cancannible 0.0.1

data/spec/unit/cached_abilities_spec.rb

@@ -0,0 +1,67 @@
+require 'spec_helper'
+
+describe Cancannible do
+  let(:grantee_class) { Member }
+  let(:grantee) { grantee_class.create! }
+
+  describe "#abilities" do
+    subject { grantee.abilities }
+
+    context "when get_cached_abilities provided" do
+      before do
+        Cancannible.get_cached_abilities = proc{|grantee| "get_cached_abilities for #{grantee.id}" }
+      end
+      it "should returned the cached object" do
+        should eql("get_cached_abilities for #{grantee.id}")
+      end
+      context "unless reload requested" do
+        subject { grantee.abilities(true) }
+        it { should be_an(Ability) }
+      end
+    end
+
+    context "when store_cached_abilities provided" do
+      before do
+        @stored = nil
+        Cancannible.store_cached_abilities = proc{ |grantee,ability| @stored = { grantee_id: grantee.id, ability: ability } }
+      end
+      it "should store the cached object" do
+        expect { subject }.to change { @stored }.from(nil)
+        expect(@stored[:grantee_id]).to eql(grantee.id)
+        expect(@stored[:ability]).to be_an(Ability)
+      end
+    end
+
+    context "when get and store cached_abilities provided" do
+      before do
+        @stored = nil
+        @store = 0
+        Cancannible.get_cached_abilities = proc{|grantee| @stored }
+        Cancannible.store_cached_abilities = proc{ |grantee,ability| @store += 1 ; @stored = { grantee_id: grantee.id, ability: ability } }
+      end
+      it "should store the cached object on the first call" do
+        expect { subject }.to change { @stored }.from(nil)
+        expect(@store).to eql(1)
+        expect(@stored[:grantee_id]).to eql(grantee.id)
+        expect(@stored[:ability]).to be_an(Ability)
+      end
+      it "should return the cached object on the second call" do
+        expect { subject }.to change { @stored }.from(nil)
+        expect(@store).to eql(1)
+        expect { grantee.abilities }.to_not change { @store }
+        expect(grantee.abilities[:grantee_id]).to eql(grantee.id)
+        expect(grantee.abilities[:ability]).to be_an(Ability)
+      end
+      it "should re-cache object on the second call if refresh requested" do
+        expect { subject }.to change { @stored }.from(nil)
+        expect(@store).to eql(1)
+        expect { grantee.abilities(true) }.to change { @store }.from(1).to(2)
+        expect(grantee.abilities[:grantee_id]).to eql(grantee.id)
+        expect(grantee.abilities[:ability]).to be_an(Ability)
+      end
+    end
+
+
+  end
+
+end

data/spec/unit/config_spec.rb

@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Cancannible do
+  let(:grantee_class) { Member }
+  let(:grantee) { grantee_class.create! }
+
+  describe "#get_cached_abilities" do
+    let(:flag) { nil }
+    before do
+      Cancannible.get_cached_abilities = proc{|user| puts "get_cached_abilities" }
+    end
+    subject { grantee.abilities }
+    it "should call" do
+      subject
+    end
+  end
+end

data/spec/unit/custom_refinements_spec.rb

@@ -0,0 +1,223 @@
+require 'spec_helper'
+
+
+describe Cancannible do
+  let(:grantee_class) { User }
+  let(:ability) { :blow }
+  let(:username) { 'username' }
+
+  subject(:grantee) { grantee_class.create!(username: username) }
+
+  describe "#can?" do
+
+    context "with custom attribute association restriction" do
+      let(:resource_class) { Widget }
+      before do
+        Cancannible.setup do |config|
+          config.refine_access category_id: :category_ids
+        end
+        allow(grantee).to receive(:category_ids).and_return([1,3])
+        grantee.can(ability,resource_class)
+      end
+      let!(:resource) { resource_class.create(category_id: category_id) }
+      subject { grantee.can?(ability,resource) }
+      context "with resource within scope" do
+        let(:category_id) { 3 }
+        it { should be_truthy }
+      end
+      context "with resource in nil scope" do
+        let(:category_id) { nil }
+        it { should be_falsey }
+      end
+      context "with resource not in scope" do
+        let(:category_id) { 2 }
+        it { should be_falsey }
+      end
+    end
+
+    context "with custom attribute association restriction and allow_nil" do
+      let(:resource_class) { Widget }
+      before do
+        Cancannible.setup do |config|
+          config.refine_access category_id: :category_ids, allow_nil: true
+        end
+        allow(grantee).to receive(:category_ids).and_return([1,3])
+        grantee.can(ability,resource_class)
+      end
+      let!(:resource) { resource_class.create(category_id: category_id) }
+      subject { grantee.can?(ability,resource) }
+      context "with resource within scope" do
+        let(:category_id) { 3 }
+        it { should be_truthy }
+      end
+      context "with resource in nil scope" do
+        let(:category_id) { nil }
+        it { should be_truthy }
+      end
+      context "with resource not in scope" do
+        let(:category_id) { 2 }
+        it { should be_falsey }
+      end
+    end
+
+    context "with custom attribute association restriction scoped by ability" do
+      let(:resource_class) { Widget }
+      let(:other_ability) { :suck }
+      before do
+        Cancannible.setup do |config|
+          config.refine_access category_id: :category_ids, scope: ability
+        end
+        allow(grantee).to receive(:category_ids).and_return([1,3])
+        grantee.can(ability,resource_class)
+        grantee.can(other_ability,resource_class)
+      end
+      let!(:resource) { resource_class.create(category_id: category_id) }
+      context "when scoped ability" do
+        subject { grantee.can?(ability,resource) }
+        context "with resource within scope" do
+          let(:category_id) { 3 }
+          it { should be_truthy }
+        end
+        context "with resource not in scope" do
+          let(:category_id) { 2 }
+          it { should be_falsey }
+        end
+      end
+      context "when other ability" do
+        subject { grantee.can?(other_ability,resource) }
+        context "with resource within scoped ability" do
+          let(:category_id) { 3 }
+          it { should be_truthy }
+        end
+        context "with resource not in scoped ability" do
+          let(:category_id) { 2 }
+          it { should be_truthy }
+        end
+      end
+    end
+
+    context "with custom attribute association restriction scoped by ability exception" do
+      let(:resource_class) { Widget }
+      let(:other_ability) { :suck }
+      before do
+        Cancannible.setup do |config|
+          config.refine_access category_id: :category_ids, except: other_ability
+        end
+        allow(grantee).to receive(:category_ids).and_return([1,3])
+        grantee.can(ability,resource_class)
+        grantee.can(other_ability,resource_class)
+      end
+      let!(:resource) { resource_class.create(category_id: category_id) }
+      context "when scoped ability" do
+        subject { grantee.can?(ability,resource) }
+        context "with resource within scope" do
+          let(:category_id) { 3 }
+          it { should be_truthy }
+        end
+        context "with resource not in scope" do
+          let(:category_id) { 2 }
+          it { should be_falsey }
+        end
+      end
+      context "when other ability" do
+        subject { grantee.can?(other_ability,resource) }
+        context "with resource within scoped ability" do
+          let(:category_id) { 3 }
+          it { should be_truthy }
+        end
+        context "with resource not in scoped ability" do
+          let(:category_id) { 2 }
+          it { should be_truthy }
+        end
+      end
+    end
+
+    context "with custom attribute association restriction scoped by ability array" do
+      let(:resource_class) { Widget }
+      let(:other_ability) { :suck }
+      before do
+        Cancannible.setup do |config|
+          config.refine_access category_id: :category_ids, scope: [ability,:another_ability]
+        end
+        allow(grantee).to receive(:category_ids).and_return([1,3])
+        grantee.can(ability,resource_class)
+        grantee.can(other_ability,resource_class)
+      end
+      let!(:resource) { resource_class.create(category_id: category_id) }
+      context "when scoped ability" do
+        subject { grantee.can?(ability,resource) }
+        context "with resource within scope" do
+          let(:category_id) { 3 }
+          it { should be_truthy }
+        end
+        context "with resource not in scope" do
+          let(:category_id) { 2 }
+          it { should be_falsey }
+        end
+      end
+      context "when other ability" do
+        subject { grantee.can?(other_ability,resource) }
+        context "with resource within scoped ability" do
+          let(:category_id) { 3 }
+          it { should be_truthy }
+        end
+        context "with resource not in scoped ability" do
+          let(:category_id) { 2 }
+          it { should be_truthy }
+        end
+      end
+    end
+    context "with if-conditional custom attribute association restriction" do
+      let(:resource_class) { Widget }
+      before do
+        Cancannible.setup do |config|
+          config.refine_access category_id: :category_ids, if: proc{ |grantee,model_resource| grantee.username == 'restrict by categories' }
+        end
+        allow(grantee).to receive(:category_ids).and_return([1,3])
+        grantee.can(ability,resource_class)
+      end
+      let!(:resource) { resource_class.create(category_id: category_id) }
+      subject { grantee.can?(ability,resource) }
+      context "with resource not in scope but restriction not applicable" do
+        let(:category_id) { 2 }
+        it { should be_truthy }
+      end
+      context "with resource not in scope and restriction applicable" do
+        let(:username) { 'restrict by categories' }
+        let(:category_id) { 2 }
+        it { should be_falsey }
+      end
+    end
+
+    context "with combined attribute association and fixed value restriction" do
+      let(:resource_class) { Widget }
+      before do
+        Cancannible.setup do |config|
+          config.refine_access category_id: :category_ids, name: 'Test'
+        end
+        allow(grantee).to receive(:category_ids).and_return([1,3])
+        grantee.can(ability,resource_class)
+      end
+      let!(:resource) { resource_class.create(category_id: category_id, name: name) }
+      subject { grantee.can?(ability,resource) }
+      context "with resource within scope" do
+        let(:name) { 'Test' }
+        let(:category_id) { 3 }
+        it { should be_truthy }
+      end
+      context "with resource not in scope (excluded by attribute association)" do
+        let(:name) { 'Test' }
+        let(:category_id) { 2 }
+        it { should be_falsey }
+      end
+      context "with resource not in scope (excluded by fixed value)" do
+        let(:name) { 'Not Test' }
+        let(:category_id) { 3 }
+        it { should be_falsey }
+      end
+    end
+
+
+  end
+
+end

data/spec/unit/inherited_permissions_spec.rb

@@ -0,0 +1,145 @@
+require 'spec_helper'
+
+
+describe Cancannible do
+  let(:grantee_class) { User }
+
+  context "with mulitple sources of permissions inheritance" do
+
+    describe "##inheritable_permissions" do
+      subject { grantee_class.inheritable_permissions }
+      it { should eql([:roles, :group]) }
+    end
+
+    let!(:role_a)  { Role.create! }
+    let!(:role_b)  { Role.create! }
+    let!(:group_a) { Group.create! }
+    let!(:group_b) { Group.create! }
+    subject(:grantee) {
+      u = grantee_class.new(group: group_a)
+      u.roles << role_a
+      u.save!
+      u
+    }
+
+    context "with a symbolic resource" do
+      let!(:resource) { :something }
+
+      describe "#can?" do
+        subject { grantee.can?(:read, resource) }
+        context "when no permission" do
+          it { should be_falsey }
+        end
+        context "when permission assigned to grantee themselves" do
+          before { grantee.can(:read, resource) }
+          it { should be_truthy }
+        end
+        context "when permission inherited thru belongs_to association" do
+          before { group_a.can(:read, resource) }
+          it { should be_truthy }
+        end
+        context "when permission inherited thru habtm association" do
+          before { role_a.can(:read, resource) }
+          it { should be_truthy }
+        end
+      end
+
+    end
+
+
+    context "with a resource class" do
+      let!(:resource) { Widget }
+
+      describe "#can?" do
+        subject { grantee.can?(:read, resource) }
+        context "when permission is not set" do
+          it { should be_falsey }
+        end
+        context "when permission assigned to grantee themselves" do
+          before { grantee.can(:read, resource) }
+          it { should be_truthy }
+        end
+        context "when permission inherited thru belongs_to association" do
+          before { group_a.can(:read, resource) }
+          it { should be_truthy }
+        end
+        context "when permission inherited thru habtm association" do
+          before { role_a.can(:read, resource) }
+          it { should be_truthy }
+        end
+      end
+
+    end
+
+    context "with a resource instance" do
+      let!(:resource) { Widget.create! }
+      let!(:other_resource) { Widget.create! }
+
+      describe "#can?" do
+        subject { grantee.can?(:read, resource) }
+        context "when permission is not set" do
+          it { should be_falsey }
+        end
+        context "when permission assigned to grantee themselves" do
+          before { grantee.can(:read, resource) }
+          it { should be_truthy }
+          context "but for other instances" do
+            subject { grantee.can?(:read, other_resource) }
+            it { should be_falsey }
+          end
+        end
+        context "when permission inherited thru belongs_to association" do
+          before { group_a.can(:read, resource) }
+          it { should be_truthy }
+          context "but for other instances" do
+            subject { grantee.can?(:read, other_resource) }
+            it { should be_falsey }
+          end
+        end
+        context "when permission inherited thru habtm association" do
+          before { role_a.can(:read, resource) }
+          it { should be_truthy }
+          context "but for other instances" do
+            subject { grantee.can?(:read, other_resource) }
+            it { should be_falsey }
+          end
+        end
+      end
+
+      describe "#cannot?" do
+        subject { grantee.cannot?(:read, resource) }
+        context "when permission is not asserted for the grantee themselves" do
+          it { should be_truthy }
+        end
+        context "when permission is not asserted but can is for the grantee themselves" do
+          before { grantee.can(:read, resource) }
+          it { should be_falsey }
+        end
+        context "when permission is not asserted but can is thru belongs_to association" do
+          before { group_a.can(:read, resource) }
+          it { should be_falsey }
+        end
+        context "when permission is not asserted but can is thru habtm association" do
+          before { role_a.can(:read, resource) }
+          it { should be_falsey }
+        end
+        context "when permission is asserted for the grantee themselves" do
+          before { grantee.cannot(:read, resource) }
+          it { should be_truthy }
+        end
+        context "when permission is asserted thru belongs_to association" do
+          before { group_a.cannot(:read, resource) }
+          it { should be_truthy }
+        end
+        context "when permission is asserted thru habtm association" do
+          before { role_a.cannot(:read, resource) }
+          it { should be_truthy }
+        end
+      end
+
+
+    end
+
+  end
+
+end