cbac 0.6.1 → 0.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/Manifest +70 -74
- data/README.rdoc +51 -51
- data/Rakefile +39 -39
- data/cbac.gemspec +30 -31
- data/config/cbac/context_roles.rb +21 -21
- data/config/cbac/privileges.rb +50 -50
- data/context_roles.rb +21 -21
- data/init.rb +3 -3
- data/lib/cbac.rb +132 -132
- data/lib/cbac/cbac_pristine/pristine.rb +138 -135
- data/lib/cbac/cbac_pristine/pristine_file.rb +173 -170
- data/lib/cbac/cbac_pristine/pristine_permission.rb +205 -194
- data/lib/cbac/cbac_pristine/pristine_role.rb +41 -41
- data/lib/cbac/config.rb +9 -9
- data/lib/cbac/context_role.rb +27 -27
- data/lib/cbac/generic_role.rb +5 -5
- data/lib/cbac/known_permission.rb +14 -14
- data/lib/cbac/membership.rb +3 -3
- data/lib/cbac/permission.rb +5 -5
- data/lib/cbac/privilege.rb +117 -117
- data/lib/cbac/privilege_new_api.rb +56 -56
- data/lib/cbac/privilege_set.rb +29 -29
- data/lib/cbac/privilege_set_record.rb +6 -6
- data/lib/cbac/setup.rb +37 -37
- data/lib/generators/cbac/USAGE +33 -33
- data/lib/generators/cbac/cbac_generator.rb +75 -75
- data/lib/generators/cbac/copy_files/config/cbac.pristine +2 -2
- data/lib/generators/cbac/copy_files/config/context_roles.rb +17 -17
- data/lib/generators/cbac/copy_files/config/privileges.rb +25 -25
- data/lib/generators/cbac/copy_files/controllers/generic_roles_controller.rb +30 -30
- data/lib/generators/cbac/copy_files/controllers/memberships_controller.rb +22 -22
- data/lib/generators/cbac/copy_files/controllers/permissions_controller.rb +61 -61
- data/lib/generators/cbac/copy_files/controllers/upgrade_controller.rb +23 -23
- data/lib/generators/cbac/copy_files/fixtures/cbac_generic_roles.yml +9 -9
- data/lib/generators/cbac/copy_files/fixtures/cbac_memberships.yml +8 -8
- data/lib/generators/cbac/copy_files/fixtures/cbac_permissions.yml +8 -8
- data/lib/generators/cbac/copy_files/initializers/cbac_config.rb +4 -4
- data/lib/generators/cbac/copy_files/migrate/create_cbac_from_scratch.rb +59 -59
- data/lib/generators/cbac/copy_files/migrate/create_cbac_upgrade_path.rb +40 -31
- data/lib/generators/cbac/copy_files/stylesheets/cbac.css +65 -65
- data/lib/generators/cbac/copy_files/tasks/cbac.rake +345 -345
- data/lib/generators/cbac/copy_files/views/generic_roles/index.html.erb +58 -58
- data/lib/generators/cbac/copy_files/views/layouts/cbac.html.erb +18 -18
- data/lib/generators/cbac/copy_files/views/memberships/_update.html.erb +11 -11
- data/lib/generators/cbac/copy_files/views/memberships/index.html.erb +23 -23
- data/lib/generators/cbac/copy_files/views/permissions/_update_context_role.html.erb +11 -11
- data/lib/generators/cbac/copy_files/views/permissions/_update_generic_role.html.erb +11 -11
- data/lib/generators/cbac/copy_files/views/permissions/index.html.erb +39 -39
- data/lib/generators/cbac/copy_files/views/upgrade/index.html.erb +31 -31
- data/migrations/20110211105533_add_pristine_files_to_cbac_upgrade_path.rb +16 -0
- data/privileges.rb +50 -50
- data/spec/cbac_pristine_file_spec.rb +329 -329
- data/spec/cbac_pristine_permission_spec.rb +358 -358
- data/spec/cbac_pristine_role_spec.rb +85 -85
- data/spec/rcov.opts +1 -1
- data/spec/spec.opts +4 -4
- data/spec/spec_helper.rb +11 -11
- data/tasks/cbac.rake +345 -345
- data/test/fixtures/cbac_generic_roles.yml +9 -9
- data/test/fixtures/cbac_memberships.yml +8 -8
- data/test/fixtures/cbac_permissions.yml +14 -14
- data/test/fixtures/cbac_privilege_set.yml +18 -18
- data/test/test_cbac_actions.rb +71 -71
- data/test/test_cbac_authorize_context_roles.rb +39 -39
- data/test/test_cbac_authorize_generic_roles.rb +36 -36
- data/test/test_cbac_context_role.rb +50 -50
- data/test/test_cbac_privilege.rb +151 -151
- data/test/test_cbac_privilege_set.rb +50 -50
- data/test/test_helper.rb +28 -28
- metadata +14 -15
- data/nbproject/private/private.properties +0 -3
- data/nbproject/private/private.xml +0 -4
- data/nbproject/private/rake-d.txt +0 -0
- data/nbproject/project.properties +0 -9
- data/nbproject/project.xml +0 -16
|
@@ -1,59 +1,59 @@
|
|
|
1
|
-
<div class="cbac">
|
|
2
|
-
<h1>Generic roles</h1>
|
|
3
|
-
<table>
|
|
4
|
-
<tr>
|
|
5
|
-
<th class="medium">Name</th>
|
|
6
|
-
<th class="large">Remarks</th>
|
|
7
|
-
<th class="small"> </th>
|
|
8
|
-
</tr>
|
|
9
|
-
|
|
10
|
-
<% Cbac::GenericRole.find(:all).each do |role| %>
|
|
11
|
-
<tr class="row">
|
|
12
|
-
<% form_for role do |r| %>
|
|
13
|
-
<td class="medium"><%= r.text_field :name %></td>
|
|
14
|
-
<td class="large"><%= r.text_field :remarks, :rows => 1 %></td>
|
|
15
|
-
<td class="small"><%= r.submit "OK" %></td>
|
|
16
|
-
<% end %>
|
|
17
|
-
</tr>
|
|
18
|
-
<% end%>
|
|
19
|
-
</table>
|
|
20
|
-
|
|
21
|
-
<div class="linebreak"></div>
|
|
22
|
-
|
|
23
|
-
<table>
|
|
24
|
-
<% form_for(Cbac::GenericRole.new) do |new_role| %>
|
|
25
|
-
<tr class="row">
|
|
26
|
-
<th colspan="2">New generic role</th>
|
|
27
|
-
</tr>
|
|
28
|
-
<tr class="row">
|
|
29
|
-
<td class="medium">Name</td>
|
|
30
|
-
<td class="medium"><%= new_role.text_field :name %></td>
|
|
31
|
-
</tr>
|
|
32
|
-
<tr class="row">
|
|
33
|
-
<td class="medium">Remarks</td>
|
|
34
|
-
<td class="large"><%= new_role.text_field :remarks %></td>
|
|
35
|
-
</tr>
|
|
36
|
-
<tr class="row">
|
|
37
|
-
<td colspan="2" class="submit"><%= new_role.submit "Create" %></td>
|
|
38
|
-
</tr>
|
|
39
|
-
<% end %>
|
|
40
|
-
</table>
|
|
41
|
-
|
|
42
|
-
<div class="linebreak"></div>
|
|
43
|
-
|
|
44
|
-
<table>
|
|
45
|
-
<% form_tag(:controller => "cbac/generic_roles", :action => "delete") do |f| %>
|
|
46
|
-
<tr>
|
|
47
|
-
<th colspan="2">Delete generic role</th>
|
|
48
|
-
</tr>
|
|
49
|
-
<tr>
|
|
50
|
-
<td class="medium">Select role</td>
|
|
51
|
-
<td class="medium"><%= select_tag "id", Cbac::GenericRole.find(:all).collect{|role|"<option value='#{role.id}'>#{role.name}</option>"} %>
|
|
52
|
-
</td>
|
|
53
|
-
</tr>
|
|
54
|
-
<tr>
|
|
55
|
-
<td colspan="2" class="submit"><%= submit_tag "Delete" %></td>
|
|
56
|
-
</tr>
|
|
57
|
-
<% end %>
|
|
58
|
-
</table>
|
|
1
|
+
<div class="cbac">
|
|
2
|
+
<h1>Generic roles</h1>
|
|
3
|
+
<table>
|
|
4
|
+
<tr>
|
|
5
|
+
<th class="medium">Name</th>
|
|
6
|
+
<th class="large">Remarks</th>
|
|
7
|
+
<th class="small"> </th>
|
|
8
|
+
</tr>
|
|
9
|
+
|
|
10
|
+
<% Cbac::GenericRole.find(:all).each do |role| %>
|
|
11
|
+
<tr class="row">
|
|
12
|
+
<% form_for role do |r| %>
|
|
13
|
+
<td class="medium"><%= r.text_field :name %></td>
|
|
14
|
+
<td class="large"><%= r.text_field :remarks, :rows => 1 %></td>
|
|
15
|
+
<td class="small"><%= r.submit "OK" %></td>
|
|
16
|
+
<% end %>
|
|
17
|
+
</tr>
|
|
18
|
+
<% end%>
|
|
19
|
+
</table>
|
|
20
|
+
|
|
21
|
+
<div class="linebreak"></div>
|
|
22
|
+
|
|
23
|
+
<table>
|
|
24
|
+
<% form_for(Cbac::GenericRole.new) do |new_role| %>
|
|
25
|
+
<tr class="row">
|
|
26
|
+
<th colspan="2">New generic role</th>
|
|
27
|
+
</tr>
|
|
28
|
+
<tr class="row">
|
|
29
|
+
<td class="medium">Name</td>
|
|
30
|
+
<td class="medium"><%= new_role.text_field :name %></td>
|
|
31
|
+
</tr>
|
|
32
|
+
<tr class="row">
|
|
33
|
+
<td class="medium">Remarks</td>
|
|
34
|
+
<td class="large"><%= new_role.text_field :remarks %></td>
|
|
35
|
+
</tr>
|
|
36
|
+
<tr class="row">
|
|
37
|
+
<td colspan="2" class="submit"><%= new_role.submit "Create" %></td>
|
|
38
|
+
</tr>
|
|
39
|
+
<% end %>
|
|
40
|
+
</table>
|
|
41
|
+
|
|
42
|
+
<div class="linebreak"></div>
|
|
43
|
+
|
|
44
|
+
<table>
|
|
45
|
+
<% form_tag(:controller => "cbac/generic_roles", :action => "delete") do |f| %>
|
|
46
|
+
<tr>
|
|
47
|
+
<th colspan="2">Delete generic role</th>
|
|
48
|
+
</tr>
|
|
49
|
+
<tr>
|
|
50
|
+
<td class="medium">Select role</td>
|
|
51
|
+
<td class="medium"><%= select_tag "id", Cbac::GenericRole.find(:all).collect{|role|"<option value='#{role.id}'>#{role.name}</option>"} %>
|
|
52
|
+
</td>
|
|
53
|
+
</tr>
|
|
54
|
+
<tr>
|
|
55
|
+
<td colspan="2" class="submit"><%= submit_tag "Delete" %></td>
|
|
56
|
+
</tr>
|
|
57
|
+
<% end %>
|
|
58
|
+
</table>
|
|
59
59
|
</div>
|
|
@@ -1,18 +1,18 @@
|
|
|
1
|
-
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
2
|
-
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
3
|
-
|
|
4
|
-
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
|
|
5
|
-
<head>
|
|
6
|
-
<meta http-equiv="content-type" content="text/html;charset=UTF-8" />
|
|
7
|
-
<title>Context Based Access Control</title>
|
|
8
|
-
<%= javascript_include_tag :defaults %>
|
|
9
|
-
<%= stylesheet_link_tag "cbac" %>
|
|
10
|
-
</head>
|
|
11
|
-
<body>
|
|
12
|
-
<%= link_to "Permissions", cbac_permissions_path %>
|
|
13
|
-
<%= link_to "Generic roles", cbac_generic_roles_path %>
|
|
14
|
-
<%= link_to "Memberships", cbac_memberships_path %>
|
|
15
|
-
<%= link_to "Upgrade", cbac_upgrade_path %>
|
|
16
|
-
<%= yield %>
|
|
17
|
-
</body>
|
|
18
|
-
</html>
|
|
1
|
+
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
2
|
+
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
3
|
+
|
|
4
|
+
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
|
|
5
|
+
<head>
|
|
6
|
+
<meta http-equiv="content-type" content="text/html;charset=UTF-8" />
|
|
7
|
+
<title>Context Based Access Control</title>
|
|
8
|
+
<%= javascript_include_tag :defaults %>
|
|
9
|
+
<%= stylesheet_link_tag "cbac" %>
|
|
10
|
+
</head>
|
|
11
|
+
<body>
|
|
12
|
+
<%= link_to "Permissions", cbac_permissions_path %>
|
|
13
|
+
<%= link_to "Generic roles", cbac_generic_roles_path %>
|
|
14
|
+
<%= link_to "Memberships", cbac_memberships_path %>
|
|
15
|
+
<%= link_to "Upgrade", cbac_upgrade_path %>
|
|
16
|
+
<%= yield %>
|
|
17
|
+
</body>
|
|
18
|
+
</html>
|
|
@@ -1,12 +1,12 @@
|
|
|
1
|
-
<% update_name = generic_role.id.to_s + "__" + user_id.to_s %>
|
|
2
|
-
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
-
<% form_for "/cbac/memberships/update", :remote => true, :url => {:controller => "cbac/memberships", :action => "update"},
|
|
4
|
-
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
-
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
-
<%= hidden_field_tag "generic_role_id" + update_name, generic_role.id.to_s, :name => "generic_role_id" %>
|
|
7
|
-
<%= hidden_field_tag "user_id" + update_name, user_id.to_s, :name => "user_id" %>
|
|
8
|
-
<%= check_box_tag "member" + update_name, "1",
|
|
9
|
-
(Cbac::Membership.find(:all, :conditions => ["generic_role_id = ? AND user_id = ?", generic_role.id.to_s, user_id.to_s]).length > 0),
|
|
10
|
-
{:onclick => "this.form.onsubmit();", :name => "member"}%>
|
|
11
|
-
<% end %>
|
|
1
|
+
<% update_name = generic_role.id.to_s + "__" + user_id.to_s %>
|
|
2
|
+
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
+
<% form_for "/cbac/memberships/update", :remote => true, :url => {:controller => "cbac/memberships", :action => "update"},
|
|
4
|
+
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
+
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
+
<%= hidden_field_tag "generic_role_id" + update_name, generic_role.id.to_s, :name => "generic_role_id" %>
|
|
7
|
+
<%= hidden_field_tag "user_id" + update_name, user_id.to_s, :name => "user_id" %>
|
|
8
|
+
<%= check_box_tag "member" + update_name, "1",
|
|
9
|
+
(Cbac::Membership.find(:all, :conditions => ["generic_role_id = ? AND user_id = ?", generic_role.id.to_s, user_id.to_s]).length > 0),
|
|
10
|
+
{:onclick => "this.form.onsubmit();", :name => "member"}%>
|
|
11
|
+
<% end %>
|
|
12
12
|
<% unless update_partial %></div><% end %>
|
|
@@ -1,23 +1,23 @@
|
|
|
1
|
-
<div class="cbac">
|
|
2
|
-
<h1>Memberships</h1>
|
|
3
|
-
<table>
|
|
4
|
-
<tr>
|
|
5
|
-
<th class="medium">Users</th>
|
|
6
|
-
<% @generic_roles.each do |role| %>
|
|
7
|
-
<th><%= role.name %></th>
|
|
8
|
-
<% end %>
|
|
9
|
-
</tr>
|
|
10
|
-
<% (@users.sort do |x,y| x.name.downcase <=> y.name.downcase end).each do |u| %>
|
|
11
|
-
<tr>
|
|
12
|
-
<%- # TODO: documentation must contain something on users having the 'name' method/ field %>
|
|
13
|
-
<td><%= u.name %></td>
|
|
14
|
-
<% @generic_roles.each do |generic_role| %>
|
|
15
|
-
<td class="checked">
|
|
16
|
-
<%= render :partial => "cbac/memberships/update.html", :locals => {:generic_role => generic_role,
|
|
17
|
-
:user_id => u.id.to_s,:update_partial => false} %>
|
|
18
|
-
</td>
|
|
19
|
-
<% end %>
|
|
20
|
-
</tr>
|
|
21
|
-
<% end %>
|
|
22
|
-
</table>
|
|
23
|
-
</div>
|
|
1
|
+
<div class="cbac">
|
|
2
|
+
<h1>Memberships</h1>
|
|
3
|
+
<table>
|
|
4
|
+
<tr>
|
|
5
|
+
<th class="medium">Users</th>
|
|
6
|
+
<% @generic_roles.each do |role| %>
|
|
7
|
+
<th><%= role.name %></th>
|
|
8
|
+
<% end %>
|
|
9
|
+
</tr>
|
|
10
|
+
<% (@users.sort do |x,y| x.name.downcase <=> y.name.downcase end).each do |u| %>
|
|
11
|
+
<tr>
|
|
12
|
+
<%- # TODO: documentation must contain something on users having the 'name' method/ field %>
|
|
13
|
+
<td><%= u.name %></td>
|
|
14
|
+
<% @generic_roles.each do |generic_role| %>
|
|
15
|
+
<td class="checked">
|
|
16
|
+
<%= render :partial => "cbac/memberships/update.html", :locals => {:generic_role => generic_role,
|
|
17
|
+
:user_id => u.id.to_s,:update_partial => false} %>
|
|
18
|
+
</td>
|
|
19
|
+
<% end %>
|
|
20
|
+
</tr>
|
|
21
|
+
<% end %>
|
|
22
|
+
</table>
|
|
23
|
+
</div>
|
|
@@ -1,12 +1,12 @@
|
|
|
1
|
-
<% update_name = "cr__" + context_role.to_s + "__" + set_id.to_s %>
|
|
2
|
-
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
-
<% form_for "/cbac/permissions/update", :remote => true, :url => cbac_permissions_update_path,
|
|
4
|
-
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
-
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
-
<%= hidden_field_tag "context_role" + update_name, context_role.to_s, :name => "context_role" %>
|
|
7
|
-
<%= hidden_field_tag "privilege_set_id" + update_name, set_id.to_s, :name => "privilege_set_id" %>
|
|
8
|
-
<%= check_box_tag "permission" + update_name, "1",
|
|
9
|
-
(Cbac::Permission.find(:all, :conditions => ["context_role = ? AND privilege_set_id = ?", context_role.to_s, set_id.to_s]).length > 0),
|
|
10
|
-
{:onclick => "this.form.onsubmit();", :name => "permission"}%>
|
|
11
|
-
<% end %>
|
|
1
|
+
<% update_name = "cr__" + context_role.to_s + "__" + set_id.to_s %>
|
|
2
|
+
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
+
<% form_for "/cbac/permissions/update", :remote => true, :url => cbac_permissions_update_path,
|
|
4
|
+
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
+
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
+
<%= hidden_field_tag "context_role" + update_name, context_role.to_s, :name => "context_role" %>
|
|
7
|
+
<%= hidden_field_tag "privilege_set_id" + update_name, set_id.to_s, :name => "privilege_set_id" %>
|
|
8
|
+
<%= check_box_tag "permission" + update_name, "1",
|
|
9
|
+
(Cbac::Permission.find(:all, :conditions => ["context_role = ? AND privilege_set_id = ?", context_role.to_s, set_id.to_s]).length > 0),
|
|
10
|
+
{:onclick => "this.form.onsubmit();", :name => "permission"}%>
|
|
11
|
+
<% end %>
|
|
12
12
|
<% unless update_partial %></div><% end %>
|
|
@@ -1,12 +1,12 @@
|
|
|
1
|
-
<% update_name = "gr__" + role.id.to_s + "__" + set_id.to_s %>
|
|
2
|
-
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
-
<% form_for "/cbac/permissions/update", :remote => true, :url => cbac_permissions_update_path,
|
|
4
|
-
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
-
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
-
<%= hidden_field_tag "generic_role_id" + update_name, role.id.to_s, :name => "generic_role_id" %>
|
|
7
|
-
<%= hidden_field_tag "privilege_set_id" + update_name, set_id.to_s, :name => "privilege_set_id" %>
|
|
8
|
-
<%= check_box_tag "permission" + update_name, "1",
|
|
9
|
-
(Cbac::Permission.find(:all, :conditions => ["generic_role_id = ? AND privilege_set_id = ?", role.id.to_s, set_id.to_s]).length > 0),
|
|
10
|
-
{:onclick => "this.form.onsubmit();", :name => "permission"}%>
|
|
11
|
-
<% end %>
|
|
1
|
+
<% update_name = "gr__" + role.id.to_s + "__" + set_id.to_s %>
|
|
2
|
+
<% unless update_partial %><div id="<%= update_name %>"><% end %>
|
|
3
|
+
<% form_for "/cbac/permissions/update", :remote => true, :url => cbac_permissions_update_path,
|
|
4
|
+
:update => update_name, :before => "$('#{update_name}').style.visibility = 'hidden';",
|
|
5
|
+
:complete => "$('#{update_name}').style.visibility = 'visible';" do %>
|
|
6
|
+
<%= hidden_field_tag "generic_role_id" + update_name, role.id.to_s, :name => "generic_role_id" %>
|
|
7
|
+
<%= hidden_field_tag "privilege_set_id" + update_name, set_id.to_s, :name => "privilege_set_id" %>
|
|
8
|
+
<%= check_box_tag "permission" + update_name, "1",
|
|
9
|
+
(Cbac::Permission.find(:all, :conditions => ["generic_role_id = ? AND privilege_set_id = ?", role.id.to_s, set_id.to_s]).length > 0),
|
|
10
|
+
{:onclick => "this.form.onsubmit();", :name => "permission"}%>
|
|
11
|
+
<% end %>
|
|
12
12
|
<% unless update_partial %></div><% end %>
|
|
@@ -1,39 +1,39 @@
|
|
|
1
|
-
<div class="cbac">
|
|
2
|
-
|
|
3
|
-
<h2>Subset:</h2>
|
|
4
|
-
<form action="<%= request.request_uri %>" method="get" name="subset_view_form">
|
|
5
|
-
<b>Privilege set</b> starts with: <input type="text" name="priv_substr" value="<%= params[:priv_substr] %>" /><br />
|
|
6
|
-
<b>Role</b> starts with: <input type="text" name="role_substr" value="<%= params[:role_substr] %>" /><br/>
|
|
7
|
-
<input type="submit" value="Submit" />
|
|
8
|
-
</form>
|
|
9
|
-
|
|
10
|
-
<h1>Permissions</h1>
|
|
11
|
-
<table>
|
|
12
|
-
<tr>
|
|
13
|
-
<th>Privilegeset</th>
|
|
14
|
-
<% (@context_roles.sort { |x, y| x[0].to_s <=> y[0].to_s }).each do |name, comment| %>
|
|
15
|
-
<th><%= name %></th>
|
|
16
|
-
<% end %>
|
|
17
|
-
<% (@generic_roles.sort { |x, y| x.name <=> y.name }).each do |role| %>
|
|
18
|
-
<th><%= role.name %></th>
|
|
19
|
-
<% end %>
|
|
20
|
-
</tr>
|
|
21
|
-
<% (@sets.sort do |x,y| x[0].to_s <=> y[0].to_s end).each do |token, set| %>
|
|
22
|
-
<tr>
|
|
23
|
-
<td><span title ="<%= set.comment %>"><%= set.name %></span></td>
|
|
24
|
-
<% (@context_roles.sort { |x, y| x[0].to_s <=> y[0].to_s }).each do |context_role, comment| %>
|
|
25
|
-
<td class="checked">
|
|
26
|
-
<%= render :partial => "cbac/permissions/update_context_role.html", :locals => {:context_role => context_role.to_s,
|
|
27
|
-
:set_id => set.id.to_s, :update_partial => false} %>
|
|
28
|
-
</td>
|
|
29
|
-
<% end %>
|
|
30
|
-
<% (@generic_roles.sort { |x, y| x.name <=> y.name }).each do |role| %>
|
|
31
|
-
<td class="checked">
|
|
32
|
-
<%= render :partial => "cbac/permissions/update_generic_role.html", :locals => {:role => role,
|
|
33
|
-
:set_id => set.id.to_s, :update_partial => false} %>
|
|
34
|
-
</td>
|
|
35
|
-
<% end %>
|
|
36
|
-
</tr>
|
|
37
|
-
<% end %>
|
|
38
|
-
</table>
|
|
39
|
-
</div>
|
|
1
|
+
<div class="cbac">
|
|
2
|
+
|
|
3
|
+
<h2>Subset:</h2>
|
|
4
|
+
<form action="<%= request.request_uri %>" method="get" name="subset_view_form">
|
|
5
|
+
<b>Privilege set</b> starts with: <input type="text" name="priv_substr" value="<%= params[:priv_substr] %>" /><br />
|
|
6
|
+
<b>Role</b> starts with: <input type="text" name="role_substr" value="<%= params[:role_substr] %>" /><br/>
|
|
7
|
+
<input type="submit" value="Submit" />
|
|
8
|
+
</form>
|
|
9
|
+
|
|
10
|
+
<h1>Permissions</h1>
|
|
11
|
+
<table>
|
|
12
|
+
<tr>
|
|
13
|
+
<th>Privilegeset</th>
|
|
14
|
+
<% (@context_roles.sort { |x, y| x[0].to_s <=> y[0].to_s }).each do |name, comment| %>
|
|
15
|
+
<th><%= name %></th>
|
|
16
|
+
<% end %>
|
|
17
|
+
<% (@generic_roles.sort { |x, y| x.name <=> y.name }).each do |role| %>
|
|
18
|
+
<th><%= role.name %></th>
|
|
19
|
+
<% end %>
|
|
20
|
+
</tr>
|
|
21
|
+
<% (@sets.sort do |x,y| x[0].to_s <=> y[0].to_s end).each do |token, set| %>
|
|
22
|
+
<tr>
|
|
23
|
+
<td><span title ="<%= set.comment %>"><%= set.name %></span></td>
|
|
24
|
+
<% (@context_roles.sort { |x, y| x[0].to_s <=> y[0].to_s }).each do |context_role, comment| %>
|
|
25
|
+
<td class="checked">
|
|
26
|
+
<%= render :partial => "cbac/permissions/update_context_role.html", :locals => {:context_role => context_role.to_s,
|
|
27
|
+
:set_id => set.id.to_s, :update_partial => false} %>
|
|
28
|
+
</td>
|
|
29
|
+
<% end %>
|
|
30
|
+
<% (@generic_roles.sort { |x, y| x.name <=> y.name }).each do |role| %>
|
|
31
|
+
<td class="checked">
|
|
32
|
+
<%= render :partial => "cbac/permissions/update_generic_role.html", :locals => {:role => role,
|
|
33
|
+
:set_id => set.id.to_s, :update_partial => false} %>
|
|
34
|
+
</td>
|
|
35
|
+
<% end %>
|
|
36
|
+
</tr>
|
|
37
|
+
<% end %>
|
|
38
|
+
</table>
|
|
39
|
+
</div>
|
|
@@ -1,32 +1,32 @@
|
|
|
1
|
-
<div class="cbac">
|
|
2
|
-
<h1>Permissions: available upgrades</h1>
|
|
3
|
-
<span>Choose which of these available permissions you want to accept or reject.
|
|
4
|
-
Each upgrade either adds a new permission or revokes an existing permission.
|
|
5
|
-
You can also leave the available upgrade for another time.</span><br/><br/>
|
|
6
|
-
<% form_tag cbac_upgrade_update_path do %>
|
|
7
|
-
<table>
|
|
8
|
-
<tr>
|
|
9
|
-
<th class="medium">Add /revoke</th>
|
|
10
|
-
<th class="large">Privilegeset</th>
|
|
11
|
-
<th class="medium">Roletype</th>
|
|
12
|
-
<th class="medium">Role</th>
|
|
13
|
-
<th class="small">Accept</th>
|
|
14
|
-
<th class="small">Reject</th>
|
|
15
|
-
<th class="small">Leave</th>
|
|
16
|
-
</tr>
|
|
17
|
-
<% @permissions.each_with_index do |permission, index| %>
|
|
18
|
-
<tr>
|
|
19
|
-
<td><span><%=permission.operation_string.capitalize%></span><input type="hidden" name="permissions[<%=index.to_s%>][id]" value="<%=permission.id.to_s%>"/></td>
|
|
20
|
-
<td><span title='<%=permission.privilege_set.comment%>'><%=permission.privilege_set_name%></span></td>
|
|
21
|
-
<td><span><%=permission.pristine_role.role_type%></span></td>
|
|
22
|
-
<td><span><%=permission.pristine_role.name%></span></td>
|
|
23
|
-
<td><input type="radio" name="permissions[<%=index.to_s%>][action]" value="accept"/></td>
|
|
24
|
-
<td><input type="radio" name="permissions[<%=index.to_s%>][action]" value="reject"/></td>
|
|
25
|
-
<td><input type="radio" name="permissions[<%=index.to_s%>][action]" value="leave" checked="checked"/></td>
|
|
26
|
-
</tr>
|
|
27
|
-
<% end %>
|
|
28
|
-
</table>
|
|
29
|
-
<input type="button" value="Cancel" onclick="window.location.reload();"/>
|
|
30
|
-
<input type="submit" value="OK"/>
|
|
31
|
-
<% end %>
|
|
1
|
+
<div class="cbac">
|
|
2
|
+
<h1>Permissions: available upgrades</h1>
|
|
3
|
+
<span>Choose which of these available permissions you want to accept or reject.
|
|
4
|
+
Each upgrade either adds a new permission or revokes an existing permission.
|
|
5
|
+
You can also leave the available upgrade for another time.</span><br/><br/>
|
|
6
|
+
<% form_tag cbac_upgrade_update_path do %>
|
|
7
|
+
<table>
|
|
8
|
+
<tr>
|
|
9
|
+
<th class="medium">Add /revoke</th>
|
|
10
|
+
<th class="large">Privilegeset</th>
|
|
11
|
+
<th class="medium">Roletype</th>
|
|
12
|
+
<th class="medium">Role</th>
|
|
13
|
+
<th class="small">Accept</th>
|
|
14
|
+
<th class="small">Reject</th>
|
|
15
|
+
<th class="small">Leave</th>
|
|
16
|
+
</tr>
|
|
17
|
+
<% @permissions.each_with_index do |permission, index| %>
|
|
18
|
+
<tr>
|
|
19
|
+
<td><span><%=permission.operation_string.capitalize%></span><input type="hidden" name="permissions[<%=index.to_s%>][id]" value="<%=permission.id.to_s%>"/></td>
|
|
20
|
+
<td><span title='<%=permission.privilege_set.comment%>'><%=permission.privilege_set_name%></span></td>
|
|
21
|
+
<td><span><%=permission.pristine_role.role_type%></span></td>
|
|
22
|
+
<td><span><%=permission.pristine_role.name%></span></td>
|
|
23
|
+
<td><input type="radio" name="permissions[<%=index.to_s%>][action]" value="accept"/></td>
|
|
24
|
+
<td><input type="radio" name="permissions[<%=index.to_s%>][action]" value="reject"/></td>
|
|
25
|
+
<td><input type="radio" name="permissions[<%=index.to_s%>][action]" value="leave" checked="checked"/></td>
|
|
26
|
+
</tr>
|
|
27
|
+
<% end %>
|
|
28
|
+
</table>
|
|
29
|
+
<input type="button" value="Cancel" onclick="window.location.reload();"/>
|
|
30
|
+
<input type="submit" value="OK"/>
|
|
31
|
+
<% end %>
|
|
32
32
|
</div>
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
class AddPristineFilesToCbacUpgradePath < ActiveRecord::Migration
|
|
2
|
+
def self.up
|
|
3
|
+
create_table :cbac_pristine_files do |t|
|
|
4
|
+
t.string :type
|
|
5
|
+
t.string :file_name
|
|
6
|
+
t.timestamps
|
|
7
|
+
end
|
|
8
|
+
|
|
9
|
+
add_column :cbac_staged_permissions, :pristine_file_id, :integer
|
|
10
|
+
end
|
|
11
|
+
|
|
12
|
+
def self.down
|
|
13
|
+
drop_table :cbac_pristine_files
|
|
14
|
+
remove_column :cbac_staged_permissions, :pristine_file_id
|
|
15
|
+
end
|
|
16
|
+
end
|
data/privileges.rb
CHANGED
|
@@ -1,50 +1,50 @@
|
|
|
1
|
-
### Privileges.rb
|
|
2
|
-
#
|
|
3
|
-
# Defines the privilegesets and privileges for the CBAC system
|
|
4
|
-
#
|
|
5
|
-
include Cbac
|
|
6
|
-
|
|
7
|
-
# Defining privilegesets
|
|
8
|
-
PrivilegeSet.add :cbac_administration, "Allows administration of CBAC modules"
|
|
9
|
-
PrivilegeSet.add :login, "Allows users to log onto the system"
|
|
10
|
-
PrivilegeSet.add :news_item_read, "Allows reading news_item items"
|
|
11
|
-
PrivilegeSet.add :news_item_create, "Allows creating news_item items"
|
|
12
|
-
PrivilegeSet.add :news_item_update, "Allows changing existing news_item items"
|
|
13
|
-
PrivilegeSet.add :news_item_administrator, "Allows administration of news items"
|
|
14
|
-
PrivilegeSet.add :news_item_moderator, "Moderator"
|
|
15
|
-
|
|
16
|
-
# Defining privileges
|
|
17
|
-
Privilege.resource :cbac_administration, "cbac/permissions/index"
|
|
18
|
-
Privilege.resource :cbac_administration, "cbac/permissions/update", :post
|
|
19
|
-
Privilege.resource :cbac_administration, "cbac/generic_roles/index"
|
|
20
|
-
Privilege.resource :cbac_administration, "cbac/generic_roles/update", :post
|
|
21
|
-
Privilege.resource :cbac_administration, "cbac/generic_roles/create", :post
|
|
22
|
-
Privilege.resource :cbac_administration, "cbac/generic_roles/delete", :post
|
|
23
|
-
Privilege.resource :cbac_administration, "cbac/memberships/index"
|
|
24
|
-
Privilege.resource :cbac_administration, "cbac/memberships/update", :post
|
|
25
|
-
Privilege.resource :cbac_administration, "cbac/upgrade/index"
|
|
26
|
-
Privilege.resource :cbac_administration, "cbac/upgrade/process_changes", :post
|
|
27
|
-
Privilege.resource :login, "news_items/login", :POST
|
|
28
|
-
Privilege.resource :news_item_read, "news_items/index"
|
|
29
|
-
Privilege.resource :news_item_read, "news_items/show"
|
|
30
|
-
Privilege.resource :news_item_create, "news_items/new"
|
|
31
|
-
Privilege.resource :news_item_create, "news_items/create", :POST
|
|
32
|
-
Privilege.resource :news_item_create, "news_items/create", :idempotent
|
|
33
|
-
Privilege.resource :news_item_update, "news_items/edit"
|
|
34
|
-
Privilege.resource :news_item_update, "news_items/update", :POST
|
|
35
|
-
|
|
36
|
-
# Recursive privilegesets
|
|
37
|
-
Privilege.include :news_item_moderator, :news_item_update
|
|
38
|
-
Privilege.include :news_item_administrator, [:news_item_read, :news_item_create, :news_item_update]
|
|
39
|
-
|
|
40
|
-
# Models
|
|
41
|
-
# Enforcing mode
|
|
42
|
-
#Privilege.model :blog_read, :blog, :load
|
|
43
|
-
#Privilege.model :blog_create, :blog, :save
|
|
44
|
-
#Privilege.model :blog_update, :blog, :update
|
|
45
|
-
#Privilege.model :blog_update, :blog, :delete
|
|
46
|
-
# model attributes
|
|
47
|
-
#Privilege.model_attribute :blog_update, :blog, :author, :write
|
|
48
|
-
#privilege.model_attribute :blog_update, :blog, :author, :w
|
|
49
|
-
#privilege.model_attribute :blog_update, :blog, :author, :rw
|
|
50
|
-
|
|
1
|
+
### Privileges.rb
|
|
2
|
+
#
|
|
3
|
+
# Defines the privilegesets and privileges for the CBAC system
|
|
4
|
+
#
|
|
5
|
+
include Cbac
|
|
6
|
+
|
|
7
|
+
# Defining privilegesets
|
|
8
|
+
PrivilegeSet.add :cbac_administration, "Allows administration of CBAC modules"
|
|
9
|
+
PrivilegeSet.add :login, "Allows users to log onto the system"
|
|
10
|
+
PrivilegeSet.add :news_item_read, "Allows reading news_item items"
|
|
11
|
+
PrivilegeSet.add :news_item_create, "Allows creating news_item items"
|
|
12
|
+
PrivilegeSet.add :news_item_update, "Allows changing existing news_item items"
|
|
13
|
+
PrivilegeSet.add :news_item_administrator, "Allows administration of news items"
|
|
14
|
+
PrivilegeSet.add :news_item_moderator, "Moderator"
|
|
15
|
+
|
|
16
|
+
# Defining privileges
|
|
17
|
+
Privilege.resource :cbac_administration, "cbac/permissions/index"
|
|
18
|
+
Privilege.resource :cbac_administration, "cbac/permissions/update", :post
|
|
19
|
+
Privilege.resource :cbac_administration, "cbac/generic_roles/index"
|
|
20
|
+
Privilege.resource :cbac_administration, "cbac/generic_roles/update", :post
|
|
21
|
+
Privilege.resource :cbac_administration, "cbac/generic_roles/create", :post
|
|
22
|
+
Privilege.resource :cbac_administration, "cbac/generic_roles/delete", :post
|
|
23
|
+
Privilege.resource :cbac_administration, "cbac/memberships/index"
|
|
24
|
+
Privilege.resource :cbac_administration, "cbac/memberships/update", :post
|
|
25
|
+
Privilege.resource :cbac_administration, "cbac/upgrade/index"
|
|
26
|
+
Privilege.resource :cbac_administration, "cbac/upgrade/process_changes", :post
|
|
27
|
+
Privilege.resource :login, "news_items/login", :POST
|
|
28
|
+
Privilege.resource :news_item_read, "news_items/index"
|
|
29
|
+
Privilege.resource :news_item_read, "news_items/show"
|
|
30
|
+
Privilege.resource :news_item_create, "news_items/new"
|
|
31
|
+
Privilege.resource :news_item_create, "news_items/create", :POST
|
|
32
|
+
Privilege.resource :news_item_create, "news_items/create", :idempotent
|
|
33
|
+
Privilege.resource :news_item_update, "news_items/edit"
|
|
34
|
+
Privilege.resource :news_item_update, "news_items/update", :POST
|
|
35
|
+
|
|
36
|
+
# Recursive privilegesets
|
|
37
|
+
Privilege.include :news_item_moderator, :news_item_update
|
|
38
|
+
Privilege.include :news_item_administrator, [:news_item_read, :news_item_create, :news_item_update]
|
|
39
|
+
|
|
40
|
+
# Models
|
|
41
|
+
# Enforcing mode
|
|
42
|
+
#Privilege.model :blog_read, :blog, :load
|
|
43
|
+
#Privilege.model :blog_create, :blog, :save
|
|
44
|
+
#Privilege.model :blog_update, :blog, :update
|
|
45
|
+
#Privilege.model :blog_update, :blog, :delete
|
|
46
|
+
# model attributes
|
|
47
|
+
#Privilege.model_attribute :blog_update, :blog, :author, :write
|
|
48
|
+
#privilege.model_attribute :blog_update, :blog, :author, :w
|
|
49
|
+
#privilege.model_attribute :blog_update, :blog, :author, :rw
|
|
50
|
+
|