cancancan 1.17.0 → 3.5.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/cancancan.gemspec +10 -11
- data/init.rb +2 -0
- data/lib/cancan/ability/actions.rb +93 -0
- data/lib/cancan/ability/rules.rb +96 -0
- data/lib/cancan/ability/strong_parameter_support.rb +41 -0
- data/lib/cancan/ability.rb +87 -198
- data/lib/cancan/class_matcher.rb +30 -0
- data/lib/cancan/conditions_matcher.rb +147 -0
- data/lib/cancan/config.rb +101 -0
- data/lib/cancan/controller_additions.rb +13 -30
- data/lib/cancan/controller_resource.rb +33 -225
- data/lib/cancan/controller_resource_builder.rb +26 -0
- data/lib/cancan/controller_resource_finder.rb +42 -0
- data/lib/cancan/controller_resource_loader.rb +120 -0
- data/lib/cancan/controller_resource_name_finder.rb +23 -0
- data/lib/cancan/controller_resource_sanitizer.rb +32 -0
- data/lib/cancan/exceptions.rb +24 -4
- data/lib/cancan/matchers.rb +12 -1
- data/lib/cancan/model_adapters/abstract_adapter.rb +22 -1
- data/lib/cancan/model_adapters/active_record_4_adapter.rb +25 -44
- data/lib/cancan/model_adapters/active_record_5_adapter.rb +61 -0
- data/lib/cancan/model_adapters/active_record_adapter.rb +157 -83
- data/lib/cancan/model_adapters/conditions_extractor.rb +75 -0
- data/lib/cancan/model_adapters/conditions_normalizer.rb +49 -0
- data/lib/cancan/model_adapters/default_adapter.rb +2 -0
- data/lib/cancan/model_adapters/sti_normalizer.rb +47 -0
- data/lib/cancan/model_adapters/strategies/base.rb +40 -0
- data/lib/cancan/model_adapters/strategies/joined_alias_each_rule_as_exists_subquery.rb +93 -0
- data/lib/cancan/model_adapters/strategies/joined_alias_exists_subquery.rb +31 -0
- data/lib/cancan/model_adapters/strategies/left_join.rb +11 -0
- data/lib/cancan/model_adapters/strategies/subquery.rb +18 -0
- data/lib/cancan/model_additions.rb +6 -2
- data/lib/cancan/parameter_validators.rb +9 -0
- data/lib/cancan/relevant.rb +29 -0
- data/lib/cancan/rule.rb +67 -90
- data/lib/cancan/rules_compressor.rb +23 -0
- data/lib/cancan/sti_detector.rb +12 -0
- data/lib/cancan/unauthorized_message_resolver.rb +24 -0
- data/lib/cancan/version.rb +3 -1
- data/lib/cancan.rb +15 -10
- data/lib/cancancan.rb +2 -0
- data/lib/generators/cancan/ability/ability_generator.rb +3 -1
- data/lib/generators/cancan/ability/templates/ability.rb +9 -9
- metadata +64 -86
- data/.gitignore +0 -15
- data/.rspec +0 -1
- data/.rubocop.yml +0 -39
- data/.rubocop_todo.yml +0 -54
- data/.travis.yml +0 -39
- data/Appraisals +0 -105
- data/CHANGELOG.rdoc +0 -536
- data/CONTRIBUTING.md +0 -23
- data/Gemfile +0 -3
- data/LICENSE +0 -22
- data/README.md +0 -234
- data/Rakefile +0 -13
- data/gemfiles/activerecord_3.2.gemfile +0 -18
- data/gemfiles/activerecord_4.0.gemfile +0 -19
- data/gemfiles/activerecord_4.1.gemfile +0 -19
- data/gemfiles/activerecord_4.2.gemfile +0 -21
- data/gemfiles/activerecord_5.0.gemfile +0 -20
- data/gemfiles/mongoid_2.x.gemfile +0 -18
- data/gemfiles/sequel_3.x.gemfile +0 -18
- data/lib/cancan/inherited_resource.rb +0 -20
- data/lib/cancan/model_adapters/active_record_3_adapter.rb +0 -16
- data/lib/cancan/model_adapters/mongoid_adapter.rb +0 -80
- data/lib/cancan/model_adapters/sequel_adapter.rb +0 -87
- data/spec/README.rdoc +0 -27
- data/spec/cancan/ability_spec.rb +0 -553
- data/spec/cancan/controller_additions_spec.rb +0 -164
- data/spec/cancan/controller_resource_spec.rb +0 -645
- data/spec/cancan/exceptions_spec.rb +0 -58
- data/spec/cancan/inherited_resource_spec.rb +0 -71
- data/spec/cancan/matchers_spec.rb +0 -29
- data/spec/cancan/model_adapters/active_record_4_adapter_spec.rb +0 -160
- data/spec/cancan/model_adapters/active_record_adapter_spec.rb +0 -415
- data/spec/cancan/model_adapters/default_adapter_spec.rb +0 -7
- data/spec/cancan/model_adapters/mongoid_adapter_spec.rb +0 -246
- data/spec/cancan/model_adapters/sequel_adapter_spec.rb +0 -129
- data/spec/cancan/rule_spec.rb +0 -52
- data/spec/matchers.rb +0 -13
- data/spec/spec.opts +0 -2
- data/spec/spec_helper.rb +0 -27
- data/spec/support/ability.rb +0 -6
@@ -1,58 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
describe CanCan::AccessDenied do
|
4
|
-
describe 'with action and subject' do
|
5
|
-
before(:each) do
|
6
|
-
@exception = CanCan::AccessDenied.new(nil, :some_action, :some_subject)
|
7
|
-
end
|
8
|
-
|
9
|
-
it 'has action and subject accessors' do
|
10
|
-
expect(@exception.action).to eq(:some_action)
|
11
|
-
expect(@exception.subject).to eq(:some_subject)
|
12
|
-
end
|
13
|
-
|
14
|
-
it 'has a changable default message' do
|
15
|
-
expect(@exception.message).to eq('You are not authorized to access this page.')
|
16
|
-
@exception.default_message = 'Unauthorized!'
|
17
|
-
expect(@exception.message).to eq('Unauthorized!')
|
18
|
-
end
|
19
|
-
end
|
20
|
-
|
21
|
-
describe 'with only a message' do
|
22
|
-
before(:each) do
|
23
|
-
@exception = CanCan::AccessDenied.new('Access denied!')
|
24
|
-
end
|
25
|
-
|
26
|
-
it 'has nil action and subject' do
|
27
|
-
expect(@exception.action).to be_nil
|
28
|
-
expect(@exception.subject).to be_nil
|
29
|
-
end
|
30
|
-
|
31
|
-
it 'has passed message' do
|
32
|
-
expect(@exception.message).to eq('Access denied!')
|
33
|
-
end
|
34
|
-
end
|
35
|
-
|
36
|
-
describe 'i18n in the default message' do
|
37
|
-
after(:each) do
|
38
|
-
I18n.backend = nil
|
39
|
-
end
|
40
|
-
|
41
|
-
it 'uses i18n for the default message' do
|
42
|
-
I18n.backend.store_translations :en, unauthorized: { default: 'This is a different message' }
|
43
|
-
@exception = CanCan::AccessDenied.new
|
44
|
-
expect(@exception.message).to eq('This is a different message')
|
45
|
-
end
|
46
|
-
|
47
|
-
it 'defaults to a nice message' do
|
48
|
-
@exception = CanCan::AccessDenied.new
|
49
|
-
expect(@exception.message).to eq('You are not authorized to access this page.')
|
50
|
-
end
|
51
|
-
|
52
|
-
it 'does not use translation if a message is given' do
|
53
|
-
@exception = CanCan::AccessDenied.new("Hey! You're not welcome here")
|
54
|
-
expect(@exception.message).to eq("Hey! You're not welcome here")
|
55
|
-
expect(@exception.message).to_not eq('You are not authorized to access this page.')
|
56
|
-
end
|
57
|
-
end
|
58
|
-
end
|
@@ -1,71 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
describe CanCan::InheritedResource do
|
4
|
-
let(:ability) { Ability.new(nil) }
|
5
|
-
let(:params) { HashWithIndifferentAccess.new(controller: 'models') }
|
6
|
-
let(:controller_class) { Class.new }
|
7
|
-
let(:controller) { controller_class.new }
|
8
|
-
|
9
|
-
before(:each) do
|
10
|
-
class Model
|
11
|
-
attr_accessor :name
|
12
|
-
|
13
|
-
def initialize(attributes = {})
|
14
|
-
attributes.each do |attribute, value|
|
15
|
-
send("#{attribute}=", value)
|
16
|
-
end
|
17
|
-
end
|
18
|
-
end
|
19
|
-
|
20
|
-
allow(controller).to receive(:params) { params }
|
21
|
-
allow(controller).to receive(:current_ability) { ability }
|
22
|
-
allow(controller_class).to receive(:cancan_skipper) { { authorize: {}, load: {} } }
|
23
|
-
end
|
24
|
-
|
25
|
-
it 'show loads resource through controller.resource' do
|
26
|
-
params.merge!(action: 'show', id: 123)
|
27
|
-
allow(controller).to receive(:resource) { :model_resource }
|
28
|
-
CanCan::InheritedResource.new(controller).load_resource
|
29
|
-
expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
|
30
|
-
end
|
31
|
-
|
32
|
-
it 'new loads through controller.build_resource' do
|
33
|
-
params[:action] = 'new'
|
34
|
-
allow(controller).to receive(:build_resource) { :model_resource }
|
35
|
-
CanCan::InheritedResource.new(controller).load_resource
|
36
|
-
expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
|
37
|
-
end
|
38
|
-
|
39
|
-
it 'index loads through controller.association_chain when parent' do
|
40
|
-
params[:action] = 'index'
|
41
|
-
allow(controller).to receive(:association_chain) { controller.instance_variable_set(:@model, :model_resource) }
|
42
|
-
CanCan::InheritedResource.new(controller, parent: true).load_resource
|
43
|
-
expect(controller.instance_variable_get(:@model)).to eq(:model_resource)
|
44
|
-
end
|
45
|
-
|
46
|
-
it 'index loads through controller.end_of_association_chain' do
|
47
|
-
params[:action] = 'index'
|
48
|
-
allow(Model).to receive(:accessible_by).with(ability, :index) { :projects }
|
49
|
-
allow(controller).to receive(:end_of_association_chain) { Model }
|
50
|
-
CanCan::InheritedResource.new(controller).load_resource
|
51
|
-
expect(controller.instance_variable_get(:@models)).to eq(:projects)
|
52
|
-
end
|
53
|
-
|
54
|
-
it 'builds a new resource with attributes from current ability' do
|
55
|
-
params[:action] = 'new'
|
56
|
-
ability.can(:create, Model, name: 'from conditions')
|
57
|
-
allow(controller).to receive(:build_resource) { Struct.new(:name).new }
|
58
|
-
resource = CanCan::InheritedResource.new(controller)
|
59
|
-
resource.load_resource
|
60
|
-
expect(controller.instance_variable_get(:@model).name).to eq('from conditions')
|
61
|
-
end
|
62
|
-
|
63
|
-
it 'overrides initial attributes with params' do
|
64
|
-
params.merge!(action: 'new', model: { name: 'from params' })
|
65
|
-
ability.can(:create, Model, name: 'from conditions')
|
66
|
-
allow(controller).to receive(:build_resource) { Struct.new(:name).new }
|
67
|
-
resource = CanCan::ControllerResource.new(controller)
|
68
|
-
resource.load_resource
|
69
|
-
expect(controller.instance_variable_get(:@model).name).to eq('from params')
|
70
|
-
end
|
71
|
-
end
|
@@ -1,29 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
describe 'be_able_to' do
|
4
|
-
it 'delegates to can?' do
|
5
|
-
expect(object = double).to receive(:can?).with(:read, 123) { true }
|
6
|
-
expect(object).to be_able_to(:read, 123)
|
7
|
-
end
|
8
|
-
|
9
|
-
it 'reports a nice failure message for should' do
|
10
|
-
expect(object = double).to receive(:can?).with(:read, 123) { false }
|
11
|
-
expect do
|
12
|
-
expect(object).to be_able_to(:read, 123)
|
13
|
-
end.to raise_error('expected to be able to :read 123')
|
14
|
-
end
|
15
|
-
|
16
|
-
it 'reports a nice failure message for should not' do
|
17
|
-
expect(object = double).to receive(:can?).with(:read, 123) { true }
|
18
|
-
expect do
|
19
|
-
expect(object).to_not be_able_to(:read, 123)
|
20
|
-
end.to raise_error('expected not to be able to :read 123')
|
21
|
-
end
|
22
|
-
|
23
|
-
it 'delegates additional arguments to can? and reports in failure message' do
|
24
|
-
expect(object = double).to receive(:can?).with(:read, 123, 456) { false }
|
25
|
-
expect do
|
26
|
-
expect(object).to be_able_to(:read, 123, 456)
|
27
|
-
end.to raise_error('expected to be able to :read 123 456')
|
28
|
-
end
|
29
|
-
end
|
@@ -1,160 +0,0 @@
|
|
1
|
-
require 'spec_helper'
|
2
|
-
|
3
|
-
if defined? CanCan::ModelAdapters::ActiveRecord4Adapter
|
4
|
-
describe CanCan::ModelAdapters::ActiveRecord4Adapter do
|
5
|
-
context 'with sqlite3' do
|
6
|
-
before :each do
|
7
|
-
ActiveRecord::Base.establish_connection(adapter: 'sqlite3', database: ':memory:')
|
8
|
-
ActiveRecord::Migration.verbose = false
|
9
|
-
ActiveRecord::Schema.define do
|
10
|
-
create_table(:parents) do |t|
|
11
|
-
t.timestamps null: false
|
12
|
-
end
|
13
|
-
|
14
|
-
create_table(:children) do |t|
|
15
|
-
t.timestamps null: false
|
16
|
-
t.integer :parent_id
|
17
|
-
end
|
18
|
-
end
|
19
|
-
|
20
|
-
class Parent < ActiveRecord::Base
|
21
|
-
has_many :children, -> { order(id: :desc) }
|
22
|
-
end
|
23
|
-
|
24
|
-
class Child < ActiveRecord::Base
|
25
|
-
belongs_to :parent
|
26
|
-
end
|
27
|
-
|
28
|
-
(@ability = double).extend(CanCan::Ability)
|
29
|
-
end
|
30
|
-
|
31
|
-
it 'respects scope on included associations' do
|
32
|
-
@ability.can :read, [Parent, Child]
|
33
|
-
|
34
|
-
parent = Parent.create!
|
35
|
-
child1 = Child.create!(parent: parent, created_at: 1.hours.ago)
|
36
|
-
child2 = Child.create!(parent: parent, created_at: 2.hours.ago)
|
37
|
-
|
38
|
-
expect(Parent.accessible_by(@ability).order(created_at: :asc).includes(:children).first.children)
|
39
|
-
.to eq [child2, child1]
|
40
|
-
end
|
41
|
-
|
42
|
-
if ActiveRecord::VERSION::MINOR >= 1
|
43
|
-
it 'allows filters on enums' do
|
44
|
-
ActiveRecord::Schema.define do
|
45
|
-
create_table(:shapes) do |t|
|
46
|
-
t.integer :color, default: 0, null: false
|
47
|
-
end
|
48
|
-
end
|
49
|
-
|
50
|
-
class Shape < ActiveRecord::Base
|
51
|
-
enum color: [:red, :green, :blue]
|
52
|
-
end
|
53
|
-
|
54
|
-
red = Shape.create!(color: :red)
|
55
|
-
green = Shape.create!(color: :green)
|
56
|
-
blue = Shape.create!(color: :blue)
|
57
|
-
|
58
|
-
# A condition with a single value.
|
59
|
-
@ability.can :read, Shape, color: Shape.colors[:green]
|
60
|
-
|
61
|
-
expect(@ability.cannot?(:read, red)).to be true
|
62
|
-
expect(@ability.can?(:read, green)).to be true
|
63
|
-
expect(@ability.cannot?(:read, blue)).to be true
|
64
|
-
|
65
|
-
accessible = Shape.accessible_by(@ability)
|
66
|
-
expect(accessible).to contain_exactly(green)
|
67
|
-
|
68
|
-
# A condition with multiple values.
|
69
|
-
@ability.can :update, Shape, color: [Shape.colors[:red],
|
70
|
-
Shape.colors[:blue]]
|
71
|
-
|
72
|
-
expect(@ability.can?(:update, red)).to be true
|
73
|
-
expect(@ability.cannot?(:update, green)).to be true
|
74
|
-
expect(@ability.can?(:update, blue)).to be true
|
75
|
-
|
76
|
-
accessible = Shape.accessible_by(@ability, :update)
|
77
|
-
expect(accessible).to contain_exactly(red, blue)
|
78
|
-
end
|
79
|
-
|
80
|
-
it 'allows dual filter on enums' do
|
81
|
-
ActiveRecord::Schema.define do
|
82
|
-
create_table(:discs) do |t|
|
83
|
-
t.integer :color, default: 0, null: false
|
84
|
-
t.integer :shape, default: 3, null: false
|
85
|
-
end
|
86
|
-
end
|
87
|
-
|
88
|
-
class Disc < ActiveRecord::Base
|
89
|
-
enum color: [:red, :green, :blue]
|
90
|
-
enum shape: { triangle: 3, rectangle: 4 }
|
91
|
-
end
|
92
|
-
|
93
|
-
red_triangle = Disc.create!(color: Disc.colors[:red], shape: Disc.shapes[:triangle])
|
94
|
-
green_triangle = Disc.create!(color: Disc.colors[:green], shape: Disc.shapes[:triangle])
|
95
|
-
green_rectangle = Disc.create!(color: Disc.colors[:green], shape: Disc.shapes[:rectangle])
|
96
|
-
blue_rectangle = Disc.create!(color: Disc.colors[:blue], shape: Disc.shapes[:rectangle])
|
97
|
-
|
98
|
-
# A condition with a dual filter.
|
99
|
-
@ability.can :read, Disc, color: Disc.colors[:green], shape: Disc.shapes[:rectangle]
|
100
|
-
|
101
|
-
expect(@ability.cannot?(:read, red_triangle)).to be true
|
102
|
-
expect(@ability.cannot?(:read, green_triangle)).to be true
|
103
|
-
expect(@ability.can?(:read, green_rectangle)).to be true
|
104
|
-
expect(@ability.cannot?(:read, blue_rectangle)).to be true
|
105
|
-
|
106
|
-
accessible = Disc.accessible_by(@ability)
|
107
|
-
expect(accessible).to contain_exactly(green_rectangle)
|
108
|
-
end
|
109
|
-
end
|
110
|
-
end
|
111
|
-
|
112
|
-
if Gem::Specification.find_all_by_name('pg').any?
|
113
|
-
context 'with postgresql' do
|
114
|
-
before :each do
|
115
|
-
ActiveRecord::Base.establish_connection(adapter: 'postgresql',
|
116
|
-
database: 'postgres',
|
117
|
-
schema_search_path: 'public')
|
118
|
-
ActiveRecord::Base.connection.drop_database('cancan_postgresql_spec')
|
119
|
-
ActiveRecord::Base.connection.create_database('cancan_postgresql_spec',
|
120
|
-
'encoding' => 'utf-8',
|
121
|
-
'adapter' => 'postgresql')
|
122
|
-
ActiveRecord::Base.establish_connection(adapter: 'postgresql',
|
123
|
-
database: 'cancan_postgresql_spec')
|
124
|
-
ActiveRecord::Migration.verbose = false
|
125
|
-
ActiveRecord::Schema.define do
|
126
|
-
create_table(:parents) do |t|
|
127
|
-
t.timestamps null: false
|
128
|
-
end
|
129
|
-
|
130
|
-
create_table(:children) do |t|
|
131
|
-
t.timestamps null: false
|
132
|
-
t.integer :parent_id
|
133
|
-
end
|
134
|
-
end
|
135
|
-
|
136
|
-
class Parent < ActiveRecord::Base
|
137
|
-
has_many :children, -> { order(id: :desc) }
|
138
|
-
end
|
139
|
-
|
140
|
-
class Child < ActiveRecord::Base
|
141
|
-
belongs_to :parent
|
142
|
-
end
|
143
|
-
|
144
|
-
(@ability = double).extend(CanCan::Ability)
|
145
|
-
end
|
146
|
-
|
147
|
-
it 'allows overlapping conditions in SQL and merge with hash conditions' do
|
148
|
-
@ability.can :read, Parent, children: { parent_id: 1 }
|
149
|
-
@ability.can :read, Parent, children: { parent_id: 1 }
|
150
|
-
|
151
|
-
parent = Parent.create!
|
152
|
-
Child.create!(parent: parent, created_at: 1.hours.ago)
|
153
|
-
Child.create!(parent: parent, created_at: 2.hours.ago)
|
154
|
-
|
155
|
-
expect(Parent.accessible_by(@ability)).to eq([parent])
|
156
|
-
end
|
157
|
-
end
|
158
|
-
end
|
159
|
-
end
|
160
|
-
end
|