+If the block returns true then the user has that :update ability for that article, otherwise he will be denied access. It's possible for the passed in model to be nil if one isn't specified, so be sure to take that into consideration.
+
+You can pass :all to reference every type of object. In this case the object type will be passed into the block as well (just in case object is nil).
+
+  can :read, :all do |object_class, object|
+    object_class != Order
+  end
+
+Here the user has permission to read all objects except orders.
+
+You can also pass :manage as the action which will match any action. In this case the action is passed to the block.
+
+  can :manage, Comment do |action, comment|
+    action != :destroy
+  end
+
+Finally, you can use the "alias_action" method to alias one or more actions into one.
+
+  alias_action :update, :destroy, :to => :modify
+  can :modify, Comment
+
+The following aliases are added by default for conveniently mapping common controller actions.
+
+  alias_action :index, :show, :to => :read
+  alias_action :new, :to => :create
+  alias_action :edit, :to => :update
+
+
+== Checking Abilities
+
+Use the "can?" method in the controller or view to check the user's permission for a given action and object.
+
+  can? :destroy, @project
+
+You can also pass the class instead of an instance (if you don't have one handy). For example:
+
+  <% if can? :create, Project %>
+    <%= link_to "New Project", new_project_path %>
+  <% end %>
+
+
+== Custom Actions
+
+There is no limit to what actions you can use to determine abilities. For example, if only pro users are allowed to upload a picture for their product, you might add restrictions like this.
+
+  # ability.rb
+  can :upload_picture, Project if user.pro?
+
+  # projects/_form.html.erb
+  <%= f.file_field :picture if can? :upload_picture, @project %>
+  
+  # projects_controller.rb
+  def update
+    unauthorized! if params[:project][:upload_picture] && !can?(:upload_picture, @project)
+    # ...
+  end
+
+
+== Customizing Assumptions
+
+CanCan makes two assumptions about your application.
+
+  * The permissions are defined in Ability#prepare.
+  * The user is fetched with current_user method in the controller.
+
+You can override these by defining the "current_ability" method in your ApplicationController.
+
+   def current_ability
+     ability = UserAbility.new          # instead of Ability
+     ability.prepare(current_account)   # instead of current_user
+     ability                            # be sure to return the ability
+   end
+
+That's it!
+
+
+== Permissions in Database
+
+Perhaps a non-coder needs the ability to modify the user abilities, or you want to change them without having to re-deploy the application. In that case it may be best to store the permission logic in a separate model, let's call it Permission. It is easy to use the database records when defining abilities.
+
+For example, let's assume that each user has_many :permissions, and each permission has "action", "object_type" and "object_id" columns. The last of which is optional.
+
+  class Ability
+    include CanCan::Ability
+  
+    def prepare(user)
+      can :manage, :all do |action, object_class, object|
+        user.permissions.find_all_by_action(action).any? do |permission|
+          permission.object_type.constantize == object_class &&
+            (object.nil? || permission.object_id.nil? || permission.object_id == object.id)
+        end
+      end
+    end
+  end
+
+The actual details will depend largely on your application requirements, but hopefully you can see how it's possible to define permissions in the database and use them with CanCan.

data/Rakefile

@@ -0,0 +1,11 @@
+require 'rubygems'
+require 'rake'
+require 'spec/rake/spectask'
+
+spec_files = Rake::FileList["spec/**/*_spec.rb"]
+
+desc "Run specs"
+Spec::Rake::SpecTask.new do |t|
+  t.spec_files = spec_files
+  t.spec_opts = ["-c"]
+end

data/init.rb

@@ -0,0 +1 @@
+require 'cancan'

data/lib/cancan.rb

@@ -0,0 +1,6 @@
+module CanCan
+  class AccessDenied < StandardError; end
+end
+
+require File.dirname(__FILE__) + '/cancan/ability'
+require File.dirname(__FILE__) + '/cancan/controller_additions'

data/lib/cancan/ability.rb

@@ -0,0 +1,55 @@
+module CanCan
+  module Ability
+    attr_accessor :user
+    
+    def can?(original_action, target) # TODO this could use some refactoring
+      (@can_history || []).reverse.each do |can_action, can_target, can_block|
+        possible_actions_for(original_action).each do |action|
+          if (can_action == :manage || can_action == action) && (can_target == :all || can_target == target || target.kind_of?(can_target))
+            if can_block.nil?
+              return true
+            else
+              block_args = []
+              block_args << action if can_action == :manage
+              block_args << (target.class == Class ? target : target.class) if can_target == :all
+              block_args << (target.class == Class ? nil : target)
+              return can_block.call(*block_args)
+            end
+          end
+        end
+      end
+      false
+    end
+    
+    def possible_actions_for(initial_action)
+      actions = [initial_action]
+      (@aliased_actions || default_alias_actions).each do |target, aliases|
+        actions += possible_actions_for(target) if aliases.include? initial_action
+      end
+      actions
+    end
+      
+    def can(action, target, &block)
+      @can_history ||= []
+      @can_history << [action, target, block]
+    end
+    
+    def alias_action(*args)
+      @aliased_actions ||= default_alias_actions
+      target = args.pop[:to]
+      @aliased_actions[target] = args
+    end
+    
+    def default_alias_actions
+      {
+        :read => [:index, :show],
+        :create => [:new],
+        :update => [:edit],
+      }
+    end
+    
+    def prepare(user)
+      # to be overriden by included class
+    end
+  end
+end

data/lib/cancan/controller_additions.rb

@@ -0,0 +1,46 @@
+module CanCan
+  module ControllerAdditions
+    def self.included(base)
+      base.helper_method :can?
+    end
+    
+    def unauthorized!
+      raise AccessDenied, "You are unable to access this page."
+    end
+    
+    def current_ability
+      ability = ::Ability.new
+      ability.prepare(current_user)
+      ability
+    end
+    
+    def can?(*args)
+      (@current_ability ||= current_ability).can?(*args)
+    end
+    
+    def load_resource # TODO this could use some refactoring
+      unless params[:action] == "index"
+        if params[:id]
+          instance_variable_set("@#{params[:controller].singularize}", params[:controller].singularize.camelcase.constantize.find(params[:id]))
+        else
+          instance_variable_set("@#{params[:controller].singularize}", params[:controller].singularize.camelcase.constantize.new(params[params[:controller].singularize.to_sym]))
+        end
+      end
+    end
+    
+    def authorize_resource # TODO this could use some refactoring
+      unauthorized! unless can?(params[:action].to_sym, instance_variable_get("@#{params[:controller].singularize}") || params[:controller].singularize.camelcase.constantize)
+    end
+    
+    def load_and_authorize_resource
+      load_resource
+      authorize_resource
+    end
+  end
+end
+
+if defined? ActionController
+  ActionController::Base.class_eval do
+    include CanCan::ControllerAdditions
+  end
+end

data/spec/cancan/ability_spec.rb

@@ -0,0 +1,84 @@
+require File.dirname(__FILE__) + '/../spec_helper'
+
+describe CanCan::Ability do
+  before(:each) do
+    @ability_class = Class.new
+    @ability_class.send(:include, CanCan::Ability)
+    @ability = @ability_class.new
+  end
+  
+  it "should be able to :read anything" do
+    @ability.can :read, :all
+    @ability.can?(:read, String).should be_true
+    @ability.can?(:read, 123).should be_true
+  end
+  
+  it "should not have permission to do something it doesn't know about" do
+    @ability.can?(:foodfight, String).should be_false
+  end
+  
+  it "should return what block returns on a can call" do
+    @ability.can :read, :all
+    @ability.can :read, Symbol do |sym|
+      sym
+    end
+    @ability.can?(:read, Symbol).should be_nil
+    @ability.can?(:read, :some_symbol).should == :some_symbol
+  end
+  
+  it "should pass class with object if :all objects are accepted" do
+    @ability.can :preview, :all do |object_class, object|
+      [object_class, object]
+    end
+    @ability.can?(:preview, 123).should == [Fixnum, 123]
+  end
+  
+  it "should pass class with no object if :all objects are accepted and class is passed directly" do
+    @ability.can :preview, :all do |object_class, object|
+      [object_class, object]
+    end
+    @ability.can?(:preview, Hash).should == [Hash, nil]
+  end
+  
+  it "should pass action and object for global manage actions" do
+    @ability.can :manage, Array do |action, object|
+      [action, object]
+    end
+    @ability.can?(:stuff, [1, 2]).should == [:stuff, [1, 2]]
+    @ability.can?(:stuff, Array).should == [:stuff, nil]
+  end
+  
+  it "should alias update or destroy actions to modify action" do
+    @ability.alias_action :update, :destroy, :to => :modify
+    @ability.can :modify, :all do |object_class, object|
+      :modify_called
+    end
+    @ability.can?(:update, 123).should == :modify_called
+    @ability.can?(:destroy, 123).should == :modify_called
+  end
+  
+  it "should return block result for action, object_class, and object for any action" do
+    @ability.can :manage, :all do |action, object_class, object|
+      [action, object_class, object]
+    end
+    @ability.can?(:foo, 123).should == [:foo, Fixnum, 123]
+    @ability.can?(:bar, Fixnum).should == [:bar, Fixnum, nil]
+  end
+  
+  it "should automatically alias index and show into read calls" do
+    @ability.can :read, :all
+    @ability.can?(:index, 123).should be_true
+    @ability.can?(:show, 123).should be_true
+  end
+  
+  it "should automatically alias new and edit into create and update respectively" do
+    @ability.can(:create, :all) { :create_called }
+    @ability.can(:update, :all) { :update_called }
+    @ability.can?(:new, 123).should == :create_called
+    @ability.can?(:edit, 123).should == :update_called
+  end
+  
+  it "should respond to prepare" do
+    @ability.should respond_to(:prepare)
+  end
+end

data/spec/cancan/controller_additions_spec.rb

@@ -0,0 +1,81 @@
+require File.dirname(__FILE__) + '/../spec_helper'
+
+class Ability
+  include CanCan::Ability
+end
+
+describe CanCan::ControllerAdditions do
+  before(:each) do
+    @controller_class = Class.new
+    @controller = @controller_class.new
+    mock(@controller_class).helper_method(:can?)
+    @controller_class.send(:include, CanCan::ControllerAdditions)
+  end
+  
+  it "should read from the cache with request uri as key and render that text" do
+    lambda {
+      @controller.unauthorized!
+    }.should raise_error(CanCan::AccessDenied)
+  end
+  
+  it "should have a current_ability method which generates an ability for the current user" do
+    stub(@controller).current_user { :current_user }
+    @controller.current_ability.should be_kind_of(Ability)
+  end
+  
+  it "should provide a can? method which goes through the current ability" do
+    stub(@controller).current_user { :current_user }
+    @controller.current_ability.should be_kind_of(Ability)
+    @controller.can?(:foo, :bar).should be_false
+  end
+  
+  it "should load the resource if params[:id] is specified" do
+    stub(@controller).params { {:controller => "abilities", :action => "show", :id => 123} }
+    stub(Ability).find(123) { :some_resource }
+    @controller.load_resource
+    @controller.instance_variable_get(:@ability).should == :some_resource
+  end
+  
+  it "should build a new resource with hash if params[:id] is not specified" do
+    stub(@controller).params { {:controller => "abilities", :action => "create", :ability => {:foo => "bar"}} }
+    stub(Ability).new(:foo => "bar") { :some_resource }
+    @controller.load_resource
+    @controller.instance_variable_get(:@ability).should == :some_resource
+  end
+  
+  it "should build a new resource even if attribute hash isn't specified" do
+    stub(@controller).params { {:controller => "abilities", :action => "new"} }
+    stub(Ability).new(nil) { :some_resource }
+    @controller.load_resource
+    @controller.instance_variable_get(:@ability).should == :some_resource
+  end
+  
+  it "should not build a resource when on index action" do
+    stub(@controller).params { {:controller => "abilities", :action => "index"} }
+    @controller.load_resource
+    @controller.instance_variable_get(:@ability).should be_nil
+  end
+  
+  it "should perform authorization using controller action and loaded model" do
+    @controller.instance_variable_set(:@ability, :some_resource)
+    stub(@controller).params { {:controller => "abilities", :action => "show"} }
+    stub(@controller).can?(:show, :some_resource) { false }
+    lambda {
+      @controller.authorize_resource
+    }.should raise_error(CanCan::AccessDenied)
+  end
+  
+  it "should perform authorization using controller action and non loaded model" do
+    stub(@controller).params { {:controller => "abilities", :action => "show"} }
+    stub(@controller).can?(:show, Ability) { false }
+    lambda {
+      @controller.authorize_resource
+    }.should raise_error(CanCan::AccessDenied)
+  end
+  
+  it "should load and authorize resource in one call" do
+    mock(@controller).load_resource
+    stub(@controller).authorize_resource
+    @controller.load_and_authorize_resource
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,11 @@
+require 'rubygems'
+require 'spec'
+require 'active_support'
+require 'active_record'
+require 'action_controller'
+require 'action_view'
+require File.dirname(__FILE__) + '/../lib/cancan.rb'
+
+Spec::Runner.configure do |config|
+  config.mock_with :rr
+end

metadata

@@ -0,0 +1,72 @@
+--- !ruby/object:Gem::Specification 
+name: cancan
+version: !ruby/object:Gem::Version 
+  version: 0.1.0
+platform: ruby
+authors: 
+- Ryan Bates
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2009-11-16 00:00:00 -08:00
+default_executable: 
+dependencies: []
+
+description: Simple authorization solution for Rails which is completely decoupled from the user's roles. All permissions are stored in a single location for convenience.
+email: ryan@railscasts.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- README.rdoc
+- CHANGELOG.rdoc
+- LICENSE
+files: 
+- lib/cancan/ability.rb
+- lib/cancan/controller_additions.rb
+- lib/cancan.rb
+- spec/cancan/ability_spec.rb
+- spec/cancan/controller_additions_spec.rb
+- spec/spec_helper.rb
+- LICENSE
+- README.rdoc
+- Rakefile
+- CHANGELOG.rdoc
+- init.rb
+has_rdoc: true
+homepage: http://github.com/ryanb/cancan
+licenses: []
+
+post_install_message: 
+rdoc_options: 
+- --line-numbers
+- --inline-source
+- --title
+- CanCan
+- --main
+- README.rdoc
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "1.2"
+  version: 
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.5
+signing_key: 
+specification_version: 3
+summary: Simple authorization solution for Rails.
+test_files: []
+