cancancan 1.17.0 → 2.0.0.rc1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/cancancan.gemspec +4 -6
- data/lib/cancan.rb +2 -11
- data/lib/cancan/ability.rb +1 -1
- data/lib/cancan/controller_additions.rb +3 -24
- data/lib/cancan/controller_resource.rb +9 -25
- data/lib/cancan/matchers.rb +7 -1
- data/lib/cancan/model_adapters/active_record_4_adapter.rb +1 -3
- data/lib/cancan/model_adapters/active_record_adapter.rb +2 -2
- data/lib/cancan/rule.rb +2 -2
- data/lib/cancan/version.rb +1 -1
- metadata +22 -69
- data/.gitignore +0 -15
- data/.rspec +0 -1
- data/.rubocop.yml +0 -39
- data/.rubocop_todo.yml +0 -54
- data/.travis.yml +0 -39
- data/Appraisals +0 -105
- data/CHANGELOG.rdoc +0 -536
- data/CONTRIBUTING.md +0 -23
- data/Gemfile +0 -3
- data/LICENSE +0 -22
- data/README.md +0 -234
- data/Rakefile +0 -13
- data/gemfiles/activerecord_3.2.gemfile +0 -18
- data/gemfiles/activerecord_4.0.gemfile +0 -19
- data/gemfiles/activerecord_4.1.gemfile +0 -19
- data/gemfiles/activerecord_4.2.gemfile +0 -21
- data/gemfiles/activerecord_5.0.gemfile +0 -20
- data/gemfiles/mongoid_2.x.gemfile +0 -18
- data/gemfiles/sequel_3.x.gemfile +0 -18
- data/lib/cancan/inherited_resource.rb +0 -20
- data/lib/cancan/model_adapters/active_record_3_adapter.rb +0 -16
- data/lib/cancan/model_adapters/mongoid_adapter.rb +0 -80
- data/lib/cancan/model_adapters/sequel_adapter.rb +0 -87
- data/spec/README.rdoc +0 -27
- data/spec/cancan/ability_spec.rb +0 -553
- data/spec/cancan/controller_additions_spec.rb +0 -164
- data/spec/cancan/controller_resource_spec.rb +0 -645
- data/spec/cancan/exceptions_spec.rb +0 -58
- data/spec/cancan/inherited_resource_spec.rb +0 -71
- data/spec/cancan/matchers_spec.rb +0 -29
- data/spec/cancan/model_adapters/active_record_4_adapter_spec.rb +0 -160
- data/spec/cancan/model_adapters/active_record_adapter_spec.rb +0 -415
- data/spec/cancan/model_adapters/default_adapter_spec.rb +0 -7
- data/spec/cancan/model_adapters/mongoid_adapter_spec.rb +0 -246
- data/spec/cancan/model_adapters/sequel_adapter_spec.rb +0 -129
- data/spec/cancan/rule_spec.rb +0 -52
- data/spec/matchers.rb +0 -13
- data/spec/spec.opts +0 -2
- data/spec/spec_helper.rb +0 -27
- data/spec/support/ability.rb +0 -6
@@ -1,58 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
describe CanCan::AccessDenied do
|
4
|
-
describe 'with action and subject' do
|
5
|
-
before(:each) do
|
6
|
-
@exception = CanCan::AccessDenied.new(nil, :some_action, :some_subject)
|
7
|
-
end
|
8
|
-
|
9
|
-
it 'has action and subject accessors' do
|
10
|
-
expect(@exception.action).to eq(:some_action)
|
11
|
-
expect(@exception.subject).to eq(:some_subject)
|
12
|
-
end
|
13
|
-
|
14
|
-
it 'has a changable default message' do
|
15
|
-
expect(@exception.message).to eq('You are not authorized to access this page.')
|
16
|
-
@exception.default_message = 'Unauthorized!'
|
17
|
-
expect(@exception.message).to eq('Unauthorized!')
|
18
|
-
end
|
19
|
-
end
|
20
|
-
|
21
|
-
describe 'with only a message' do
|
22
|
-
before(:each) do
|
23
|
-
@exception = CanCan::AccessDenied.new('Access denied!')
|
24
|
-
end
|
25
|
-
|
26
|
-
it 'has nil action and subject' do
|
27
|
-
expect(@exception.action).to be_nil
|
28
|
-
expect(@exception.subject).to be_nil
|
29
|
-
end
|
30
|
-
|
31
|
-
it 'has passed message' do
|
32
|
-
expect(@exception.message).to eq('Access denied!')
|
33
|
-
end
|
34
|
-
end
|
35
|
-
|
36
|
-
describe 'i18n in the default message' do
|
37
|
-
after(:each) do
|
38
|
-
I18n.backend = nil
|
39
|
-
end
|
40
|
-
|
41
|
-
it 'uses i18n for the default message' do
|
42
|
-
I18n.backend.store_translations :en, unauthorized: { default: 'This is a different message' }
|
43
|
-
@exception = CanCan::AccessDenied.new
|
44
|
-
expect(@exception.message).to eq('This is a different message')
|
45
|
-
end
|
46
|
-
|
47
|
-
it 'defaults to a nice message' do
|
48
|
-
@exception = CanCan::AccessDenied.new
|
49
|
-
expect(@exception.message).to eq('You are not authorized to access this page.')
|
50
|
-
end
|
51
|
-
|
52
|
-
it 'does not use translation if a message is given' do
|
53
|
-
@exception = CanCan::AccessDenied.new("Hey! You're not welcome here")
|
54
|
-
expect(@exception.message).to eq("Hey! You're not welcome here")
|
55
|
-
expect(@exception.message).to_not eq('You are not authorized to access this page.')
|
56
|
-
end
|
57
|
-
end
|
58
|
-
end
|
@@ -1,71 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
describe CanCan::InheritedResource do
|
4
|
-
let(:ability) { Ability.new(nil) }
|
5
|
-
let(:params) { HashWithIndifferentAccess.new(controller: 'models') }
|
6
|
-
let(:controller_class) { Class.new }
|
7
|
-
let(:controller) { controller_class.new }
|
8
|
-
|
9
|
-
before(:each) do
|
10
|
-
class Model
|
11
|
-
attr_accessor :name
|
12
|
-
|
13
|
-
def initialize(attributes = {})
|
14
|
-
attributes.each do |attribute, value|
|
15
|
-
send("#{attribute}=", value)
|
16
|
-
end
|
17
|
-
end
|
18
|
-
end
|
19
|
-
|
20
|
-
allow(controller).to receive(:params) { params }
|
21
|
-
allow(controller).to receive(:current_ability) { ability }
|
22
|
-
allow(controller_class).to receive(:cancan_skipper) { { authorize: {}, load: {} } }
|
23
|
-
end
|
24
|
-
|
25
|
-
it 'show loads resource through controller.resource' do
|
26
|
-
params.merge!(action: 'show', id: 123)
|
27
|
-
allow(controller).to receive(:resource) { :model_resource }
|
28
|
-
CanCan::InheritedResource.new(controller).load_resource
|
29
|
-
expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
|
30
|
-
end
|
31
|
-
|
32
|
-
it 'new loads through controller.build_resource' do
|
33
|
-
params[:action] = 'new'
|
34
|
-
allow(controller).to receive(:build_resource) { :model_resource }
|
35
|
-
CanCan::InheritedResource.new(controller).load_resource
|
36
|
-
expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
|
37
|
-
end
|
38
|
-
|
39
|
-
it 'index loads through controller.association_chain when parent' do
|
40
|
-
params[:action] = 'index'
|
41
|
-
allow(controller).to receive(:association_chain) { controller.instance_variable_set(:@model, :model_resource) }
|
42
|
-
CanCan::InheritedResource.new(controller, parent: true).load_resource
|
43
|
-
expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
|
44
|
-
end
|
45
|
-
|
46
|
-
it 'index loads through controller.end_of_association_chain' do
|
47
|
-
params[:action] = 'index'
|
48
|
-
allow(Model).to receive(:accessible_by).with(ability, :index) { :projects }
|
49
|
-
allow(controller).to receive(:end_of_association_chain) { Model }
|
50
|
-
CanCan::InheritedResource.new(controller).load_resource
|
51
|
-
expect(controller.instance_variable_get(:@models)).to eq(:projects)
|
52
|
-
end
|
53
|
-
|
54
|
-
it 'builds a new resource with attributes from current ability' do
|
55
|
-
params[:action] = 'new'
|
56
|
-
ability.can(:create, Model, name: 'from conditions')
|
57
|
-
allow(controller).to receive(:build_resource) { Struct.new(:name).new }
|
58
|
-
resource = CanCan::InheritedResource.new(controller)
|
59
|
-
resource.load_resource
|
60
|
-
expect(controller.instance_variable_get(:@model).name).to eq('from conditions')
|
61
|
-
end
|
62
|
-
|
63
|
-
it 'overrides initial attributes with params' do
|
64
|
-
params.merge!(action: 'new', model: { name: 'from params' })
|
65
|
-
ability.can(:create, Model, name: 'from conditions')
|
66
|
-
allow(controller).to receive(:build_resource) { Struct.new(:name).new }
|
67
|
-
resource = CanCan::ControllerResource.new(controller)
|
68
|
-
resource.load_resource
|
69
|
-
expect(controller.instance_variable_get(:@model).name).to eq('from params')
|
70
|
-
end
|
71
|
-
end
|
@@ -1,29 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
describe 'be_able_to' do
|
4
|
-
it 'delegates to can?' do
|
5
|
-
expect(object = double).to receive(:can?).with(:read, 123) { true }
|
6
|
-
expect(object).to be_able_to(:read, 123)
|
7
|
-
end
|
8
|
-
|
9
|
-
it 'reports a nice failure message for should' do
|
10
|
-
expect(object = double).to receive(:can?).with(:read, 123) { false }
|
11
|
-
expect do
|
12
|
-
expect(object).to be_able_to(:read, 123)
|
13
|
-
end.to raise_error('expected to be able to :read 123')
|
14
|
-
end
|
15
|
-
|
16
|
-
it 'reports a nice failure message for should not' do
|
17
|
-
expect(object = double).to receive(:can?).with(:read, 123) { true }
|
18
|
-
expect do
|
19
|
-
expect(object).to_not be_able_to(:read, 123)
|
20
|
-
end.to raise_error('expected not to be able to :read 123')
|
21
|
-
end
|
22
|
-
|
23
|
-
it 'delegates additional arguments to can? and reports in failure message' do
|
24
|
-
expect(object = double).to receive(:can?).with(:read, 123, 456) { false }
|
25
|
-
expect do
|
26
|
-
expect(object).to be_able_to(:read, 123, 456)
|
27
|
-
end.to raise_error('expected to be able to :read 123 456')
|
28
|
-
end
|
29
|
-
end
|
@@ -1,160 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
if defined? CanCan::ModelAdapters::ActiveRecord4Adapter
|
4
|
-
describe CanCan::ModelAdapters::ActiveRecord4Adapter do
|
5
|
-
context 'with sqlite3' do
|
6
|
-
before :each do
|
7
|
-
ActiveRecord::Base.establish_connection(adapter: 'sqlite3', database: ':memory:')
|
8
|
-
ActiveRecord::Migration.verbose = false
|
9
|
-
ActiveRecord::Schema.define do
|
10
|
-
create_table(:parents) do |t|
|
11
|
-
t.timestamps null: false
|
12
|
-
end
|
13
|
-
|
14
|
-
create_table(:children) do |t|
|
15
|
-
t.timestamps null: false
|
16
|
-
t.integer :parent_id
|
17
|
-
end
|
18
|
-
end
|
19
|
-
|
20
|
-
class Parent < ActiveRecord::Base
|
21
|
-
has_many :children, -> { order(id: :desc) }
|
22
|
-
end
|
23
|
-
|
24
|
-
class Child < ActiveRecord::Base
|
25
|
-
belongs_to :parent
|
26
|
-
end
|
27
|
-
|
28
|
-
(@ability = double).extend(CanCan::Ability)
|
29
|
-
end
|
30
|
-
|
31
|
-
it 'respects scope on included associations' do
|
32
|
-
@ability.can :read, [Parent, Child]
|
33
|
-
|
34
|
-
parent = Parent.create!
|
35
|
-
child1 = Child.create!(parent: parent, created_at: 1.hours.ago)
|
36
|
-
child2 = Child.create!(parent: parent, created_at: 2.hours.ago)
|
37
|
-
|
38
|
-
expect(Parent.accessible_by(@ability).order(created_at: :asc).includes(:children).first.children)
|
39
|
-
.to eq [child2, child1]
|
40
|
-
end
|
41
|
-
|
42
|
-
if ActiveRecord::VERSION::MINOR >= 1
|
43
|
-
it 'allows filters on enums' do
|
44
|
-
ActiveRecord::Schema.define do
|
45
|
-
create_table(:shapes) do |t|
|
46
|
-
t.integer :color, default: 0, null: false
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
class Shape < ActiveRecord::Base
|
51
|
-
enum color: [:red, :green, :blue]
|
52
|
-
end
|
53
|
-
|
54
|
-
red = Shape.create!(color: :red)
|
55
|
-
green = Shape.create!(color: :green)
|
56
|
-
blue = Shape.create!(color: :blue)
|
57
|
-
|
58
|
-
# A condition with a single value.
|
59
|
-
@ability.can :read, Shape, color: Shape.colors[:green]
|
60
|
-
|
61
|
-
expect(@ability.cannot?(:read, red)).to be true
|
62
|
-
expect(@ability.can?(:read, green)).to be true
|
63
|
-
expect(@ability.cannot?(:read, blue)).to be true
|
64
|
-
|
65
|
-
accessible = Shape.accessible_by(@ability)
|
66
|
-
expect(accessible).to contain_exactly(green)
|
67
|
-
|
68
|
-
# A condition with multiple values.
|
69
|
-
@ability.can :update, Shape, color: [Shape.colors[:red],
|
70
|
-
Shape.colors[:blue]]
|
71
|
-
|
72
|
-
expect(@ability.can?(:update, red)).to be true
|
73
|
-
expect(@ability.cannot?(:update, green)).to be true
|
74
|
-
expect(@ability.can?(:update, blue)).to be true
|
75
|
-
|
76
|
-
accessible = Shape.accessible_by(@ability, :update)
|
77
|
-
expect(accessible).to contain_exactly(red, blue)
|
78
|
-
end
|
79
|
-
|
80
|
-
it 'allows dual filter on enums' do
|
81
|
-
ActiveRecord::Schema.define do
|
82
|
-
create_table(:discs) do |t|
|
83
|
-
t.integer :color, default: 0, null: false
|
84
|
-
t.integer :shape, default: 3, null: false
|
85
|
-
end
|
86
|
-
end
|
87
|
-
|
88
|
-
class Disc < ActiveRecord::Base
|
89
|
-
enum color: [:red, :green, :blue]
|
90
|
-
enum shape: { triangle: 3, rectangle: 4 }
|
91
|
-
end
|
92
|
-
|
93
|
-
red_triangle = Disc.create!(color: Disc.colors[:red], shape: Disc.shapes[:triangle])
|
94
|
-
green_triangle = Disc.create!(color: Disc.colors[:green], shape: Disc.shapes[:triangle])
|
95
|
-
green_rectangle = Disc.create!(color: Disc.colors[:green], shape: Disc.shapes[:rectangle])
|
96
|
-
blue_rectangle = Disc.create!(color: Disc.colors[:blue], shape: Disc.shapes[:rectangle])
|
97
|
-
|
98
|
-
# A condition with a dual filter.
|
99
|
-
@ability.can :read, Disc, color: Disc.colors[:green], shape: Disc.shapes[:rectangle]
|
100
|
-
|
101
|
-
expect(@ability.cannot?(:read, red_triangle)).to be true
|
102
|
-
expect(@ability.cannot?(:read, green_triangle)).to be true
|
103
|
-
expect(@ability.can?(:read, green_rectangle)).to be true
|
104
|
-
expect(@ability.cannot?(:read, blue_rectangle)).to be true
|
105
|
-
|
106
|
-
accessible = Disc.accessible_by(@ability)
|
107
|
-
expect(accessible).to contain_exactly(green_rectangle)
|
108
|
-
end
|
109
|
-
end
|
110
|
-
end
|
111
|
-
|
112
|
-
if Gem::Specification.find_all_by_name('pg').any?
|
113
|
-
context 'with postgresql' do
|
114
|
-
before :each do
|
115
|
-
ActiveRecord::Base.establish_connection(adapter: 'postgresql',
|
116
|
-
database: 'postgres',
|
117
|
-
schema_search_path: 'public')
|
118
|
-
ActiveRecord::Base.connection.drop_database('cancan_postgresql_spec')
|
119
|
-
ActiveRecord::Base.connection.create_database('cancan_postgresql_spec',
|
120
|
-
'encoding' => 'utf-8',
|
121
|
-
'adapter' => 'postgresql')
|
122
|
-
ActiveRecord::Base.establish_connection(adapter: 'postgresql',
|
123
|
-
database: 'cancan_postgresql_spec')
|
124
|
-
ActiveRecord::Migration.verbose = false
|
125
|
-
ActiveRecord::Schema.define do
|
126
|
-
create_table(:parents) do |t|
|
127
|
-
t.timestamps null: false
|
128
|
-
end
|
129
|
-
|
130
|
-
create_table(:children) do |t|
|
131
|
-
t.timestamps null: false
|
132
|
-
t.integer :parent_id
|
133
|
-
end
|
134
|
-
end
|
135
|
-
|
136
|
-
class Parent < ActiveRecord::Base
|
137
|
-
has_many :children, -> { order(id: :desc) }
|
138
|
-
end
|
139
|
-
|
140
|
-
class Child < ActiveRecord::Base
|
141
|
-
belongs_to :parent
|
142
|
-
end
|
143
|
-
|
144
|
-
(@ability = double).extend(CanCan::Ability)
|
145
|
-
end
|
146
|
-
|
147
|
-
it 'allows overlapping conditions in SQL and merge with hash conditions' do
|
148
|
-
@ability.can :read, Parent, children: { parent_id: 1 }
|
149
|
-
@ability.can :read, Parent, children: { parent_id: 1 }
|
150
|
-
|
151
|
-
parent = Parent.create!
|
152
|
-
Child.create!(parent: parent, created_at: 1.hours.ago)
|
153
|
-
Child.create!(parent: parent, created_at: 2.hours.ago)
|
154
|
-
|
155
|
-
expect(Parent.accessible_by(@ability)).to eq([parent])
|
156
|
-
end
|
157
|
-
end
|
158
|
-
end
|
159
|
-
end
|
160
|
-
end
|
@@ -1,415 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
if defined? CanCan::ModelAdapters::ActiveRecordAdapter
|
4
|
-
|
5
|
-
describe CanCan::ModelAdapters::ActiveRecordAdapter do
|
6
|
-
before :each do
|
7
|
-
ActiveRecord::Base.establish_connection(adapter: 'sqlite3', database: ':memory:')
|
8
|
-
ActiveRecord::Migration.verbose = false
|
9
|
-
ActiveRecord::Schema.define do
|
10
|
-
create_table(:categories) do |t|
|
11
|
-
t.string :name
|
12
|
-
t.boolean :visible
|
13
|
-
t.timestamps null: false
|
14
|
-
end
|
15
|
-
|
16
|
-
create_table(:projects) do |t|
|
17
|
-
t.string :name
|
18
|
-
t.timestamps null: false
|
19
|
-
end
|
20
|
-
|
21
|
-
create_table(:articles) do |t|
|
22
|
-
t.string :name
|
23
|
-
t.timestamps null: false
|
24
|
-
t.boolean :published
|
25
|
-
t.boolean :secret
|
26
|
-
t.integer :priority
|
27
|
-
t.integer :category_id
|
28
|
-
t.integer :user_id
|
29
|
-
end
|
30
|
-
|
31
|
-
create_table(:comments) do |t|
|
32
|
-
t.boolean :spam
|
33
|
-
t.integer :article_id
|
34
|
-
t.timestamps null: false
|
35
|
-
end
|
36
|
-
|
37
|
-
create_table(:legacy_mentions) do |t|
|
38
|
-
t.integer :user_id
|
39
|
-
t.integer :article_id
|
40
|
-
t.timestamps null: false
|
41
|
-
end
|
42
|
-
|
43
|
-
create_table(:users) do |t|
|
44
|
-
t.timestamps null: false
|
45
|
-
end
|
46
|
-
end
|
47
|
-
|
48
|
-
class Project < ActiveRecord::Base
|
49
|
-
end
|
50
|
-
|
51
|
-
class Category < ActiveRecord::Base
|
52
|
-
has_many :articles
|
53
|
-
end
|
54
|
-
|
55
|
-
class Article < ActiveRecord::Base
|
56
|
-
belongs_to :category
|
57
|
-
has_many :comments
|
58
|
-
has_many :mentions
|
59
|
-
has_many :mentioned_users, through: :mentions, source: :user
|
60
|
-
belongs_to :user
|
61
|
-
end
|
62
|
-
|
63
|
-
class Mention < ActiveRecord::Base
|
64
|
-
self.table_name = 'legacy_mentions'
|
65
|
-
belongs_to :user
|
66
|
-
belongs_to :article
|
67
|
-
end
|
68
|
-
|
69
|
-
class Comment < ActiveRecord::Base
|
70
|
-
belongs_to :article
|
71
|
-
end
|
72
|
-
|
73
|
-
class User < ActiveRecord::Base
|
74
|
-
has_many :articles
|
75
|
-
end
|
76
|
-
|
77
|
-
(@ability = double).extend(CanCan::Ability)
|
78
|
-
@article_table = Article.table_name
|
79
|
-
@comment_table = Comment.table_name
|
80
|
-
end
|
81
|
-
|
82
|
-
it 'is for only active record classes' do
|
83
|
-
if ActiveRecord.respond_to?(:version) &&
|
84
|
-
ActiveRecord.version > Gem::Version.new('4')
|
85
|
-
expect(CanCan::ModelAdapters::ActiveRecord4Adapter).to_not be_for_class(Object)
|
86
|
-
expect(CanCan::ModelAdapters::ActiveRecord4Adapter).to be_for_class(Article)
|
87
|
-
expect(CanCan::ModelAdapters::AbstractAdapter.adapter_class(Article))
|
88
|
-
.to eq(CanCan::ModelAdapters::ActiveRecord4Adapter)
|
89
|
-
else
|
90
|
-
expect(CanCan::ModelAdapters::ActiveRecord3Adapter).to_not be_for_class(Object)
|
91
|
-
expect(CanCan::ModelAdapters::ActiveRecord3Adapter).to be_for_class(Article)
|
92
|
-
expect(CanCan::ModelAdapters::AbstractAdapter.adapter_class(Article))
|
93
|
-
.to eq(CanCan::ModelAdapters::ActiveRecord3Adapter)
|
94
|
-
end
|
95
|
-
end
|
96
|
-
|
97
|
-
it 'finds record' do
|
98
|
-
article = Article.create!
|
99
|
-
adapter = CanCan::ModelAdapters::AbstractAdapter.adapter_class(Article)
|
100
|
-
expect(adapter.find(Article, article.id)).to eq(article)
|
101
|
-
end
|
102
|
-
|
103
|
-
it 'does not fetch any records when no abilities are defined' do
|
104
|
-
Article.create!
|
105
|
-
expect(Article.accessible_by(@ability)).to be_empty
|
106
|
-
end
|
107
|
-
|
108
|
-
it 'fetches all articles when one can read all' do
|
109
|
-
@ability.can :read, Article
|
110
|
-
article = Article.create!
|
111
|
-
expect(Article.accessible_by(@ability)).to eq([article])
|
112
|
-
end
|
113
|
-
|
114
|
-
it 'fetches only the articles that are published' do
|
115
|
-
@ability.can :read, Article, published: true
|
116
|
-
article1 = Article.create!(published: true)
|
117
|
-
Article.create!(published: false)
|
118
|
-
expect(Article.accessible_by(@ability)).to eq([article1])
|
119
|
-
end
|
120
|
-
|
121
|
-
it 'fetches any articles which are published or secret' do
|
122
|
-
@ability.can :read, Article, published: true
|
123
|
-
@ability.can :read, Article, secret: true
|
124
|
-
article1 = Article.create!(published: true, secret: false)
|
125
|
-
article2 = Article.create!(published: true, secret: true)
|
126
|
-
article3 = Article.create!(published: false, secret: true)
|
127
|
-
Article.create!(published: false, secret: false)
|
128
|
-
expect(Article.accessible_by(@ability)).to eq([article1, article2, article3])
|
129
|
-
end
|
130
|
-
|
131
|
-
it 'fetches any articles which we are cited in' do
|
132
|
-
user = User.create!
|
133
|
-
cited = Article.create!
|
134
|
-
Article.create!
|
135
|
-
cited.mentioned_users << user
|
136
|
-
@ability.can :read, Article, mentioned_users: { id: user.id }
|
137
|
-
@ability.can :read, Article, mentions: { user_id: user.id }
|
138
|
-
expect(Article.accessible_by(@ability)).to eq([cited])
|
139
|
-
end
|
140
|
-
|
141
|
-
it 'fetches only the articles that are published and not secret' do
|
142
|
-
@ability.can :read, Article, published: true
|
143
|
-
@ability.cannot :read, Article, secret: true
|
144
|
-
article1 = Article.create!(published: true, secret: false)
|
145
|
-
Article.create!(published: true, secret: true)
|
146
|
-
Article.create!(published: false, secret: true)
|
147
|
-
Article.create!(published: false, secret: false)
|
148
|
-
expect(Article.accessible_by(@ability)).to eq([article1])
|
149
|
-
end
|
150
|
-
|
151
|
-
it 'only reads comments for articles which are published' do
|
152
|
-
@ability.can :read, Comment, article: { published: true }
|
153
|
-
comment1 = Comment.create!(article: Article.create!(published: true))
|
154
|
-
Comment.create!(article: Article.create!(published: false))
|
155
|
-
expect(Comment.accessible_by(@ability)).to eq([comment1])
|
156
|
-
end
|
157
|
-
|
158
|
-
it 'should only read articles which are published or in visible categories' do
|
159
|
-
@ability.can :read, Article, category: { visible: true }
|
160
|
-
@ability.can :read, Article, published: true
|
161
|
-
article1 = Article.create!(published: true)
|
162
|
-
Article.create!(published: false)
|
163
|
-
article3 = Article.create!(published: false, category: Category.create!(visible: true))
|
164
|
-
expect(Article.accessible_by(@ability)).to eq([article1, article3])
|
165
|
-
end
|
166
|
-
|
167
|
-
it 'should only read categories once even if they have multiple articles' do
|
168
|
-
@ability.can :read, Category, articles: { published: true }
|
169
|
-
@ability.can :read, Article, published: true
|
170
|
-
category = Category.create!
|
171
|
-
Article.create!(published: true, category: category)
|
172
|
-
Article.create!(published: true, category: category)
|
173
|
-
expect(Category.accessible_by(@ability)).to eq([category])
|
174
|
-
end
|
175
|
-
|
176
|
-
it 'only reads comments for visible categories through articles' do
|
177
|
-
@ability.can :read, Comment, article: { category: { visible: true } }
|
178
|
-
comment1 = Comment.create!(article: Article.create!(category: Category.create!(visible: true)))
|
179
|
-
Comment.create!(article: Article.create!(category: Category.create!(visible: false)))
|
180
|
-
expect(Comment.accessible_by(@ability)).to eq([comment1])
|
181
|
-
end
|
182
|
-
|
183
|
-
it 'allows conditions in SQL and merge with hash conditions' do
|
184
|
-
@ability.can :read, Article, published: true
|
185
|
-
@ability.can :read, Article, ['secret=?', true]
|
186
|
-
article1 = Article.create!(published: true, secret: false)
|
187
|
-
article2 = Article.create!(published: true, secret: true)
|
188
|
-
article3 = Article.create!(published: false, secret: true)
|
189
|
-
Article.create!(published: false, secret: false)
|
190
|
-
expect(Article.accessible_by(@ability)).to eq([article1, article2, article3])
|
191
|
-
end
|
192
|
-
|
193
|
-
it 'allows a scope for conditions' do
|
194
|
-
@ability.can :read, Article, Article.where(secret: true)
|
195
|
-
article1 = Article.create!(secret: true)
|
196
|
-
Article.create!(secret: false)
|
197
|
-
expect(Article.accessible_by(@ability)).to eq([article1])
|
198
|
-
end
|
199
|
-
|
200
|
-
it 'fetches only associated records when using with a scope for conditions' do
|
201
|
-
@ability.can :read, Article, Article.where(secret: true)
|
202
|
-
category1 = Category.create!(visible: false)
|
203
|
-
category2 = Category.create!(visible: true)
|
204
|
-
article1 = Article.create!(secret: true, category: category1)
|
205
|
-
Article.create!(secret: true, category: category2)
|
206
|
-
expect(category1.articles.accessible_by(@ability)).to eq([article1])
|
207
|
-
end
|
208
|
-
|
209
|
-
it 'raises an exception when trying to merge scope with other conditions' do
|
210
|
-
@ability.can :read, Article, published: true
|
211
|
-
@ability.can :read, Article, Article.where(secret: true)
|
212
|
-
expect(-> { Article.accessible_by(@ability) })
|
213
|
-
.to raise_error(CanCan::Error,
|
214
|
-
'Unable to merge an Active Record scope with other conditions. '\
|
215
|
-
'Instead use a hash or SQL for read Article ability.')
|
216
|
-
end
|
217
|
-
|
218
|
-
it 'does not allow to fetch records when ability with just block present' do
|
219
|
-
@ability.can :read, Article do
|
220
|
-
false
|
221
|
-
end
|
222
|
-
expect(-> { Article.accessible_by(@ability) }).to raise_error(CanCan::Error)
|
223
|
-
end
|
224
|
-
|
225
|
-
it 'should support more than one deeply nested conditions' do
|
226
|
-
@ability.can :read, Comment, article: {
|
227
|
-
category: {
|
228
|
-
name: 'foo', visible: true
|
229
|
-
}
|
230
|
-
}
|
231
|
-
expect { Comment.accessible_by(@ability) }.to_not raise_error
|
232
|
-
end
|
233
|
-
|
234
|
-
it 'does not allow to check ability on object against SQL conditions without block' do
|
235
|
-
@ability.can :read, Article, ['secret=?', true]
|
236
|
-
expect(-> { @ability.can? :read, Article.new }).to raise_error(CanCan::Error)
|
237
|
-
end
|
238
|
-
|
239
|
-
it 'has false conditions if no abilities match' do
|
240
|
-
expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='f'")
|
241
|
-
end
|
242
|
-
|
243
|
-
it 'returns false conditions for cannot clause' do
|
244
|
-
@ability.cannot :read, Article
|
245
|
-
expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='f'")
|
246
|
-
end
|
247
|
-
|
248
|
-
it 'returns SQL for single `can` definition in front of default `cannot` condition' do
|
249
|
-
@ability.cannot :read, Article
|
250
|
-
@ability.can :read, Article, published: false, secret: true
|
251
|
-
expect(@ability.model_adapter(Article, :read).conditions)
|
252
|
-
.to orderlessly_match(%("#{@article_table}"."published" = 'f' AND "#{@article_table}"."secret" = 't'))
|
253
|
-
end
|
254
|
-
|
255
|
-
it 'returns true condition for single `can` definition in front of default `can` condition' do
|
256
|
-
@ability.can :read, Article
|
257
|
-
@ability.can :read, Article, published: false, secret: true
|
258
|
-
expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='t'")
|
259
|
-
end
|
260
|
-
|
261
|
-
it 'returns `false condition` for single `cannot` definition in front of default `cannot` condition' do
|
262
|
-
@ability.cannot :read, Article
|
263
|
-
@ability.cannot :read, Article, published: false, secret: true
|
264
|
-
expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='f'")
|
265
|
-
end
|
266
|
-
|
267
|
-
it 'returns `not (sql)` for single `cannot` definition in front of default `can` condition' do
|
268
|
-
@ability.can :read, Article
|
269
|
-
@ability.cannot :read, Article, published: false, secret: true
|
270
|
-
expect(@ability.model_adapter(Article, :read).conditions)
|
271
|
-
.to orderlessly_match(%["not (#{@article_table}"."published" = 'f' AND "#{@article_table}"."secret" = 't')])
|
272
|
-
end
|
273
|
-
|
274
|
-
it 'returns appropriate sql conditions in complex case' do
|
275
|
-
@ability.can :read, Article
|
276
|
-
@ability.can :manage, Article, id: 1
|
277
|
-
@ability.can :update, Article, published: true
|
278
|
-
@ability.cannot :update, Article, secret: true
|
279
|
-
expect(@ability.model_adapter(Article, :update).conditions)
|
280
|
-
.to eq(%[not ("#{@article_table}"."secret" = 't') ] +
|
281
|
-
%[AND (("#{@article_table}"."published" = 't') ] +
|
282
|
-
%[OR ("#{@article_table}"."id" = 1))])
|
283
|
-
expect(@ability.model_adapter(Article, :manage).conditions).to eq(id: 1)
|
284
|
-
expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='t'")
|
285
|
-
end
|
286
|
-
|
287
|
-
it 'returns appropriate sql conditions in complex case with nested joins' do
|
288
|
-
@ability.can :read, Comment, article: { category: { visible: true } }
|
289
|
-
expect(@ability.model_adapter(Comment, :read).conditions).to eq(Category.table_name.to_sym => { visible: true })
|
290
|
-
end
|
291
|
-
|
292
|
-
it 'returns appropriate sql conditions in complex case with nested joins of different depth' do
|
293
|
-
@ability.can :read, Comment, article: { published: true, category: { visible: true } }
|
294
|
-
expect(@ability.model_adapter(Comment, :read).conditions)
|
295
|
-
.to eq(Article.table_name.to_sym => { published: true }, Category.table_name.to_sym => { visible: true })
|
296
|
-
end
|
297
|
-
|
298
|
-
it 'does not forget conditions when calling with SQL string' do
|
299
|
-
@ability.can :read, Article, published: true
|
300
|
-
@ability.can :read, Article, ['secret=?', false]
|
301
|
-
adapter = @ability.model_adapter(Article, :read)
|
302
|
-
2.times do
|
303
|
-
expect(adapter.conditions).to eq(%[(secret='f') OR ("#{@article_table}"."published" = 't')])
|
304
|
-
end
|
305
|
-
end
|
306
|
-
|
307
|
-
it 'has nil joins if no rules' do
|
308
|
-
expect(@ability.model_adapter(Article, :read).joins).to be_nil
|
309
|
-
end
|
310
|
-
|
311
|
-
it 'has nil joins if no nested hashes specified in conditions' do
|
312
|
-
@ability.can :read, Article, published: false
|
313
|
-
@ability.can :read, Article, secret: true
|
314
|
-
expect(@ability.model_adapter(Article, :read).joins).to be_nil
|
315
|
-
end
|
316
|
-
|
317
|
-
it 'merges separate joins into a single array' do
|
318
|
-
@ability.can :read, Article, project: { blocked: false }
|
319
|
-
@ability.can :read, Article, company: { admin: true }
|
320
|
-
expect(@ability.model_adapter(Article, :read).joins.inspect).to orderlessly_match([:company, :project].inspect)
|
321
|
-
end
|
322
|
-
|
323
|
-
it 'merges same joins into a single array' do
|
324
|
-
@ability.can :read, Article, project: { blocked: false }
|
325
|
-
@ability.can :read, Article, project: { admin: true }
|
326
|
-
expect(@ability.model_adapter(Article, :read).joins).to eq([:project])
|
327
|
-
end
|
328
|
-
|
329
|
-
it 'merges nested and non-nested joins' do
|
330
|
-
@ability.can :read, Article, project: { blocked: false }
|
331
|
-
@ability.can :read, Article, project: { comments: { spam: true } }
|
332
|
-
expect(@ability.model_adapter(Article, :read).joins).to eq([{ project: [:comments] }])
|
333
|
-
end
|
334
|
-
|
335
|
-
it 'merges :all conditions with other conditions' do
|
336
|
-
user = User.create!
|
337
|
-
article = Article.create!(user: user)
|
338
|
-
ability = Ability.new(user)
|
339
|
-
ability.can :manage, :all
|
340
|
-
ability.can :manage, Article, user_id: user.id
|
341
|
-
expect(Article.accessible_by(ability)).to eq([article])
|
342
|
-
end
|
343
|
-
|
344
|
-
it 'should not execute a scope when checking ability on the class' do
|
345
|
-
relation = Article.where(secret: true)
|
346
|
-
@ability.can :read, Article, relation do |article|
|
347
|
-
article.secret == true
|
348
|
-
end
|
349
|
-
|
350
|
-
allow(relation).to receive(:count).and_raise('Unexpected scope execution.')
|
351
|
-
|
352
|
-
expect { @ability.can? :read, Article }.not_to raise_error
|
353
|
-
end
|
354
|
-
|
355
|
-
context 'with namespaced models' do
|
356
|
-
before :each do
|
357
|
-
ActiveRecord::Schema.define do
|
358
|
-
create_table(:table_xes) do |t|
|
359
|
-
t.timestamps null: false
|
360
|
-
end
|
361
|
-
|
362
|
-
create_table(:table_zs) do |t|
|
363
|
-
t.integer :table_x_id
|
364
|
-
t.integer :user_id
|
365
|
-
t.timestamps null: false
|
366
|
-
end
|
367
|
-
end
|
368
|
-
|
369
|
-
module Namespace
|
370
|
-
end
|
371
|
-
|
372
|
-
class Namespace::TableX < ActiveRecord::Base
|
373
|
-
has_many :table_zs
|
374
|
-
end
|
375
|
-
|
376
|
-
class Namespace::TableZ < ActiveRecord::Base
|
377
|
-
belongs_to :table_x
|
378
|
-
belongs_to :user
|
379
|
-
end
|
380
|
-
end
|
381
|
-
|
382
|
-
it 'fetches all namespace::table_x when one is related by table_y' do
|
383
|
-
user = User.create!
|
384
|
-
|
385
|
-
ability = Ability.new(user)
|
386
|
-
ability.can :read, Namespace::TableX, table_zs: { user_id: user.id }
|
387
|
-
|
388
|
-
table_x = Namespace::TableX.create!
|
389
|
-
table_x.table_zs.create(user: user)
|
390
|
-
expect(Namespace::TableX.accessible_by(ability)).to eq([table_x])
|
391
|
-
end
|
392
|
-
end
|
393
|
-
|
394
|
-
context 'when conditions are non iterable ranges' do
|
395
|
-
before :each do
|
396
|
-
ActiveRecord::Schema.define do
|
397
|
-
create_table(:courses) do |t|
|
398
|
-
t.datetime :start_at
|
399
|
-
end
|
400
|
-
end
|
401
|
-
|
402
|
-
class Course < ActiveRecord::Base
|
403
|
-
end
|
404
|
-
end
|
405
|
-
|
406
|
-
it 'fetches only the valid records' do
|
407
|
-
@ability.can :read, Course, start_at: 1.day.ago..1.day.from_now
|
408
|
-
Course.create!(start_at: 10.days.ago)
|
409
|
-
valid_course = Course.create!(start_at: Time.now)
|
410
|
-
|
411
|
-
expect(Course.accessible_by(@ability)).to eq([valid_course])
|
412
|
-
end
|
413
|
-
end
|
414
|
-
end
|
415
|
-
end
|