cancancan 3.6.2 → 3.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f110f791b83ea1cc157fae66dd576a3dae94f60b983d654e8be252cb6c4e8939
-  data.tar.gz: cbf9e6c8e6fadca715eeff37cfce3b289550d538e84a5996b4e95aa00632d7fd
+  metadata.gz: a89f93b55a85e54a08313de3a4cb8bad1886b3a1325c39953a8667fd58734be9
+  data.tar.gz: fdbf729ba98180067f749415815005bb2362e84f3f04014248b88f7974bf3982
 SHA512:
-  metadata.gz: 8102b54914e87e65dbd15b27991e33462d5083d37c6f57aaf09a2dfeaff92826420e27863bd88e17a8c1f18939281ec36ed2abb70e2e012df16661997af5f98a
-  data.tar.gz: 6b1defbddb0262274e8ad349fb6b267fa45b4024ca790ba3ba93f67d741cc38055e37e485d57f7ff17b59244a5c235d42e956b9049b603d2d8aa28898a4dd768
+  metadata.gz: 3ae7721feae9b7dfc2e411878bb600f08cf8edfbe42a01989b6c09ad162443714643898129ad15ca24b5f8d1bf30fb916016eac7baf466671a18a0f292f69f5d
+  data.tar.gz: '086c7fdf46ab6caa794c425681557469deffb8038f88fc7aba00e1a361fe8dd5b85caaa18884916e5ce908c7e6efec0f02b3b337a1405159b12d785ea2dc6f5d'

data/cancancan.gemspec

@@ -10,7 +10,8 @@ Gem::Specification.new do |s|
   s.authors     = ['Alessandro Rodi (Renuo AG)', 'Bryan Rite', 'Ryan Bates', 'Richard Wilson']
   s.email       = 'alessandro.rodi@renuo.ch'
   s.homepage    = 'https://github.com/CanCanCommunity/cancancan'
-  s.metadata = { 'funding_uri' => 'https://github.com/sponsors/coorasse' }
+  s.metadata = { 'changelog_uri' => 'https://github.com/CanCanCommunity/cancancan/blob/develop/CHANGELOG.md',
+                 'funding_uri' => 'https://github.com/sponsors/coorasse' }
   s.summary     = 'Simple authorization solution for Rails.'
   s.description = 'Simple authorization solution for Rails. All permissions are stored in a single location.'
   s.platform    = Gem::Platform::RUBY
@@ -23,7 +24,7 @@ Gem::Specification.new do |s|
 
   s.add_development_dependency 'appraisal', '~> 2.0', '>= 2.0.0'
   s.add_development_dependency 'bundler', '~> 2.0'
-  s.add_development_dependency 'rake', '~> 10.1', '>= 10.1.1'
+  s.add_development_dependency 'rake'
   s.add_development_dependency 'rspec', '~> 3.2', '>= 3.2.0'
   s.add_development_dependency 'rubocop', '~> 1.31.1'
 end

data/lib/cancan/ability/actions.rb

@@ -33,10 +33,12 @@ module CanCan
       #
       # This way one can use params[:action] in the controller to determine the permission.
       def alias_action(*args)
-        target = args.pop[:to]
-        validate_target(target)
+        target = args.pop[:to]&.to_sym
+        actions = args.map(&:to_sym)
+        validate_target(target, actions)
         aliased_actions[target] ||= []
-        aliased_actions[target] += args
+        aliased_actions[target] += actions
+        @expanded_actions = nil
       end
 
       # Returns a hash of aliased actions. The key is the target and the value is an array of actions aliasing the key.
@@ -47,6 +49,7 @@ module CanCan
       # Removes previously aliased actions including the defaults.
       def clear_aliased_actions
         @aliased_actions = {}
+        @expanded_actions = nil
       end
 
       private

data/lib/cancan/ability/rules.rb

@@ -35,6 +35,9 @@ module CanCan
       def relevant_rules(action, subject)
         return [] unless @rules
 
+        # Actions are symbols in the rules, so 'destroy' must also match a `cannot :destroy`.
+        action = action.to_sym if action.is_a?(String)
+
         relevant = possible_relevant_rules(subject).select do |rule|
           rule.expanded_actions = expand_actions(rule.actions)
           rule.relevant? action, subject
@@ -56,8 +59,32 @@ module CanCan
         end
       end
 
+      # Returns nil when no rule matches. A class that uses single table inheritance is checked together with
+      # its subclasses, each one with the rules of its own ancestors: the check passes when any of them passes,
+      # which is also when `accessible_by` can return records.
+      def subject_can?(action, subject, attribute, *extra_args)
+        results = sti_classes(subject).map do |klass|
+          matching_rule(action, klass, attribute, *extra_args)&.base_behavior
+        end
+        results.compact.empty? ? nil : results.any?
+      end
+
+      def matching_rule(action, subject, attribute, *extra_args)
+        relevant_rules_for_match(action, subject).detect do |rule|
+          rule.matches_conditions?(action, subject, attribute, *extra_args) && rule.matches_attributes?(attribute)
+        end
+      end
+
+      def sti_classes(subject)
+        return [subject] unless defined?(ActiveRecord::Base) && subject.is_a?(Class) && subject < ActiveRecord::Base
+
+        [subject, *subject.descendants.select { |klass| StiDetector.sti_class?(klass) }]
+      end
+
       def relevant_rules_for_match(action, subject)
-        relevant_rules(action, subject).each do |rule|
+        rules = relevant_rules(action, subject)
+        rules = rules.reject { |rule| rule.only_for_subclasses_of?(subject) } if subject.is_a?(Class)
+        rules.each do |rule|
           next unless rule.only_raw_sql?
 
           raise Error,

data/lib/cancan/ability/strong_parameter_support.rb

@@ -4,34 +4,48 @@ module CanCan
   module Ability
     module StrongParameterSupport
       # Returns an array of attributes suitable for use with strong parameters
-      #
-      # Note: reversing the relevant rules is important. Normal order means that 'cannot'
+      def permitted_attributes(action, subject)
+        fold_attributes(action, subject) { |rule, set| apply_attributes(rule, subject, set) }
+      end
+
+      # This method returns all attributes which are explicity disallowed
+      def disallowed_attributes(action, subject)
+        fold_attributes(action, subject) do |rule, set|
+          attributes = get_attributes(rule, subject)
+          rule.base_behavior ? set.subtract(attributes) : set.merge(attributes)
+        end
+      end
+
+      private
+
+      # Reversing the relevant rules is important. Normal order means that 'cannot'
       # rules will come before 'can' rules. However, you can't remove attributes before
       # they are added. The 'reverse' is so that attributes will be added before the
       # 'cannot' rules remove them.
-      def permitted_attributes(action, subject)
+      def fold_attributes(action, subject, &block)
         relevant_rules(action, subject)
           .reverse
           .select { |rule| rule.matches_conditions? action, subject }
-          .each_with_object(Set.new) do |rule, set|
-          attributes = get_attributes(rule, subject)
-          # add attributes for 'can', remove them for 'cannot'
-          rule.base_behavior ? set.merge(attributes) : set.subtract(attributes)
-        end.to_a
+          .each_with_object(Set.new, &block)
+          .to_a
       end
 
-      private
-
-      def subject_class?(subject)
-        klass = (subject.is_a?(Hash) ? subject.values.first : subject).class
-        [Class, Module].include? klass
+      def apply_attributes(rule, subject, set)
+        if rule.base_behavior
+          set.merge(get_attributes(rule, subject))
+        elsif rule.attributes.empty?
+          set.clear
+        else
+          set.subtract(rule.attributes)
+        end
       end
 
       def get_attributes(rule, subject)
-        klass = subject_class?(subject) ? subject : subject.class
+        subject = subject.values.first if subject.is_a?(Hash)
+        klass = subject.is_a?(Module) ? subject : subject.class
         # empty attributes is an 'all'
         if rule.attributes.empty? && klass < ActiveRecord::Base
-          klass.attribute_names.map(&:to_sym) - Array(klass.primary_key)
+          klass.attribute_names.map(&:to_sym) - Array(klass.primary_key).map(&:to_sym)
         else
           rule.attributes
         end

data/lib/cancan/ability.rb

@@ -49,8 +49,9 @@ module CanCan
     #
     # Any additional arguments will be passed into the "can" block definition. This
     # can be used to pass more information about the user's request for example.
+    # The block is not called when a class is passed instead of an instance.
     #
-    #   can? :create, Project, request.remote_ip
+    #   can? :create, @project, request.remote_ip
     #
     #   can :create, Project do |project, remote_ip|
     #     # ...
@@ -72,12 +73,11 @@ module CanCan
     #
     # Also see the RSpec Matchers to aid in testing.
     def can?(action, subject, attribute = nil, *extra_args)
-      match = extract_subjects(subject).lazy.map do |a_subject|
-        relevant_rules_for_match(action, a_subject).detect do |rule|
-          rule.matches_conditions?(action, a_subject, attribute, *extra_args) && rule.matches_attributes?(attribute)
-        end
-      end.reject(&:nil?).first
-      match ? match.base_behavior : false
+      action = action.to_sym if action.is_a?(String)
+      results = extract_subjects(subject).lazy.map do |a_subject|
+        subject_can?(action, a_subject, attribute, *extra_args)
+      end
+      results.reject(&:nil?).first || false
     end
 
     # Convenience method which works the same as "can?" but returns the opposite value.
@@ -162,9 +162,11 @@ module CanCan
     end
 
     # User shouldn't specify targets with names of real actions or it will cause Seg fault
-    def validate_target(target)
+    def validate_target(target, actions = [])
       error_message = "You can't specify target (#{target}) as alias because it is real action name"
       raise Error, error_message if aliased_actions.values.flatten.include? target
+      raise Error, "You can't specify target (#{target}) as alias because it is a reserved action" if target == :manage
+      raise Error, "You can't alias the action (#{target}) to itself" if actions.include?(target)
     end
 
     def model_adapter(model_class, action)
@@ -250,6 +252,7 @@ module CanCan
         add_rule(rule.dup)
       end
       @aliased_actions = aliased_actions.merge(ability.aliased_actions)
+      @expanded_actions = nil
       self
     end
 
@@ -303,9 +306,9 @@ module CanCan
     def alternative_subjects(subject)
       subject = subject.class unless subject.is_a?(Module)
       if subject.respond_to?(:subclasses) && defined?(ActiveRecord::Base) && subject < ActiveRecord::Base
-        [:all, *(subject.ancestors + subject.subclasses), subject.class.to_s]
+        [:all, *(subject.ancestors + subject.descendants)]
       else
-        [:all, *subject.ancestors, subject.class.to_s]
+        [:all, *subject.ancestors]
       end
     end
   end

data/lib/cancan/class_matcher.rb

@@ -16,7 +16,7 @@ class SubjectClassMatcher
     if has_subclasses
       return matches unless StiDetector.sti_class?(sub)
 
-      matches || subject.subclasses.include?(sub)
+      matches || subject.descendants.include?(sub)
     else
       matches
     end

data/lib/cancan/conditions_matcher.rb

@@ -41,10 +41,11 @@ module CanCan
 
       adapter = model_adapter(parent)
 
-      parent_condition_name = adapter.parent_condition_name(parent, child)
+      # Like for a class, a "cannot" with conditions on the child does not stop the check.
+      return false unless @base_behavior || adapter.conditions_only_on_parent?(parent, child, @conditions)
 
-      matches_base_parent_conditions = matches_conditions_hash?(parent,
-                                                                @conditions[parent_condition_name] || {})
+      parent_conditions = @conditions[adapter.parent_condition_name(parent, child)] || {}
+      matches_base_parent_conditions = matches_conditions_hash?(parent, parent_conditions)
 
       matches_base_parent_conditions &&
         (!adapter.override_nested_subject_conditions_matching?(parent, child, @conditions) ||
@@ -88,18 +89,26 @@ module CanCan
     end
 
     def condition_match?(attribute, value)
+      return relation_match?(attribute, value) if defined?(ActiveRecord) && value.is_a?(ActiveRecord::Relation)
+
       case value
-      when Hash
-        hash_condition_match?(attribute, value)
-      when Range
-        value.cover?(attribute)
-      when Enumerable
-        value.include?(attribute)
-      else
-        attribute == value
+      when Hash then hash_condition_match?(attribute, value)
+      when Range then value.cover?(attribute)
+      when Enumerable then value.any? { |element| value_match?(attribute, element) }
+      else value_match?(attribute, value)
       end
     end
 
+    # Like Active Record in the SQL conditions, a symbol matches the string with the same name.
+    def value_match?(attribute, value)
+      attribute == value || (value.is_a?(Symbol) && attribute == value.to_s)
+    end
+
+    # Like Active Record with a relation as condition value: the selected column, or the primary key, is matched.
+    def relation_match?(attribute, relation)
+      relation.where((relation.select_values.first || relation.primary_key) => attribute).exists?
+    end
+
     def hash_condition_match?(attribute, value)
       if attribute.is_a?(Array) || (defined?(ActiveRecord) && attribute.is_a?(ActiveRecord::Relation))
         array_like_matches_condition_hash?(attribute, value)

data/lib/cancan/config.rb

@@ -47,10 +47,14 @@ module CanCan
   #                ensures records are unique using `distinct`. Note that
   #                `distinct` is not reliable in some cases. See
   #                https://github.com/CanCanCommunity/cancancan/pull/605
+  # - :joined_alias_exists_subquery, :joined_alias_each_rule_as_exists_subquery -
+  #                Build an EXISTS subquery on an aliased table.
+  # - a subclass of CanCan::ModelAdapters::Strategies::Base - Your own
+  #                strategy. Implement `execute!` and return the relation.
   def self.accessible_by_strategy
-    return @accessible_by_strategy if @accessible_by_strategy
-
-    @accessible_by_strategy = default_accessible_by_strategy
+    Thread.current[:cancan_accessible_by_strategy_override] ||
+      @accessible_by_strategy ||
+      default_accessible_by_strategy
   end
 
   def self.default_accessible_by_strategy
@@ -74,24 +78,34 @@ module CanCan
     @accessible_by_strategy = value
   end
 
+  # Overrides the strategy for the duration of the block. The override is local to the current
+  # thread and fiber, so it never leaks into concurrent requests.
   def self.with_accessible_by_strategy(value)
     return yield if value == accessible_by_strategy
 
     validate_accessible_by_strategy!(value)
 
     begin
-      strategy_was = accessible_by_strategy
-      @accessible_by_strategy = value
+      override_was = Thread.current[:cancan_accessible_by_strategy_override]
+      Thread.current[:cancan_accessible_by_strategy_override] = value
       yield
     ensure
-      @accessible_by_strategy = strategy_was
+      Thread.current[:cancan_accessible_by_strategy_override] = override_was
     end
   end
 
   def self.validate_accessible_by_strategy!(value)
     return if valid_accessible_by_strategies.include?(value)
+    return if custom_accessible_by_strategy?(value)
+
+    raise ArgumentError, "accessible_by_strategy must be one of #{valid_accessible_by_strategies.join(', ')} " \
+                         'or a subclass of CanCan::ModelAdapters::Strategies::Base'
+  end
 
-    raise ArgumentError, "accessible_by_strategy must be one of #{valid_accessible_by_strategies.join(', ')}"
+  def self.custom_accessible_by_strategy?(value)
+    value.is_a?(Class) &&
+      defined?(CanCan::ModelAdapters::Strategies::Base) &&
+      value < CanCan::ModelAdapters::Strategies::Base
   end
 
   def self.does_not_support_subquery_strategy?

data/lib/cancan/controller_additions.rb

@@ -74,7 +74,8 @@ module CanCan
       #
       # [:+through_association+]
       #   The name of the association to fetch the child records through the parent resource.
-      #   This is normally not needed because it defaults to the pluralized resource name.
+      #   This is normally not needed because it defaults to the pluralized resource name,
+      #   or to the singular resource name when +:singleton+ is used.
       #
       # [:+shallow+]
       #   Pass +true+ to allow this resource to be loaded directly when parent is +nil+. Defaults to +false+.
@@ -302,7 +303,7 @@ module CanCan
       # its own. Assign a copy, so a skip in a subclass does not change the superclass or sibling classes.
       def add_cancan_skip(behavior, name, options)
         skipper = cancan_skipper
-        self._cancan_skipper = skipper.merge(behavior => skipper[behavior].merge(name => options))
+        self._cancan_skipper = skipper.merge(behavior => skipper[behavior].merge(name&.to_sym => options))
       end
     end