cantango 0.8.0

data/lib/cantango/permission_engine/store.rb

@@ -0,0 +1,33 @@
+require 'set'
+
+module CanTango
+  module PermissionEngine
+    class Store
+      attr_reader :name, :options
+
+      def initialize name, options = {}
+        @name, @options = [name, options]
+
+        options.each_pair do |name, value|
+          var = :"@#{name}"
+          self.instance_variable_set(var, value)
+        end
+      end
+
+      def self.create name, options = {}
+        self.new name, options
+      end
+
+      def load!
+        raise NotImplementedError
+      end
+
+      def save! permissions
+        permissions.each do |permission|
+          store permission
+        end
+      end
+
+    end
+  end
+end

data/lib/cantango/permission_engine/yaml_store.rb

@@ -0,0 +1,108 @@
+require 'yaml'
+
+module CanTango
+  module PermissionEngine
+    class YamlStore < Store
+      attr_reader :path
+
+      # for a YamlStore, the name is the name of the yml file
+      # options: extension, path
+
+      def initialize name, options = {}
+        super
+      end
+
+      def self.create name, options = {}
+        super
+      end
+
+      def load!
+        loader.load!
+      end
+
+      def load_from_hash hash
+        loader.load_from_hash hash
+      end
+
+      # @stanislaw: don't like this, because what if loader#load! will be called
+      # twice during object's (YamlStore.new) life time!
+      def permissions
+        @permissions ||= loader.permissions
+      end
+
+      CanTango.config.permissions.types.each do |type|
+        define_method(:"#{type}_permissions") do
+          loader.send(:"#{type}_permissions")
+        end
+
+        define_method(:"#{type}_permissions_rules") do
+          send(:"#{type}_permissions").inject({}) do |result,(pk,pv)| 
+            result.merge(pv.to_hash)
+          end
+        end
+
+        define_method(:"#{type}_permissions_to_hash") do
+          { type.to_s => send(:"#{type}_permissions_rules") }
+        end
+
+        define_method(:"#{type}_compiled_permissions") do
+          loader.send(:"#{type}_compiled_permissions")
+        end
+
+        # @stanislaw: this needs revision!
+
+        define_method(:"#{type}_rules") do
+          #cache(":#{type}") || 
+          send(:"#{type}_compiled_permissions")
+        end
+      end
+
+      def save! perms = nil
+        save_permissions(perms) if perms
+
+        File.open(file_path, 'w') do |f|
+          f.write to_yaml
+        end
+      end
+
+      def save_permissions(perms)
+        load_from_hash perms
+      end
+
+      protected
+
+      def permission_types
+        CanTango.config.engine(:permission).types
+      end
+
+      def to_yaml
+        permission_types.inject({}) do |collection, type|
+          collection.merge(send(:"#{type}_permissions_to_hash"))
+        end.to_yaml.gsub(/"(@\w+)"/,'\1') # hash.to_yaml leaves quotes on strings prefixed with @
+      end
+
+      def loader
+        @loader ||= CanTango::PermissionEngine::Loader::Permissions.new file_path
+      end
+
+      def file_path
+        File.join(path, file_name)
+      end
+
+      private
+
+      def file_name
+        [name, extension].join('.')
+      end
+
+      def extension
+        @extension || default_ext
+      end
+
+      def default_ext
+        'yml'
+      end
+
+    end
+  end
+end

data/lib/cantango/permit_engine.rb

@@ -0,0 +1,8 @@
+module CanTango
+  module PermitEngine
+    autoload_modules :Builder, :Compatibility, :Executor
+    autoload_modules :Factory, :Finder, :License, :Loaders, :Permit
+    autoload_modules :RoleGroupPermit, :RolePermit, :UserPermit, :AccountPermit
+    autoload_modules :RoleMatcher, :Util
+  end
+end

data/lib/cantango/permit_engine/account_permit.rb

@@ -0,0 +1,41 @@
+module CanTango
+  module PermitEngine
+    class AccountPermit < CanTango::PermitEngine::Permit
+
+      autoload_modules :Builder, :Finder
+
+      # fx for Admin account class, becomes simply AdminAccountPermit
+      def account_type
+        self.class.name.demodulize.gsub(/(.*)(AccountPermit)/, '\1').underscore.to_sym
+      end
+
+      # creates the permit
+      # @param [Permits::Ability] the ability
+      # @param [Hash] the options
+      def initialize ability
+        super
+      end
+
+
+      # In a specific Role based Permit you can use 
+      #   def permit? user, options = {}
+      #     ... permission logic follows
+      #
+      # This will call the Permit::Base#permit? instance method (the method below)
+      # It will only return true if the user matches the role of the Permit class and the
+      #
+      # If these confitions are not met, it will return false and thus the outer permit 
+      # will not run the permission logic to follow
+      #
+      # Normally super for #permit? should not be called except for this case, 
+      # or if subclassing another Permit than Permit::Base
+      #
+      def permit?
+        super
+      end
+    end
+
+  end
+end
+
+

data/lib/cantango/permit_engine/account_permit/builder.rb

@@ -0,0 +1,22 @@
+module CanTango
+  module PermitEngine
+    class AccountPermit < CanTango::PermitEngine::Permit
+      class Builder < CanTango::PermitEngine::Builder::Base
+        # class NoAvailableRoles < StandardError; end
+
+        # builds a list of Permits for each role of the current ability user (or account)
+        # @return [Array<RoleGroupPermit::Base>] the role permits built for this ability
+        def build
+          return [] if !user_account
+          # raise NoAvailableRoles, "no available roles are defined" if available_roles.empty?
+          [] << create_permit(user_account.class.to_s)
+        end
+
+        def finder
+          CanTango::PermitEngine::AccountPermit::Finder
+        end
+      end
+    end
+  end
+end
+

data/lib/cantango/permit_engine/account_permit/finder.rb

@@ -0,0 +1,20 @@
+module CanTango
+  module PermitEngine
+    class AccountPermit < CanTango::PermitEngine::Permit
+      class Finder < CanTango::PermitEngine::Finder
+        def initialize account, name
+          super
+        end
+
+        def type
+          :account
+        end
+
+        def permit_class
+          "#{name.to_s.camelize}AccountPermit"
+        end
+      end
+    end
+  end
+end
+

data/lib/cantango/permit_engine/builder.rb

@@ -0,0 +1,8 @@
+module CanTango
+  module PermitEngine
+    module Builder
+      autoload :Base,             'cantango/permit_engine/builder/base'
+      autoload :SpecialPermits,   'cantango/permit_engine/builder/special_permits'
+    end
+  end
+end

data/lib/cantango/permit_engine/builder/base.rb

@@ -0,0 +1,50 @@
+module CanTango
+  module PermitEngine
+    module Builder
+      class Base
+        attr_accessor :ability
+
+        # creates the factory for the ability
+        # note that the ability contains the roles and role groups of the user (or account)
+        # @param [Permits::Ability] the ability
+        def initialize ability
+          @ability = ability
+        end
+
+        protected
+
+        # Tries to create a new permit for the given role
+        # If no permit Class can be found, it should return nil
+        # @param [Symbol] the name
+        # @return the permit Class or nil if not found
+        def create_permit name
+          begin
+            permit_clazz(name).new ability
+          rescue RuntimeError => e
+            #raise "Error instantiating Permit instance for role #{role}, cause #{e}"
+            nil
+          end
+        end
+
+        def permit_clazz name
+          finder.new(subject, name).get_permit
+        end
+
+        # delegate to ability
+        [:options, :role_groups, :roles, :subject, :user, :user_account].each do |name|
+          define_method name do
+            ability.send(name)
+          end
+        end
+
+        def available_role_groups
+          CanTango.config.role_groups
+        end
+
+        def available_roles
+          CanTango.config.roles
+        end
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/builder/special_permits.rb

@@ -0,0 +1,20 @@
+module CanTango
+  module PermitEngine
+    module Builder
+      class SpecialPermits < Base      
+        def build
+          special_permits.map{|role| create_permit(role)}.compact
+        end    
+
+        def special_permits
+          [:system, :any]
+        end    
+      
+        def finder
+          CanTango::PermitEngine::RolePermit::Finder
+        end      
+      end
+    end
+
+  end
+end

data/lib/cantango/permit_engine/compatibility.rb

@@ -0,0 +1,20 @@
+# ensures compatibility with CanCan 1.5+ and 1.4-
+module CanTango
+  module PermitEngine
+    module Compatibility
+      def rules
+        return rules_1_5 if rules_1_5
+        return rules_1_4 if rules_1_4
+        raise "CanCan ability.rules could not be found. Possibly due to CanCan API change since 1.5"
+      end
+
+      def rules_1_5
+        ability.send :rules
+      end
+
+      def rules_1_4
+        ability.send :can_definitions
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/executor.rb

@@ -0,0 +1,7 @@
+module CanTango
+  module PermitEngine
+    module Executor
+      autoload_modules :Abstract, :Base, :System
+    end
+  end
+end

data/lib/cantango/permit_engine/executor/abstract.rb

@@ -0,0 +1,40 @@
+module CanTango
+  module PermitEngine
+    module Executor
+      class Abstract
+        attr_accessor :permit
+
+        def initialize permit
+          @permit = permit
+        end
+
+        def permit?
+          permit.permit? if permit
+        end
+
+        def execute!
+          raise "Must be implemented by subclass"
+        end
+
+        protected
+
+        def options
+          permit.options
+        end
+
+        def subject
+          permit.subject
+        end
+
+        def user
+          permit.user
+        end
+
+        def user_account
+          permit.user_account
+        end
+      end
+    end
+  end
+end
+

data/lib/cantango/permit_engine/executor/base.rb

@@ -0,0 +1,51 @@
+module CanTango
+  module PermitEngine
+    module Executor
+      class Base < Abstract
+        # execute the permit
+        def execute!
+          role_execution
+          #role_group_execution
+        end
+
+        # only execute the permit if the user has the role of the permit or is for any role      
+        def role_execution
+          permit? if permit_for_user_role? || permit_for_user_group?
+        end
+
+        def permit_for_user_role?
+          subject_in_role? || role == :any
+        end
+
+        def role_group_execution
+          # could also use #user.is_member_of?
+          permit? if permit_for_user_group?
+        end
+
+        def permit_for_user_group?
+          subject_in_role_group? || false
+        end
+
+        protected
+
+        def subject_in_role?
+          return subject.send(has_role_meth, role) if subject.respond_to? has_role_meth
+          return subject.send(list_role_meth, role).include? role if subject.respond_to? has_role_meth
+          false
+        end
+
+        def subject_in_role_group?
+          return subject.send(has_role_group_meth, role) if subject.respond_to? has_role_group_meth
+          return subject.send(list_role_group_meth).include? role if subject.respond_to? list_role_group_meth
+          false
+        end
+
+        include CanTango::Helpers::RoleMethods
+
+        def role
+          permit.role
+        end
+      end
+    end
+  end
+end