cancancan 1.10.1 → 1.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 21431fc240e1b6a6093c6b9020f3804be1dc4b92
-  data.tar.gz: 604de9f26326c369c30746aee8103e9761c8319f
+  metadata.gz: 31c960036e585081371697da5c478888f7f5f03d
+  data.tar.gz: c0ecbe3789eae4ec649037153b750749bc5c6279
 SHA512:
-  metadata.gz: 05de9daae982bbf29448fbbcc5f15ea074ab8d33a4cef3b84555c494c9a2f8fabe759b09241d593de05ffb83c7c579de25445c6b88cc398cf9f4da39008ba57e
-  data.tar.gz: 040dbc4c5450a992bd3ce233435a44faac4aedba9cbec03387242bb8e84933f315135955765d318da58b0f0b40d9f0825c2bccf9bf2a6b2e1a552e613ed88826
+  metadata.gz: 3bf8dcc830c31f9b2b0658dd25f3995358d7ef2150a054a85646b766eb1e202c1c949a75ef618bdb0f772a8b5d9a10a3b35c9c392865092e1761f2a1693237cd
+  data.tar.gz: 7eebcdd0f7a211f958279848dde7a076f2a9c048f110096ecf939bd85731750dda57a5e6b50589fbe1c3708b107117f047049bdce651756955a23fad9a247c58

data/.travis.yml

@@ -4,6 +4,7 @@ rvm:
   - 1.9.3
   - 2.0.0
   - 2.1.0
+  - 2.2.0
   - ree
   - jruby
   - rbx
@@ -37,6 +38,12 @@ matrix:
       gemfile: gemfiles/activerecord_4.1.gemfile
     - rvm: 1.9.2
       gemfile: gemfiles/activerecord_4.2.gemfile
+    - rvm: 2.2.0
+      gemfile: gemfiles/activerecord_3.0.gemfile
+    - rvm: 2.2.0
+      gemfile: gemfiles/activerecord_3.1.gemfile
+    - rvm: 2.2.0
+      gemfile: gemfiles/activerecord_3.2.gemfile
     - rvm: ree
       gemfile: gemfiles/activerecord_4.0.gemfile
     - rvm: ree

data/CHANGELOG.rdoc

@@ -1,5 +1,8 @@
 Develop
 
+1.11.0 (June 15th, 2015)
+
+* Complete cancancan#115 - Specify authorization action for parent resources. (phallguy)
 
 1.10.1 (January 13th, 2015)
 

data/README.md

@@ -5,11 +5,10 @@
 [![Code Climate Badge](https://codeclimate.com/github/CanCanCommunity/cancancan.png)](https://codeclimate.com/github/CanCanCommunity/cancancan)
 [![Inch CI](http://inch-ci.org/github/CanCanCommunity/cancancan.png)](http://inch-ci.org/github/CanCanCommunity/cancancan)
 
-[Wiki](https://github.com/CanCanCommunity/cancancan/wiki) | [RDocs](http://rdoc.info/projects/CanCanCommunity/cancan) | [Screencast](http://railscasts.com/episodes/192-authorization-with-cancan)
+[Wiki](https://github.com/CanCanCommunity/cancancan/wiki) | [RDocs](http://rdoc.info/projects/CanCanCommunity/cancancan) | [Screencast](http://railscasts.com/episodes/192-authorization-with-cancan)
 
 CanCan is an authorization library for Ruby on Rails which restricts what resources a given user is allowed to access. All permissions are defined in a single location (the `Ability` class) and not duplicated across controllers, views, and database queries.
 
-
 ## Mission
 
 This repo is a continuation of the dead [CanCan](https://github.com/ryanb/cancan) project. Our mission is to keep CanCan alive and moving forward, with maintenance fixes and new features. Pull Requests are welcome!
@@ -25,14 +24,6 @@ In **Rails 3 and 4**, add this to your Gemfile and run the `bundle install` comm
 
     gem 'cancancan', '~> 1.10'
 
-In **Rails 2**, add this to your environment.rb file.
-
-    config.gem "cancancan"
-
-Alternatively, you can install it as a plugin.
-
-    rails plugin install git://github.com/CanCanCommunity/cancancan.git
-
 ## Getting Started
 
 CanCanCan expects a `current_user` method to exist in the controller. First, set up some authentication (such as [Authlogic](https://github.com/binarylogic/authlogic) or [Devise](https://github.com/plataformatec/devise)). See [Changing Defaults](https://github.com/CanCanCommunity/cancancan/wiki/changing-defaults) if you need different behavior.
@@ -100,9 +91,9 @@ When using `strong_parameters` or Rails 4+, you have to sanitize inputs before s
 
 By default, CanCan will try to sanitize the input on `:create` and `:update` routes by seeing if your controller will respond to the following methods (in order):
 
-* `create_params` or `update_params` (depending on the action you are performing)
-* `<model_name>_params` such as `article_params` (this is the default convention in rails for naming your param method)
-* `resource_params` (a generically named method you could specify in each controller)
+1. `create_params` or `update_params` (depending on the action you are performing)
+2. `<model_name>_params` such as `article_params` (this is the default convention in rails for naming your param method)
+3. `resource_params` (a generically named method you could specify in each controller)
 
 Additionally, `load_and_authorize_resource` can now take a `param_method` option to specify a custom method in the controller to run to sanitize input.
 
@@ -163,7 +154,7 @@ class ApplicationController < ActionController::Base
 end
 ```
 
-This will raise an exception if authorization is not performed in an action. If you want to skip this add `skip_authorization_check` to a controller subclass. See [Ensure Authorization](https://github.com/CanCanCommunity/cancancan/wiki/Ensure-Authorization) for more information.
+This will raise an exception if authorization is not performed in an action. If you want to skip this, add `skip_authorization_check` to a controller subclass. See [Ensure Authorization](https://github.com/CanCanCommunity/cancancan/wiki/Ensure-Authorization) for more information.
 
 
 ## Wiki Docs
@@ -183,7 +174,7 @@ If you have any issues with CanCan which you cannot find the solution to in the
 
 ## Development
 
-Cancancan uses [appraisals](https://github.com/thoughtbot/appraisal) to test the code base against multiple versions of rails, as well as the different model adapters.
+Cancancan uses [appraisals](https://github.com/thoughtbot/appraisal) to test the code base against multiple versions of Rails, as well as the different model adapters.
 
 When first developing, you may need to run `bundle install` and then `appraisal install`, to install the different sets.
 

data/cancancan.gemspec

@@ -26,6 +26,7 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'rake', '~> 10.1.1'
   s.add_development_dependency 'rspec', '~> 3.0.0'
   s.add_development_dependency 'appraisal', '>= 1.0.0'
+  s.add_development_dependency 'pry', '~> 0.10.0'
 
   s.rubyforge_project = s.name
 end

data/lib/cancan/controller_resource.rb

@@ -46,17 +46,12 @@ module CanCan
       @options.has_key?(:parent) ? @options[:parent] : @name && @name != name_from_controller.to_sym
     end
 
-    def skip?(behavior) # This could probably use some refactoring
-      options = @controller.class.cancan_skipper[behavior][@name]
-      if options.nil?
-        false
-      elsif options == {}
-        true
-      elsif options[:except] && ![options[:except]].flatten.include?(@params[:action].to_sym)
-        true
-      elsif [options[:only]].flatten.include?(@params[:action].to_sym)
-        true
-      end
+    def skip?(behavior)
+      return false unless options = @controller.class.cancan_skipper[behavior][@name]
+
+      options == {} ||
+      options[:except] && !action_exists_in?(options[:except]) ||
+      action_exists_in?(options[:only])
     end
 
     protected
@@ -123,7 +118,11 @@ module CanCan
     end
 
     def authorization_action
-      parent? ? :show : @params[:action].to_sym
+      parent? ? parent_authorization_action : @params[:action].to_sym
+    end
+
+    def parent_authorization_action
+      @options[:parent_action] || :show
     end
 
     def id_param
@@ -259,7 +258,7 @@ module CanCan
     end
 
     def namespace
-      @params[:controller].split(/::|\//)[0..-2]
+      @params[:controller].split('/')[0..-2]
     end
 
     def namespaced_name
@@ -269,7 +268,7 @@ module CanCan
     end
 
     def name_from_controller
-      @params[:controller].sub("Controller", "").underscore.split('/').last.singularize
+      @params[:controller].split('/').last.singularize
     end
 
     def instance_name
@@ -290,6 +289,10 @@ module CanCan
 
     private
 
+    def action_exists_in?(options)
+      Array(options).include?(@params[:action].to_sym)
+    end
+
     def extract_key(value)
        value.to_s.underscore.gsub('/', '_')
     end

data/lib/cancan/version.rb

@@ -1,3 +1,3 @@
 module CanCan
-  VERSION = "1.10.1"
+  VERSION = "1.11.0"
 end

data/spec/cancan/controller_resource_spec.rb

@@ -72,7 +72,7 @@ describe CanCan::ControllerResource do
         class Model < ::Model; end
       end
 
-      params.merge!(:controller => "MyEngine::ModelsController", :my_engine_model => {:name => "foobar"})
+      params.merge!(:controller => "my_engine/models", :my_engine_model => {:name => "foobar"})
       resource = CanCan::ControllerResource.new(controller)
       resource.load_resource
       expect(controller.instance_variable_get(:@model).name).to eq("foobar")
@@ -97,7 +97,7 @@ describe CanCan::ControllerResource do
     end
 
     it "builds a new resource for namespaced controller and namespaced model with hash if params[:id] is not specified" do
-      params.merge!(:controller => "Admin::SubModelsController", 'sub_model' => {:name => "foobar"})
+      params.merge!(:controller => "admin/sub_models", 'sub_model' => {:name => "foobar"})
       resource = CanCan::ControllerResource.new(controller, :class => Model)
       resource.load_resource
       expect(controller.instance_variable_get(:@sub_model).name).to eq("foobar")
@@ -231,6 +231,14 @@ describe CanCan::ControllerResource do
       expect { resource.authorize_resource }.to raise_error(CanCan::AccessDenied)
     end
 
+    it "authorizes with :custom_action for parent collection action" do
+      controller.instance_variable_set(:@category, :some_category)
+      allow(controller).to receive(:authorize!).with(:custom_action, :some_category) { raise CanCan::AccessDenied }
+
+      resource = CanCan::ControllerResource.new(controller, :category, :parent => true, :parent_action => :custom_action )
+      expect { resource.authorize_resource }.to raise_error(CanCan::AccessDenied)
+    end
+
     it "has the specified nested resource_class when using / for namespace" do
       module Admin
         class Dashboard; end
@@ -307,30 +315,6 @@ describe CanCan::ControllerResource do
       expect(controller.instance_variable_get(:@model)).to eq(model)
     end
 
-    it "attempts to load a resource with the same namespace as the controller when using :: for namespace" do
-      module MyEngine
-        class Model < ::Model; end
-      end
-
-      model = MyEngine::Model.new
-      allow(MyEngine::Model).to receive(:find).with("123") { model }
-
-      params.merge!(:controller => "MyEngine::ModelsController")
-      resource = CanCan::ControllerResource.new(controller)
-      resource.load_resource
-      expect(controller.instance_variable_get(:@model)).to eq(model)
-    end
-
-    it "loads resource for namespaced controller when using '::' for namespace" do
-      model = Model.new
-      allow(Model).to receive(:find).with("123") { model }
-
-      params.merge!(:controller => "Admin::ModelsController")
-      resource = CanCan::ControllerResource.new(controller)
-      resource.load_resource
-      expect(controller.instance_variable_get(:@model)).to eq(model)
-    end
-
     it "performs authorization using controller action and loaded model" do
       controller.instance_variable_set(:@model, :some_model)
       allow(controller).to receive(:authorize!).with(:show, :some_model) { raise CanCan::AccessDenied }

data/spec/spec_helper.rb

@@ -1,5 +1,6 @@
 require 'rubygems'
 require 'bundler/setup'
+require 'pry'
 
 Bundler.require
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cancancan
 version: !ruby/object:Gem::Version
-  version: 1.10.1
+  version: 1.11.0
 platform: ruby
 authors:
 - Bryan Rite
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-13 00:00:00.000000000 Z
+date: 2015-06-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -67,6 +67,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.0
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.10.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.10.0
 description: Continuation of the simple authorization solution for Rails which is
   decoupled from user roles. All permissions are stored in a single location.
 email: bryan@bryanrite.com
@@ -155,36 +169,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.4
 requirements: []
 rubyforge_project: cancancan
-rubygems_version: 2.4.3
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: Simple authorization solution for Rails.
 test_files:
 - Appraisals
-- gemfiles/activerecord_3.0.gemfile
-- gemfiles/activerecord_3.1.gemfile
-- gemfiles/activerecord_3.2.gemfile
-- gemfiles/activerecord_4.0.gemfile
-- gemfiles/activerecord_4.1.gemfile
-- gemfiles/activerecord_4.2.gemfile
-- gemfiles/datamapper_1.x.gemfile
-- gemfiles/mongoid_2.x.gemfile
-- gemfiles/sequel_3.x.gemfile
-- spec/README.rdoc
-- spec/cancan/ability_spec.rb
-- spec/cancan/controller_additions_spec.rb
-- spec/cancan/controller_resource_spec.rb
-- spec/cancan/exceptions_spec.rb
-- spec/cancan/inherited_resource_spec.rb
-- spec/cancan/matchers_spec.rb
-- spec/cancan/model_adapters/active_record_4_adapter_spec.rb
-- spec/cancan/model_adapters/active_record_adapter_spec.rb
-- spec/cancan/model_adapters/data_mapper_adapter_spec.rb
-- spec/cancan/model_adapters/default_adapter_spec.rb
-- spec/cancan/model_adapters/mongoid_adapter_spec.rb
-- spec/cancan/model_adapters/sequel_adapter_spec.rb
-- spec/cancan/rule_spec.rb
-- spec/matchers.rb
-- spec/spec.opts
-- spec/spec_helper.rb
-- spec/support/ability.rb