cantango 0.8.0

data/lib/cantango/permit_engine/executor/system.rb

@@ -0,0 +1,13 @@
+module CanTango
+  module PermitEngine
+    module Executor
+      class System < Abstract
+        # always execute system permit
+        def execute!
+          permit?
+        end
+      end
+    end
+  end
+end
+

data/lib/cantango/permit_engine/factory.rb

@@ -0,0 +1,45 @@
+require 'sugar-high/class_ext'
+
+module CanTango
+  module PermitEngine
+    class Factory
+      include ClassExt
+
+      attr_accessor :ability, :builders
+
+      # creates the factory for the ability
+      # note that the ability contains the roles and role groups of the user (or account)
+      # @param [Permits::Ability] the ability
+      def initialize ability
+        @ability = ability
+      end
+
+      def build!
+        @builders ||= builders.inject([]) do |res, builder|
+          res << create_builder(builder).build
+          res
+        end.flatten.compact
+      end
+
+      def create_builder builder
+        clazz = builder_class(builder)
+        clazz.constantize.new(ability)
+      end
+
+      def builder_class builder
+        return "CanTango::PermitEngine::Builder::SpecialPermits" if builder == :special
+        "CanTango::PermitEngine::#{builder.to_s.camelize}Permit::Builder"
+      end
+
+      def builders
+        [:role_group, :role, :user, :account, :special]
+      end
+
+      def options
+        ability.options
+      end
+    end
+
+  end
+end
+

data/lib/cantango/permit_engine/finder.rb

@@ -0,0 +1,39 @@
+module CanTango
+  module PermitEngine
+    class Finder
+      include ClassExt
+
+      # This class is used to find the right permit, possible scoped for a specific user account
+
+      attr_reader :user_account, :name
+
+      def initialize user_account, name
+        @user_account = user_account
+        @name = name
+      end
+
+      def get_permit
+        begin
+          find_first_class account_permit_class, permit_class
+        rescue
+          raise "Permit for #{type} #{name} could not be loaded. Define either class: #{account_permit_class} or #{permit_class}"
+        end
+      end
+
+      # this is used to namespace role permits for a specific type of user account
+      # this allows role permits to be defined differently for each user account (and hence sub application) if need be
+      # otherwise it will fall back to the generic role permit (the one which is not wrapped in a user account namespace)
+      def account_permit_class
+        [account_permit_ns , permit_class].join('::')
+      end
+
+      def account_permit_ns
+        "#{user_account.class}Permits"
+      end
+
+      def permit_class
+        "#{name.to_s.camelize}Permit"
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/license.rb

@@ -0,0 +1,37 @@
+module CanTango
+  module PermitEngine
+    class License
+      autoload_modules :Loader, :Rules
+
+      include Rules
+      include Loader
+
+      attr_reader :permit, :licenses
+
+      def initialize permit
+        @permit   = permit
+      end
+
+      def license_rules
+        static_rules
+        permit_rules
+        dynamic_rules
+      end
+
+      def permit_rules
+      end
+
+      def static_rules
+      end
+
+      def dynamic_rules
+      end
+
+      protected
+
+      def permits_loader
+        CanTango::Loader::Permissions
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/license/loader.rb

@@ -0,0 +1,19 @@
+module CanTango::PermitEngine
+  class License
+    module Loader
+      def load_rules name = nil
+        return if !licenses || licenses.permissions.empty?
+        name ||= self.class.to_s.gsub(/License$/, "").underscore
+
+        return if licenses.permissions[name].nil?
+
+        licenses.permissions[name].can_eval do |permission_statement|
+          instance_eval permission_statement
+        end
+        licenses.permissions[name].cannot_eval do |permission_statement|
+          instance_eval permission_statement
+        end
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/license/rules.rb

@@ -0,0 +1,17 @@
+module CanTango::PermitEngine
+  class License
+    module Rules
+      def can(action, subject, conditions = nil, &block)
+        permit.can action, subject, conditions, &block
+      end
+
+      def cannot(action, subject, conditions = nil, &block)
+        permit.cannot action, subject, conditions, &block
+      end
+
+      def owns(user_account, clazz, ownership_relation = :user_id, user_id_attribute = :id)
+        permit.owns user_account, clazz, ownership_relation, user_id_attribute
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/permit.rb

@@ -0,0 +1,149 @@
+require 'sugar-high/array'
+
+# The permit base class for both Role Permits and Role Group Permits
+# Should contain all common logic
+module CanTango
+  module PermitEngine
+    class Permit
+      attr_reader :ability
+
+      # strategy is used to control the owns strategy (see rules.rb)
+      attr_reader :strategy
+
+      # creates the permit
+      def initialize ability
+        @ability  = ability
+      end
+
+      # executes the permit
+      def execute
+        executor.execute!
+      end
+
+      def category label
+        config.models.by_category label
+      end
+
+      def any reg_exp
+        config.models.by_reg_exp reg_exp
+      end
+
+      def options
+        ability.options
+      end
+
+      [:session, :controller, :request, :params].each do |obj|
+        class_eval %{
+          def #{obj}
+            options[:#{obj}]
+          end
+        }
+      end
+
+      def localhost?
+        config.localhost_list.include? request.host
+      end
+
+      def publichost?
+        !localhost?
+      end
+
+      def subject
+        ability.subject
+      end
+
+      def user
+        ability.user
+      end
+
+      def user_account
+        ability.user_account
+      end
+
+      def rules
+        ability.send :rules
+      end
+
+      # In a specific Role based Permit you can use 
+      #   def permit? user, options = {}
+      #     return if !super(user, :in_role)
+      #     ... permission logic follows
+      #
+      # This will call the Permit::Base#permit? instance method (the method below)
+      # It will only return true if the user matches the role of the Permit class and the
+      # options passed in is set to :in_role
+      #
+      # If these confitions are not met, it will return false and thus the outer permit 
+      # will not run the permission logic to follow
+      #
+      # Normally super for #permit? should not be called except for this case, 
+      # or if subclassing another Permit than Permit::Base
+      #
+      def permit?
+        static_rules
+        permit_rules
+        dynamic_rules
+      end
+
+      def licenses *names
+        names.to_strings.each do |name|
+          try_license name
+        end
+      end
+
+      include CanTango::Rules
+
+      protected
+
+      def try_license name
+        module_name = "#{name.camelize}License"
+        clazz = module_name.constantize
+        clazz.new(self).license_rules
+      rescue NameError
+        raise "License #{module_name} is not defined"
+      rescue
+        raise "License #{clazz} could not be enforced using #{self.inspect}"
+      end
+
+      # This method will contain the actual rules 
+      # can be implemented in the subclass
+
+      def permit_rules
+      end
+
+      def static_rules
+      end
+
+      def dynamic_rules
+      end
+
+      #include CanTango::PermitEngine::Cache
+      include CanTango::PermitEngine::Util
+      include CanTango::PermitEngine::Compatibility
+
+      def strategy
+        @strategy ||= options[:strategy] || CanTango::Ability.strategy || :default
+      end
+
+      include CanTango::PermitEngine::RoleMatcher
+
+      def any_role_match?
+        role_match?(subject) || role_group_match?(subject)
+      end
+
+      # return the executor used to execute the permit
+      def executor
+        @executor ||= case self.class.name
+        when /System/
+          then CanTango::PermitEngine::Executor::System.new self
+        else
+          CanTango::PermitEngine::Executor::Base.new self
+        end
+      end
+
+      def config
+        CanTango.config
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/role_group_permit.rb

@@ -0,0 +1,37 @@
+module CanTango
+  module PermitEngine
+    class RoleGroupPermit < CanTango::PermitEngine::Permit
+
+      autoload_modules :Builder, :Finder
+
+      def role_group
+        self.class.name.demodulize.gsub(/(.*)(RoleGroupPermit)/, '\1').underscore.to_sym
+      end
+
+      # creates the permit
+      def initialize ability
+        super
+      end
+
+      # In a specific Role based Permit you can use 
+      #   def permit? user, options = {}
+      #     return if !super(user, :in_group)
+      #     ... permission logic follows
+      #
+      # This will call the Permit::Base#permit? instance method (the method below)
+      # It will only return true if the user matches the role of the Permit class and the
+      # options passed in is set to :in_role
+      #
+      # If these confitions are not met, it will return false and thus the outer permit 
+      # will not run the permission logic to follow
+      #
+      # Normally super for #permit? should not be called except for this case, 
+      # or if subclassing another Permit than Permit::Base
+      #
+      def permit?
+        super
+      end
+ 
+    end
+  end
+end

data/lib/cantango/permit_engine/role_group_permit/builder.rb

@@ -0,0 +1,47 @@
+module CanTango
+  module PermitEngine
+    class RoleGroupPermit < CanTango::PermitEngine::Permit
+
+      class Builder < CanTango::PermitEngine::Builder::Base
+        #class NoAvailableRoleGroups < StandardError; end
+
+        # builds a list of Permits for each role group of the current ability user (or account)
+        # @return [Array<RoleGroupPermit::Base>] the role group permits built for this ability
+        def build
+          # raise NoAvailableRoleGroups, "no available roles groups are defined" if available_role_groups.empty?
+          role_groups.inject([]) do |permits, role_group|
+            (permits << create_permit(role_group)) if valid?(role_group.to_sym)
+            permits
+          end.compact
+        end
+
+        def finder
+          CanTango::PermitEngine::RoleGroupPermit::Finder
+        end
+
+        protected
+
+        def valid? role_group
+          return false if not_only_role_group?(role_group)
+          !excluded? role_group
+        end
+
+        def not_only_role_group? role_group
+          !only_role_groups.empty? && !only_role_groups.include?(role_group)
+        end
+
+        def excluded? role_group
+          excluded_role_groups.include? role_group
+        end
+
+        def only_role_groups
+          CanTango.config.role_groups.onlies
+        end
+
+        def excluded_role_groups
+          CanTango.config.role_groups.excluded
+        end
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/role_group_permit/finder.rb

@@ -0,0 +1,20 @@
+module CanTango
+  module PermitEngine
+    class RoleGroupPermit < CanTango::PermitEngine::Permit
+
+      class Finder < CanTango::PermitEngine::Finder
+        def initialize account, name
+          super
+        end
+
+        def type
+          :role_group
+        end
+
+        def permit_class
+          "#{name.to_s.camelize}RoleGroupPermit"
+        end
+      end
+    end
+  end
+end

data/lib/cantango/permit_engine/role_matcher.rb

@@ -0,0 +1,13 @@
+module CanTango
+  module PermitEngine
+    module RoleMatcher
+      def role_match? user_account
+        user_account.has_role? permit_name(self.class)
+      end
+
+      def role_group_match? user, group_name = nil
+        user_account.is_in_group? permit_name(self.class)
+      end
+    end
+  end
+end