cancancan 1.15.0 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: f603bcd9b02f8b042e5de713df94cb01abec7486
-  data.tar.gz: 358a5080dcef4525f7993d9c1383daffc147d169
+SHA256:
+  metadata.gz: 81afd3cec5dc78c4e4d9d14719482ae589ed43bf336cc1b4f9e5681dea56b99d
+  data.tar.gz: fd23ce69481f9daf4b227b61e4e7e236abcd40d7b5f0dd01f70ca20a3706fae3
 SHA512:
-  metadata.gz: c56c8b9e82e5ab6868a5dafcf811d2363b023c4f1eb05149de64996919e6da6e60dff583e7d1b9f1c1eeb277a52a5327e03b52bf753b3ed79ce2cc22fad0b431
-  data.tar.gz: a1be98535ecbcde3db1b8accc41446bbb139b413b544a2541af00f699e5e5a548d3fdfdb41b09ed951504d4c8a6a31fc24a50aea690ad70ed2fb224a1676d954
+  metadata.gz: 04ee2bfead0ce01e0bdc64e69fae219c221495c30950542323fc5e3d91e250e9a679863546c09db9f3a71a647cb414510bcbb92db41309d9b0b2d04f7d2a1b0e
+  data.tar.gz: 79b4b11ef02ca50417c4e441dd8586569ed86caa4d3216fc54e1713bd09071e544b529db0babd429dd14b0efc90f59f2dfbd8a8d101a9e4d4332908f0487115b

data/cancancan.gemspec

@@ -1,28 +1,28 @@
-# coding: utf-8
-lib = File.expand_path('../lib', __FILE__)
+# frozen_string_literal: true
+
+lib = File.expand_path('lib', __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'cancan/version'
 
 Gem::Specification.new do |s|
-  s.name        = "cancancan"
+  s.name        = 'cancancan'
   s.version     = CanCan::VERSION
-  s.authors     = ["Bryan Rite", "Ryan Bates", "Richard Wilson"]
-  s.email       = "r.crawfordwilson@gmail.com"
-  s.homepage    = "https://github.com/CanCanCommunity/cancancan"
-  s.summary     = "Simple authorization solution for Rails."
-  s.description = "Continuation of the simple authorization solution for Rails which is decoupled from user roles. All permissions are stored in a single location."
+  s.authors     = ['Alessandro Rodi (Renuo AG)', 'Bryan Rite', 'Ryan Bates', 'Richard Wilson']
+  s.email       = 'alessandro.rodi@renuo.ch'
+  s.homepage    = 'https://github.com/CanCanCommunity/cancancan'
+  s.summary     = 'Simple authorization solution for Rails.'
+  s.description = 'Simple authorization solution for Rails. All permissions are stored in a single location.'
   s.platform    = Gem::Platform::RUBY
-  s.license     = "MIT"
+  s.license     = 'MIT'
 
-  s.files       = `git ls-files`.split($/)
-  s.test_files  = `git ls-files -- Appraisals {spec,features,gemfiles}/*`.split($/)
-  s.executables = `git ls-files -- bin/*`.split($/).map{ |f| File.basename(f) }
-  s.require_paths = ["lib"]
+  s.files       = `git ls-files lib init.rb cancancan.gemspec`.split($INPUT_RECORD_SEPARATOR)
+  s.require_paths = ['lib']
 
-  s.required_ruby_version = ">= 2.0.0"
+  s.required_ruby_version = '>= 2.2.0'
 
-  s.add_development_dependency 'bundler', '~> 1.3'
-  s.add_development_dependency 'rake', '~> 10.1.1'
-  s.add_development_dependency 'rspec', '~> 3.2.0'
-  s.add_development_dependency 'appraisal', '>= 2.0.0'
+  s.add_development_dependency 'appraisal', '~> 2.0', '>= 2.0.0'
+  s.add_development_dependency 'bundler', '~> 2.0'
+  s.add_development_dependency 'rake', '~> 10.1', '>= 10.1.1'
+  s.add_development_dependency 'rspec', '~> 3.2', '>= 3.2.0'
+  s.add_development_dependency 'rubocop', '~> 0.63.1'
 end

data/init.rb

@@ -1 +1,3 @@
+# frozen_string_literal: true
+
 require 'cancan'

data/lib/cancan.rb

@@ -1,24 +1,22 @@
-require "cancan/version"
+# frozen_string_literal: true
+
+require 'cancan/version'
+require 'cancan/parameter_validators'
 require 'cancan/ability'
 require 'cancan/rule'
 require 'cancan/controller_resource'
 require 'cancan/controller_additions'
 require 'cancan/model_additions'
 require 'cancan/exceptions'
-require 'cancan/inherited_resource'
 
 require 'cancan/model_adapters/abstract_adapter'
 require 'cancan/model_adapters/default_adapter'
+require 'cancan/rules_compressor'
 
 if defined? ActiveRecord
+  require 'cancan/model_adapters/conditions_extractor'
+  require 'cancan/model_adapters/conditions_normalizer'
   require 'cancan/model_adapters/active_record_adapter'
-  if ActiveRecord.respond_to?(:version) &&
-      ActiveRecord.version >= Gem::Version.new("4")
-    require 'cancan/model_adapters/active_record_4_adapter'
-  else
-    require 'cancan/model_adapters/active_record_3_adapter'
-  end
+  require 'cancan/model_adapters/active_record_4_adapter'
+  require 'cancan/model_adapters/active_record_5_adapter'
 end
-
-require 'cancan/model_adapters/mongoid_adapter' if defined?(Mongoid) && defined?(Mongoid::Document)
-require 'cancan/model_adapters/sequel_adapter' if defined? Sequel

data/lib/cancan/ability.rb

@@ -1,5 +1,11 @@
-module CanCan
+# frozen_string_literal: true
+
+require_relative 'ability/rules.rb'
+require_relative 'ability/actions.rb'
+require_relative 'unauthorized_message_resolver.rb'
+require_relative 'ability/strong_parameter_support'
 
+module CanCan
   # This module is designed to be included into an Ability class. This will
   # provide the "can" methods for defining and checking abilities.
   #
@@ -16,6 +22,11 @@ module CanCan
   #   end
   #
   module Ability
+    include CanCan::Ability::Rules
+    include CanCan::Ability::Actions
+    include CanCan::UnauthorizedMessageResolver
+    include StrongParameterSupport
+
     # Check if the user has permission to perform a given action on an object.
     #
     #   can? :destroy, @project
@@ -60,14 +71,15 @@ module CanCan
     #   end
     #
     # Also see the RSpec Matchers to aid in testing.
-    def can?(action, subject, *extra_args)
+    def can?(action, subject, attribute = nil, *extra_args)
       match = extract_subjects(subject).lazy.map do |a_subject|
         relevant_rules_for_match(action, a_subject).detect do |rule|
-          rule.matches_conditions?(action, a_subject, extra_args)
+          rule.matches_conditions?(action, a_subject, attribute, *extra_args) && rule.matches_attributes?(attribute)
         end
       end.reject(&:nil?).first
       match ? match.base_behavior : false
     end
+
     # Convenience method which works the same as "can?" but returns the opposite value.
     #
     #   cannot? :destroy, @project
@@ -129,8 +141,8 @@ module CanCan
     #     # check the database and return true/false
     #   end
     #
-    def can(action = nil, subject = nil, conditions = nil, &block)
-      add_rule(Rule.new(true, action, subject, conditions, block))
+    def can(action = nil, subject = nil, *attributes_and_conditions, &block)
+      add_rule(Rule.new(true, action, subject, *attributes_and_conditions, &block))
     end
 
     # Defines an ability which cannot be done. Accepts the same arguments as "can".
@@ -145,59 +157,14 @@ module CanCan
     #     product.invisible?
     #   end
     #
-    def cannot(action = nil, subject = nil, conditions = nil, &block)
-      add_rule(Rule.new(false, action, subject, conditions, block))
-    end
-
-    # Alias one or more actions into another one.
-    #
-    #   alias_action :update, :destroy, :to => :modify
-    #   can :modify, Comment
-    #
-    # Then :modify permission will apply to both :update and :destroy requests.
-    #
-    #   can? :update, Comment # => true
-    #   can? :destroy, Comment # => true
-    #
-    # This only works in one direction. Passing the aliased action into the "can?" call
-    # will not work because aliases are meant to generate more generic actions.
-    #
-    #   alias_action :update, :destroy, :to => :modify
-    #   can :update, Comment
-    #   can? :modify, Comment # => false
-    #
-    # Unless that exact alias is used.
-    #
-    #   can :modify, Comment
-    #   can? :modify, Comment # => true
-    #
-    # The following aliases are added by default for conveniently mapping common controller actions.
-    #
-    #   alias_action :index, :show, :to => :read
-    #   alias_action :new, :to => :create
-    #   alias_action :edit, :to => :update
-    #
-    # This way one can use params[:action] in the controller to determine the permission.
-    def alias_action(*args)
-      target = args.pop[:to]
-      validate_target(target)
-      aliased_actions[target] ||= []
-      aliased_actions[target] += args
+    def cannot(action = nil, subject = nil, *attributes_and_conditions, &block)
+      add_rule(Rule.new(false, action, subject, *attributes_and_conditions, &block))
     end
 
     # User shouldn't specify targets with names of real actions or it will cause Seg fault
     def validate_target(target)
-      raise Error, "You can't specify target (#{target}) as alias because it is real action name" if aliased_actions.values.flatten.include? target
-    end
-
-    # Returns a hash of aliased actions. The key is the target and the value is an array of actions aliasing the key.
-    def aliased_actions
-      @aliased_actions ||= default_alias_actions
-    end
-
-    # Removes previously aliased actions including the defaults.
-    def clear_aliased_actions
-      @aliased_actions = {}
+      error_message = "You can't specify target (#{target}) as alias because it is real action name"
+      raise Error, error_message if aliased_actions.values.flatten.include? target
     end
 
     def model_adapter(model_class, action)
@@ -207,25 +174,14 @@ module CanCan
 
     # See ControllerAdditions#authorize! for documentation.
     def authorize!(action, subject, *args)
-      message = nil
-      if args.last.kind_of?(Hash) && args.last.has_key?(:message)
-        message = args.pop[:message]
-      end
+      message = args.last.is_a?(Hash) && args.last.key?(:message) ? args.pop[:message] : nil
       if cannot?(action, subject, *args)
         message ||= unauthorized_message(action, subject)
-        raise AccessDenied.new(message, action, subject)
+        raise AccessDenied.new(message, action, subject, args)
       end
       subject
     end
 
-    def unauthorized_message(action, subject)
-      keys = unauthorized_message_keys(action, subject)
-      variables = {:action => action.to_s}
-      variables[:subject] = (subject.class == Class ? subject : subject.class).to_s.underscore.humanize.downcase
-      message = I18n.translate(nil, variables.merge(:scope => :unauthorized, :default => keys + [""]))
-      message.blank? ? nil : message
-    end
-
     def attributes_for(action, subject)
       attributes = {}
       relevant_rules(action, subject).map do |rule|
@@ -242,10 +198,58 @@ module CanCan
       relevant_rules(action, subject).any?(&:only_raw_sql?)
     end
 
+    # Copies all rules and aliased actions of the given +CanCan::Ability+ and adds them to +self+.
+    #   class ReadAbility
+    #     include CanCan::Ability
+    #
+    #     def initialize
+    #       can :read, User
+    #       alias_action :show, :index, to: :see
+    #     end
+    #   end
+    #
+    #   class WritingAbility
+    #     include CanCan::Ability
+    #
+    #     def initialize
+    #       can :edit, User
+    #       alias_action :create, :update, to: :modify
+    #     end
+    #   end
+    #
+    #   read_ability = ReadAbility.new
+    #   read_ability.can? :edit, User.new #=> false
+    #   read_ability.merge(WritingAbility.new)
+    #   read_ability.can? :edit, User.new #=> true
+    #   read_ability.aliased_actions #=> [:see => [:show, :index], :modify => [:create, :update]]
+    #
+    # If there are collisions when merging the +aliased_actions+, the actions on +self+ will be
+    # overwritten.
+    #
+    # class ReadAbility
+    #   include CanCan::Ability
+    #
+    #   def initialize
+    #     alias_action :show, :index, to: :see
+    #   end
+    # end
+    #
+    # class ShowAbility
+    #   include CanCan::Ability
+    #
+    #   def initialize
+    #     alias_action :show, to: :see
+    #   end
+    # end
+    #
+    # read_ability = ReadAbility.new
+    # read_ability.merge(ShowAbility)
+    # read_ability.aliased_actions #=> [:see => [:show]]
     def merge(ability)
       ability.rules.each do |rule|
         add_rule(rule.dup)
       end
+      @aliased_actions = aliased_actions.merge(ability.aliased_actions)
       self
     end
 
@@ -257,165 +261,48 @@ module CanCan
     #
     # Where can_hash and cannot_hash are formatted thusly:
     #   {
-    #     action: array_of_objects
+    #     action: { subject: [attributes] }
     #   }
     def permissions
-      permissions_list = {:can => {}, :cannot => {}}
-
-      rules.each do |rule|
-        subjects = rule.subjects
-        expand_actions(rule.actions).each do |action|
-          if(rule.base_behavior)
-            permissions_list[:can][action] ||= []
-            permissions_list[:can][action] += subjects.map(&:to_s)
-          else
-            permissions_list[:cannot][action] ||= []
-            permissions_list[:cannot][action] += subjects.map(&:to_s)
-          end
-        end
-      end
-
+      permissions_list = {
+        can: Hash.new { |actions, k1| actions[k1] = Hash.new { |subjects, k2| subjects[k2] = [] } },
+        cannot: Hash.new { |actions, k1| actions[k1] = Hash.new { |subjects, k2| subjects[k2] = [] } }
+      }
+      rules.each { |rule| extract_rule_in_permissions(permissions_list, rule) }
       permissions_list
     end
 
-    protected
-
-    # Must be protected as an ability can merge with other abilities.
-    # This means that an ability must expose their rules with another ability.
-    def rules
-      @rules ||= []
+    def extract_rule_in_permissions(permissions_list, rule)
+      expand_actions(rule.actions).each do |action|
+        container = rule.base_behavior ? :can : :cannot
+        rule.subjects.each do |subject|
+          permissions_list[container][action][subject.to_s] += rule.attributes
+        end
+      end
     end
 
     private
 
     def unauthorized_message_keys(action, subject)
-      subject = (subject.class == Class ? subject : subject.class).name.underscore unless subject.kind_of? Symbol
-      [subject, :all].map do |try_subject|
-        [aliases_for_action(action), :manage].flatten.map do |try_action|
-          :"#{try_action}.#{try_subject}"
-        end
-      end.flatten
-    end
-
-    # Accepts an array of actions and returns an array of actions which match.
-    # This should be called before "matches?" and other checking methods since they
-    # rely on the actions to be expanded.
-    def expand_actions(actions)
-      expanded_actions[actions] ||= begin
-        expanded = []
-        actions.each do |action|
-          expanded << action
-          if aliases = aliased_actions[action]
-            expanded += expand_actions(aliases)
-          end
-        end
-        expanded
+      subject = (subject.class == Class ? subject : subject.class).name.underscore unless subject.is_a? Symbol
+      aliases = aliases_for_action(action)
+      [subject, :all].product([*aliases, :manage]).map do |try_subject, try_action|
+        :"#{try_action}.#{try_subject}"
       end
     end
 
-    def expanded_actions
-      @expanded_actions ||= {}
-    end
-
     # It translates to an array the subject or the hash with multiple subjects given to can?.
     def extract_subjects(subject)
-      if subject.kind_of?(Hash) && subject.key?(:any)
+      if subject.is_a?(Hash) && subject.key?(:any)
         subject[:any]
       else
         [subject]
       end
     end
 
-    # Given an action, it will try to find all of the actions which are aliased to it.
-    # This does the opposite kind of lookup as expand_actions.
-    def aliases_for_action(action)
-      results = [action]
-      aliased_actions.each do |aliased_action, actions|
-        results += aliases_for_action(aliased_action) if actions.include? action
-      end
-      results
-    end
-
-    def add_rule(rule)
-      rules << rule
-      add_rule_to_index(rule, rules.size - 1)
-    end
-
-    def add_rule_to_index(rule, position)
-      @rules_index ||= Hash.new { |h, k| h[k] = [] }
-
-      subjects = rule.subjects.compact
-      subjects << :all if subjects.empty?
-
-      subjects.each do |subject|
-        @rules_index[subject] << position
-      end
-    end
-
     def alternative_subjects(subject)
       subject = subject.class unless subject.is_a?(Module)
-      [:all, *subject.ancestors,  subject.class.to_s]
-    end
-
-    # Returns an array of Rule instances which match the action and subject
-    # This does not take into consideration any hash conditions or block statements
-    def relevant_rules(action, subject)
-      return [] unless @rules
-      relevant = possible_relevant_rules(subject).select do |rule|
-        rule.expanded_actions = expand_actions(rule.actions)
-        rule.relevant? action, subject
-      end
-      relevant.reverse!.uniq!
-      optimize_order! relevant
-      relevant
-    end
-
-    # Optimizes the order of the rules, so that rules with the :all subject are evaluated first.
-    def optimize_order!(rules)
-      first_can_in_group = -1
-      rules.each_with_index do |rule, i|
-        (first_can_in_group = -1) and next unless rule.base_behavior
-        (first_can_in_group = i) and next if first_can_in_group == -1
-        if rule.subjects == [:all]
-          rules[i] = rules[first_can_in_group]
-          rules[first_can_in_group] = rule
-          first_can_in_group += 1
-        end
-      end
-    end
-
-    def possible_relevant_rules(subject)
-      if subject.is_a?(Hash)
-        rules
-      else
-        positions = @rules_index.values_at(subject, *alternative_subjects(subject))
-        positions.flatten!.sort!
-        positions.map { |i| @rules[i] }
-      end
-    end
-
-    def relevant_rules_for_match(action, subject)
-      relevant_rules(action, subject).each do |rule|
-        if rule.only_raw_sql?
-          raise Error, "The can? and cannot? call cannot be used with a raw sql 'can' definition. The checking code cannot be determined for #{action.inspect} #{subject.inspect}"
-        end
-      end
-    end
-
-    def relevant_rules_for_query(action, subject)
-      relevant_rules(action, subject).each do |rule|
-        if rule.only_block?
-          raise Error, "The accessible_by call cannot be used with a block 'can' definition. The SQL cannot be determined for #{action.inspect} #{subject.inspect}"
-        end
-      end
-    end
-
-    def default_alias_actions
-      {
-        :read => [:index, :show],
-        :create => [:new],
-        :update => [:edit],
-      }
+      [:all, *subject.ancestors, subject.class.to_s]
     end
   end
 end