cancancan_resource_controller 0.0.2 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b99718f6d48907515dff8a39fd93995f044a4bb085ab7113efeea26e0273ad3
-  data.tar.gz: 46c90e5bf82f050e4772018508e594d1ebaa8e04b33268b332c4c0ded334583d
+  metadata.gz: d65b84894faeb3238628a9b7171979e7b6e472aaac77c0a6012e03393560a38b
+  data.tar.gz: 610df250cf0731176e364771e64e0fbc5e0c661e143d26060a7b580472811fd8
 SHA512:
-  metadata.gz: 4e19a473a79d8f349c304f820ee6678180d805cf3c565f6dc71fd779613e6d200563ba8192a17f8a1eac8e676df6346266f8937900f162183485dfe39b96e4ec
-  data.tar.gz: 0c039d6dd0f6397f43a2661a38c2646a2e807105f8f85cd221c611b54c16bb5a739ddc4d2e1c706b25d8c3dc899dd5ae0453b1024328fea39f110602f02417cb
+  metadata.gz: 2be5a3c7cbcdf9589435a6b2b57da0c5fde6454768441528da2a2e1ddaa80526aaf668a68ceee8b3c5f311dec7da16bf6c2445e831bad7fab4165faa2a93a656
+  data.tar.gz: 80caf64d6786139549aca8617c2fb4e8f194589877b477d5f67ecc947c40e47ff6768afce7cd3722af8b063432cb4e71478502fa32a1c2fb60bfd1df4b5da47a

data/lib/cancancan/abstract_resource_controller.rb

@@ -1,3 +1,4 @@
+require 'cancancan_nested_assignment_and_authorization'
 # How to utilize CanCan Permissions to work with this controller:
 module CanCanCan
   module AbstractResourceController
@@ -11,14 +12,6 @@ module CanCanCan
     MAX_ASSOCIATIVE_NESTED_DEPTH = 60
     REGEX_FOR_HTML_TAG_DETECTION = /.*\<\/?[^_\W]+\>.*/
 
-    # to handle adding/removing associations by "_ids" suffix
-    IDS_ATTIB_PERMISSION_KEY_GEN = Proc.new { |assoc_key| "#{assoc_key.to_s.singularize}_ids".to_sym }
-    IDS_ACTION_PERMISSION_KEY_GEN = Proc.new { |assoc_key| "_can_add_or_remove_association_#{assoc_key.to_s}".to_sym }
-
-    # to handle updating nested attributes
-    NESTED_ATTIB_PERMISSION_KEY_GEN = Proc.new { |assoc_key| "#{assoc_key.to_s}_attributes".to_sym }
-    NESTED_ACTION_PERMISSION_KEY_GEN  = Proc.new { |assoc_key| "_can_update_association_#{assoc_key.to_s}".to_sym }
-
     # For Read-Only fields
     #  - define this on your class model
     # optional allowlist for incoming parameters for the implemented resource
@@ -95,15 +88,13 @@ module CanCanCan
       # Allow @resource to be set from subclass controller
       @resource ||= @resource_class.find(params[:id])
       authorize! :show, @resource
-      
+
       respond_with_resource
     end
 
     def new
       authorize! :create, @resource_class
       @resource ||= @resource_class.new(resource_params)
-      # 2nd auth on the object itself
-      #   Not authing on the nested resources, that could have come in as nested attributes.
       authorize! :create, @resource
 
       respond_with_resource
@@ -125,17 +116,16 @@ module CanCanCan
 
     def create
       authorize! :create, @resource_class
-      # @resource = @resource_class.new(resource_params)
+      @resource ||= @resource_class.new
 
-      # This 2nd @resource initiation is so we run run whitelisting attribs on the object.
-      #   Class whitelisting is far more broad than object attrib whitelisting.
-      #   Necessary if class permissions have a permissions-block.
-      @resource ||= @resource_class.new(resource_params(@resource))
-
-      # 2nd auth on the object itself
-      authorize! :create, @resource
+      service = CanCanCan::AssignmentAndAuthorization.new(
+        current_ability,
+        action_name,
+        @resource,
+        clean_parameter_data(params)
+      )
 
-      if @resource.save
+      if service.call
         respond_with_resource
       else
         begin
@@ -152,25 +142,14 @@ module CanCanCan
     def update
       authorize! :update, @resource_class
       @resource ||= @resource_class.find(params[:id])
-      authorize! :update, @resource
-
-      second_authorize = false
-      ActiveRecord::Base.transaction do
-        @resource.assign_attributes(resource_params(@resource))
-        second_authorize = can?(action_name.to_sym, @resource)
-        unless second_authorize
-          # NOTE: Does not halt the controller process, just rolls back the DB
-          raise ActiveRecord::Rollback
-        end
-      end
-
-      unless second_authorize
-        raise CanCan::AccessDenied.new("Not authorized!", action_name.to_sym, @resource)
-      end
-
-      # 2nd auth, on the updates of the object, without saving, so we can rollback without auth.
-      # authorize! :update, @resource
-      if @resource.save
+      service = CanCanCan::AssignmentAndAuthorization.new(
+        current_ability,
+        action_name,
+        @resource,
+        clean_parameter_data(params)
+      )
+
+      if service.call
         respond_with_resource
       else
         begin
@@ -245,36 +224,6 @@ module CanCanCan
       return resource_query
     end
 
-    # can pass in custom method to supplant 'param.permit', like if you wanted to whitelist a hash instead of params.
-    # ex: CanCanCanResourceController#deactivate_helper, permits on fake params: ActionController::Parameters.new(deactive_params)
-    def resource_params resource_object = nil, opts = {}, &block
-      local_action_name = opts[:custom_action_name] || action_name
-      allowlist_permitted = get_nested_attributes_for_class(@resource_class, local_action_name.to_sym, resource_object)
-
-      # # Rails kludge, issue with allowing parameters with empty arrays
-      # # Needs to be nested, recursive
-      # # Updating params in-place
-      # params.each do |key, value|
-      #   if key.to_s =~ /(.*)_ids/ && (value == "remove" || value == ["remove"])
-      #     params[key] = []
-      #   end
-      # end
-
-      if block_given?
-        params_with_only_allowed_parameters = yield(allowlist_permitted)
-      else
-        params_with_only_allowed_parameters = param_permit(allowlist_permitted)
-      end
-
-      # sanitize all input.
-      sanitized_params_with_only_allowed_parameters = clean_parameter_data(params_with_only_allowed_parameters)
-
-      # recast type (and have to re-permit)
-      sanitized_params_with_only_allowed_parameters = ActionController::Parameters.new(sanitized_params_with_only_allowed_parameters).permit(allowlist_permitted)
-
-      return sanitized_params_with_only_allowed_parameters
-    end
-
     # recursive
     # src: https://apidock.com/rails/v5.2.3/ActionView/Helpers/SanitizeHelper/sanitize
     def clean_parameter_data param_value
@@ -311,86 +260,6 @@ module CanCanCan
       end
     end
 
-    # Not checking instances of classes. What if they are object-state dependent?
-    # Need to run them again, after object instantiation, but in a different method.
-    def get_nested_attributes_for_class resource_class, action_name, root_level_object, depth = 0
-      raise "invalid action class: #{action_name.class}" if !action_name.is_a?(Symbol)
-      association_parameters = []
-      if depth > MAX_ASSOCIATIVE_NESTED_DEPTH
-        return association_parameters
-      end
-
-      # Handle resource_class attribs
-      # issue here is the 'action_name' on the root 'resource_class' may not be the action that the user has for the 'assoc_class'
-      # i.e:
-      #   We may want the user to update Account, and create attachments on it, but not 'update' attachments.
-      if depth == 0
-        association_parameters = current_ability.permitted_attributes(action_name, (root_level_object || resource_class)) 
-      else
-        association_parameters = current_ability.permitted_attributes(action_name, resource_class)
-      end
-
-      if resource_class.const_defined?('RESOURCE_CONTROLLER_ATTRIB_ALLOWLIST') && !resource_class::RESOURCE_CONTROLLER_ATTRIB_ALLOWLIST.nil?
-        association_parameters &= resource_class::RESOURCE_CONTROLLER_ATTRIB_ALLOWLIST
-      end
-
-      # remove customized, non-params, assoc' attrib data by only allowing class columns
-      association_parameters &= resource_class.column_names.collect(&:to_sym)
-
-      resource_class.reflect_on_all_associations(:has_many).each do |assoc_class|
-        resource_key = assoc_class.name
-        # attrib_permission_key = (resource_key.to_s.singularize + '_ids').to_sym
-        attrib_permission_key = IDS_ATTIB_PERMISSION_KEY_GEN.call(resource_key)
-        # action_permission_key = ('_can_add_or_remove_association_' + resource_key.to_s).to_sym
-        action_permission_key = IDS_ACTION_PERMISSION_KEY_GEN.call(resource_key)
-        # i.e. can?(:can_participation_ids, Account)
-        # Check to see if we manually gave the user a custom permission
-        # # (i.e.: can [:update, :can_account_sector_ids], Account)
-        # OR
-        # see if it has the attribute on the class's allowed params
-        if can?(action_permission_key, resource_class) || can?(action_name, resource_class, attrib_permission_key)
-          association_parameters << {
-            attrib_permission_key => []
-          }
-        end
-      end
-
-      resource_class.nested_attributes_options.each do |resource_key, options|
-        reflection_class = resource_class.reflect_on_association(resource_key).class
-        reflection_type  = reflection_class.name
-        assoc_class = resource_class.reflect_on_association(resource_key).klass
-
-        if [
-          "ActiveRecord::Reflection::BelongsToReflection",
-          "ActiveRecord::Reflection::HasOneReflection",
-          "ActiveRecord::Reflection::HasManyReflection"
-        ].include?(reflection_type)
-          parameter_key = NESTED_ATTIB_PERMISSION_KEY_GEN.call(resource_key)
-          permission_key = NESTED_ACTION_PERMISSION_KEY_GEN.call(resource_key)
-
-          # Can check if permission to update assoc is defined as an action OR as an attrib on the parent resource_class
-          if can?(permission_key, resource_class) || can?(action_name, resource_class, parameter_key)
-            # Handle recursion
-            assoc_parameters = get_nested_attributes_for_class(assoc_class, action_name, root_level_object, depth + 1)
-
-            if options[:allow_destroy] && can?(:destroy, resource_class)
-              assoc_parameters << :_destroy
-            end
-
-            association_parameters << {
-              parameter_key => assoc_parameters
-            }
-          end
-        end
-      end
-
-      return association_parameters
-    end
-
-    def param_permit base_parameters
-      params.permit(base_parameters)
-    end
-
     def initialize_resource_class
       # First priority is the namespaced model, e.g. User::Group
       @resource_class ||= begin

data/lib/cancancan/configuration.rb

@@ -0,0 +1,10 @@
+module CanCanCan
+  module AbstractResourceController
+    class Configuration
+      # attr_accessor :silence_raised_errors, :use_smart_nested_authorizations
+
+      def initialize
+      end
+    end
+  end
+end

data/lib/cancancan/version.rb

@@ -0,0 +1,5 @@
+module CanCanCan
+  module AbstractResourceController
+    VERSION = '1.0.2'
+  end
+end

data/lib/cancancan_resource_controller.rb

@@ -1,4 +1,27 @@
+require_relative 'cancancan/configuration'
 require_relative 'cancancan/abstract_resource_controller'
+require_relative 'cancancan/version'
 
 # include the extension 
-# ActiveRecord::Base.send(:include, Serializer::Concern)
+# ActiveRecord::Base.send(:include, Serializer::Concern)
+
+module CanCanCan
+  module AbstractResourceController
+    # config src: http://lizabinante.com/blog/creating-a-configurable-ruby-gem/
+    class << self
+      attr_accessor :configuration
+    end
+
+    def self.configuration
+      @configuration ||= Configuration.new
+    end
+
+    def self.reset
+      @configuration = Configuration.new
+    end
+
+    def self.configure
+      yield(configuration)
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cancancan_resource_controller
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 1.0.2
 platform: ruby
 authors:
 - benjamin.dana.software.dev@gmail.com
@@ -30,6 +30,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.5.0
+- !ruby/object:Gem::Dependency
+  name: cancancan_nested_auth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -121,6 +135,8 @@ extensions: []
 extra_rdoc_files: []
 files:
 - lib/cancancan/abstract_resource_controller.rb
+- lib/cancancan/configuration.rb
+- lib/cancancan/version.rb
 - lib/cancancan_resource_controller.rb
 homepage: https://github.com/danabr75/cancancan_resource_controller
 licenses: