cbac 0.3.1
Sign up to get free protection for your applications and to get access to all the features.
- data/Manifest +44 -0
- data/README.rdoc +48 -0
- data/Rakefile +36 -0
- data/cbac.gemspec +31 -0
- data/generators/cbac/USAGE +34 -0
- data/generators/cbac/cbac_generator.rb +45 -0
- data/generators/cbac/templates/config/context_roles.rb +10 -0
- data/generators/cbac/templates/config/privileges.rb +30 -0
- data/generators/cbac/templates/controllers/generic_roles_controller.rb +30 -0
- data/generators/cbac/templates/controllers/memberships_controller.rb +22 -0
- data/generators/cbac/templates/controllers/permissions_controller.rb +42 -0
- data/generators/cbac/templates/fixtures/cbac_generic_roles.yml +9 -0
- data/generators/cbac/templates/fixtures/cbac_memberships.yml +8 -0
- data/generators/cbac/templates/fixtures/cbac_permissions.yml +8 -0
- data/generators/cbac/templates/migrate/create_cbac.rb +40 -0
- data/generators/cbac/templates/stylesheets/cbac.css +65 -0
- data/generators/cbac/templates/views/generic_roles/index.html.erb +59 -0
- data/generators/cbac/templates/views/layouts/cbac.html.erb +17 -0
- data/generators/cbac/templates/views/memberships/_update.html.erb +12 -0
- data/generators/cbac/templates/views/memberships/index.html.erb +22 -0
- data/generators/cbac/templates/views/permissions/_update_context_role.html.erb +12 -0
- data/generators/cbac/templates/views/permissions/_update_generic_role.html.erb +12 -0
- data/generators/cbac/templates/views/permissions/index.html.erb +31 -0
- data/init.rb +11 -0
- data/lib/cbac.rb +104 -0
- data/lib/cbac/config.rb +10 -0
- data/lib/cbac/context_role.rb +27 -0
- data/lib/cbac/generic_role.rb +6 -0
- data/lib/cbac/membership.rb +4 -0
- data/lib/cbac/permission.rb +6 -0
- data/lib/cbac/privilege.rb +72 -0
- data/lib/cbac/privilege_set.rb +28 -0
- data/lib/cbac/privilege_set_record.rb +5 -0
- data/lib/cbac/setup.rb +31 -0
- data/tasks/cbac.rake +19 -0
- data/test/fixtures/cbac_generic_roles.yml +9 -0
- data/test/fixtures/cbac_memberships.yml +8 -0
- data/test/fixtures/cbac_permissions.yml +15 -0
- data/test/fixtures/cbac_privilege_set.yml +18 -0
- data/test/test_cbac_authorize_context_roles.rb +43 -0
- data/test/test_cbac_authorize_generic_roles.rb +37 -0
- data/test/test_cbac_context_role.rb +51 -0
- data/test/test_cbac_privilege.rb +99 -0
- data/test/test_cbac_privilege_set.rb +52 -0
- metadata +118 -0
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
/****
|
|
2
|
+
* General
|
|
3
|
+
*/
|
|
4
|
+
|
|
5
|
+
div.cbac h1 {
|
|
6
|
+
|
|
7
|
+
}
|
|
8
|
+
|
|
9
|
+
div.cbac table {
|
|
10
|
+
padding: 0px;
|
|
11
|
+
margin: 0px;
|
|
12
|
+
border-collapse: collapse;
|
|
13
|
+
}
|
|
14
|
+
|
|
15
|
+
div.cbac div.linebreak {
|
|
16
|
+
height: 20px;
|
|
17
|
+
}
|
|
18
|
+
|
|
19
|
+
/****
|
|
20
|
+
* Table
|
|
21
|
+
*/
|
|
22
|
+
|
|
23
|
+
div.cbac th {
|
|
24
|
+
background-color: #ABEB71;
|
|
25
|
+
}
|
|
26
|
+
|
|
27
|
+
div.cbac td, div.cbac th {
|
|
28
|
+
border: 1px solid black;
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
div.cbac td.small, div.cbac th.small {
|
|
32
|
+
width: 50px;
|
|
33
|
+
}
|
|
34
|
+
|
|
35
|
+
div.cbac td.medium, div.cbac th.medium {
|
|
36
|
+
width: 150px;
|
|
37
|
+
}
|
|
38
|
+
|
|
39
|
+
div.cbac td.large, div.cbac th.large {
|
|
40
|
+
width: 600px;
|
|
41
|
+
}
|
|
42
|
+
|
|
43
|
+
div.cbac td.checked {
|
|
44
|
+
text-align: center;
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
div.cbac td.submit {
|
|
48
|
+
text-align: right;
|
|
49
|
+
}
|
|
50
|
+
|
|
51
|
+
/****
|
|
52
|
+
* Controls
|
|
53
|
+
*/
|
|
54
|
+
|
|
55
|
+
div.cbac input[type="text"] {
|
|
56
|
+
margin: 2px;
|
|
57
|
+
}
|
|
58
|
+
|
|
59
|
+
div.cbac td.medium input[type="text"] {
|
|
60
|
+
width: 138px;
|
|
61
|
+
}
|
|
62
|
+
|
|
63
|
+
div.cbac td.large input[type="text"] {
|
|
64
|
+
width: 588px;
|
|
65
|
+
}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
<div class="cbac">
|
|
2
|
+
<h1>Generic roles</h1>
|
|
3
|
+
<table>
|
|
4
|
+
<tr>
|
|
5
|
+
<th class="medium">Name</th>
|
|
6
|
+
<th class="large">Remarks</th>
|
|
7
|
+
<th class="small"> </th>
|
|
8
|
+
</tr>
|
|
9
|
+
|
|
10
|
+
<% Cbac::GenericRole.find(:all).each do |role| %>
|
|
11
|
+
<tr class="row">
|
|
12
|
+
<% form_for role do |r| %>
|
|
13
|
+
<td class="medium"><%= r.text_field :name %></td>
|
|
14
|
+
<td class="large"><%= r.text_field :remarks, :rows => 1 %></td>
|
|
15
|
+
<td class="small"><%= r.submit "OK" %></td>
|
|
16
|
+
<% end %>
|
|
17
|
+
</tr>
|
|
18
|
+
<% end%>
|
|
19
|
+
</table>
|
|
20
|
+
|
|
21
|
+
<div class="linebreak"></div>
|
|
22
|
+
|
|
23
|
+
<table>
|
|
24
|
+
<% form_for(Cbac::GenericRole.new) do |new_role| %>
|
|
25
|
+
<tr class="row">
|
|
26
|
+
<th colspan="2">New generic role</th>
|
|
27
|
+
</tr>
|
|
28
|
+
<tr class="row">
|
|
29
|
+
<td class="medium">Name</td>
|
|
30
|
+
<td class="medium"><%= new_role.text_field :name %></td>
|
|
31
|
+
</tr>
|
|
32
|
+
<tr class="row">
|
|
33
|
+
<td class="medium">Remarks</td>
|
|
34
|
+
<td class="large"><%= new_role.text_field :remarks %></td>
|
|
35
|
+
</tr>
|
|
36
|
+
<tr class="row">
|
|
37
|
+
<td colspan="2" class="submit"><%= new_role.submit "Create" %></td>
|
|
38
|
+
</tr>
|
|
39
|
+
<% end %>
|
|
40
|
+
</table>
|
|
41
|
+
|
|
42
|
+
<div class="linebreak"></div>
|
|
43
|
+
|
|
44
|
+
<table>
|
|
45
|
+
<% form_tag(:controller => "cbac/generic_roles", :action => "delete") do |f| %>
|
|
46
|
+
<tr>
|
|
47
|
+
<th colspan="2">Delete generic role</th>
|
|
48
|
+
</tr>
|
|
49
|
+
<tr>
|
|
50
|
+
<td class="medium">Select role</td>
|
|
51
|
+
<td class="medium"><%= select_tag "id", Cbac::GenericRole.find(:all).collect{|role|"<option value='#{role.id}'>#{role.name}</option>"} %>
|
|
52
|
+
</td>
|
|
53
|
+
</tr>
|
|
54
|
+
<tr>
|
|
55
|
+
<td colspan="2" class="submit"><%= submit_tag "Delete" %></td>
|
|
56
|
+
</tr>
|
|
57
|
+
<% end %>
|
|
58
|
+
</table>
|
|
59
|
+
</div>
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
2
|
+
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
3
|
+
|
|
4
|
+
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
|
|
5
|
+
<head>
|
|
6
|
+
<meta http-equiv="content-type" content="text/html;charset=UTF-8" />
|
|
7
|
+
<title>Context Based Access Control</title>
|
|
8
|
+
<%= javascript_include_tag :defaults %>
|
|
9
|
+
<%= stylesheet_link_tag "cbac" %>
|
|
10
|
+
</head>
|
|
11
|
+
<body>
|
|
12
|
+
<%= link_to "Permissions", cbac_permissions_path %>
|
|
13
|
+
<%= link_to "Generic roles", cbac_generic_roles_path %>
|
|
14
|
+
<%= link_to "Memberships", cbac_memberships_path %>
|
|
15
|
+
<%= yield %>
|
|
16
|
+
</body>
|
|
17
|
+
</html>
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
<% update_name = generic_role.id.to_s + "__" + user_id.to_s %>
|
|
2
|
+
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
+
<% remote_form_for "/cbac/memberships/update", :url => {:controller => "cbac/memberships", :action => "update"},
|
|
4
|
+
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
+
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
+
<%= hidden_field_tag "generic_role_id" + update_name, generic_role.id.to_s, :name => "generic_role_id" %>
|
|
7
|
+
<%= hidden_field_tag "user_id" + update_name, user_id.to_s, :name => "user_id" %>
|
|
8
|
+
<%= check_box_tag "member" + update_name, "1",
|
|
9
|
+
(Cbac::Membership.find(:all, :conditions => ["generic_role_id = ? AND user_id = ?", generic_role.id.to_s, user_id.to_s]).length > 0),
|
|
10
|
+
{:onclick => "this.form.onsubmit();", :name => "member"}%>
|
|
11
|
+
<% end %>
|
|
12
|
+
<% unless update_partial %></div><% end %>
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
<div class="cbac">
|
|
2
|
+
<h1>Memberships</h1>
|
|
3
|
+
<table>
|
|
4
|
+
<tr>
|
|
5
|
+
<th class="medium">Users</th>
|
|
6
|
+
<% @generic_roles.each do |role| %>
|
|
7
|
+
<th><%= role.name %></th>
|
|
8
|
+
<% end %>
|
|
9
|
+
</tr>
|
|
10
|
+
<% @users.each do |u| %>
|
|
11
|
+
<tr>
|
|
12
|
+
<td><%= u.name %></td>
|
|
13
|
+
<% @generic_roles.each do |generic_role| %>
|
|
14
|
+
<td class="checked">
|
|
15
|
+
<%= render :partial => "cbac/memberships/update.html", :locals => {:generic_role => generic_role,
|
|
16
|
+
:user_id => u.id.to_s,:update_partial => false} %>
|
|
17
|
+
</td>
|
|
18
|
+
<% end %>
|
|
19
|
+
</tr>
|
|
20
|
+
<% end %>
|
|
21
|
+
</table>
|
|
22
|
+
</div>
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
<% update_name = "cr__" + context_role.to_s + "__" + set_id.to_s %>
|
|
2
|
+
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
+
<% remote_form_for "/cbac/permissions/update", :url => cbac_permissions_update_path,
|
|
4
|
+
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
+
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
+
<%= hidden_field_tag "context_role" + update_name, context_role.to_s, :name => "context_role" %>
|
|
7
|
+
<%= hidden_field_tag "privilege_set_id" + update_name, set_id.to_s, :name => "privilege_set_id" %>
|
|
8
|
+
<%= check_box_tag "permission" + update_name, "1",
|
|
9
|
+
(Cbac::Permission.find(:all, :conditions => ["context_role = ? AND privilege_set_id = ?", context_role.to_s, set_id.to_s]).length > 0),
|
|
10
|
+
{:onclick => "this.form.onsubmit();", :name => "permission"}%>
|
|
11
|
+
<% end %>
|
|
12
|
+
<% unless update_partial %></div><% end %>
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
<% update_name = "gr__" + role.id.to_s + "__" + set_id.to_s %>
|
|
2
|
+
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
+
<% remote_form_for "/cbac/permissions/update", :url => cbac_permissions_update_path,
|
|
4
|
+
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
+
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
+
<%= hidden_field_tag "generic_role_id" + update_name, role.id.to_s, :name => "generic_role_id" %>
|
|
7
|
+
<%= hidden_field_tag "privilege_set_id" + update_name, set_id.to_s, :name => "privilege_set_id" %>
|
|
8
|
+
<%= check_box_tag "permission" + update_name, "1",
|
|
9
|
+
(Cbac::Permission.find(:all, :conditions => ["generic_role_id = ? AND privilege_set_id = ?", role.id.to_s, set_id.to_s]).length > 0),
|
|
10
|
+
{:onclick => "this.form.onsubmit();", :name => "permission"}%>
|
|
11
|
+
<% end %>
|
|
12
|
+
<% unless update_partial %></div><% end %>
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
<div class="cbac">
|
|
2
|
+
<h1>Permissions</h1>
|
|
3
|
+
<table>
|
|
4
|
+
<tr>
|
|
5
|
+
<th>Privilegeset</th>
|
|
6
|
+
<% @context_roles.each do |name, comment| %>
|
|
7
|
+
<th><%= name %></th>
|
|
8
|
+
<% end %>
|
|
9
|
+
<% @generic_roles.each do |role| %>
|
|
10
|
+
<th><%= role.name %></th>
|
|
11
|
+
<% end %>
|
|
12
|
+
</tr>
|
|
13
|
+
<% PrivilegeSet.sets.each do |token, set| %>
|
|
14
|
+
<tr>
|
|
15
|
+
<td><%= set.name %></td>
|
|
16
|
+
<% @context_roles.each do |context_role, comment| %>
|
|
17
|
+
<td class="checked">
|
|
18
|
+
<%= render :partial => "cbac/permissions/update_context_role.html", :locals => {:context_role => context_role.to_s,
|
|
19
|
+
:set_id => set.id.to_s, :update_partial => false} %>
|
|
20
|
+
</td>
|
|
21
|
+
<% end %>
|
|
22
|
+
<% @generic_roles.each do |role| %>
|
|
23
|
+
<td class="checked">
|
|
24
|
+
<%= render :partial => "cbac/permissions/update_generic_role.html", :locals => {:role => role,
|
|
25
|
+
:set_id => set.id.to_s, :update_partial => false} %>
|
|
26
|
+
</td>
|
|
27
|
+
<% end %>
|
|
28
|
+
</tr>
|
|
29
|
+
<% end %>
|
|
30
|
+
</table>
|
|
31
|
+
</div>
|
data/init.rb
ADDED
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
# Configuration file
|
|
2
|
+
require File.dirname(__FILE__) + '/lib/cbac/config.rb'
|
|
3
|
+
|
|
4
|
+
# The following code contains configuration options. You can turn them on for
|
|
5
|
+
# gem development. For actual usage, it is advisable to set the configuration
|
|
6
|
+
# options in the environment files.
|
|
7
|
+
Cbac::Config.verbose = false
|
|
8
|
+
|
|
9
|
+
# Include CBAC core file
|
|
10
|
+
require File.dirname(__FILE__) + '/lib/cbac.rb'
|
|
11
|
+
|
data/lib/cbac.rb
ADDED
|
@@ -0,0 +1,104 @@
|
|
|
1
|
+
# TODO: Check the permission table for double entries, ie: both an entry in the
|
|
2
|
+
# generic_role_id field and an entry in the context_role field. Solution: solve
|
|
3
|
+
# via model. Update model & add test
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
module Cbac
|
|
7
|
+
if Cbac::Setup.check
|
|
8
|
+
puts "CBAC properly installed"
|
|
9
|
+
|
|
10
|
+
require File.dirname(__FILE__) + '/cbac/privilege.rb'
|
|
11
|
+
require File.dirname(__FILE__) + '/cbac/privilege_set.rb'
|
|
12
|
+
require File.dirname(__FILE__) + '/cbac/context_role.rb'
|
|
13
|
+
|
|
14
|
+
# check performs a check to see if the user is allowed to access the given
|
|
15
|
+
# resource. Example: authorization_check("BlogController", "index", :get)
|
|
16
|
+
def authorization_check(controller, action, request, context = {})
|
|
17
|
+
# Determine the controller to look for
|
|
18
|
+
controller_method = [controller, action].join("/")
|
|
19
|
+
# Get the privilegesets
|
|
20
|
+
privilege_sets = Privilege.select(controller_method, request)
|
|
21
|
+
# Check the privilege sets
|
|
22
|
+
check_privilege_sets(privilege_sets, context)
|
|
23
|
+
end
|
|
24
|
+
|
|
25
|
+
# Check the given privilege_set symbol
|
|
26
|
+
# TODO following code is not yet tested
|
|
27
|
+
def check_privilege_set(privilege_set, context = {})
|
|
28
|
+
check_privilege_sets([PrivilegeSet.sets[privilege_set.to_sym]], context)
|
|
29
|
+
end
|
|
30
|
+
|
|
31
|
+
# Check the given privilege_sets
|
|
32
|
+
def check_privilege_sets(privilege_sets, context = {})
|
|
33
|
+
# Check the generic roles
|
|
34
|
+
return true if privilege_sets.any? { |set| Cbac::GenericRole.find(:all, :conditions => ["user_id= ? AND privilege_set_id = ?", current_user, set.id],:joins => [:generic_role_members, :permissions]).length > 0 }
|
|
35
|
+
# Check the context roles Get the permissions
|
|
36
|
+
privilege_sets.collect{|privilege_set|Cbac::Permission.find(:all, :conditions => ["privilege_set_id = ? AND generic_role_id = 0", privilege_set.id.to_s])}.flatten.each do |permission|
|
|
37
|
+
puts "Checking for context_role:#{permission.context_role} on privilege_set:#{permission.privilegeset.name}" if Cbac::Config.verbose
|
|
38
|
+
eval_string = ContextRole.roles[permission.context_role.to_sym]
|
|
39
|
+
# Not sure if this will work everywhere
|
|
40
|
+
return true if eval_string.call(context)
|
|
41
|
+
end
|
|
42
|
+
# not authorized
|
|
43
|
+
puts "Not authorized for: #{controller_method}" if Cbac::Config.verbose
|
|
44
|
+
false
|
|
45
|
+
end
|
|
46
|
+
|
|
47
|
+
# Code that performs authorization
|
|
48
|
+
def authorize
|
|
49
|
+
authorization_check(params[:controller], params[:action], request.request_method) || unauthorized
|
|
50
|
+
end
|
|
51
|
+
|
|
52
|
+
# Default unauthorized method Override this method to supply your own code
|
|
53
|
+
# for incorrect authorization
|
|
54
|
+
def unauthorized
|
|
55
|
+
render :text => "You are not authorized to perform this action", :status => 401
|
|
56
|
+
end
|
|
57
|
+
|
|
58
|
+
# Default implementation of the current_user method
|
|
59
|
+
def current_user
|
|
60
|
+
session[:currentuser].to_i
|
|
61
|
+
end
|
|
62
|
+
|
|
63
|
+
# Load controller classes and methods
|
|
64
|
+
def load_controller_methods
|
|
65
|
+
begin
|
|
66
|
+
Dir.glob("app/controllers/**/*.rb").each{|file| require file}
|
|
67
|
+
rescue LoadError
|
|
68
|
+
raise "Could not load controller classes"
|
|
69
|
+
end
|
|
70
|
+
# Make this iterative TODO
|
|
71
|
+
@classes = ApplicationController.subclasses
|
|
72
|
+
end
|
|
73
|
+
|
|
74
|
+
# Extracts the class name from the filename
|
|
75
|
+
def extract_class_name(filename)
|
|
76
|
+
File.basename(filename).chomp(".rb").camelize
|
|
77
|
+
end
|
|
78
|
+
|
|
79
|
+
# ### Initializer Include privileges file - contains the privilege and
|
|
80
|
+
# privilege definitions
|
|
81
|
+
begin
|
|
82
|
+
require File.join(RAILS_ROOT, "config", "privileges.rb")
|
|
83
|
+
rescue MissingSourceFile
|
|
84
|
+
puts "CBAC warning: Could not load config/privileges.rb (Did you run ./script/generate cbac)"
|
|
85
|
+
end
|
|
86
|
+
# Include context roles file - contains the context role definitions
|
|
87
|
+
begin
|
|
88
|
+
require File.join(RAILS_ROOT, "config", "context_roles.rb")
|
|
89
|
+
rescue MissingSourceFile
|
|
90
|
+
puts "CBAC warning: Could not load config/context_roles.rb (Did you run ./script/generate cbac)"
|
|
91
|
+
end
|
|
92
|
+
|
|
93
|
+
# ### Database autoload code
|
|
94
|
+
else
|
|
95
|
+
# This is the code that is executed if CBAc is not properly installed/
|
|
96
|
+
# configured. It includes a different authorize method, aimes at refusing
|
|
97
|
+
# all authorizations
|
|
98
|
+
def authorize
|
|
99
|
+
render :text => "Authorization error", :status => 401
|
|
100
|
+
false
|
|
101
|
+
end
|
|
102
|
+
end
|
|
103
|
+
end
|
|
104
|
+
|
data/lib/cbac/config.rb
ADDED
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
module Cbac
|
|
2
|
+
# Class containing configuration options for the Cbac system. The following
|
|
3
|
+
# configuration options are supported: verbose. Determines whether or not to
|
|
4
|
+
# output results to the console. All outputs are processed as puts commands.
|
|
5
|
+
class Config
|
|
6
|
+
class << self
|
|
7
|
+
attr_accessor :verbose
|
|
8
|
+
end
|
|
9
|
+
end
|
|
10
|
+
end
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
# ContextRole is the class containing the context role definitions
|
|
2
|
+
#
|
|
3
|
+
# Usage: ContextRole.add :logged_in_user, "!session[:currentuser].nil?"
|
|
4
|
+
class ContextRole
|
|
5
|
+
class << self
|
|
6
|
+
# Hash containing all the context roles. Keys are the role names Values are
|
|
7
|
+
# the Ruby eval strings Eval strings must result in true or false
|
|
8
|
+
attr_reader :roles
|
|
9
|
+
|
|
10
|
+
# Adds a context role to the list of context roles. @symbol defines the name
|
|
11
|
+
# of the context role @context_rule defines the ruby code to be evaluated
|
|
12
|
+
# when determining role membership
|
|
13
|
+
#
|
|
14
|
+
# If the context role already exists, an exception is thrown.
|
|
15
|
+
def add(symbol, context_rule = "", &block)
|
|
16
|
+
symbol = symbol.to_sym
|
|
17
|
+
@roles = Hash.new if @roles.nil?
|
|
18
|
+
raise ArgumentError, "CBAC: ContextRole was already defined" if @roles.keys.include?(symbol)
|
|
19
|
+
# TODO following code
|
|
20
|
+
#raise ArgumentError, "CBAC: cannot specify both string rule and block rule" unless context_rule.nil? and block.nil?
|
|
21
|
+
# TODO context parameter in block statement is not explicitly tested
|
|
22
|
+
block = eval("Proc.new {|context| " + context_rule + "}") if block.nil?
|
|
23
|
+
@roles[symbol] = block
|
|
24
|
+
end
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
class Cbac::GenericRole < ActiveRecord::Base
|
|
2
|
+
set_table_name "cbac_generic_roles"
|
|
3
|
+
|
|
4
|
+
has_many :generic_role_members, :class_name => "Cbac::Membership", :foreign_key => "generic_role_id"
|
|
5
|
+
has_many :permissions, :class_name => "Cbac::Permission", :foreign_key => "generic_role_id"
|
|
6
|
+
end
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
class Cbac::Permission < ActiveRecord::Base
|
|
2
|
+
set_table_name "cbac_permissions"
|
|
3
|
+
|
|
4
|
+
belongs_to :generic_role, :class_name => "Cbac::GenericRole", :foreign_key => "generic_role_id"
|
|
5
|
+
belongs_to :privilegeset, :class_name => "Cbac::PrivilegeSetRecord", :foreign_key => "privilege_set_id"
|
|
6
|
+
end
|
|
@@ -0,0 +1,72 @@
|
|
|
1
|
+
# Class containing all the privileges
|
|
2
|
+
#
|
|
3
|
+
# To define a new controller method resource: Privilege.resource :privilegeset,
|
|
4
|
+
# "controller/method"
|
|
5
|
+
#
|
|
6
|
+
class Privilege
|
|
7
|
+
class << self
|
|
8
|
+
attr_reader :get_resources, :post_resources, :model_attributes, :models
|
|
9
|
+
|
|
10
|
+
# Links a resource with a PrivilegeSet
|
|
11
|
+
#
|
|
12
|
+
# An ArgumentError exception is thrown if the PrivilegeSet does not exist.
|
|
13
|
+
# To create PrivilegeSets, use the PrivilegeSet.add method
|
|
14
|
+
def resource(privilege_set, method, action="GET")
|
|
15
|
+
privilege_set = privilege_set.to_sym
|
|
16
|
+
@get_resources = Hash.new if @get_resources.nil?
|
|
17
|
+
@post_resources = Hash.new if @post_resources.nil?
|
|
18
|
+
action_aliases = {"GET" => ["GET", "get", "g","idempotent"], "POST" => ["POST", "post", "p"]}
|
|
19
|
+
raise ArgumentError, "CBAC: PrivilegeSet does not exist: #{privilege_set}" unless PrivilegeSet.sets.include?(privilege_set)
|
|
20
|
+
action_option = action_aliases.find { |name, aliases| aliases.include?(action.to_s) }
|
|
21
|
+
raise ArgumentError, "CBAC: Wrong value for argument 'action' in Privilege.resource: #{action}" if action_option.nil?
|
|
22
|
+
case action_option[0]
|
|
23
|
+
when "GET"
|
|
24
|
+
(@get_resources[method] ||= Array.new) << PrivilegeSet.sets[privilege_set]
|
|
25
|
+
when "POST"
|
|
26
|
+
(@post_resources[method] ||= Array.new) << PrivilegeSet.sets[privilege_set]
|
|
27
|
+
else
|
|
28
|
+
end
|
|
29
|
+
end
|
|
30
|
+
|
|
31
|
+
def model_attribute
|
|
32
|
+
|
|
33
|
+
end
|
|
34
|
+
def model
|
|
35
|
+
|
|
36
|
+
end
|
|
37
|
+
|
|
38
|
+
# Finds the privilege sets associated with the given controller_method and
|
|
39
|
+
# action_type Valid values for action_type are "get", "post" and "put".
|
|
40
|
+
# "put" is converted into "post".
|
|
41
|
+
#
|
|
42
|
+
# If incorrect values are given for action_type the method will raise an
|
|
43
|
+
# ArgumentError. If the controller and action name are not found, an
|
|
44
|
+
# exception is being raised.
|
|
45
|
+
def select(controller_method, action_type)
|
|
46
|
+
action_type = action_type.to_s
|
|
47
|
+
post_methods = ["post", "put", "delete"]
|
|
48
|
+
if action_type == "get"
|
|
49
|
+
privilege_sets = Privilege.get_resources[controller_method]
|
|
50
|
+
else if post_methods.include?(action_type)
|
|
51
|
+
privilege_sets = Privilege.post_resources[controller_method]
|
|
52
|
+
else
|
|
53
|
+
raise ArgumentError, "CBAC: Incorrect action_type: #{action_type}"
|
|
54
|
+
end
|
|
55
|
+
end
|
|
56
|
+
# Error handling if no privilege_sets were found
|
|
57
|
+
if privilege_sets.nil?
|
|
58
|
+
if action_type == "get"
|
|
59
|
+
if !Privilege.post_resources[controller_method].nil?
|
|
60
|
+
raise "CBAC: PrivilegeSets only exist for other action: post on method: #{controller_method}"
|
|
61
|
+
end
|
|
62
|
+
else
|
|
63
|
+
if !Privilege.get_resources[controller_method].nil?
|
|
64
|
+
raise "CBAC: PrivilegeSets only exist for other action: get on method: #{controller_method}"
|
|
65
|
+
end
|
|
66
|
+
end
|
|
67
|
+
raise "CBAC: Could not find any privilege sets associated with: #{controller_method} and action: #{action_type}"
|
|
68
|
+
end
|
|
69
|
+
privilege_sets
|
|
70
|
+
end
|
|
71
|
+
end
|
|
72
|
+
end
|