cbac 0.3.1 → 0.5.1
Sign up to get free protection for your applications and to get access to all the features.
- data/Manifest +60 -44
- data/Rakefile +2 -2
- data/cbac.gemspec +31 -31
- data/generators/cbac/cbac_generator.rb +27 -6
- data/generators/cbac/templates/config/cbac.pristine +2 -0
- data/generators/cbac/templates/controllers/permissions_controller.rb +21 -2
- data/generators/cbac/templates/controllers/upgrade_controller.rb +24 -0
- data/generators/cbac/templates/fixtures/cbac_memberships.yml +1 -1
- data/generators/cbac/templates/migrate/create_cbac_from_scratch.rb +59 -0
- data/generators/cbac/templates/migrate/create_cbac_upgrade_path.rb +31 -0
- data/generators/cbac/templates/tasks/cbac.rake +345 -0
- data/generators/cbac/templates/views/layouts/cbac.html.erb +2 -1
- data/generators/cbac/templates/views/memberships/index.html.erb +1 -1
- data/generators/cbac/templates/views/permissions/index.html.erb +14 -6
- data/generators/cbac/templates/views/upgrade/index.html.erb +32 -0
- data/lib/cbac.rb +23 -12
- data/lib/cbac/cbac_pristine/pristine.rb +133 -0
- data/lib/cbac/cbac_pristine/pristine_file.rb +158 -0
- data/lib/cbac/cbac_pristine/pristine_permission.rb +194 -0
- data/lib/cbac/cbac_pristine/pristine_role.rb +42 -0
- data/lib/cbac/known_permission.rb +14 -0
- data/lib/cbac/permission.rb +1 -1
- data/lib/cbac/privilege.rb +44 -0
- data/lib/cbac/privilege_set.rb +5 -4
- data/lib/cbac/privilege_set_record.rb +3 -1
- data/spec/cbac_pristine_file_spec.rb +329 -0
- data/spec/cbac_pristine_permission_spec.rb +358 -0
- data/spec/cbac_pristine_role_spec.rb +85 -0
- data/spec/rcov.opts +2 -0
- data/spec/spec.opts +4 -0
- data/spec/spec_helper.rb +12 -0
- data/tasks/cbac.rake +345 -19
- data/test/test_cbac_privilege.rb +54 -0
- metadata +43 -9
- data/generators/cbac/templates/migrate/create_cbac.rb +0 -40
data/Manifest
CHANGED
@@ -1,44 +1,60 @@
|
|
1
|
-
Manifest
|
2
|
-
README.rdoc
|
3
|
-
Rakefile
|
4
|
-
cbac.gemspec
|
5
|
-
generators/cbac/USAGE
|
6
|
-
generators/cbac/cbac_generator.rb
|
7
|
-
generators/cbac/templates/config/
|
8
|
-
generators/cbac/templates/config/
|
9
|
-
generators/cbac/templates/
|
10
|
-
generators/cbac/templates/controllers/
|
11
|
-
generators/cbac/templates/controllers/
|
12
|
-
generators/cbac/templates/
|
13
|
-
generators/cbac/templates/
|
14
|
-
generators/cbac/templates/fixtures/
|
15
|
-
generators/cbac/templates/
|
16
|
-
generators/cbac/templates/
|
17
|
-
generators/cbac/templates/
|
18
|
-
generators/cbac/templates/
|
19
|
-
generators/cbac/templates/
|
20
|
-
generators/cbac/templates/
|
21
|
-
generators/cbac/templates/views/
|
22
|
-
generators/cbac/templates/views/
|
23
|
-
generators/cbac/templates/views/
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
lib/cbac
|
31
|
-
lib/cbac/
|
32
|
-
lib/cbac/
|
33
|
-
lib/cbac/
|
34
|
-
lib/cbac/
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
1
|
+
Manifest
|
2
|
+
README.rdoc
|
3
|
+
Rakefile
|
4
|
+
cbac.gemspec
|
5
|
+
generators/cbac/USAGE
|
6
|
+
generators/cbac/cbac_generator.rb
|
7
|
+
generators/cbac/templates/config/cbac.pristine
|
8
|
+
generators/cbac/templates/config/context_roles.rb
|
9
|
+
generators/cbac/templates/config/privileges.rb
|
10
|
+
generators/cbac/templates/controllers/generic_roles_controller.rb
|
11
|
+
generators/cbac/templates/controllers/memberships_controller.rb
|
12
|
+
generators/cbac/templates/controllers/permissions_controller.rb
|
13
|
+
generators/cbac/templates/controllers/upgrade_controller.rb
|
14
|
+
generators/cbac/templates/fixtures/cbac_generic_roles.yml
|
15
|
+
generators/cbac/templates/fixtures/cbac_memberships.yml
|
16
|
+
generators/cbac/templates/fixtures/cbac_permissions.yml
|
17
|
+
generators/cbac/templates/migrate/create_cbac_from_scratch.rb
|
18
|
+
generators/cbac/templates/migrate/create_cbac_upgrade_path.rb
|
19
|
+
generators/cbac/templates/stylesheets/cbac.css
|
20
|
+
generators/cbac/templates/tasks/cbac.rake
|
21
|
+
generators/cbac/templates/views/generic_roles/index.html.erb
|
22
|
+
generators/cbac/templates/views/layouts/cbac.html.erb
|
23
|
+
generators/cbac/templates/views/memberships/_update.html.erb
|
24
|
+
generators/cbac/templates/views/memberships/index.html.erb
|
25
|
+
generators/cbac/templates/views/permissions/_update_context_role.html.erb
|
26
|
+
generators/cbac/templates/views/permissions/_update_generic_role.html.erb
|
27
|
+
generators/cbac/templates/views/permissions/index.html.erb
|
28
|
+
generators/cbac/templates/views/upgrade/index.html.erb
|
29
|
+
init.rb
|
30
|
+
lib/cbac.rb
|
31
|
+
lib/cbac/cbac_pristine/pristine.rb
|
32
|
+
lib/cbac/cbac_pristine/pristine_file.rb
|
33
|
+
lib/cbac/cbac_pristine/pristine_permission.rb
|
34
|
+
lib/cbac/cbac_pristine/pristine_role.rb
|
35
|
+
lib/cbac/config.rb
|
36
|
+
lib/cbac/context_role.rb
|
37
|
+
lib/cbac/generic_role.rb
|
38
|
+
lib/cbac/known_permission.rb
|
39
|
+
lib/cbac/membership.rb
|
40
|
+
lib/cbac/permission.rb
|
41
|
+
lib/cbac/privilege.rb
|
42
|
+
lib/cbac/privilege_set.rb
|
43
|
+
lib/cbac/privilege_set_record.rb
|
44
|
+
lib/cbac/setup.rb
|
45
|
+
spec/cbac_pristine_file_spec.rb
|
46
|
+
spec/cbac_pristine_permission_spec.rb
|
47
|
+
spec/cbac_pristine_role_spec.rb
|
48
|
+
spec/rcov.opts
|
49
|
+
spec/spec.opts
|
50
|
+
spec/spec_helper.rb
|
51
|
+
tasks/cbac.rake
|
52
|
+
test/fixtures/cbac_generic_roles.yml
|
53
|
+
test/fixtures/cbac_memberships.yml
|
54
|
+
test/fixtures/cbac_permissions.yml
|
55
|
+
test/fixtures/cbac_privilege_set.yml
|
56
|
+
test/test_cbac_authorize_context_roles.rb
|
57
|
+
test/test_cbac_authorize_generic_roles.rb
|
58
|
+
test/test_cbac_context_role.rb
|
59
|
+
test/test_cbac_privilege.rb
|
60
|
+
test/test_cbac_privilege_set.rb
|
data/Rakefile
CHANGED
@@ -24,12 +24,12 @@ Rake::RDocTask.new(:rdoc) do |rdoc|
|
|
24
24
|
rdoc.rdoc_files.include('lib/**/*.rb')
|
25
25
|
end
|
26
26
|
|
27
|
-
Echoe.new('cbac', '0.
|
27
|
+
Echoe.new('cbac', '0.5.1') do |p|
|
28
28
|
p.summary = "CBAC - Simple authorization system for Rails applications."
|
29
29
|
p.description = "Simple authorization system for Rails applications. Allows you to develop applications with a mixed role based authorization and a context based authorization model. Does not supply authentication."
|
30
30
|
p.url = "http://cbac.rubyforge.org"
|
31
31
|
p.author = "Bert Meerman"
|
32
|
-
p.email = "
|
32
|
+
p.email = "bertm@rubyforge.org"
|
33
33
|
p.ignore_pattern = []
|
34
34
|
p.development_dependencies = []
|
35
35
|
end
|
data/cbac.gemspec
CHANGED
@@ -1,31 +1,31 @@
|
|
1
|
-
# -*- encoding: utf-8 -*-
|
2
|
-
|
3
|
-
Gem::Specification.new do |s|
|
4
|
-
s.name = %q{cbac}
|
5
|
-
s.version = "0.
|
6
|
-
|
7
|
-
s.required_rubygems_version = Gem::Requirement.new(">= 1.2") if s.respond_to? :required_rubygems_version=
|
8
|
-
s.authors = ["Bert Meerman"]
|
9
|
-
s.date = %q{2010-
|
10
|
-
s.description = %q{Simple authorization system for Rails applications. Allows you to develop applications with a mixed role based authorization and a context based authorization model. Does not supply authentication.}
|
11
|
-
s.email = %q{
|
12
|
-
s.extra_rdoc_files = ["README.rdoc", "lib/cbac.rb", "lib/cbac/config.rb", "lib/cbac/context_role.rb", "lib/cbac/generic_role.rb", "lib/cbac/membership.rb", "lib/cbac/permission.rb", "lib/cbac/privilege.rb", "lib/cbac/privilege_set.rb", "lib/cbac/privilege_set_record.rb", "lib/cbac/setup.rb", "tasks/cbac.rake"]
|
13
|
-
s.files = ["Manifest", "README.rdoc", "Rakefile", "cbac.gemspec", "generators/cbac/USAGE", "generators/cbac/cbac_generator.rb", "generators/cbac/templates/config/context_roles.rb", "generators/cbac/templates/config/privileges.rb", "generators/cbac/templates/controllers/generic_roles_controller.rb", "generators/cbac/templates/controllers/memberships_controller.rb", "generators/cbac/templates/controllers/permissions_controller.rb", "generators/cbac/templates/fixtures/cbac_generic_roles.yml", "generators/cbac/templates/fixtures/cbac_memberships.yml", "generators/cbac/templates/fixtures/cbac_permissions.yml", "generators/cbac/templates/migrate/
|
14
|
-
s.homepage = %q{http://cbac.rubyforge.org}
|
15
|
-
s.rdoc_options = ["--line-numbers", "--inline-source", "--title", "Cbac", "--main", "README.rdoc"]
|
16
|
-
s.require_paths = ["lib"]
|
17
|
-
s.rubyforge_project = %q{cbac}
|
18
|
-
s.rubygems_version = %q{1.3.
|
19
|
-
s.summary = %q{CBAC - Simple authorization system for Rails applications.}
|
20
|
-
s.test_files = ["test/
|
21
|
-
|
22
|
-
if s.respond_to? :specification_version then
|
23
|
-
current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
|
24
|
-
s.specification_version = 3
|
25
|
-
|
26
|
-
if Gem::Version.new(Gem::
|
27
|
-
else
|
28
|
-
end
|
29
|
-
else
|
30
|
-
end
|
31
|
-
end
|
1
|
+
# -*- encoding: utf-8 -*-
|
2
|
+
|
3
|
+
Gem::Specification.new do |s|
|
4
|
+
s.name = %q{cbac}
|
5
|
+
s.version = "0.5.1"
|
6
|
+
|
7
|
+
s.required_rubygems_version = Gem::Requirement.new(">= 1.2") if s.respond_to? :required_rubygems_version=
|
8
|
+
s.authors = ["Bert Meerman"]
|
9
|
+
s.date = %q{2010-07-15}
|
10
|
+
s.description = %q{Simple authorization system for Rails applications. Allows you to develop applications with a mixed role based authorization and a context based authorization model. Does not supply authentication.}
|
11
|
+
s.email = %q{bertm@rubyforge.org}
|
12
|
+
s.extra_rdoc_files = ["README.rdoc", "lib/cbac.rb", "lib/cbac/cbac_pristine/pristine.rb", "lib/cbac/cbac_pristine/pristine_file.rb", "lib/cbac/cbac_pristine/pristine_permission.rb", "lib/cbac/cbac_pristine/pristine_role.rb", "lib/cbac/config.rb", "lib/cbac/context_role.rb", "lib/cbac/generic_role.rb", "lib/cbac/known_permission.rb", "lib/cbac/membership.rb", "lib/cbac/permission.rb", "lib/cbac/privilege.rb", "lib/cbac/privilege_set.rb", "lib/cbac/privilege_set_record.rb", "lib/cbac/setup.rb", "tasks/cbac.rake"]
|
13
|
+
s.files = ["Manifest", "README.rdoc", "Rakefile", "cbac.gemspec", "generators/cbac/USAGE", "generators/cbac/cbac_generator.rb", "generators/cbac/templates/config/cbac.pristine", "generators/cbac/templates/config/context_roles.rb", "generators/cbac/templates/config/privileges.rb", "generators/cbac/templates/controllers/generic_roles_controller.rb", "generators/cbac/templates/controllers/memberships_controller.rb", "generators/cbac/templates/controllers/permissions_controller.rb", "generators/cbac/templates/controllers/upgrade_controller.rb", "generators/cbac/templates/fixtures/cbac_generic_roles.yml", "generators/cbac/templates/fixtures/cbac_memberships.yml", "generators/cbac/templates/fixtures/cbac_permissions.yml", "generators/cbac/templates/migrate/create_cbac_from_scratch.rb", "generators/cbac/templates/migrate/create_cbac_upgrade_path.rb", "generators/cbac/templates/stylesheets/cbac.css", "generators/cbac/templates/tasks/cbac.rake", "generators/cbac/templates/views/generic_roles/index.html.erb", "generators/cbac/templates/views/layouts/cbac.html.erb", "generators/cbac/templates/views/memberships/_update.html.erb", "generators/cbac/templates/views/memberships/index.html.erb", "generators/cbac/templates/views/permissions/_update_context_role.html.erb", "generators/cbac/templates/views/permissions/_update_generic_role.html.erb", "generators/cbac/templates/views/permissions/index.html.erb", "generators/cbac/templates/views/upgrade/index.html.erb", "init.rb", "lib/cbac.rb", "lib/cbac/cbac_pristine/pristine.rb", "lib/cbac/cbac_pristine/pristine_file.rb", "lib/cbac/cbac_pristine/pristine_permission.rb", "lib/cbac/cbac_pristine/pristine_role.rb", "lib/cbac/config.rb", "lib/cbac/context_role.rb", "lib/cbac/generic_role.rb", "lib/cbac/known_permission.rb", "lib/cbac/membership.rb", "lib/cbac/permission.rb", "lib/cbac/privilege.rb", "lib/cbac/privilege_set.rb", "lib/cbac/privilege_set_record.rb", "lib/cbac/setup.rb", "spec/cbac_pristine_file_spec.rb", "spec/cbac_pristine_permission_spec.rb", "spec/cbac_pristine_role_spec.rb", "spec/rcov.opts", "spec/spec.opts", "spec/spec_helper.rb", "tasks/cbac.rake", "test/fixtures/cbac_generic_roles.yml", "test/fixtures/cbac_memberships.yml", "test/fixtures/cbac_permissions.yml", "test/fixtures/cbac_privilege_set.yml", "test/test_cbac_authorize_context_roles.rb", "test/test_cbac_authorize_generic_roles.rb", "test/test_cbac_context_role.rb", "test/test_cbac_privilege.rb", "test/test_cbac_privilege_set.rb"]
|
14
|
+
s.homepage = %q{http://cbac.rubyforge.org}
|
15
|
+
s.rdoc_options = ["--line-numbers", "--inline-source", "--title", "Cbac", "--main", "README.rdoc"]
|
16
|
+
s.require_paths = ["lib"]
|
17
|
+
s.rubyforge_project = %q{cbac}
|
18
|
+
s.rubygems_version = %q{1.3.7}
|
19
|
+
s.summary = %q{CBAC - Simple authorization system for Rails applications.}
|
20
|
+
s.test_files = ["test/test_cbac_context_role.rb", "test/test_cbac_authorize_context_roles.rb", "test/test_cbac_privilege.rb", "test/test_cbac_privilege_set.rb", "test/test_cbac_authorize_generic_roles.rb"]
|
21
|
+
|
22
|
+
if s.respond_to? :specification_version then
|
23
|
+
current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
|
24
|
+
s.specification_version = 3
|
25
|
+
|
26
|
+
if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
|
27
|
+
else
|
28
|
+
end
|
29
|
+
else
|
30
|
+
end
|
31
|
+
end
|
@@ -7,39 +7,60 @@ class CbacGenerator < Rails::Generator::Base
|
|
7
7
|
#raise "silently quiting"
|
8
8
|
end
|
9
9
|
|
10
|
+
def migration_exists?(name)
|
11
|
+
not Dir.glob("#{RAILS_ROOT}/db/migrate/[0-9]*_*.rb").grep(/[0-9]+_#{name}.rb$/).empty?
|
12
|
+
end
|
13
|
+
|
10
14
|
def manifest
|
11
15
|
record do |m|
|
12
16
|
# developer files
|
13
|
-
m.
|
14
|
-
m.file "config/
|
17
|
+
m.directory "config/cbac"
|
18
|
+
m.file "config/privileges.rb", "config/cbac/privileges.rb", :collision => :skip
|
19
|
+
m.file "config/context_roles.rb", "config/cbac/context_roles.rb", :collision => :skip
|
20
|
+
|
21
|
+
# deployment file
|
22
|
+
m.file "config/cbac.pristine", "config/cbac/cbac.pristine", :collision => :skip
|
15
23
|
|
16
24
|
# administration pages
|
17
25
|
m.directory "app/controllers/cbac"
|
18
26
|
m.file "controllers/permissions_controller.rb", "app/controllers/cbac/permissions_controller.rb"
|
19
27
|
m.file "controllers/generic_roles_controller.rb", "app/controllers/cbac/generic_roles_controller.rb"
|
20
28
|
m.file "controllers/memberships_controller.rb", "app/controllers/cbac/memberships_controller.rb"
|
29
|
+
m.file "controllers/upgrade_controller.rb", "app/controllers/cbac/upgrade_controller.rb"
|
21
30
|
m.directory "app/views/layouts"
|
22
31
|
m.file "views/layouts/cbac.html.erb", "app/views/layouts/cbac.html.erb"
|
23
32
|
m.directory "app/views/cbac"
|
24
33
|
m.directory "app/views/cbac/permissions"
|
25
34
|
m.directory "app/views/cbac/generic_roles"
|
26
35
|
m.directory "app/views/cbac/memberships"
|
36
|
+
m.directory "app/views/cbac/upgrade"
|
27
37
|
m.file "views/permissions/index.html.erb", "app/views/cbac/permissions/index.html.erb"
|
28
38
|
m.file "views/permissions/_update_context_role.html.erb", "app/views/cbac/permissions/_update_context_role.html.erb"
|
29
39
|
m.file "views/permissions/_update_generic_role.html.erb", "app/views/cbac/permissions/_update_generic_role.html.erb"
|
30
40
|
m.file "views/generic_roles/index.html.erb", "app/views/cbac/generic_roles/index.html.erb"
|
31
41
|
m.file "views/memberships/index.html.erb", "app/views/cbac/memberships/index.html.erb"
|
32
42
|
m.file "views/memberships/_update.html.erb", "app/views/cbac/memberships/_update.html.erb"
|
43
|
+
m.file "views/upgrade/index.html.erb", "app/views/cbac/upgrade/index.html.erb"
|
33
44
|
m.directory "public/stylesheets"
|
34
45
|
m.file "stylesheets/cbac.css", "public/stylesheets/cbac.css"
|
35
46
|
|
36
47
|
# migrations
|
37
|
-
|
38
|
-
|
48
|
+
puts "type of m: " + m.class.name
|
49
|
+
if migration_exists?("create_cbac")
|
50
|
+
# This is an upgrade from a previous version of CBAC
|
51
|
+
m.migration_template "migrate/create_cbac_upgrade_path.rb", "db/migrate", {:migration_file_name => "create_cbac_upgrade_path"} unless migration_exists?("create_cbac_upgrade_path")
|
52
|
+
else
|
53
|
+
# This is the first install of CBAC into the current project
|
54
|
+
m.migration_template "migrate/create_cbac_from_scratch.rb", "db/migrate", {:migration_file_name => "create_cbac_from_scratch"} unless migration_exists?("create_cbac_from_scratch")
|
55
|
+
end
|
39
56
|
# default fixtures
|
40
57
|
m.file "fixtures/cbac_permissions.yml", "test/fixtures/cbac_permissions.yml"
|
41
58
|
m.file "fixtures/cbac_generic_roles.yml", "test/fixtures/cbac_generic_roles.yml"
|
42
59
|
m.file "fixtures/cbac_memberships.yml", "test/fixtures/cbac_memberships.yml"
|
60
|
+
|
61
|
+
# Rake task
|
62
|
+
m.directory "lib/tasks"
|
63
|
+
m.file "tasks/cbac.rake", "lib/tasks/cbac.rake"
|
43
64
|
end
|
44
|
-
end
|
45
|
-
end
|
65
|
+
end
|
66
|
+
end
|
@@ -4,8 +4,27 @@ class Cbac::PermissionsController < ApplicationController
|
|
4
4
|
|
5
5
|
# GET /index GET /index.xml
|
6
6
|
def index
|
7
|
-
|
8
|
-
|
7
|
+
if params[:role_substr] and params[:role_substr] != ""
|
8
|
+
@context_roles = []
|
9
|
+
@generic_roles = []
|
10
|
+
|
11
|
+
params[:role_substr].split('|').each do |role_start|
|
12
|
+
@context_roles += (ContextRole.roles.select {|key,value| !key.to_s.match(/^#{role_start}/).nil?}).collect{|key, value| [key, value]}
|
13
|
+
@generic_roles += Cbac::GenericRole.find(:all).select {|role| !role.name.match(/^#{role_start}/).nil? }
|
14
|
+
end
|
15
|
+
else
|
16
|
+
@context_roles = ContextRole.roles
|
17
|
+
@generic_roles = Cbac::GenericRole.all
|
18
|
+
end
|
19
|
+
|
20
|
+
if params[:priv_substr] && params[:priv_substr] != ""
|
21
|
+
@sets = []
|
22
|
+
params[:priv_substr].split('|').each do |priv_start|
|
23
|
+
@sets += PrivilegeSet.sets.select {|key, value| !key.to_s.match(/^#{priv_start}/).nil?}
|
24
|
+
end
|
25
|
+
else
|
26
|
+
@sets = PrivilegeSet.sets
|
27
|
+
end
|
9
28
|
end
|
10
29
|
|
11
30
|
def update
|
@@ -0,0 +1,24 @@
|
|
1
|
+
class Cbac::UpgradeController < ApplicationController
|
2
|
+
|
3
|
+
layout 'cbac'
|
4
|
+
|
5
|
+
def index
|
6
|
+
@permissions = Cbac::CbacPristine::PristinePermission.all
|
7
|
+
end
|
8
|
+
|
9
|
+
def update
|
10
|
+
|
11
|
+
params[:permissions].each do |perm_array|
|
12
|
+
next if perm_array[1][:action] == 'leave'
|
13
|
+
permission = Cbac::CbacPristine::PristinePermission.find(perm_array[1][:id])
|
14
|
+
case perm_array[1][:action]
|
15
|
+
when 'accept'
|
16
|
+
permission.accept
|
17
|
+
when 'reject'
|
18
|
+
permission.reject
|
19
|
+
end
|
20
|
+
end
|
21
|
+
redirect_to :action => :index
|
22
|
+
|
23
|
+
end
|
24
|
+
end
|
@@ -0,0 +1,59 @@
|
|
1
|
+
class CreateCbacFromScratch < ActiveRecord::Migration
|
2
|
+
def self.up
|
3
|
+
create_table :cbac_permissions do |t|
|
4
|
+
t.integer :generic_role_id, :default => 0
|
5
|
+
t.string :context_role
|
6
|
+
t.integer :privilege_set_id
|
7
|
+
t.timestamps
|
8
|
+
end
|
9
|
+
|
10
|
+
create_table :cbac_generic_roles do |t|
|
11
|
+
t.string :name
|
12
|
+
t.text :remarks
|
13
|
+
t.timestamps
|
14
|
+
end
|
15
|
+
|
16
|
+
create_table :cbac_memberships do |t|
|
17
|
+
t.integer :user_id
|
18
|
+
t.integer :generic_role_id
|
19
|
+
t.timestamps
|
20
|
+
end
|
21
|
+
|
22
|
+
create_table :cbac_privilege_set do |t|
|
23
|
+
t.string :name
|
24
|
+
t.string :comment
|
25
|
+
t.timestamps
|
26
|
+
end
|
27
|
+
|
28
|
+
create_table :cbac_staged_permissions do |t|
|
29
|
+
t.integer :pristine_role_id
|
30
|
+
t.string :privilege_set_name
|
31
|
+
t.integer :line_number
|
32
|
+
t.string :comment
|
33
|
+
t.text :operation, :limit => 2
|
34
|
+
t.timestamps
|
35
|
+
end
|
36
|
+
|
37
|
+
create_table :cbac_staged_roles do |t|
|
38
|
+
t.string :role_type
|
39
|
+
t.string :name
|
40
|
+
t.integer :role_id
|
41
|
+
t.timestamps
|
42
|
+
end
|
43
|
+
|
44
|
+
create_table :cbac_known_permissions do |t|
|
45
|
+
t.integer :permission_number, :null => :no
|
46
|
+
t.integer :permission_type, :default => 0
|
47
|
+
end
|
48
|
+
end
|
49
|
+
|
50
|
+
def self.down
|
51
|
+
drop_table :cbac_permissions
|
52
|
+
drop_table :cbac_generic_roles
|
53
|
+
drop_table :cbac_memberships
|
54
|
+
drop_table :cbac_privilege_set
|
55
|
+
drop_table :cbac_staged_permissions
|
56
|
+
drop_table :cbac_staged_roles
|
57
|
+
drop_table :cbac_known_permission
|
58
|
+
end
|
59
|
+
end
|
@@ -0,0 +1,31 @@
|
|
1
|
+
class CreateCbacUpgradePath < ActiveRecord::Migration
|
2
|
+
def self.up
|
3
|
+
|
4
|
+
create_table :cbac_staged_permissions do |t|
|
5
|
+
t.integer :pristine_role_id
|
6
|
+
t.string :privilege_set_name
|
7
|
+
t.integer :line_number
|
8
|
+
t.string :comment
|
9
|
+
t.text :operation, :limit => 2
|
10
|
+
t.timestamps
|
11
|
+
end
|
12
|
+
|
13
|
+
create_table :cbac_staged_roles do |t|
|
14
|
+
t.string :role_type
|
15
|
+
t.string :name
|
16
|
+
t.integer :role_id
|
17
|
+
t.timestamps
|
18
|
+
end
|
19
|
+
|
20
|
+
create_table :cbac_known_permissions do |t|
|
21
|
+
t.integer :permission_number, :null => :no
|
22
|
+
t.integer :permission_type, :default => 0
|
23
|
+
end
|
24
|
+
end
|
25
|
+
|
26
|
+
def self.down
|
27
|
+
drop_table :cbac_staged_permissions
|
28
|
+
drop_table :cbac_staged_roles
|
29
|
+
drop_table :cbac_known_permissions
|
30
|
+
end
|
31
|
+
end
|
@@ -0,0 +1,345 @@
|
|
1
|
+
#TODO: zip (or something) the directory resulting from a snapshot and delete it
|
2
|
+
#TODO: unzip (or something) the provided snapshot and load from it, then delete temp dir
|
3
|
+
#TODO: add staging area to extracted snapshot, inserted snapshot, clearing code, etc.
|
4
|
+
|
5
|
+
#TODO: add comments to pristine lines, in a Comment() style
|
6
|
+
|
7
|
+
# WARNING: Non-changes are not saved as known_permissions when using pristine or such. THIS IS NOT A BUG! Think of the following scenario:
|
8
|
+
# 1) Developers grant permission X
|
9
|
+
# 2) User deploys. Permission X is granted in the database.
|
10
|
+
# 3) User revokes permission X
|
11
|
+
# 4) Developers revoke permission X
|
12
|
+
# 5) User upgrades. No change in permission X detected, (since devteam and user agree) so the user is not prompted to accept the change.
|
13
|
+
# 6) User grants permission X again
|
14
|
+
# 7) User upgrades again. At this point, we want the user to be warned that the devteam thinks granting this permission is not a good idea.
|
15
|
+
# This is only possible if the non-change in #5 is not registered as KnownChange
|
16
|
+
|
17
|
+
# Get a privilege set that fulfills the provided conditions
|
18
|
+
def get_privilege_set(conditions)
|
19
|
+
Cbac::PrivilegeSetRecord.first(:conditions => conditions)
|
20
|
+
end
|
21
|
+
|
22
|
+
# Get a Hash containing all entries from the provided table
|
23
|
+
def select_all(table)
|
24
|
+
ActiveRecord::Base.connection.select_all("SELECT * FROM %s;" % table)
|
25
|
+
end
|
26
|
+
|
27
|
+
# Generate a usable filename for dumping records of the specified type
|
28
|
+
def get_filename(type)
|
29
|
+
"#{ENV['SNAPSHOT_NAME']}/cbac_#{type}.yml"
|
30
|
+
end
|
31
|
+
|
32
|
+
def load_objects_from_yaml(type)
|
33
|
+
filename = get_filename(type)
|
34
|
+
|
35
|
+
Yaml.load_file(filename)
|
36
|
+
end
|
37
|
+
|
38
|
+
# Dump the specified permissions to a YAML file
|
39
|
+
def dump_permissions_to_yaml_file(permissions)
|
40
|
+
permissions.each do |cp|
|
41
|
+
privilege_set_name = get_privilege_set(:id => cp['privilege_set_id']).name
|
42
|
+
cp['privilege_set_id'] = "<%= Cbac::PrivilegeSetRecord.find(:first, :conditions => {:name => '#{privilege_set_name}'}).id %>"
|
43
|
+
end
|
44
|
+
dump_objects_to_yaml_file(permissions, "permissions")
|
45
|
+
end
|
46
|
+
|
47
|
+
# Dump a set of objects to a YAML file. Filename is determined by type-string
|
48
|
+
def dump_objects_to_yaml_file(objects, type)
|
49
|
+
filename = get_filename(type)
|
50
|
+
|
51
|
+
puts "Writing #{type} to disk"
|
52
|
+
|
53
|
+
File.open(filename, "w") do |output_file|
|
54
|
+
index = "0000"
|
55
|
+
output_file.write objects.inject({}) { |hash, record|
|
56
|
+
hash["#{type.singularize}_#{index.succ!}"] = record
|
57
|
+
hash
|
58
|
+
}.to_yaml
|
59
|
+
end
|
60
|
+
end
|
61
|
+
|
62
|
+
def get_cbac_pristine_adapter
|
63
|
+
adapter_class = Class.new
|
64
|
+
adapter_class.send :include, Cbac::CbacPristine
|
65
|
+
adapter_class.new
|
66
|
+
end
|
67
|
+
|
68
|
+
namespace :cbac do
|
69
|
+
desc 'Initialize CBAC tables with bootstrap data. Allows ADMINUSER to log in and visit CBAC administration pages. Also, if a Privilege Set called "login" exists, this privilege is granted to "everyone"'
|
70
|
+
task :bootstrap => :environment do
|
71
|
+
adapter = get_cbac_pristine_adapter
|
72
|
+
if adapter.database_contains_cbac_data?
|
73
|
+
if ENV['FORCE'] == "true"
|
74
|
+
puts "FORCE specified: emptying CBAC tables"
|
75
|
+
adapter.clear_cbac_tables
|
76
|
+
else
|
77
|
+
puts "CBAC bootstrap failed: CBAC tables are nonempty. Specify FORCE=true to override this check and empty the tables"
|
78
|
+
exit
|
79
|
+
end
|
80
|
+
end
|
81
|
+
|
82
|
+
adminuser = ENV['ADMINUSER'] || 1
|
83
|
+
login_privilege_set = get_privilege_set(:name => "login")
|
84
|
+
everybody_context_role = ContextRole.roles[:everybody]
|
85
|
+
if !login_privilege_set.nil? and !everybody_context_role.nil?
|
86
|
+
puts "Login privilege exists. Allowing context role 'everybody' to use login privilege"
|
87
|
+
login_permission = Cbac::Permission.new(:context_role => 'everybody', :privilege_set_id => login_privilege_set.id)
|
88
|
+
throw "Failed to save Login Permission" unless login_permission.save
|
89
|
+
end
|
90
|
+
|
91
|
+
puts "Creating Generic Role: administrators"
|
92
|
+
admin_role = Cbac::GenericRole.new(:name => "administrators", :remarks => "System administrators - may edit CBAC permissions")
|
93
|
+
throw "Failed to save new Generic Role" unless admin_role.save
|
94
|
+
|
95
|
+
puts "Creating Administrator Membership for user #{adminuser}"
|
96
|
+
membership = Cbac::Membership.new(:user_id => adminuser, :generic_role_id => admin_role.id)
|
97
|
+
throw "Failed to save new Administrator Membership" unless membership.save
|
98
|
+
|
99
|
+
begin
|
100
|
+
admin_privilege_set_id = get_privilege_set({:name => 'cbac_administration'}).id
|
101
|
+
rescue
|
102
|
+
throw "No PrivilegeSet cbac_administration defined. Aborting."
|
103
|
+
end
|
104
|
+
cbac_admin_permission = Cbac::Permission.new(:generic_role_id => admin_role.id, :privilege_set_id => admin_privilege_set_id)
|
105
|
+
throw "Failed to save Cbac_Administration Permission" unless cbac_admin_permission.save
|
106
|
+
|
107
|
+
puts <<EOF
|
108
|
+
**********************************************************
|
109
|
+
* Succesfully bootstrapped CBAC. The specified user (# #{adminuser} ) *
|
110
|
+
* may now visit the cbac administration pages, which are *
|
111
|
+
* located at the URL /cbac/permissions/index by default *
|
112
|
+
**********************************************************
|
113
|
+
EOF
|
114
|
+
end
|
115
|
+
|
116
|
+
desc 'Extract a snapshot of the current authorization settings, which can later be restored using the restore_snapshot task. Parameter SNAPSHOT_NAME determines where the snapshot is stored'
|
117
|
+
task :extract_snapshot => :environment do
|
118
|
+
if ENV['SNAPSHOT_NAME'].nil?
|
119
|
+
puts "Missing argument SNAPSHOT_NAME. Substituting timestamp for SNAPSHOT_NAME"
|
120
|
+
require 'date'
|
121
|
+
ENV['SNAPSHOT_NAME'] = DateTime.now.strftime("%Y%m%d%H%M%S")
|
122
|
+
end
|
123
|
+
|
124
|
+
if File::exists?(ENV['SNAPSHOT_NAME']) # Directory already exists!
|
125
|
+
if ENV['FORCE'] == "true"
|
126
|
+
puts "FORCE specified - overwriting older snapshot with same name."
|
127
|
+
else
|
128
|
+
puts "A snapshot with the given name (#{ENV['SNAPSHOT_NAME']}) already exists, and overwriting is dangerous. Specify FORCE=true to override this check"
|
129
|
+
exit
|
130
|
+
end
|
131
|
+
else # Directory does not exist yet
|
132
|
+
FileUtils.mkdir(ENV['SNAPSHOT_NAME'])
|
133
|
+
end
|
134
|
+
|
135
|
+
puts "Extracting CBAC permissions to #{ENV['SNAPSHOT_NAME']}"
|
136
|
+
|
137
|
+
# Don't need privilege sets since they are loaded from a config file.
|
138
|
+
staged_changes = select_all "cbac_staged_permissions"
|
139
|
+
dump_objects_to_yaml_file(staged_changes, "staged_permissions")
|
140
|
+
|
141
|
+
staged_roles = select_all "cbac_staged_roles"
|
142
|
+
dump_objects_to_yaml_file(staged_roles, "staged_roles")
|
143
|
+
|
144
|
+
permissions = select_all "cbac_permissions"
|
145
|
+
dump_permissions_to_yaml_file(permissions)
|
146
|
+
|
147
|
+
generic_roles = select_all "cbac_generic_roles"
|
148
|
+
dump_objects_to_yaml_file(generic_roles, "generic_roles")
|
149
|
+
|
150
|
+
memberships = select_all "cbac_memberships"
|
151
|
+
dump_objects_to_yaml_file(memberships, "memberships")
|
152
|
+
|
153
|
+
known_permissions = select_all "cbac_known_permissions"
|
154
|
+
dump_objects_to_yaml_file(known_permissions, "known_permissions")
|
155
|
+
end
|
156
|
+
|
157
|
+
desc 'Restore a snapshot of authorization settings that was extracted earlier. Specify a snapshot using SNAPSHOT_NAME'
|
158
|
+
task :restore_snapshot => :environment do
|
159
|
+
adapter = get_cbac_pristine_adapter
|
160
|
+
if ENV['SNAPSHOT_NAME'].nil?
|
161
|
+
puts "Missing required parameter SNAPSHOT_NAME. Exiting."
|
162
|
+
exit
|
163
|
+
elsif adapter.database_contains_cbac_data?
|
164
|
+
if ENV['FORCE'] == "true"
|
165
|
+
puts "FORCE specified: emptying CBAC tables"
|
166
|
+
adapter.clear_cbac_tables
|
167
|
+
else
|
168
|
+
puts "Reloading snapshot failed: CBAC tables are nonempty. Specify FORCE=true to override this check and empty the tables"
|
169
|
+
exit
|
170
|
+
end
|
171
|
+
end
|
172
|
+
|
173
|
+
puts "Restoring snapshot #{ENV['SNAPSHOT_NAME']}"
|
174
|
+
|
175
|
+
ENV['FIXTURES_PATH'] = ENV['SNAPSHOT_NAME']
|
176
|
+
|
177
|
+
# Don't need privilege sets since they are loaded from a config file.
|
178
|
+
ENV['FIXTURES'] = "cbac_generic_roles,cbac_memberships,cbac_known_permissions,cbac_permissions,cbac_staged_permissions, cbac_staged_roles"
|
179
|
+
|
180
|
+
Rake::Task["db:fixtures:load"].invoke
|
181
|
+
puts "Successfully restored snapshot."
|
182
|
+
#TODO: check if rake task was successful. else
|
183
|
+
# puts "Restoring snapshot failed."
|
184
|
+
#end
|
185
|
+
end
|
186
|
+
|
187
|
+
desc 'Restore permissions to factory settings by loading the pristine file into the database'
|
188
|
+
task :pristine => :environment do
|
189
|
+
adapter = get_cbac_pristine_adapter
|
190
|
+
if adapter.database_contains_cbac_data?
|
191
|
+
if ENV['FORCE'] == "true"
|
192
|
+
puts "FORCE specified: emptying CBAC tables"
|
193
|
+
else
|
194
|
+
puts "CBAC pristine failed: CBAC tables are nonempty. Specify FORCE=true to override this check and empty the tables"
|
195
|
+
exit
|
196
|
+
end
|
197
|
+
end
|
198
|
+
|
199
|
+
if ENV['SKIP_SNAPSHOT'] == 'true'
|
200
|
+
puts "\nSKIP_SNAPSHOT provided - not dumping database."
|
201
|
+
else
|
202
|
+
puts "\nDumping a snapshot of the database"
|
203
|
+
Rake::Task["cbac:extract_snapshot"].invoke
|
204
|
+
end
|
205
|
+
filename = ENV['PRISTINE_FILE'] || "config/cbac/cbac.pristine"
|
206
|
+
puts "Parsing pristine file #{filename}"
|
207
|
+
pristine_file = adapter.create_pristine_file(filename)
|
208
|
+
adapter.set_pristine_state([pristine_file], true)
|
209
|
+
puts "Applied #{pristine_file.permissions.length.to_s} permissions."
|
210
|
+
puts "Task cbac:pristine finished."
|
211
|
+
end
|
212
|
+
|
213
|
+
desc 'Restore generic permissions to factory settings'
|
214
|
+
task :pristine_generic => :environment do
|
215
|
+
adapter = get_cbac_pristine_adapter
|
216
|
+
if adapter.database_contains_cbac_data?
|
217
|
+
if ENV['FORCE'] == "true"
|
218
|
+
puts "FORCE specified. Dropping all generic permissions and replacing them with generic pristine"
|
219
|
+
adapter.delete_generic_known_permissions
|
220
|
+
adapter.delete_generic_permissions
|
221
|
+
else
|
222
|
+
puts "CBAC pristine failed: CBAC tables are nonempty. Specify FORCE=true to override this check and empty the tables"
|
223
|
+
exit
|
224
|
+
end
|
225
|
+
end
|
226
|
+
|
227
|
+
if ENV['SKIP_SNAPSHOT'] == 'true'
|
228
|
+
puts "\nSKIP_SNAPSHOT provided - not dumping database."
|
229
|
+
else
|
230
|
+
puts "\nDumping a snapshot of the database"
|
231
|
+
Rake::Task["cbac:extract_snapshot"].invoke
|
232
|
+
end
|
233
|
+
|
234
|
+
filename = ENV['GENERIC_PRISTINE_FILE'] || "config/cbac/cbac_generic.pristine"
|
235
|
+
puts "Parsing pristine file #{filename}"
|
236
|
+
pristine_file = adapter.create_generic_pristine_file(filename)
|
237
|
+
adapter.set_pristine_state([pristine_file], false)
|
238
|
+
puts "Applied #{pristine_file.permissions.length.to_s} permissions."
|
239
|
+
puts "Task cbac:pristine_generic finished."
|
240
|
+
end
|
241
|
+
|
242
|
+
desc 'Restore all permissions to factory state. Uses the pristine file and the generic pristine file'
|
243
|
+
task :pristine_all => :environment do
|
244
|
+
adapter = get_cbac_pristine_adapter
|
245
|
+
if adapter.database_contains_cbac_data?
|
246
|
+
if ENV['FORCE'] == "true"
|
247
|
+
puts "FORCE specified: emptying CBAC tables"
|
248
|
+
else
|
249
|
+
puts "CBAC pristine failed: CBAC tables are nonempty. Specify FORCE=true to override this check and empty the tables"
|
250
|
+
exit
|
251
|
+
end
|
252
|
+
end
|
253
|
+
|
254
|
+
if ENV['SKIP_SNAPSHOT'] == 'true'
|
255
|
+
puts "\nSKIP_SNAPSHOT provided - not dumping database."
|
256
|
+
else
|
257
|
+
puts "\nDumping a snapshot of the database"
|
258
|
+
Rake::Task["cbac:extract_snapshot"].invoke
|
259
|
+
end
|
260
|
+
filename = ENV['PRISTINE_FILE'] || "config/cbac/cbac.pristine"
|
261
|
+
generic_filename = ENV['GENERIC_PRISTINE_FILE'] || "config/cbac/cbac_generic.pristine"
|
262
|
+
puts "Parsing pristine file #{filename} and generic pristine file #{generic_filename}"
|
263
|
+
pristine_file = adapter.create_pristine_file(filename)
|
264
|
+
generic_pristine_file = adapter.create_generic_pristine_file(generic_filename)
|
265
|
+
adapter.set_pristine_state([pristine_file, generic_pristine_file], true)
|
266
|
+
puts "Applied #{pristine_file.permissions.length.to_s} permissions and #{generic_pristine_file.permissions.length.to_s} generic permissions."
|
267
|
+
puts "Task cbac:pristine_all finished."
|
268
|
+
end
|
269
|
+
|
270
|
+
desc 'Upgrade permissions by adding them to the staging area. Does not upgrade generic permissions'
|
271
|
+
task :upgrade_pristine => :environment do
|
272
|
+
adapter = get_cbac_pristine_adapter
|
273
|
+
if ENV['SKIP_SNAPSHOT'] == 'true'
|
274
|
+
puts "\nSKIP_SNAPSHOT provided - not dumping database."
|
275
|
+
else
|
276
|
+
puts "\nDumping a snapshot of the database"
|
277
|
+
Rake::Task["cbac:extract_snapshot"].invoke
|
278
|
+
end
|
279
|
+
|
280
|
+
ENV['CHANGE_TYPE'] = 'context'
|
281
|
+
filename = ENV['PRISTINE_FILE'] || "config/cbac/cbac.pristine"
|
282
|
+
puts "Parsing pristine file #{filename}"
|
283
|
+
|
284
|
+
pristine_file = adapter.create_pristine_file(filename)
|
285
|
+
adapter.delete_non_generic_staged_permissions
|
286
|
+
puts "Deleted all staged context and administrator permissions"
|
287
|
+
|
288
|
+
adapter.stage_permissions([pristine_file])
|
289
|
+
puts "Staged #{adapter.number_of_non_generic_staged_permissions.to_s} permissions."
|
290
|
+
puts "Task cbac:upgrade_pristine finished."
|
291
|
+
end
|
292
|
+
|
293
|
+
|
294
|
+
desc 'Upgrade generic permissions by adding them to the staging area. Does not upgrade context or admin permissions.'
|
295
|
+
task :upgrade_pristine_generic => :environment do
|
296
|
+
adapter = get_cbac_pristine_adapter
|
297
|
+
if ENV['SKIP_SNAPSHOT'] == 'true'
|
298
|
+
puts "\nSKIP_SNAPSHOT provided - not dumping database."
|
299
|
+
else
|
300
|
+
puts "\nDumping a snapshot of the database"
|
301
|
+
Rake::Task["cbac:extract_snapshot"].invoke
|
302
|
+
end
|
303
|
+
|
304
|
+
ENV['CHANGE_TYPE'] = 'context'
|
305
|
+
generic_filename = ENV['GENERIC_PRISTINE_FILE'] || "config/cbac/cbac_generic.pristine"
|
306
|
+
|
307
|
+
puts "Parsing pristine file #{generic_filename}"
|
308
|
+
generic_pristine_file = adapter.create_generic_pristine_file(generic_filename)
|
309
|
+
|
310
|
+
adapter.delete_non_generic_staged_permissions
|
311
|
+
puts "Deleted all staged generic permissions"
|
312
|
+
|
313
|
+
adapter.stage_permissions([generic_pristine_file])
|
314
|
+
puts "Staged #{adapter.number_of_generic_staged_permissions.to_s} generic permissions."
|
315
|
+
puts "Task cbac:upgrade_pristine finished."
|
316
|
+
end
|
317
|
+
|
318
|
+
desc 'Upgrade all permissions by adding them to the staging area.'
|
319
|
+
task :upgrade_all => :environment do
|
320
|
+
adapter = get_cbac_pristine_adapter
|
321
|
+
if ENV['SKIP_SNAPSHOT'] == 'true'
|
322
|
+
puts "\nSKIP_SNAPSHOT provided - not dumping database."
|
323
|
+
else
|
324
|
+
puts "\nDumping a snapshot of the database"
|
325
|
+
Rake::Task["cbac:extract_snapshot"].invoke
|
326
|
+
end
|
327
|
+
|
328
|
+
ENV['CHANGE_TYPE'] = 'context'
|
329
|
+
filename = ENV['PRISTINE_FILE'] || "config/cbac/cbac.pristine"
|
330
|
+
generic_filename = ENV['GENERIC_PRISTINE_FILE'] || "config/cbac/cbac_generic.pristine"
|
331
|
+
puts "Parsing pristine file #{filename} and generic pristine file #{generic_filename}"
|
332
|
+
|
333
|
+
pristine_file = adapter.create_pristine_file(filename)
|
334
|
+
generic_pristine_file = adapter.create_generic_pristine_file(generic_filename)
|
335
|
+
|
336
|
+
adapter.delete_generic_staged_permissions
|
337
|
+
adapter.delete_non_generic_staged_permissions
|
338
|
+
puts "Deleted all current staged permissions"
|
339
|
+
|
340
|
+
|
341
|
+
adapter.stage_permissions([pristine_file, generic_pristine_file])
|
342
|
+
puts "Staged #{adapter.number_of_non_generic_staged_permissions.to_s} permissions and #{adapter.number_of_generic_staged_permissions.to_s} generic permissions."
|
343
|
+
puts "Task cbac:upgrade_all finished."
|
344
|
+
end
|
345
|
+
end
|