cancancan 1.17.0 → 2.0.0.rc1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (52) hide show
  1. checksums.yaml +4 -4
  2. data/cancancan.gemspec +4 -6
  3. data/lib/cancan.rb +2 -11
  4. data/lib/cancan/ability.rb +1 -1
  5. data/lib/cancan/controller_additions.rb +3 -24
  6. data/lib/cancan/controller_resource.rb +9 -25
  7. data/lib/cancan/matchers.rb +7 -1
  8. data/lib/cancan/model_adapters/active_record_4_adapter.rb +1 -3
  9. data/lib/cancan/model_adapters/active_record_adapter.rb +2 -2
  10. data/lib/cancan/rule.rb +2 -2
  11. data/lib/cancan/version.rb +1 -1
  12. metadata +22 -69
  13. data/.gitignore +0 -15
  14. data/.rspec +0 -1
  15. data/.rubocop.yml +0 -39
  16. data/.rubocop_todo.yml +0 -54
  17. data/.travis.yml +0 -39
  18. data/Appraisals +0 -105
  19. data/CHANGELOG.rdoc +0 -536
  20. data/CONTRIBUTING.md +0 -23
  21. data/Gemfile +0 -3
  22. data/LICENSE +0 -22
  23. data/README.md +0 -234
  24. data/Rakefile +0 -13
  25. data/gemfiles/activerecord_3.2.gemfile +0 -18
  26. data/gemfiles/activerecord_4.0.gemfile +0 -19
  27. data/gemfiles/activerecord_4.1.gemfile +0 -19
  28. data/gemfiles/activerecord_4.2.gemfile +0 -21
  29. data/gemfiles/activerecord_5.0.gemfile +0 -20
  30. data/gemfiles/mongoid_2.x.gemfile +0 -18
  31. data/gemfiles/sequel_3.x.gemfile +0 -18
  32. data/lib/cancan/inherited_resource.rb +0 -20
  33. data/lib/cancan/model_adapters/active_record_3_adapter.rb +0 -16
  34. data/lib/cancan/model_adapters/mongoid_adapter.rb +0 -80
  35. data/lib/cancan/model_adapters/sequel_adapter.rb +0 -87
  36. data/spec/README.rdoc +0 -27
  37. data/spec/cancan/ability_spec.rb +0 -553
  38. data/spec/cancan/controller_additions_spec.rb +0 -164
  39. data/spec/cancan/controller_resource_spec.rb +0 -645
  40. data/spec/cancan/exceptions_spec.rb +0 -58
  41. data/spec/cancan/inherited_resource_spec.rb +0 -71
  42. data/spec/cancan/matchers_spec.rb +0 -29
  43. data/spec/cancan/model_adapters/active_record_4_adapter_spec.rb +0 -160
  44. data/spec/cancan/model_adapters/active_record_adapter_spec.rb +0 -415
  45. data/spec/cancan/model_adapters/default_adapter_spec.rb +0 -7
  46. data/spec/cancan/model_adapters/mongoid_adapter_spec.rb +0 -246
  47. data/spec/cancan/model_adapters/sequel_adapter_spec.rb +0 -129
  48. data/spec/cancan/rule_spec.rb +0 -52
  49. data/spec/matchers.rb +0 -13
  50. data/spec/spec.opts +0 -2
  51. data/spec/spec_helper.rb +0 -27
  52. data/spec/support/ability.rb +0 -6
@@ -1,58 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CanCan::AccessDenied do
4
- describe 'with action and subject' do
5
- before(:each) do
6
- @exception = CanCan::AccessDenied.new(nil, :some_action, :some_subject)
7
- end
8
-
9
- it 'has action and subject accessors' do
10
- expect(@exception.action).to eq(:some_action)
11
- expect(@exception.subject).to eq(:some_subject)
12
- end
13
-
14
- it 'has a changable default message' do
15
- expect(@exception.message).to eq('You are not authorized to access this page.')
16
- @exception.default_message = 'Unauthorized!'
17
- expect(@exception.message).to eq('Unauthorized!')
18
- end
19
- end
20
-
21
- describe 'with only a message' do
22
- before(:each) do
23
- @exception = CanCan::AccessDenied.new('Access denied!')
24
- end
25
-
26
- it 'has nil action and subject' do
27
- expect(@exception.action).to be_nil
28
- expect(@exception.subject).to be_nil
29
- end
30
-
31
- it 'has passed message' do
32
- expect(@exception.message).to eq('Access denied!')
33
- end
34
- end
35
-
36
- describe 'i18n in the default message' do
37
- after(:each) do
38
- I18n.backend = nil
39
- end
40
-
41
- it 'uses i18n for the default message' do
42
- I18n.backend.store_translations :en, unauthorized: { default: 'This is a different message' }
43
- @exception = CanCan::AccessDenied.new
44
- expect(@exception.message).to eq('This is a different message')
45
- end
46
-
47
- it 'defaults to a nice message' do
48
- @exception = CanCan::AccessDenied.new
49
- expect(@exception.message).to eq('You are not authorized to access this page.')
50
- end
51
-
52
- it 'does not use translation if a message is given' do
53
- @exception = CanCan::AccessDenied.new("Hey! You're not welcome here")
54
- expect(@exception.message).to eq("Hey! You're not welcome here")
55
- expect(@exception.message).to_not eq('You are not authorized to access this page.')
56
- end
57
- end
58
- end
@@ -1,71 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe CanCan::InheritedResource do
4
- let(:ability) { Ability.new(nil) }
5
- let(:params) { HashWithIndifferentAccess.new(controller: 'models') }
6
- let(:controller_class) { Class.new }
7
- let(:controller) { controller_class.new }
8
-
9
- before(:each) do
10
- class Model
11
- attr_accessor :name
12
-
13
- def initialize(attributes = {})
14
- attributes.each do |attribute, value|
15
- send("#{attribute}=", value)
16
- end
17
- end
18
- end
19
-
20
- allow(controller).to receive(:params) { params }
21
- allow(controller).to receive(:current_ability) { ability }
22
- allow(controller_class).to receive(:cancan_skipper) { { authorize: {}, load: {} } }
23
- end
24
-
25
- it 'show loads resource through controller.resource' do
26
- params.merge!(action: 'show', id: 123)
27
- allow(controller).to receive(:resource) { :model_resource }
28
- CanCan::InheritedResource.new(controller).load_resource
29
- expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
30
- end
31
-
32
- it 'new loads through controller.build_resource' do
33
- params[:action] = 'new'
34
- allow(controller).to receive(:build_resource) { :model_resource }
35
- CanCan::InheritedResource.new(controller).load_resource
36
- expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
37
- end
38
-
39
- it 'index loads through controller.association_chain when parent' do
40
- params[:action] = 'index'
41
- allow(controller).to receive(:association_chain) { controller.instance_variable_set(:@model, :model_resource) }
42
- CanCan::InheritedResource.new(controller, parent: true).load_resource
43
- expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
44
- end
45
-
46
- it 'index loads through controller.end_of_association_chain' do
47
- params[:action] = 'index'
48
- allow(Model).to receive(:accessible_by).with(ability, :index) { :projects }
49
- allow(controller).to receive(:end_of_association_chain) { Model }
50
- CanCan::InheritedResource.new(controller).load_resource
51
- expect(controller.instance_variable_get(:@models)).to eq(:projects)
52
- end
53
-
54
- it 'builds a new resource with attributes from current ability' do
55
- params[:action] = 'new'
56
- ability.can(:create, Model, name: 'from conditions')
57
- allow(controller).to receive(:build_resource) { Struct.new(:name).new }
58
- resource = CanCan::InheritedResource.new(controller)
59
- resource.load_resource
60
- expect(controller.instance_variable_get(:@model).name).to eq('from conditions')
61
- end
62
-
63
- it 'overrides initial attributes with params' do
64
- params.merge!(action: 'new', model: { name: 'from params' })
65
- ability.can(:create, Model, name: 'from conditions')
66
- allow(controller).to receive(:build_resource) { Struct.new(:name).new }
67
- resource = CanCan::ControllerResource.new(controller)
68
- resource.load_resource
69
- expect(controller.instance_variable_get(:@model).name).to eq('from params')
70
- end
71
- end
@@ -1,29 +0,0 @@
1
- require 'spec_helper'
2
-
3
- describe 'be_able_to' do
4
- it 'delegates to can?' do
5
- expect(object = double).to receive(:can?).with(:read, 123) { true }
6
- expect(object).to be_able_to(:read, 123)
7
- end
8
-
9
- it 'reports a nice failure message for should' do
10
- expect(object = double).to receive(:can?).with(:read, 123) { false }
11
- expect do
12
- expect(object).to be_able_to(:read, 123)
13
- end.to raise_error('expected to be able to :read 123')
14
- end
15
-
16
- it 'reports a nice failure message for should not' do
17
- expect(object = double).to receive(:can?).with(:read, 123) { true }
18
- expect do
19
- expect(object).to_not be_able_to(:read, 123)
20
- end.to raise_error('expected not to be able to :read 123')
21
- end
22
-
23
- it 'delegates additional arguments to can? and reports in failure message' do
24
- expect(object = double).to receive(:can?).with(:read, 123, 456) { false }
25
- expect do
26
- expect(object).to be_able_to(:read, 123, 456)
27
- end.to raise_error('expected to be able to :read 123 456')
28
- end
29
- end
@@ -1,160 +0,0 @@
1
- require 'spec_helper'
2
-
3
- if defined? CanCan::ModelAdapters::ActiveRecord4Adapter
4
- describe CanCan::ModelAdapters::ActiveRecord4Adapter do
5
- context 'with sqlite3' do
6
- before :each do
7
- ActiveRecord::Base.establish_connection(adapter: 'sqlite3', database: ':memory:')
8
- ActiveRecord::Migration.verbose = false
9
- ActiveRecord::Schema.define do
10
- create_table(:parents) do |t|
11
- t.timestamps null: false
12
- end
13
-
14
- create_table(:children) do |t|
15
- t.timestamps null: false
16
- t.integer :parent_id
17
- end
18
- end
19
-
20
- class Parent < ActiveRecord::Base
21
- has_many :children, -> { order(id: :desc) }
22
- end
23
-
24
- class Child < ActiveRecord::Base
25
- belongs_to :parent
26
- end
27
-
28
- (@ability = double).extend(CanCan::Ability)
29
- end
30
-
31
- it 'respects scope on included associations' do
32
- @ability.can :read, [Parent, Child]
33
-
34
- parent = Parent.create!
35
- child1 = Child.create!(parent: parent, created_at: 1.hours.ago)
36
- child2 = Child.create!(parent: parent, created_at: 2.hours.ago)
37
-
38
- expect(Parent.accessible_by(@ability).order(created_at: :asc).includes(:children).first.children)
39
- .to eq [child2, child1]
40
- end
41
-
42
- if ActiveRecord::VERSION::MINOR >= 1
43
- it 'allows filters on enums' do
44
- ActiveRecord::Schema.define do
45
- create_table(:shapes) do |t|
46
- t.integer :color, default: 0, null: false
47
- end
48
- end
49
-
50
- class Shape < ActiveRecord::Base
51
- enum color: [:red, :green, :blue]
52
- end
53
-
54
- red = Shape.create!(color: :red)
55
- green = Shape.create!(color: :green)
56
- blue = Shape.create!(color: :blue)
57
-
58
- # A condition with a single value.
59
- @ability.can :read, Shape, color: Shape.colors[:green]
60
-
61
- expect(@ability.cannot?(:read, red)).to be true
62
- expect(@ability.can?(:read, green)).to be true
63
- expect(@ability.cannot?(:read, blue)).to be true
64
-
65
- accessible = Shape.accessible_by(@ability)
66
- expect(accessible).to contain_exactly(green)
67
-
68
- # A condition with multiple values.
69
- @ability.can :update, Shape, color: [Shape.colors[:red],
70
- Shape.colors[:blue]]
71
-
72
- expect(@ability.can?(:update, red)).to be true
73
- expect(@ability.cannot?(:update, green)).to be true
74
- expect(@ability.can?(:update, blue)).to be true
75
-
76
- accessible = Shape.accessible_by(@ability, :update)
77
- expect(accessible).to contain_exactly(red, blue)
78
- end
79
-
80
- it 'allows dual filter on enums' do
81
- ActiveRecord::Schema.define do
82
- create_table(:discs) do |t|
83
- t.integer :color, default: 0, null: false
84
- t.integer :shape, default: 3, null: false
85
- end
86
- end
87
-
88
- class Disc < ActiveRecord::Base
89
- enum color: [:red, :green, :blue]
90
- enum shape: { triangle: 3, rectangle: 4 }
91
- end
92
-
93
- red_triangle = Disc.create!(color: Disc.colors[:red], shape: Disc.shapes[:triangle])
94
- green_triangle = Disc.create!(color: Disc.colors[:green], shape: Disc.shapes[:triangle])
95
- green_rectangle = Disc.create!(color: Disc.colors[:green], shape: Disc.shapes[:rectangle])
96
- blue_rectangle = Disc.create!(color: Disc.colors[:blue], shape: Disc.shapes[:rectangle])
97
-
98
- # A condition with a dual filter.
99
- @ability.can :read, Disc, color: Disc.colors[:green], shape: Disc.shapes[:rectangle]
100
-
101
- expect(@ability.cannot?(:read, red_triangle)).to be true
102
- expect(@ability.cannot?(:read, green_triangle)).to be true
103
- expect(@ability.can?(:read, green_rectangle)).to be true
104
- expect(@ability.cannot?(:read, blue_rectangle)).to be true
105
-
106
- accessible = Disc.accessible_by(@ability)
107
- expect(accessible).to contain_exactly(green_rectangle)
108
- end
109
- end
110
- end
111
-
112
- if Gem::Specification.find_all_by_name('pg').any?
113
- context 'with postgresql' do
114
- before :each do
115
- ActiveRecord::Base.establish_connection(adapter: 'postgresql',
116
- database: 'postgres',
117
- schema_search_path: 'public')
118
- ActiveRecord::Base.connection.drop_database('cancan_postgresql_spec')
119
- ActiveRecord::Base.connection.create_database('cancan_postgresql_spec',
120
- 'encoding' => 'utf-8',
121
- 'adapter' => 'postgresql')
122
- ActiveRecord::Base.establish_connection(adapter: 'postgresql',
123
- database: 'cancan_postgresql_spec')
124
- ActiveRecord::Migration.verbose = false
125
- ActiveRecord::Schema.define do
126
- create_table(:parents) do |t|
127
- t.timestamps null: false
128
- end
129
-
130
- create_table(:children) do |t|
131
- t.timestamps null: false
132
- t.integer :parent_id
133
- end
134
- end
135
-
136
- class Parent < ActiveRecord::Base
137
- has_many :children, -> { order(id: :desc) }
138
- end
139
-
140
- class Child < ActiveRecord::Base
141
- belongs_to :parent
142
- end
143
-
144
- (@ability = double).extend(CanCan::Ability)
145
- end
146
-
147
- it 'allows overlapping conditions in SQL and merge with hash conditions' do
148
- @ability.can :read, Parent, children: { parent_id: 1 }
149
- @ability.can :read, Parent, children: { parent_id: 1 }
150
-
151
- parent = Parent.create!
152
- Child.create!(parent: parent, created_at: 1.hours.ago)
153
- Child.create!(parent: parent, created_at: 2.hours.ago)
154
-
155
- expect(Parent.accessible_by(@ability)).to eq([parent])
156
- end
157
- end
158
- end
159
- end
160
- end
@@ -1,415 +0,0 @@
1
- require 'spec_helper'
2
-
3
- if defined? CanCan::ModelAdapters::ActiveRecordAdapter
4
-
5
- describe CanCan::ModelAdapters::ActiveRecordAdapter do
6
- before :each do
7
- ActiveRecord::Base.establish_connection(adapter: 'sqlite3', database: ':memory:')
8
- ActiveRecord::Migration.verbose = false
9
- ActiveRecord::Schema.define do
10
- create_table(:categories) do |t|
11
- t.string :name
12
- t.boolean :visible
13
- t.timestamps null: false
14
- end
15
-
16
- create_table(:projects) do |t|
17
- t.string :name
18
- t.timestamps null: false
19
- end
20
-
21
- create_table(:articles) do |t|
22
- t.string :name
23
- t.timestamps null: false
24
- t.boolean :published
25
- t.boolean :secret
26
- t.integer :priority
27
- t.integer :category_id
28
- t.integer :user_id
29
- end
30
-
31
- create_table(:comments) do |t|
32
- t.boolean :spam
33
- t.integer :article_id
34
- t.timestamps null: false
35
- end
36
-
37
- create_table(:legacy_mentions) do |t|
38
- t.integer :user_id
39
- t.integer :article_id
40
- t.timestamps null: false
41
- end
42
-
43
- create_table(:users) do |t|
44
- t.timestamps null: false
45
- end
46
- end
47
-
48
- class Project < ActiveRecord::Base
49
- end
50
-
51
- class Category < ActiveRecord::Base
52
- has_many :articles
53
- end
54
-
55
- class Article < ActiveRecord::Base
56
- belongs_to :category
57
- has_many :comments
58
- has_many :mentions
59
- has_many :mentioned_users, through: :mentions, source: :user
60
- belongs_to :user
61
- end
62
-
63
- class Mention < ActiveRecord::Base
64
- self.table_name = 'legacy_mentions'
65
- belongs_to :user
66
- belongs_to :article
67
- end
68
-
69
- class Comment < ActiveRecord::Base
70
- belongs_to :article
71
- end
72
-
73
- class User < ActiveRecord::Base
74
- has_many :articles
75
- end
76
-
77
- (@ability = double).extend(CanCan::Ability)
78
- @article_table = Article.table_name
79
- @comment_table = Comment.table_name
80
- end
81
-
82
- it 'is for only active record classes' do
83
- if ActiveRecord.respond_to?(:version) &&
84
- ActiveRecord.version > Gem::Version.new('4')
85
- expect(CanCan::ModelAdapters::ActiveRecord4Adapter).to_not be_for_class(Object)
86
- expect(CanCan::ModelAdapters::ActiveRecord4Adapter).to be_for_class(Article)
87
- expect(CanCan::ModelAdapters::AbstractAdapter.adapter_class(Article))
88
- .to eq(CanCan::ModelAdapters::ActiveRecord4Adapter)
89
- else
90
- expect(CanCan::ModelAdapters::ActiveRecord3Adapter).to_not be_for_class(Object)
91
- expect(CanCan::ModelAdapters::ActiveRecord3Adapter).to be_for_class(Article)
92
- expect(CanCan::ModelAdapters::AbstractAdapter.adapter_class(Article))
93
- .to eq(CanCan::ModelAdapters::ActiveRecord3Adapter)
94
- end
95
- end
96
-
97
- it 'finds record' do
98
- article = Article.create!
99
- adapter = CanCan::ModelAdapters::AbstractAdapter.adapter_class(Article)
100
- expect(adapter.find(Article, article.id)).to eq(article)
101
- end
102
-
103
- it 'does not fetch any records when no abilities are defined' do
104
- Article.create!
105
- expect(Article.accessible_by(@ability)).to be_empty
106
- end
107
-
108
- it 'fetches all articles when one can read all' do
109
- @ability.can :read, Article
110
- article = Article.create!
111
- expect(Article.accessible_by(@ability)).to eq([article])
112
- end
113
-
114
- it 'fetches only the articles that are published' do
115
- @ability.can :read, Article, published: true
116
- article1 = Article.create!(published: true)
117
- Article.create!(published: false)
118
- expect(Article.accessible_by(@ability)).to eq([article1])
119
- end
120
-
121
- it 'fetches any articles which are published or secret' do
122
- @ability.can :read, Article, published: true
123
- @ability.can :read, Article, secret: true
124
- article1 = Article.create!(published: true, secret: false)
125
- article2 = Article.create!(published: true, secret: true)
126
- article3 = Article.create!(published: false, secret: true)
127
- Article.create!(published: false, secret: false)
128
- expect(Article.accessible_by(@ability)).to eq([article1, article2, article3])
129
- end
130
-
131
- it 'fetches any articles which we are cited in' do
132
- user = User.create!
133
- cited = Article.create!
134
- Article.create!
135
- cited.mentioned_users << user
136
- @ability.can :read, Article, mentioned_users: { id: user.id }
137
- @ability.can :read, Article, mentions: { user_id: user.id }
138
- expect(Article.accessible_by(@ability)).to eq([cited])
139
- end
140
-
141
- it 'fetches only the articles that are published and not secret' do
142
- @ability.can :read, Article, published: true
143
- @ability.cannot :read, Article, secret: true
144
- article1 = Article.create!(published: true, secret: false)
145
- Article.create!(published: true, secret: true)
146
- Article.create!(published: false, secret: true)
147
- Article.create!(published: false, secret: false)
148
- expect(Article.accessible_by(@ability)).to eq([article1])
149
- end
150
-
151
- it 'only reads comments for articles which are published' do
152
- @ability.can :read, Comment, article: { published: true }
153
- comment1 = Comment.create!(article: Article.create!(published: true))
154
- Comment.create!(article: Article.create!(published: false))
155
- expect(Comment.accessible_by(@ability)).to eq([comment1])
156
- end
157
-
158
- it 'should only read articles which are published or in visible categories' do
159
- @ability.can :read, Article, category: { visible: true }
160
- @ability.can :read, Article, published: true
161
- article1 = Article.create!(published: true)
162
- Article.create!(published: false)
163
- article3 = Article.create!(published: false, category: Category.create!(visible: true))
164
- expect(Article.accessible_by(@ability)).to eq([article1, article3])
165
- end
166
-
167
- it 'should only read categories once even if they have multiple articles' do
168
- @ability.can :read, Category, articles: { published: true }
169
- @ability.can :read, Article, published: true
170
- category = Category.create!
171
- Article.create!(published: true, category: category)
172
- Article.create!(published: true, category: category)
173
- expect(Category.accessible_by(@ability)).to eq([category])
174
- end
175
-
176
- it 'only reads comments for visible categories through articles' do
177
- @ability.can :read, Comment, article: { category: { visible: true } }
178
- comment1 = Comment.create!(article: Article.create!(category: Category.create!(visible: true)))
179
- Comment.create!(article: Article.create!(category: Category.create!(visible: false)))
180
- expect(Comment.accessible_by(@ability)).to eq([comment1])
181
- end
182
-
183
- it 'allows conditions in SQL and merge with hash conditions' do
184
- @ability.can :read, Article, published: true
185
- @ability.can :read, Article, ['secret=?', true]
186
- article1 = Article.create!(published: true, secret: false)
187
- article2 = Article.create!(published: true, secret: true)
188
- article3 = Article.create!(published: false, secret: true)
189
- Article.create!(published: false, secret: false)
190
- expect(Article.accessible_by(@ability)).to eq([article1, article2, article3])
191
- end
192
-
193
- it 'allows a scope for conditions' do
194
- @ability.can :read, Article, Article.where(secret: true)
195
- article1 = Article.create!(secret: true)
196
- Article.create!(secret: false)
197
- expect(Article.accessible_by(@ability)).to eq([article1])
198
- end
199
-
200
- it 'fetches only associated records when using with a scope for conditions' do
201
- @ability.can :read, Article, Article.where(secret: true)
202
- category1 = Category.create!(visible: false)
203
- category2 = Category.create!(visible: true)
204
- article1 = Article.create!(secret: true, category: category1)
205
- Article.create!(secret: true, category: category2)
206
- expect(category1.articles.accessible_by(@ability)).to eq([article1])
207
- end
208
-
209
- it 'raises an exception when trying to merge scope with other conditions' do
210
- @ability.can :read, Article, published: true
211
- @ability.can :read, Article, Article.where(secret: true)
212
- expect(-> { Article.accessible_by(@ability) })
213
- .to raise_error(CanCan::Error,
214
- 'Unable to merge an Active Record scope with other conditions. '\
215
- 'Instead use a hash or SQL for read Article ability.')
216
- end
217
-
218
- it 'does not allow to fetch records when ability with just block present' do
219
- @ability.can :read, Article do
220
- false
221
- end
222
- expect(-> { Article.accessible_by(@ability) }).to raise_error(CanCan::Error)
223
- end
224
-
225
- it 'should support more than one deeply nested conditions' do
226
- @ability.can :read, Comment, article: {
227
- category: {
228
- name: 'foo', visible: true
229
- }
230
- }
231
- expect { Comment.accessible_by(@ability) }.to_not raise_error
232
- end
233
-
234
- it 'does not allow to check ability on object against SQL conditions without block' do
235
- @ability.can :read, Article, ['secret=?', true]
236
- expect(-> { @ability.can? :read, Article.new }).to raise_error(CanCan::Error)
237
- end
238
-
239
- it 'has false conditions if no abilities match' do
240
- expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='f'")
241
- end
242
-
243
- it 'returns false conditions for cannot clause' do
244
- @ability.cannot :read, Article
245
- expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='f'")
246
- end
247
-
248
- it 'returns SQL for single `can` definition in front of default `cannot` condition' do
249
- @ability.cannot :read, Article
250
- @ability.can :read, Article, published: false, secret: true
251
- expect(@ability.model_adapter(Article, :read).conditions)
252
- .to orderlessly_match(%("#{@article_table}"."published" = 'f' AND "#{@article_table}"."secret" = 't'))
253
- end
254
-
255
- it 'returns true condition for single `can` definition in front of default `can` condition' do
256
- @ability.can :read, Article
257
- @ability.can :read, Article, published: false, secret: true
258
- expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='t'")
259
- end
260
-
261
- it 'returns `false condition` for single `cannot` definition in front of default `cannot` condition' do
262
- @ability.cannot :read, Article
263
- @ability.cannot :read, Article, published: false, secret: true
264
- expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='f'")
265
- end
266
-
267
- it 'returns `not (sql)` for single `cannot` definition in front of default `can` condition' do
268
- @ability.can :read, Article
269
- @ability.cannot :read, Article, published: false, secret: true
270
- expect(@ability.model_adapter(Article, :read).conditions)
271
- .to orderlessly_match(%["not (#{@article_table}"."published" = 'f' AND "#{@article_table}"."secret" = 't')])
272
- end
273
-
274
- it 'returns appropriate sql conditions in complex case' do
275
- @ability.can :read, Article
276
- @ability.can :manage, Article, id: 1
277
- @ability.can :update, Article, published: true
278
- @ability.cannot :update, Article, secret: true
279
- expect(@ability.model_adapter(Article, :update).conditions)
280
- .to eq(%[not ("#{@article_table}"."secret" = 't') ] +
281
- %[AND (("#{@article_table}"."published" = 't') ] +
282
- %[OR ("#{@article_table}"."id" = 1))])
283
- expect(@ability.model_adapter(Article, :manage).conditions).to eq(id: 1)
284
- expect(@ability.model_adapter(Article, :read).conditions).to eq("'t'='t'")
285
- end
286
-
287
- it 'returns appropriate sql conditions in complex case with nested joins' do
288
- @ability.can :read, Comment, article: { category: { visible: true } }
289
- expect(@ability.model_adapter(Comment, :read).conditions).to eq(Category.table_name.to_sym => { visible: true })
290
- end
291
-
292
- it 'returns appropriate sql conditions in complex case with nested joins of different depth' do
293
- @ability.can :read, Comment, article: { published: true, category: { visible: true } }
294
- expect(@ability.model_adapter(Comment, :read).conditions)
295
- .to eq(Article.table_name.to_sym => { published: true }, Category.table_name.to_sym => { visible: true })
296
- end
297
-
298
- it 'does not forget conditions when calling with SQL string' do
299
- @ability.can :read, Article, published: true
300
- @ability.can :read, Article, ['secret=?', false]
301
- adapter = @ability.model_adapter(Article, :read)
302
- 2.times do
303
- expect(adapter.conditions).to eq(%[(secret='f') OR ("#{@article_table}"."published" = 't')])
304
- end
305
- end
306
-
307
- it 'has nil joins if no rules' do
308
- expect(@ability.model_adapter(Article, :read).joins).to be_nil
309
- end
310
-
311
- it 'has nil joins if no nested hashes specified in conditions' do
312
- @ability.can :read, Article, published: false
313
- @ability.can :read, Article, secret: true
314
- expect(@ability.model_adapter(Article, :read).joins).to be_nil
315
- end
316
-
317
- it 'merges separate joins into a single array' do
318
- @ability.can :read, Article, project: { blocked: false }
319
- @ability.can :read, Article, company: { admin: true }
320
- expect(@ability.model_adapter(Article, :read).joins.inspect).to orderlessly_match([:company, :project].inspect)
321
- end
322
-
323
- it 'merges same joins into a single array' do
324
- @ability.can :read, Article, project: { blocked: false }
325
- @ability.can :read, Article, project: { admin: true }
326
- expect(@ability.model_adapter(Article, :read).joins).to eq([:project])
327
- end
328
-
329
- it 'merges nested and non-nested joins' do
330
- @ability.can :read, Article, project: { blocked: false }
331
- @ability.can :read, Article, project: { comments: { spam: true } }
332
- expect(@ability.model_adapter(Article, :read).joins).to eq([{ project: [:comments] }])
333
- end
334
-
335
- it 'merges :all conditions with other conditions' do
336
- user = User.create!
337
- article = Article.create!(user: user)
338
- ability = Ability.new(user)
339
- ability.can :manage, :all
340
- ability.can :manage, Article, user_id: user.id
341
- expect(Article.accessible_by(ability)).to eq([article])
342
- end
343
-
344
- it 'should not execute a scope when checking ability on the class' do
345
- relation = Article.where(secret: true)
346
- @ability.can :read, Article, relation do |article|
347
- article.secret == true
348
- end
349
-
350
- allow(relation).to receive(:count).and_raise('Unexpected scope execution.')
351
-
352
- expect { @ability.can? :read, Article }.not_to raise_error
353
- end
354
-
355
- context 'with namespaced models' do
356
- before :each do
357
- ActiveRecord::Schema.define do
358
- create_table(:table_xes) do |t|
359
- t.timestamps null: false
360
- end
361
-
362
- create_table(:table_zs) do |t|
363
- t.integer :table_x_id
364
- t.integer :user_id
365
- t.timestamps null: false
366
- end
367
- end
368
-
369
- module Namespace
370
- end
371
-
372
- class Namespace::TableX < ActiveRecord::Base
373
- has_many :table_zs
374
- end
375
-
376
- class Namespace::TableZ < ActiveRecord::Base
377
- belongs_to :table_x
378
- belongs_to :user
379
- end
380
- end
381
-
382
- it 'fetches all namespace::table_x when one is related by table_y' do
383
- user = User.create!
384
-
385
- ability = Ability.new(user)
386
- ability.can :read, Namespace::TableX, table_zs: { user_id: user.id }
387
-
388
- table_x = Namespace::TableX.create!
389
- table_x.table_zs.create(user: user)
390
- expect(Namespace::TableX.accessible_by(ability)).to eq([table_x])
391
- end
392
- end
393
-
394
- context 'when conditions are non iterable ranges' do
395
- before :each do
396
- ActiveRecord::Schema.define do
397
- create_table(:courses) do |t|
398
- t.datetime :start_at
399
- end
400
- end
401
-
402
- class Course < ActiveRecord::Base
403
- end
404
- end
405
-
406
- it 'fetches only the valid records' do
407
- @ability.can :read, Course, start_at: 1.day.ago..1.day.from_now
408
- Course.create!(start_at: 10.days.ago)
409
- valid_course = Course.create!(start_at: Time.now)
410
-
411
- expect(Course.accessible_by(@ability)).to eq([valid_course])
412
- end
413
- end
414
- end
415
- end