cancancan 1.8.0 → 1.14.0

data/lib/cancan/ability.rb

@@ -61,14 +61,11 @@ module CanCan
     #
     # Also see the RSpec Matchers to aid in testing.
     def can?(action, subject, *extra_args)
-      subject = extract_subjects(subject)
-
-      match = subject.map do |subject|
-        relevant_rules_for_match(action, subject).detect do |rule|
-          rule.matches_conditions?(action, subject, extra_args)
+      match = extract_subjects(subject).lazy.map do |a_subject|
+        relevant_rules_for_match(action, a_subject).detect do |rule|
+          rule.matches_conditions?(action, a_subject, extra_args)
         end
-      end.compact.first
-
+      end.reject(&:nil?).first
       match ? match.base_behavior : false
     end
     # Convenience method which works the same as "can?" but returns the opposite value.
@@ -119,7 +116,7 @@ module CanCan
     #   can :read, :stats
     #   can? :read, :stats # => true
     #
-    # IMPORTANT: Neither a hash of conditions or a block will be used when checking permission on a class.
+    # IMPORTANT: Neither a hash of conditions nor a block will be used when checking permission on a class.
     #
     #   can :update, Project, :priority => 3
     #   can? :update, Project # => true
@@ -133,7 +130,7 @@ module CanCan
     #   end
     #
     def can(action = nil, subject = nil, conditions = nil, &block)
-      rules << Rule.new(true, action, subject, conditions, block)
+      add_rule(Rule.new(true, action, subject, conditions, block))
     end
 
     # Defines an ability which cannot be done. Accepts the same arguments as "can".
@@ -149,7 +146,7 @@ module CanCan
     #   end
     #
     def cannot(action = nil, subject = nil, conditions = nil, &block)
-      rules << Rule.new(false, action, subject, conditions, block)
+      add_rule(Rule.new(false, action, subject, conditions, block))
     end
 
     # Alias one or more actions into another one.
@@ -246,12 +243,49 @@ module CanCan
     end
 
     def merge(ability)
-      ability.send(:rules).each do |rule|
-        rules << rule.dup
+      ability.rules.each do |rule|
+        add_rule(rule.dup)
       end
       self
     end
 
+    # Return a hash of permissions for the user in the format of:
+    #   {
+    #     can: can_hash,
+    #     cannot: cannot_hash
+    #   }
+    #
+    # Where can_hash and cannot_hash are formatted thusly:
+    #   {
+    #     action: array_of_objects
+    #   }
+    def permissions
+      permissions_list = {:can => {}, :cannot => {}}
+
+      rules.each do |rule|
+        subjects = rule.subjects
+        expand_actions(rule.actions).each do |action|
+          if(rule.base_behavior)
+            permissions_list[:can][action] ||= []
+            permissions_list[:can][action] += subjects.map(&:to_s)
+          else
+            permissions_list[:cannot][action] ||= []
+            permissions_list[:cannot][action] += subjects.map(&:to_s)
+          end
+        end
+      end
+
+      permissions_list
+    end
+
+    protected
+
+    # Must be protected as an ability can merge with other abilities.
+    # This means that an ability must expose their rules with another ability.
+    def rules
+      @rules ||= []
+    end
+
     private
 
     def unauthorized_message_keys(action, subject)
@@ -285,7 +319,7 @@ module CanCan
 
     # It translates to an array the subject or the hash with multiple subjects given to can?.
     def extract_subjects(subject)
-      subject = if subject.respond_to?(:keys) && subject.key?(:any)
+      if subject.kind_of?(Hash) && subject.key?(:any)
         subject[:any]
       else
         [subject]
@@ -302,21 +336,64 @@ module CanCan
       results
     end
 
-    def rules
-      @rules ||= []
+    def add_rule(rule)
+      rules << rule
+      add_rule_to_index(rule, rules.size - 1)
+    end
+
+    def add_rule_to_index(rule, position)
+      @rules_index ||= Hash.new { |h, k| h[k] = [] }
+
+      subjects = rule.subjects.compact
+      subjects << :all if subjects.empty?
+
+      subjects.each do |subject|
+        @rules_index[subject] << position
+      end
+    end
+
+    def alternative_subjects(subject)
+      subject = subject.class unless subject.is_a?(Module)
+      [:all, *subject.ancestors,  subject.class.to_s]
     end
 
     # Returns an array of Rule instances which match the action and subject
     # This does not take into consideration any hash conditions or block statements
     def relevant_rules(action, subject)
-      relevant = rules.select do |rule|
+      return [] unless @rules
+      relevant = possible_relevant_rules(subject).select do |rule|
         rule.expanded_actions = expand_actions(rule.actions)
         rule.relevant? action, subject
       end
-      relevant.reverse!
+      relevant.reverse!.uniq!
+      optimize_order! relevant
       relevant
     end
 
+    # Optimizes the order of the rules, so that rules with the :all subject are evaluated first.
+    def optimize_order!(rules)
+      first_can_in_group = -1
+      rules.each_with_index do |rule, i|
+        (first_can_in_group = -1) and next unless rule.base_behavior
+        (first_can_in_group = i) and next if first_can_in_group == -1
+        if rule.subjects == [:all]
+          rules[i] = rules[first_can_in_group]
+          rules[first_can_in_group] = rule
+          first_can_in_group += 1
+        end
+      end
+    end
+
+    def possible_relevant_rules(subject)
+      if subject.is_a?(Hash)
+        rules
+      else
+        positions = @rules_index.values_at(subject, *alternative_subjects(subject))
+        positions.flatten!.sort!
+        positions.map { |i| @rules[i] }
+      end
+    end
+
     def relevant_rules_for_match(action, subject)
       relevant_rules(action, subject).each do |rule|
         if rule.only_raw_sql?

data/lib/cancan/controller_additions.rb

@@ -294,7 +294,7 @@ module CanCan
 
     def self.included(base)
       base.extend ClassMethods
-      base.helper_method :can?, :cannot?, :current_ability
+      base.helper_method :can?, :cannot?, :current_ability if base.respond_to? :helper_method
     end
 
     # Raises a CanCan::AccessDenied exception if the current_ability cannot

data/lib/cancan/controller_resource.rb

@@ -46,17 +46,12 @@ module CanCan
       @options.has_key?(:parent) ? @options[:parent] : @name && @name != name_from_controller.to_sym
     end
 
-    def skip?(behavior) # This could probably use some refactoring
-      options = @controller.class.cancan_skipper[behavior][@name]
-      if options.nil?
-        false
-      elsif options == {}
-        true
-      elsif options[:except] && ![options[:except]].flatten.include?(@params[:action].to_sym)
-        true
-      elsif [options[:only]].flatten.include?(@params[:action].to_sym)
-        true
-      end
+    def skip?(behavior)
+      return false unless options = @controller.class.cancan_skipper[behavior][@name]
+
+      options == {} ||
+      options[:except] && !action_exists_in?(options[:except]) ||
+      action_exists_in?(options[:only])
     end
 
     protected
@@ -123,7 +118,11 @@ module CanCan
     end
 
     def authorization_action
-      parent? ? :show : @params[:action].to_sym
+      parent? ? parent_authorization_action : @params[:action].to_sym
+    end
+
+    def parent_authorization_action
+      @options[:parent_action] || :show
     end
 
     def id_param
@@ -220,22 +219,29 @@ module CanCan
     end
 
     def resource_params
-      if param_actions.include?(@params[:action].to_sym) && params_method.present?
+      if parameters_require_sanitizing? && params_method.present?
         return case params_method
           when Symbol then @controller.send(params_method)
           when String then @controller.instance_eval(params_method)
           when Proc then params_method.call(@controller)
         end
-      elsif @options[:class]
-        params_key = extract_key(@options[:class])
-        return @params[params_key] if @params[params_key]
+      else
+        resource_params_by_namespaced_name
       end
+    end
 
-      resource_params_by_namespaced_name
+    def parameters_require_sanitizing?
+      save_actions.include?(@params[:action].to_sym) || resource_params_by_namespaced_name.present?
     end
 
     def resource_params_by_namespaced_name
-      @params[extract_key(namespaced_name)]
+      if @options[:instance_name] && @params.has_key?(extract_key(@options[:instance_name]))
+        @params[extract_key(@options[:instance_name])]
+      elsif @options[:class] && @params.has_key?(extract_key(@options[:class]))
+        @params[extract_key(@options[:class])]
+      else
+        @params[extract_key(namespaced_name)]
+      end
     end
 
     def params_method
@@ -252,17 +258,15 @@ module CanCan
     end
 
     def namespace
-      @params[:controller].split(/::|\//)[0..-2]
+      @params[:controller].split('/')[0..-2]
     end
 
     def namespaced_name
-      [namespace, name.camelize].join('::').singularize.camelize.constantize
-    rescue NameError
-      name
+      ([namespace, name] * '/').singularize.camelize.safe_constantize || name
     end
 
     def name_from_controller
-      @params[:controller].sub("Controller", "").underscore.split('/').last.singularize
+      @params[:controller].split('/').last.singularize
     end
 
     def instance_name
@@ -277,12 +281,16 @@ module CanCan
       [:new, :create] + Array(@options[:new])
     end
 
-    def param_actions
+    def save_actions
       [:create, :update]
     end
 
     private
 
+    def action_exists_in?(options)
+      Array(options).include?(@params[:action].to_sym)
+    end
+
     def extract_key(value)
        value.to_s.underscore.gsub('/', '_')
     end

data/lib/cancan/matchers.rb

@@ -1,10 +1,10 @@
-rspec_module = defined?(RSpec::Core) ? 'RSpec' : 'Spec'  # for RSpec 1 compatability
+rspec_module = defined?(RSpec::Core) ? 'RSpec' : 'Spec' # RSpec 1 compatability
 
 if rspec_module == 'RSpec'
   require 'rspec/core'
   require 'rspec/expectations'
 else
-  ActiveSupport::Deprecation.warn("RSpec v1 will not be supported in the CanCanCan >= 2.0.0")
+  ActiveSupport::Deprecation.warn('RSpec < 3 will not be supported in the CanCanCan >= 2.0.0')
 end
 
 Kernel.const_get(rspec_module)::Matchers.define :be_able_to do |*args|
@@ -12,11 +12,34 @@ Kernel.const_get(rspec_module)::Matchers.define :be_able_to do |*args|
     ability.can?(*args)
   end
 
-  failure_message_for_should do |ability|
-    "expected to be able to #{args.map(&:inspect).join(" ")}"
+  # Check that RSpec is < 2.99
+  if !respond_to?(:failure_message) && respond_to?(:failure_message_for_should)
+    alias :failure_message :failure_message_for_should
   end
 
-  failure_message_for_should_not do |ability|
-    "expected not to be able to #{args.map(&:inspect).join(" ")}"
+  if !respond_to?(:failure_message_when_negated) && respond_to?(:failure_message_for_should_not)
+    alias :failure_message_when_negated :failure_message_for_should_not
+  end
+
+  failure_message do
+    resource = args[1]
+    if resource.instance_of?(Class)
+      "expected to be able to #{args.map(&:to_s).join(' ')}"
+    else
+      "expected to be able to #{args.map(&:inspect).join(' ')}"
+    end
+  end
+
+  failure_message_when_negated do
+    resource = args[1]
+    if resource.instance_of?(Class)
+      "expected not to be able to #{args.map(&:to_s).join(' ')}"
+    else
+      "expected not to be able to #{args.map(&:inspect).join(' ')}"
+    end
+  end
+
+  description do
+    "be able to #{args.map(&:to_s).join(' ')}"
   end
 end

data/lib/cancan/model_adapters/active_record_3_adapter.rb

@@ -0,0 +1,16 @@
+module CanCan
+  module ModelAdapters
+    class ActiveRecord3Adapter < AbstractAdapter
+      include ActiveRecordAdapter
+      def self.for_class?(model_class)
+        model_class <= ActiveRecord::Base
+      end
+
+      private
+
+      def build_relation(*where_conditions)
+        @model_class.where(*where_conditions).includes(joins)
+      end
+    end
+  end
+end

data/lib/cancan/model_adapters/active_record_4_adapter.rb

@@ -0,0 +1,55 @@
+module CanCan
+  module ModelAdapters
+    class ActiveRecord4Adapter < AbstractAdapter
+      include ActiveRecordAdapter
+      def self.for_class?(model_class)
+        model_class <= ActiveRecord::Base
+      end
+
+      private
+
+      # As of rails 4, `includes()` no longer causes active record to
+      # look inside the where clause to decide to outer join tables
+      # you're using in the where. Instead, `references()` is required
+      # in addition to `includes()` to force the outer join.
+      def build_relation(*where_conditions)
+        relation = @model_class.where(*where_conditions)
+        relation = relation.includes(joins).references(joins) if joins.present?
+        relation
+      end
+
+      def self.override_condition_matching?(subject, name, value)
+        # ActiveRecord introduced enums in version 4.1.
+        ActiveRecord::VERSION::MINOR >= 1 &&
+          subject.class.defined_enums.include?(name.to_s)
+      end
+
+      def self.matches_condition?(subject, name, value)
+        # Get the mapping from enum strings to values.
+        enum = subject.class.send(name.to_s.pluralize)
+        # Get the value of the attribute as an integer.
+        attribute = enum[subject.send(name)]
+        # Check to see if the value matches the condition.
+        value.is_a?(Enumerable) ? 
+          (value.include? attribute) :
+          attribute == value
+      end
+
+      # Rails 4.2 deprecates `sanitize_sql_hash_for_conditions`
+      def sanitize_sql(conditions)
+        if ActiveRecord::VERSION::MINOR >= 2 && Hash === conditions
+          table = Arel::Table.new(@model_class.send(:table_name))
+
+          conditions = ActiveRecord::PredicateBuilder.resolve_column_aliases @model_class, conditions
+          conditions = @model_class.send(:expand_hash_conditions_for_aggregates, conditions)
+
+          ActiveRecord::PredicateBuilder.build_from_hash(@model_class, conditions, table).map { |b|
+            @model_class.send(:connection).visitor.compile b
+          }.join(' AND ')
+        else
+          @model_class.send(:sanitize_sql, conditions)
+        end
+      end
+    end
+  end
+end

data/lib/cancan/model_adapters/active_record_adapter.rb

@@ -1,41 +1,6 @@
 module CanCan
   module ModelAdapters
-    class ActiveRecordAdapter < AbstractAdapter
-      def self.for_class?(model_class)
-        model_class <= ActiveRecord::Base
-      end
-
-      def self.override_condition_matching?(subject, name, value)
-        name.kind_of?(MetaWhere::Column) if defined? MetaWhere
-      end
-
-      def self.matches_condition?(subject, name, value)
-        subject_value = subject.send(name.column)
-        if name.method.to_s.ends_with? "_any"
-          value.any? { |v| meta_where_match? subject_value, name.method.to_s.sub("_any", ""), v }
-        elsif name.method.to_s.ends_with? "_all"
-          value.all? { |v| meta_where_match? subject_value, name.method.to_s.sub("_all", ""), v }
-        else
-          meta_where_match? subject_value, name.method, value
-        end
-      end
-
-      def self.meta_where_match?(subject_value, method, value)
-        case method.to_sym
-        when :eq      then subject_value == value
-        when :not_eq  then subject_value != value
-        when :in      then value.include?(subject_value)
-        when :not_in  then !value.include?(subject_value)
-        when :lt      then subject_value < value
-        when :lteq    then subject_value <= value
-        when :gt      then subject_value > value
-        when :gteq    then subject_value >= value
-        when :matches then subject_value =~ Regexp.new("^" + Regexp.escape(value).gsub("%", ".*") + "$", true)
-        when :does_not_match then !meta_where_match?(subject_value, :matches, value)
-        else raise NotImplemented, "The #{method} MetaWhere condition is not supported."
-        end
-      end
-
+    module ActiveRecordAdapter
       # Returns conditions intended to be used inside a database query. Normally you will not call this
       # method directly, but instead go through ModelAdditions#accessible_by.
       #
@@ -67,7 +32,7 @@ module CanCan
         conditions.inject({}) do |result_hash, (name, value)|
           if value.kind_of? Hash
             value = value.dup
-            association_class = model_class.reflect_on_association(name).class_name.constantize
+            association_class = model_class.reflect_on_association(name).klass.name.constantize
             nested = value.inject({}) do |nested,(k,v)|
               if v.kind_of? Hash
                 value.delete(k)
@@ -99,11 +64,10 @@ module CanCan
         if override_scope
           @model_class.where(nil).merge(override_scope)
         elsif @model_class.respond_to?(:where) && @model_class.respond_to?(:joins)
-          mergeable_conditions = @rules.select {|rule| rule.unmergeable? }.blank?
-          if mergeable_conditions
-            @model_class.where(conditions).includes(joins)
+          if mergeable_conditions?
+            build_relation(conditions)
           else
-            @model_class.where(*(@rules.map(&:conditions))).includes(joins)
+            build_relation(*(@rules.map(&:conditions)))
           end
         else
           @model_class.all(:conditions => conditions, :joins => joins)
@@ -112,6 +76,10 @@ module CanCan
 
       private
 
+      def mergeable_conditions?
+        @rules.find {|rule| rule.unmergeable? }.blank?
+      end
+
       def override_scope
         conditions = @rules.map(&:conditions).compact
         if defined?(ActiveRecord::Relation) && conditions.any? { |c| c.kind_of?(ActiveRecord::Relation) }

data/lib/cancan/model_adapters/mongoid_adapter.rb

@@ -35,15 +35,36 @@ module CanCan
 
           rules.inject(@model_class.all) do |records, rule|
             if process_can_rules && rule.base_behavior
-              records.or rule.conditions
+              records.or simplify_relations(@model_class, rule.conditions)
             elsif !rule.base_behavior
-              records.excludes rule.conditions
+              records.excludes simplify_relations(@model_class, rule.conditions)
             else
               records
             end
           end
         end
       end
+
+      private
+      # Look for criteria on relations and replace with simple id queries
+      # eg.
+      # {user: {:tags.all => []}} becomes {"user_id" => {"$in" => [__, ..]}}
+      # {user: {:session => {:tags.all => []}}} becomes {"user_id" => {"session_id" => {"$in" => [__, ..]} }}
+      def simplify_relations model_class, conditions
+        model_relations = model_class.relations.with_indifferent_access
+        Hash[
+          conditions.map {|k,v|
+            if relation = model_relations[k]
+              relation_class_name = relation[:class_name].blank? ? k.to_s.classify : relation[:class_name]
+              v = simplify_relations(relation_class_name.constantize, v)
+              relation_ids = relation_class_name.constantize.where(v).only(:id).map(&:id)
+              k = "#{k}_id"
+              v = { "$in" => relation_ids }
+            end
+            [k,v]
+          }
+        ]
+      end
     end
   end
 end

data/lib/cancan/rule.rb

@@ -91,7 +91,11 @@ module CanCan
     end
 
     def matches_subject_class?(subject)
-      @subjects.any? { |sub| sub.kind_of?(Module) && (subject.kind_of?(sub) || subject.class.to_s == sub.to_s || subject.kind_of?(Module) && subject.ancestors.include?(sub)) }
+      @subjects.any? do |sub|
+        sub.kind_of?(Module) && (subject.kind_of?(sub) ||
+                                 subject.class.to_s == sub.to_s ||
+                                 (subject.kind_of?(Module) && subject.ancestors.include?(sub)))
+      end
     end
 
     # Checks if the given subject matches the given conditions hash.
@@ -108,15 +112,15 @@ module CanCan
 
       conditions.all? do |name, value|
         if adapter.override_condition_matching?(subject, name, value)
-          return adapter.matches_condition?(subject, name, value)
+          adapter.matches_condition?(subject, name, value)
+        else
+          condition_match?(subject.send(name), value)
         end
-
-        condition_match?(subject.send(name), value)
       end
     end
 
     def nested_subject_matches_conditions?(subject_hash)
-      parent, child = subject_hash.first
+      parent, _child = subject_hash.first
       matches_conditions_hash?(parent, @conditions[parent.class.name.downcase.to_sym] || {})
     end
 
@@ -136,6 +140,7 @@ module CanCan
       case value
       when Hash       then hash_condition_match?(attribute, value)
       when String     then attribute == value
+      when Range      then value.cover?(attribute)
       when Enumerable then value.include?(attribute)
       else attribute == value
       end

data/lib/cancan/version.rb

@@ -1,3 +1,3 @@
 module CanCan
-  VERSION = "1.8.0"
+  VERSION = "1.14.0"
 end

data/lib/cancan.rb

@@ -9,7 +9,16 @@ require 'cancan/inherited_resource'
 
 require 'cancan/model_adapters/abstract_adapter'
 require 'cancan/model_adapters/default_adapter'
-require 'cancan/model_adapters/active_record_adapter' if defined? ActiveRecord
-require 'cancan/model_adapters/data_mapper_adapter' if defined? DataMapper
+
+if defined? ActiveRecord
+  require 'cancan/model_adapters/active_record_adapter'
+  if ActiveRecord.respond_to?(:version) &&
+      ActiveRecord.version >= Gem::Version.new("4")
+    require 'cancan/model_adapters/active_record_4_adapter'
+  else
+    require 'cancan/model_adapters/active_record_3_adapter'
+  end
+end
+
 require 'cancan/model_adapters/mongoid_adapter' if defined?(Mongoid) && defined?(Mongoid::Document)
 require 'cancan/model_adapters/sequel_adapter' if defined? Sequel

data/lib/generators/cancan/ability/templates/ability.rb

@@ -27,6 +27,6 @@ class Ability
     #   can :update, Article, :published => true
     #
     # See the wiki for details:
-    # https://github.com/bryanrite/cancancan/wiki/Defining-Abilities
+    # https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities
   end
 end

data/spec/README.rdoc

@@ -6,7 +6,7 @@ To run the specs first run the +bundle+ command to install the necessary gems an
 
   bundle
 
-Then run the appraisal command to install all the necssary test sets:
+Then run the appraisal command to install all the necessary test sets:
 
   appraisal install
 
@@ -16,7 +16,7 @@ You can then run all test sets:
 
 Or individual ones:
 
-  appraisal rails_3.0 rake
+  appraisal activerecord_3.2 rake
 
 A list of the tests is in the +Appraisal+ file.