cancancan 3.6.1 → 3.7.0

data/lib/cancan/controller_resource.rb

@@ -1,13 +1,10 @@
 # frozen_string_literal: true
 
-require_relative 'controller_resource_loader.rb'
 module CanCan
   # Handle the load and authorization controller logic
   # so we don't clutter up all controllers with non-interface methods.
   # This class is used internally, so you do not need to call methods directly on it.
   class ControllerResource # :nodoc:
-    include ControllerResourceLoader
-
     def self.add_before_action(controller_class, method, *args)
       options = args.extract_options!
       resource_name = args.first
@@ -26,7 +23,7 @@ module CanCan
       @controller = controller
       @params = controller.params
       @options = args.extract_options!
-      @name = args.first
+      @name = args.first&.to_sym
     end
 
     def load_and_authorize_resource
@@ -34,6 +31,16 @@ module CanCan
       authorize_resource
     end
 
+    def load_resource
+      return if skip?(:load)
+
+      if load_instance?
+        self.resource_instance ||= load_resource_instance
+      elsif load_collection?
+        self.collection_instance ||= load_collection
+      end
+    end
+
     def authorize_resource
       return if skip?(:authorize)
 
@@ -54,10 +61,34 @@ module CanCan
 
     protected
 
+    def name
+      @name || name_from_controller
+    end
+
+    def name_from_controller
+      @params[:controller].split('/').last.singularize
+    end
+
+    def namespace
+      @params[:controller].split('/')[0..-2]
+    end
+
+    def namespaced_name
+      [namespace, name].join('/').singularize.camelize.safe_constantize || name
+    end
+
+    def instance_name
+      @options[:instance_name] || name
+    end
+
     # Returns the class used for this resource. This can be overridden by the :class option.
     # If +false+ is passed in it will use the resource name as a symbol in which case it should
     # only be used for authorization, not loading since there's no class to load through.
     def resource_class
+      @resource_class ||= resource_class_from_options
+    end
+
+    def resource_class_from_options
       case @options[:class]
       when false
         name.to_sym
@@ -70,12 +101,20 @@ module CanCan
       end
     end
 
-    def load_instance?
-      parent? || member_action?
+    def resource_class_with_parent
+      parent_resource ? { parent_resource => resource_class } : resource_class
     end
 
-    def load_collection?
-      resource_base.respond_to?(:accessible_by) && !current_ability.has_block?(authorization_action, resource_class)
+    def new_actions
+      %i[new create] + Array(@options[:new]).map(&:to_sym)
+    end
+
+    def collection_actions
+      [:index] + Array(@options[:collection]).map(&:to_sym)
+    end
+
+    def save_actions
+      %i[create update]
     end
 
     def member_action?
@@ -84,8 +123,20 @@ module CanCan
           !collection_actions.include?(@params[:action].to_sym))
     end
 
-    def resource_class_with_parent
-      parent_resource ? { parent_resource => resource_class } : resource_class
+    def load_instance?
+      parent? || member_action?
+    end
+
+    def load_collection?
+      resource_base.respond_to?(:accessible_by) && !current_ability.has_block?(authorization_action, resource_class)
+    end
+
+    def parent_authorization_action
+      @options[:parent_action] || :show
+    end
+
+    def authorization_action
+      parent? ? parent_authorization_action : @params[:action].to_sym
     end
 
     def resource_instance=(instance)
@@ -108,26 +159,205 @@ module CanCan
       @controller.instance_variable_get("@#{instance_name.to_s.pluralize}")
     end
 
+    def load_collection
+      resource_base.accessible_by(current_ability, authorization_action)
+    end
+
+    def load_resource_instance
+      if !parent? && new_actions.include?(@params[:action].to_sym)
+        build_resource
+      elsif id_param || @options[:singleton]
+        find_resource
+      end
+    end
+
+    def fetch_parent(name)
+      if @controller.instance_variable_defined? "@#{name}"
+        @controller.instance_variable_get("@#{name}")
+      elsif @controller.respond_to?(name, true)
+        @controller.send(name)
+      end
+    end
+
+    # The object to load this resource through.
+    def parent_resource
+      parent_name && fetch_parent(parent_name)
+    end
+
+    def parent_name
+      @options[:through] && [@options[:through]].flatten.detect { |i| fetch_parent(i) }
+    end
+
+    def resource_base_through_parent_resource
+      if @options[:singleton]
+        resource_class
+      else
+        parent_resource.send(@options[:through_association] || name.to_s.pluralize)
+      end
+    end
+
+    def resource_base_through
+      if parent_resource
+        resource_base_through_parent_resource
+      elsif @options[:shallow]
+        resource_class
+      else
+        # maybe this should be a record not found error instead?
+        raise AccessDenied.new(nil, authorization_action, resource_class)
+      end
+    end
+
+    # The object that methods (such as "find", "new" or "build") are called on.
+    # If the :through option is passed it will go through an association on that instance.
+    # If the :shallow option is passed it will use the resource_class if there's no parent
+    # If the :singleton option is passed it won't use the association because it needs to be handled later.
+    def resource_base
+      @options[:through] ? resource_base_through : resource_class
+    end
+
+    def find_resource
+      singleton_association_name = @options[:through_association] || name
+      if @options[:singleton] && parent_resource.respond_to?(singleton_association_name)
+        parent_resource.send(singleton_association_name)
+      elsif @options[:find_by]
+        find_resource_using_find_by
+      else
+        adapter.find(resource_base, id_param)
+      end
+    end
+
+    def find_resource_using_find_by
+      find_by_dynamic_finder || find_by_find_by_finder || resource_base.send(@options[:find_by], id_param)
+    end
+
+    def find_by_dynamic_finder
+      method_name = "find_by_#{@options[:find_by]}!"
+      resource_base.send(method_name, id_param) if resource_base.respond_to? method_name
+    end
+
+    def find_by_find_by_finder
+      resource_base.find_by(@options[:find_by].to_sym => id_param) if resource_base.respond_to? :find_by
+    end
+
+    def id_param
+      # A whitespace-only id is blank but given, so it must also be looked up.
+      id = @params[id_param_key].to_s
+      id unless id.empty?
+    end
+
+    def id_param_key
+      if @options[:id_param]
+        @options[:id_param]
+      else
+        parent? ? :"#{name}_id" : :id
+      end
+    end
+
+    def build_resource
+      resource = resource_base.new(resource_params || {})
+      assign_attributes(resource)
+    end
+
+    def assign_attributes(resource)
+      assign_parent(resource) if @options[:singleton] && parent_resource
+      initial_attributes.each do |attr_name, value|
+        resource.send("#{attr_name}=", value)
+      end
+      resource
+    end
+
+    # The parent is assigned through the setter named after the :through option when the resource has one,
+    # otherwise through the inverse of the association on the parent.
+    def assign_parent(resource)
+      setter = "#{parent_name}="
+      setter = "#{inverse_association_name}=" unless resource.respond_to?(setter)
+      resource.send(setter, parent_resource)
+    end
+
+    def inverse_association_name
+      association_name = @options[:through_association] || name
+      inverse = inverse_of_association(parent_resource.class, association_name)
+      return inverse if inverse
+
+      raise Error, "Cannot assign the parent to the singleton resource: #{resource_class} has no " \
+                   "#{parent_name}= method and the association #{association_name} on #{parent_resource.class} " \
+                   'has no inverse. Define inverse_of on the association or use a through option named after it.'
+    end
+
+    def inverse_of_association(parent_class, association_name)
+      return unless parent_class.respond_to?(:reflect_on_association)
+
+      reflection = parent_class.reflect_on_association(association_name)
+      reflection && (reflection.inverse_of&.name || reflection.options[:as])
+    end
+
+    def initial_attributes
+      current_ability.attributes_for(@params[:action].to_sym, resource_class).delete_if do |key, _value|
+        resource_params&.include?(key)
+      end
+    end
+
+    # The params method of the controller can have side effects, so it is called at most once per request.
+    def resource_params
+      return @resource_params if defined?(@resource_params)
+
+      @resource_params =
+        if parameters_require_sanitizing? && params_method.present?
+          sanitize_parameters
+        else
+          resource_params_by_namespaced_name
+        end
+    end
+
     def parameters_require_sanitizing?
       save_actions.include?(@params[:action].to_sym) || resource_params_by_namespaced_name.present?
     end
 
-    def instance_name
-      @options[:instance_name] || name
+    def resource_params_by_key(key)
+      return unless @options[key] && @params.key?(extract_key(@options[key]))
+
+      @params[extract_key(@options[key])]
     end
 
-    def collection_actions
-      [:index] + Array(@options[:collection])
+    def resource_params_by_namespaced_name
+      resource_params_by_key(:instance_name) || resource_params_by_key(:class) || (
+      params = @params[extract_key(namespaced_name)]
+      params.respond_to?(:to_h) ? params : nil)
     end
 
-    def save_actions
-      %i[create update]
+    def sanitize_parameters
+      case params_method
+      when Symbol
+        @controller.send(params_method)
+      when String
+        @controller.instance_eval(params_method)
+      when Proc
+        params_method.call(@controller)
+      end
+    end
+
+    def params_methods
+      methods = ["#{@params[:action]}_params".to_sym, "#{name}_params".to_sym, :resource_params]
+      methods.unshift(@options[:param_method]) if @options[:param_method].present?
+      methods
+    end
+
+    def params_method
+      params_methods.each do |method|
+        return method if (method.is_a?(Symbol) && @controller.respond_to?(method, true)) ||
+                         method.is_a?(String) || method.is_a?(Proc)
+      end
+      nil
     end
 
     private
 
     def action_exists_in?(options)
-      Array(options).include?(@params[:action].to_sym)
+      Array(options).map(&:to_sym).include?(@params[:action].to_sym)
+    end
+
+    def extract_key(value)
+      value.to_s.underscore.tr('/', '_')
     end
 
     def adapter

data/lib/cancan/model_adapters/abstract_adapter.rb

@@ -40,6 +40,15 @@ module CanCan
         parent.class.name.downcase.to_sym
       end
 
+      # Override if conditions on the parent could be under other keys, like a foreign key
+      def self.parent_condition_keys(parent, child)
+        [parent_condition_name(parent, child)]
+      end
+
+      def self.conditions_only_on_parent?(parent, child, conditions)
+        conditions.is_a?(Hash) && (conditions.keys.map(&:to_sym) - parent_condition_keys(parent, child)).empty?
+      end
+
       # Used above override_conditions_hash_matching to determine if this model adapter will override the
       # matching behavior for nested subject.
       # If this returns true then nested_subject_matches_conditions? will be called.

data/lib/cancan/model_adapters/active_record_5_adapter.rb

@@ -14,8 +14,8 @@ module CanCan
       def self.matches_condition?(subject, name, value)
         return super if Array.wrap(value).all? { |x| x.is_a? Integer }
 
-        attribute = subject.send(name)
-        raw_attribute = subject.class.send(name.to_s.pluralize)[attribute]
+        attribute = subject.send(name).to_s
+        raw_attribute = subject.class.send(name.to_s.pluralize)[attribute].to_s
         !(Array(value).map(&:to_s) & [attribute, raw_attribute]).empty?
       end
 
@@ -26,34 +26,62 @@ module CanCan
       end
 
       def strategy_class
-        strategy_class_name = CanCan.accessible_by_strategy.to_s.camelize
-        CanCan::ModelAdapters::Strategies.const_get(strategy_class_name)
+        strategy = CanCan.accessible_by_strategy
+        return strategy if strategy.is_a?(Class)
+
+        CanCan::ModelAdapters::Strategies.const_get(strategy.to_s.camelize)
       end
 
-      def sanitize_sql(conditions)
+      def sanitize_sql(conditions, conditions_extractor = nil)
         if conditions.is_a?(Hash)
-          sanitize_sql_activerecord5(conditions)
+          sanitize_sql_activerecord5(conditions, conditions_extractor)
         else
           @model_class.send(:sanitize_sql, conditions)
         end
       end
 
-      def sanitize_sql_activerecord5(conditions)
-        table = @model_class.send(:arel_table)
-        table_metadata = ActiveRecord::TableMetadata.new(@model_class, table)
-        predicate_builder = ActiveRecord::PredicateBuilder.new(table_metadata)
+      def where_node(conditions, conditions_extractor)
+        Arel::Nodes::And.new(predicates(conditions, conditions_extractor))
+      end
+
+      def sanitize_sql_activerecord5(conditions, conditions_extractor)
+        predicates(conditions, conditions_extractor).map { |b| visit_nodes(b) }.join(' AND ')
+      end
 
-        predicate_builder.build_from_hash(conditions.stringify_keys).map { |b| visit_nodes(b) }.join(' AND ')
+      def predicates(conditions, conditions_extractor)
+        conditions.flat_map do |key, value|
+          table_class = value.is_a?(Hash) && conditions_extractor&.model_class_for(key)
+          if table_class
+            predicate_builder(table_class, table_class.arel_table.alias(key.to_s)).build_from_hash(value.stringify_keys)
+          else
+            predicate_builder(@model_class, @model_class.send(:arel_table)).build_from_hash(key.to_s => value)
+          end
+        end
+      end
+
+      def predicate_builder(model_class, table)
+        ActiveRecord::PredicateBuilder.new(ActiveRecord::TableMetadata.new(model_class, table))
       end
 
       def visit_nodes(node)
         # Rails 5.2 adds a BindParam node that prevents the visitor method from properly compiling the SQL query
         if self.class.version_greater_or_equal?('5.2.0')
-          connection = @model_class.send(:connection)
+          connection = model_connection
           collector = Arel::Collectors::SubstituteBinds.new(connection, Arel::Collectors::SQLString.new)
           connection.visitor.accept(node, collector).value
         else
-          @model_class.send(:connection).visitor.compile(node)
+          model_connection.visitor.compile(node)
+        end
+      end
+
+      # Rails 7.2 soft-deprecated ActiveRecord::Base.connection in favour of
+      # lease_connection, which better describes its lifecycle. Fall back to
+      # connection for Rails < 7.2 where lease_connection is not defined.
+      def model_connection
+        if @model_class.respond_to?(:lease_connection)
+          @model_class.lease_connection
+        else
+          @model_class.send(:connection)
         end
       end
     end

data/lib/cancan/model_adapters/active_record_adapter.rb

@@ -23,6 +23,8 @@ module CanCan
                             else
                               @rules
                             end
+        # The normalizers change the rules. Work on copies, so the rules of the ability stay the same.
+        @compressed_rules = @compressed_rules.map(&:dup)
         StiNormalizer.normalize(@compressed_rules)
         ConditionsNormalizer.normalize(model_class, @compressed_rules)
       end
@@ -43,7 +45,16 @@ module CanCan
           false
         end
 
+        def parent_condition_keys(parent, child)
+          [parent_condition_name(parent, child), parent_child_foreign_key(parent, child)].compact
+        end
+
         def parent_child_conditions(parent, child, all_conditions)
+          foreign_key = parent_child_foreign_key(parent, child)
+          foreign_key.nil? ? nil : all_conditions[foreign_key]
+        end
+
+        def parent_child_foreign_key(parent, child)
           child_class = child.is_a?(Class) ? child : child.class
           parent_class = parent.is_a?(Class) ? parent : parent.class
 
@@ -54,11 +65,9 @@ module CanCan
 
           # Search again in case of polymorphic associations, this time matching on the :has_many side
           # via the :as option, as well as klass
-          foreign_key ||= parent_class.reflect_on_all_associations(:has_many).find do |has_many_assoc|
+          foreign_key || parent_class.reflect_on_all_associations(:has_many).find do |has_many_assoc|
             matching_parent_child_polymorphic_association(has_many_assoc, child_class)
           end&.foreign_key&.to_sym
-
-          foreign_key.nil? ? nil : all_conditions[foreign_key]
         end
 
         def matching_parent_child_polymorphic_association(parent_assoc, child_class)
@@ -110,26 +119,22 @@ module CanCan
       #   query(:manage, User).conditions # => "not (self_managed = 't') AND ((manager_id = 1) OR (id = 1))"
       #
       def conditions
-        conditions_extractor = ConditionsExtractor.new(@model_class)
-        if @compressed_rules.size == 1 && @compressed_rules.first.base_behavior
-          # Return the conditions directly if there's just one definition
-          conditions_extractor.tableize_conditions(@compressed_rules.first.conditions).dup
-        else
-          extract_multiple_conditions(conditions_extractor, @compressed_rules)
-        end
+        extract_conditions(ConditionsExtractor.new(@model_class, joins))
       end
 
       def extract_multiple_conditions(conditions_extractor, rules)
-        rules.reverse.inject(false_sql) do |sql, rule|
-          merge_conditions(sql, conditions_extractor.tableize_conditions(rule.conditions).dup, rule.base_behavior)
+        sql, = rules.reverse.inject([false_sql, false]) do |(sql, or_chain), rule|
+          conditions_hash = conditions_extractor.tableize_conditions(rule.conditions).dup
+          merge_conditions(sql, or_chain, conditions_hash, rule.base_behavior, conditions_extractor)
         end
+        sql
       end
 
       def database_records
         if override_scope
-          @model_class.where(nil).merge(override_scope)
+          merge_override_scope
         elsif @model_class.respond_to?(:where) && @model_class.respond_to?(:joins)
-          build_relation(conditions)
+          build_relation(where_conditions)
         else
           @model_class.all(conditions: conditions, joins: joins)
         end
@@ -155,6 +160,29 @@ module CanCan
 
       private
 
+      def extract_conditions(conditions_extractor)
+        if @compressed_rules.size == 1 && @compressed_rules.first.base_behavior
+          # Return the conditions directly if there's just one definition
+          conditions_extractor.tableize_conditions(@compressed_rules.first.conditions).dup
+        else
+          extract_multiple_conditions(conditions_extractor, @compressed_rules)
+        end
+      end
+
+      # Active Record cannot find the model of an aliased table in a hash of conditions,
+      # so the conditions on associations are converted to SQL with the model of each table.
+      def where_conditions
+        conditions_extractor = ConditionsExtractor.new(@model_class, joins)
+        conditions = extract_conditions(conditions_extractor)
+        return conditions unless conditions.is_a?(Hash) && conditions.values.any? { |value| value.is_a?(Hash) }
+
+        where_node(conditions, conditions_extractor)
+      end
+
+      def where_node(conditions, conditions_extractor)
+        sanitize_sql(conditions, conditions_extractor)
+      end
+
       # Removes empty hashes and moves everything into arrays.
       def deep_clean(joins_hash)
         joins_hash.map { |name, nested| nested.empty? ? name : { name => deep_clean(nested) } }
@@ -171,6 +199,17 @@ module CanCan
         end
       end
 
+      # `merge` replaces the conditions of the base relation on the columns the scope also constrains,
+      # so the conditions it dropped, like the one of an association like `category.articles`, are applied again.
+      # The conditions the scope removes with `unscope`, like the ones of a default scope, stay removed.
+      def merge_override_scope
+        merged = @model_class.where(nil).merge(override_scope)
+        base = @model_class.where(nil)
+        base = base.unscope(*override_scope.unscope_values) if override_scope.unscope_values.any?
+        dropped = base.where_clause.send(:predicates) - merged.where_clause.send(:predicates)
+        dropped.inject(merged) { |relation, predicate| relation.where(predicate) }
+      end
+
       def override_scope
         conditions = @compressed_rules.map(&:conditions).compact
         return unless conditions.any? { |c| c.is_a?(ActiveRecord::Relation) }
@@ -186,26 +225,45 @@ module CanCan
               "Instead use a hash or SQL for #{rule_found.actions.first} #{rule_found.subjects.first} ability."
       end
 
-      def merge_conditions(sql, conditions_hash, behavior)
+      # Returns the merged sql and whether it is a flat chain of OR conditions.
+      def merge_conditions(sql, or_chain, conditions_hash, behavior, conditions_extractor)
         if conditions_hash.blank?
-          behavior ? true_sql : false_sql
+          [behavior ? true_sql : false_sql, false]
         else
-          merge_non_empty_conditions(behavior, conditions_hash, sql)
+          merge_non_empty_conditions(behavior, sanitize_sql(conditions_hash, conditions_extractor), sql, or_chain)
         end
       end
 
-      def merge_non_empty_conditions(behavior, conditions_hash, sql)
-        conditions = sanitize_sql(conditions_hash)
+      # Consecutive `can` rules are joined in a flat chain of ORs, so that the nesting of the query only grows
+      # when `can` and `cannot` rules alternate. Deeply nested conditions overflow the parser of SQLite.
+      def merge_non_empty_conditions(behavior, conditions, sql, or_chain)
         case sql
         when true_sql
-          behavior ? true_sql : "not (#{conditions})"
+          behavior ? [true_sql, false] : [not_conditions(conditions), false]
         when false_sql
-          behavior ? conditions : false_sql
+          behavior ? [conditions, false] : [false_sql, false]
+        else
+          merge_with_previous_conditions(behavior, conditions, sql, or_chain)
+        end
+      end
+
+      def merge_with_previous_conditions(behavior, conditions, sql, or_chain)
+        if behavior
+          [or_conditions(conditions, sql, or_chain), true]
         else
-          behavior ? "(#{conditions}) OR (#{sql})" : "not (#{conditions}) AND (#{sql})"
+          ["#{not_conditions(conditions)} AND (#{sql})", false]
         end
       end
 
+      # A cannot rule only excludes the records that match its conditions: NULL does not match.
+      def not_conditions(conditions)
+        "(#{conditions}) IS NOT TRUE"
+      end
+
+      def or_conditions(conditions, sql, or_chain)
+        "(#{conditions}) OR #{or_chain ? sql : "(#{sql})"}"
+      end
+
       def false_sql
         sanitize_sql(['?=?', true, false])
       end
@@ -214,7 +272,7 @@ module CanCan
         sanitize_sql(['?=?', true, true])
       end
 
-      def sanitize_sql(conditions)
+      def sanitize_sql(conditions, _conditions_extractor = nil)
         @model_class.send(:sanitize_sql, conditions)
       end
     end