cant_cant_cant 0.1.9 → 0.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2b7f960df566535239837a3b10da07249852957b
-  data.tar.gz: 0177db1f7cbde126092dc4b11d6eee99329a3420
+  metadata.gz: a3c41e2930a4a017599c9e543e4c5e1169889117
+  data.tar.gz: 86763bee8b49529010526fce57b9f679a24a8bfc
 SHA512:
-  metadata.gz: 696a00f8b533dcddfbc0c2b0e69b9880957847c43ce783024c59d3944bde49c7a6eac415c66bc1504c69169b7fc467b84fe806104f2333dfed69d984a902b026
-  data.tar.gz: 0d8b38ed2c21267889862dc00eb85f62ed110f818e9c7304aa0ed4e63007a06a22bdf047795c88b5f730c43bf901ce5f6b1295e4a37f44ef184c43dc2e2b1723
+  metadata.gz: 566fcfca7d3f06465cacf466ab1890161d70901a3754d4c61e3d3f924bcd97cf227bb54e3120cd5e69a7801ee2a32a46adc08fb3e414ec0e86307025550cb5b5
+  data.tar.gz: 5c974bc3695058e4b763e9077d10db1b469b5a3613d4475d5fcf9e9e71b90c539ed27be6302fdba0499ec39b1f9087bc184255aaca935d4ef824ff8c04029101

data/README.md

@@ -36,7 +36,7 @@ You're done. There is no need to configure more in any of your controllers.
 
 Note that live reloading is not supported yet; it means you'll need to restart your server after modifying your actions/controllers/config to take effect.
 
-If you need to acquire a list of actions that given roles have access to, just call `CantCantCant.permissions_for(roles)`.
+If you need to acquire a list of actions that given roles have access to, just call `CantCantCant.allowed_actions_for(roles)`.
 
 
 ## Configuration

data/lib/cant_cant_cant.rb

@@ -1,43 +1,108 @@
 require 'yaml'
+require 'ostruct'
+require 'set'
+require_relative 'concern'
 
 module CantCantCant
   PermissionDenied = Class.new(RuntimeError)
   InvalidConfiguration = Class.new(RuntimeError)
+  UnfilledAction = Class.new(RuntimeError)
 
   class << self
-    def initialize(config)
+    def initialize(config, &block)
       @config_file = config
-      @cache = {}
 
-      inject_actions
-    end
+      @config = OpenStruct.new(
+        injection_mode: :base_controller,
+        base_controller: ActionController::Base,
+        default_policy: :allow,
+        report_unfilled_actions: :ignore,
+        caching: true
+      )
+      @config.instance_eval(&block) if block_given?
+
+      @allow_cache = {}
+      @deny_cache = {}
 
-    def inject_actions
       validate_config
 
-      permission_table.values.map(&:keys).flatten.uniq.each do |param|
-        inject_action(param)
+      case @config.injection_mode
+      when :base_controller
+        inject_base_controller
+      when :individual
+        inject_individual_actions
       end
     end
 
-    def allow?(param, roles)
-      permissions_for(roles).include? param
+    def allow?(action, roles)
+      return true if allowed_actions_for(roles).include? action
+      return false if denied_actions_for(roles).include?(action)
+
+      case @config.report_unfilled_actions
+      # when :ignore, do nothing
+      when :warn
+        warn "Please fill in CantCantCant permission #{action}"
+      when :raise
+        raise UnfilledAction, [action, roles]
+      end
+
+      case @config.default_policy
+      when :allow then true
+      when :deny  then false
+      end
     end
 
-    def permissions_for(roles)
+    def allowed_actions_for(roles)
       roles = [roles] unless roles.is_a? Array
-      @cache[roles.sort.join(',')] ||=
-        permission_table
-        .values_at(*roles.map(&:to_s))
-        .select(&:present?)
-        .map { |x| x.keep_if { |_, v| v == 'allow' }.keys }
-        .flatten
-        .uniq
+      key = roles.sort.join(',')
+      return @allow_cache[key] if @allow_cache[key] && @config.caching
+
+      perms = permission_table
+              .values_at(*roles.map(&:to_s))
+              .select(&:present?)
+      allowed_perms = perms
+                      .map { |x| x.select { |_, v| v == 'allow' }.keys }
+                      .flatten
+                      .uniq
+      @allow_cache[key] = allowed_perms.to_set
+    end
+
+    def all_actions
+      @all_actions = nil unless @config.caching
+      @all_actions ||= permission_table
+                       .values
+                       .map(&:keys)
+                       .flatten
+                       .uniq
+                       .to_set
+    end
+
+    def denied_actions_for(roles)
+      roles = [roles] unless roles.is_a? Array
+      key = roles.sort.join(',')
+      return @deny_cache[key] if @deny_cache[key] && @config.caching
+      @deny_cache[key] = all_actions - allowed_actions_for(roles)
     end
 
     private
 
+    def inject_base_controller
+      base_controller_class = @config.base_controller
+      base_controller_class.before_action CantCantCantAuth
+    end
+
+    def inject_individual_actions
+      controller_actions = all_actions
+                           .map { |x| extract_controller(x) }
+                           .group_by(&:first)
+      controller_actions.each do |controller, actions|
+        actions = actions.map(&:second)
+        controller.before_action CantCantCantAuth, only: actions
+      end
+    end
+
     def permission_table
+      @permission_table = nil unless @config.caching
       @permission_table ||= YAML.load_file(@config_file).freeze
     end
 
@@ -51,17 +116,6 @@ module CantCantCant
       [controller_class, action]
     end
 
-    def inject_action(param)
-      controller_class, action = extract_controller(param)
-      controller_class.class_eval do
-        before_action(only: action) do
-          roles = current_roles
-          next true if CantCantCant.allow?(param, roles)
-          raise PermissionDenied, [param, roles]
-        end
-      end
-    end
-
     def validate_config
       permission_table.each do |_, perms|
         perms.each do |param, access|

data/lib/concern.rb

@@ -0,0 +1,9 @@
+class CantCantCantAuth
+  def self.before(controller)
+    roles = controller.current_roles
+    params = controller.params
+    action = "#{params[:controller]}\##{params[:action]}"
+    return true if CantCantCant.allow?(action, roles)
+    raise CantCantCant::PermissionDenied, [action, roles]
+  end
+end

data/lib/generators/cant_cant_cant/install/install_generator.rb

@@ -18,7 +18,7 @@ module CantCantCant::Generators
 
     def user_params
       routes = Rails.application.routes.routes.to_a
-      routes.reject! {|x| x.defaults[:internal] }
+      routes.reject! { |x| x.defaults[:internal] }
       routes.map(&:defaults).reject(&:empty?).uniq
     end
 

data/lib/generators/cant_cant_cant/install/templates/initializer.rb

@@ -1,6 +1,24 @@
 Rails.application.config.after_initialize do
-  config = File.join(Rails.root, 'config/cant_cant_cant.yml')
-  CantCantCant.initialize(config)
+  perm_file = File.join(Rails.root, 'config/cant_cant_cant.yml')
+  CantCantCant.initialize(perm_file) do |c|
+    # - base_controller: Inject validation to the base controller
+    # - individual:      Inject validation only to actions specified in config
+    # c.injection_mode = :base_controller
+
+    # This option is ignored unless c.injection_mode == :base_controller
+    # c.base_controller = ActionController::Base
+
+    # Specify what to do for unlisted access
+    # c.default_policy = :allow
+
+    # warn:   print a warning for unlisted actions and adopt default_policy
+    # raise:  raise an exception for unlisted actions
+    # ignore: ignore validation on unlisted actions and adopt default_policy
+    # c.report_unlisted_actions = :ignore
+
+    # Cache permission or load them from file for every request
+    c.caching = Rails.env.production?
+  end
 end
 
 class ActionController::Base
@@ -8,6 +26,10 @@ class ActionController::Base
   rescue_from CantCantCant::PermissionDenied do
     render plain: 'permission denied', status: 403
   end
+  # Only useful when report_unlisted_actions is set :raise
+  rescue_from CantCantCant::UnfilledAction do
+    render plain: 'action unlisted in cantcantcant permission file'
+  end
 
   # Write your own method to return the roles for current user
   def current_roles

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cant_cant_cant
 version: !ruby/object:Gem::Version
-  version: 0.1.9
+  version: 0.1.10
 platform: ruby
 authors:
 - Shou Ya
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-10-13 00:00:00.000000000 Z
+date: 2017-03-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -62,6 +62,7 @@ files:
 - README.md
 - Rakefile
 - lib/cant_cant_cant.rb
+- lib/concern.rb
 - lib/generators/cant_cant_cant/install/install_generator.rb
 - lib/generators/cant_cant_cant/install/templates/config.yml
 - lib/generators/cant_cant_cant/install/templates/initializer.rb