cantango 0.8.0

data/ideas/feature_list.markdown

@@ -0,0 +1,58 @@
+## Role Filters
+
+In this case, disregard any permits relating to the :bloggers role
+```ruby
+user_can? :roles_filter => :bloggers
+```
+
+Config:
+
+```ruby
+CanTango.config.roles.filter :on
+CanTango.config.roles.filter :off
+```
+
+Will use:
+
+```ruby
+CanTango.config.roles.register :admin
+
+CanTango.config.roles.registered
+CanTango.config.roles.registered
+```
+
+We should also have a #tango_role macro to add on the role class, which
+will lazily execute Role.all somehow.
+
+This should later be extended with:
+
+```ruby
+CanTango.config.roles.included :admin...
+```
+
+In Ability#initialize
+
+```ruby
+with(:permits) {|permit| break if permit.execute == :break }
+...
+```
+
+Becomes
+
+```ruby
+with(:filtered_permits) {|permit| break if permit.execute == :break }
+...
+```
+
+## Domain differentiation
+
+Load specific permissions file (or permits) depending on which domain the user is in.
+Would be nice to allow user to hook in and customize load logic in some
+way. Have Session and Request obj available.
+
+Also need some more documentation and specs on the use of special
+permits Any and System. Any is last permit to always exectute (unless
+flow broken). System is always first permit and can break off the flow, thus no
+other permits may have effect after if broken.
+
+Is there a need to enhance this with more control flow? Keep it simple!

data/lib/cantango.rb

@@ -0,0 +1,32 @@
+require 'cantango/rails/railtie' if defined?(Rails)
+require 'cantango/rails/engine' if defined?(Rails)
+require 'cancan'
+require 'cantango/cancan/rule'
+require 'sugar-high/class_ext'
+require 'sugar-high/array'
+require 'sugar-high/blank'
+require 'hashie'
+require 'cutter'
+require 'moneta'
+
+# AutoLoader.root = ''
+AutoLoader.namespaces = {:CanTango => 'cantango'}
+
+module CanTango
+  autoload_modules :Ability, :Api, :Configuration, :Cache
+  autoload_modules :PermitEngine, :Rails, :Users
+  autoload_modules :PermissionEngine, :Rules, :Api, :Helpers
+
+  class << self
+    def configure &block
+      conf = CanTango::Configuration.instance
+      yield conf if block
+      conf
+    end
+
+    alias_method :config, :configure
+  end
+end
+
+require 'cantango/api/aliases'
+require 'cantango/users/macros'

data/lib/cantango/ability.rb

@@ -0,0 +1,56 @@
+# @stanislaw: needed?
+require 'cantango/permit_engine/util'
+
+module CanTango
+  class Ability
+    autoload_modules :ClassMethods, :Scope, :Cache
+    autoload_modules :MasqueradeHelpers, :PermitHelpers, :PermissionHelpers
+    autoload_modules :UserHelpers, :RoleHelpers
+
+    include CanCan::Ability
+    include Cache
+    extend  ClassMethods
+
+    attr_reader :options, :subject, :session
+
+    # Equivalent to a CanCan Ability#initialize call
+    # which executes all the permission logic
+    def initialize candidate, options = {}
+      raise "Candidate must be something!" if !candidate
+      @candidate, @options = candidate, options
+      @session = options[:session] || {} # seperate session cache for each type of user?
+
+      return if cached_rules?
+
+      # run permission evaluators
+      with(:permissions)  {|permission| permission.evaluate! user }
+      with(:permits)      {|permit| break if permit.execute == :break }
+
+      cache_rules!
+    end
+
+    include CanTango::PermitEngine::Util
+
+    def with engine_type, &block
+      send(engine_type).each do |obj|
+        yield obj
+      end if send(:"#{engine_type}?")
+    end
+
+    def subject
+      return @candidate.active_user if masquerade_user?
+      return @candidate.active_account if masquerade_account?
+      @candidate
+    end
+
+    def config
+      CanTango.config
+    end
+
+    include MasqueradeHelpers
+    include PermissionHelpers
+    include PermitHelpers
+    include UserHelpers
+    include RoleHelpers
+  end
+end

data/lib/cantango/ability/cache.rb

@@ -0,0 +1,95 @@
+module CanTango
+  class Ability
+    module Cache
+      autoload_modules :BaseCache, :SessionCache, :MonetaCache, :Kompiler
+
+      include CanTango::Ability::Cache::Kompiler
+
+      attr_reader :rules_cached
+
+      def rules
+        return cached_rules if cached_rules?
+        super
+      end
+
+      def cache_rules!
+        return if !caching_on?
+        invalidate_cache!
+        rules_compiled = compile_rules! rules
+        rules_cache.save cache_key, rules_compiled
+        session_check!
+        session[:cache_key] = cache_key
+      end
+
+      def caching_on?
+        CanTango.config.cache.on?
+      end
+
+      def cached_rules?
+        caching_on? && cache_key_same?
+      end
+
+      def cached_rules
+        rules_compiled = rules_cache.load(cache_key)
+        rules_raw = decompile_rules! rules_compiled
+        @rules ||= rules_raw
+      end
+
+      def cache_key
+        @cache_key ||= begin
+          user_key_field = CanTango.config.user.unique_key_field || :email
+          raise "#{user.class} must have a method ##{user_key_field}. You can configure this with CanTango.config#user.unique_key_field" if !user.respond_to?(user_key_field)
+
+          user_key = user.send(user_key_field)
+          [user_key, subject_roles_hash].hash
+        end
+      end
+
+      def subject_roles_hash
+        [subject.roles_list, subject.role_groups_list].hash
+      end
+
+      def invalidate_cache!
+        session_check!
+        rules_cache.invalidate! session[:cache_key]
+      end
+
+      def rules_cache
+        @rules_cache ||= rules_cache_instance
+      end
+
+      protected
+
+      def cache_key_same?
+        session_check!
+        session[:cache_key] && (cache_key == session[:cache_key])
+      end
+
+      def rules_cache_instance
+        @rules_cache_instance ||= begin
+          options = rules_cache_options
+          options.merge!(:session => session) if session?
+          rules_cache_class.new :rules_cache, options
+        end
+      end
+
+      def rules_cache_options
+       CanTango.config.cache.store.options || {}
+      end
+
+      def rules_cache_class
+        CanTango.config.cache.store.default_class
+      end
+
+      def session?
+        session
+      end
+
+      def session_check!
+        raise "No session available" if !session?
+      end
+    end
+  end
+end
+
+

data/lib/cantango/ability/cache/base_cache.rb

@@ -0,0 +1,26 @@
+module CanTango
+  class Ability
+    module Cache
+      class BaseCache
+        attr_reader :name, :options
+
+        def initialize name, options = {}
+          @name, @options = [name, options]
+
+          options.each_pair do |name, value|
+            var = :"@#{name}"
+            self.instance_variable_set(var, value)
+          end
+        end
+
+        def load key
+          raise NotImplementedError
+        end
+
+        def save key, rules
+          raise NotImplementedError
+        end
+      end
+    end
+  end
+end

data/lib/cantango/ability/cache/kompiler.rb

@@ -0,0 +1,24 @@
+require 'sourcify'
+module CanTango
+  class Ability
+    module Cache
+      module Kompiler
+
+        def compile_rules! rules_raw
+          rules_compiled = rules_raw.map do |rule|
+            rule.block = rule.block.to_source if rule.block.class == Proc
+            rule
+          end
+        end
+
+        def decompile_rules! rules_compiled
+          rules_raw = rules_compiled.map do |rule|
+            rule.block = eval("#{rule.block}")
+            rule
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/cantango/ability/cache/moneta_cache.rb

@@ -0,0 +1,32 @@
+require 'moneta'
+require 'active_support/inflector'
+
+module CanTango
+  class Ability
+    module Cache
+      class MonetaCache
+        # one cache store is shared for all store instances (w different names)
+        attr_reader :store
+
+        # for a YamlStore, the name is the name of the yml file
+        def initialize name, options = {}
+          super
+          @store = CanTango::Cache::MonetaCache.instance
+          @store.configure_with options
+        end
+
+        def load key
+          store.load! key
+        end
+
+        def save key, rules
+          store.save! key, rules
+        end
+
+        def invalidate! key
+          store.delete key
+        end
+      end
+    end
+  end
+end

data/lib/cantango/ability/cache/session_cache.rb

@@ -0,0 +1,38 @@
+module CanTango
+  class Ability
+    module Cache
+      class SessionCache < BaseCache
+        attr_accessor :session
+
+        # will be called with :session => session (pointing to user session)
+        def initialize name, options = {}
+          super # will set all instance vars using options hash
+          @cache = cache
+          @cache.configure_with :type => :memory
+          raise "SessionCache must be initialized with a :session option" if !session
+          session[:rules_cache] = @cache
+        end
+
+        def store
+          session[:rules_cache]
+        end
+
+        def load key
+          store.load! key
+        end
+
+        def save key, rules
+          store.save! key, rules
+        end
+
+        def invalidate! key
+          store.delete key
+        end
+
+        def cache
+          CanTango::Cache::MonetaCache.instance
+        end
+      end
+    end
+  end
+end

data/lib/cantango/ability/class_methods.rb

@@ -0,0 +1,27 @@
+module CanTango
+  class Ability
+    mattr_accessor :orm, :strategy
+    
+    module ClassMethods
+      # BAD!
+      def orm= orm
+        @orm = orm 
+        set_strategy orm        
+      end
+
+      def set_strategy orm
+        @strategy = relational_orm?(orm) ? :default : :string
+      end
+  
+      private
+  
+      def relational_orm? orm
+        relations_orms.include?(orm)
+      end
+  
+      def relations_orms
+        [:active_record, :generic]
+      end
+    end    
+  end
+end

data/lib/cantango/ability/masquerade_helpers.rb

@@ -0,0 +1,19 @@
+module CanTango
+  class Ability
+    module MasqueradeHelpers
+      def masquerade_user?
+        return false if masquerading_off?
+        @candidate.respond_to?(:active_user) && @candidate.masquerading?
+      end
+
+      def masquerade_account?
+        return false if masquerading_off?
+        @candidate.respond_to?(:active_account)
+      end
+
+      def masquerading_off?
+        options[:masquerade] == false
+      end
+    end
+  end
+end

data/lib/cantango/ability/permission_helpers.rb

@@ -0,0 +1,20 @@
+module CanTango
+  class Ability
+    module PermissionHelpers
+      def permissions
+        permission_factory.build!
+      end
+
+      protected
+
+      def permission_factory
+        @permission_factory ||= CanTango::PermissionEngine::Factory.new self
+      end
+
+      def permissions?
+        config.permissions.on?
+      end
+    end
+  end
+end
+ 

data/lib/cantango/ability/permit_helpers.rb

@@ -0,0 +1,27 @@
+module CanTango
+  class Ability
+    module PermitHelpers
+      # by default, only execute permits for which the user
+      # has a role or a role group
+      # also execute any permit marked as special
+      def permits
+        permit_factory.build!
+      end
+
+      def permit_class_names
+        @permit_class_names ||= permits.map{|p| p.class.to_s}
+      end
+
+      protected
+
+      def permit_factory
+        @permit_factory ||= CanTango::PermitEngine::Factory.new self
+      end
+
+      def permits?
+        config.permits.on?
+      end
+    end
+  end
+end
+