checken 0.0.4 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 26f7fc494eacd3729c46774a936ba735a317c2835f7df07abf3920afe3cbf792
-  data.tar.gz: 5d449e1b99a7fe53e366796c13ad73d09ca332115b770ab6dbac0e04ba709ead
+  metadata.gz: 4113a0625a091278bb2c8fff39ebd8d44c36ba0a9b61ca7e6670d4c606e6e300
+  data.tar.gz: 16814ed3fc998c70a12ba021f9dc2081eda7139fdaab656e2ae87557956e1eb1
 SHA512:
-  metadata.gz: 83c122e8c10a61bfab0a0da4709cc7fbe9241514398b7d1e90a88b8ceecf24a8be0864dd29de0e819f799a5ae3b23544ac18bcbcf493bee04eb69a210d7c5b71
-  data.tar.gz: fbea10f7112b0e37480e50a33480a93c5dc91732735c1c1f477009b87b45c00ec1b7ba173462f6ac14b068cb7e1bf0621a5dd975faf186dc81e3d77ce906a06b
+  metadata.gz: d65beeffd78dcbab44c52d4e9a27da6999fbd856d3488a271410e381637a7f509766230da6bb28926727a9ee22d984551da4cdc5bee8262d7a6fca69592e5c47
+  data.tar.gz: 97da186a28f704b5ca785a1a6b55246302fa8666d3f0fa1a0e78016d371c6f4dbd8b5259750e6e93be206b4eabd818f85aa114bc4ae32178e3733b84b7b6b25f

data/lib/checken/concerns/has_parents.rb

@@ -9,6 +9,13 @@ module Checken
         @key.nil? ? nil : [@group.path, @key].compact.join('.')
       end
 
+      # Return the full path to this permission with the namespace
+      #
+      # @return [String]
+      def path_with_namespace
+        [@schema.config.namespace, path].compact.join(@schema.config.namespace_delimiter)
+      end
+
       # Return the parents for ths group
       #
       # @return [Array<Checken::PermissionGroup, Checken::Permission>]

data/lib/checken/config.rb

@@ -4,6 +4,30 @@ require 'checken/user_proxy'
 module Checken
   class Config
 
+    DEFAULT_NAMESPACE_DELIMITER = ":"
+
+    # An optional namespace that will prefix all group and permission paths.
+    #
+    attr_accessor :namespace
+
+    # The delimiter that should be used to separate namespaces
+    # in group and permission paths.
+    #
+    # @return [String]
+    def namespace_delimiter
+      @namespace_delimiter ||= DEFAULT_NAMESPACE_DELIMITER
+    end
+    attr_writer :namespace_delimiter
+
+    # Should the namespace be optional when checking permissions?
+    # Defaults to false.
+    #
+    # @return [Boolean]
+    def namespace_optional?
+      @namespace_optional || false
+    end
+    attr_writer :namespace_optional
+
     # The class that should be used to create user proxies.
     #
     # @return [Class]

data/lib/checken/extensions/action_controller.rb

@@ -17,14 +17,14 @@ module Checken
         # when performing permission checks using `restrict`.
       end
 
-      def restrict(permission_path, object = nil, options = {})
+      def restrict(permission_path, object = nil, options = {}, strict: true)
         if checken_user_proxy.nil?
           user = send(Checken.current_schema.config.current_user_method_name)
           user_proxy = Checken.current_schema.config.user_proxy_class.new(user)
         else
           user_proxy = checken_user_proxy
         end
-        granted_permissions = Checken.current_schema.check_permission!(permission_path, user_proxy, object)
+        granted_permissions = Checken.current_schema.check_permission!(permission_path, user_proxy, object, strict: strict)
         granted_permissions.each do |permission|
           granted_checken_permissions << permission
         end
@@ -35,7 +35,7 @@ module Checken
       end
 
       module ClassMethods
-        def restrict(permission_path, object_or_options = {}, options_if_object_provided = {})
+        def restrict(permission_path, object_or_options = {}, options_if_object_provided = {}, strict: true)
           if object_or_options.is_a?(Hash)
             object = nil
             options = object_or_options
@@ -61,7 +61,7 @@ module Checken
               resolved_object = nil
             end
 
-            restrict(permission_path, resolved_object, restrict_options)
+            restrict(permission_path, resolved_object, restrict_options, strict: strict)
           end
 
         end

data/lib/checken/permission.rb

@@ -43,6 +43,7 @@ module Checken
       end
 
       @group = group
+      @schema = group.schema
       @key = key
       @required_object_types = []
       @dependencies = []
@@ -84,7 +85,15 @@ module Checken
       end
 
       # Check the user has this permission
-      unless user_proxy.granted_permissions.include?(self.path)
+      if @group.schema.config.namespace && @group.schema.config.namespace_optional?
+        found_permission = (user_proxy.granted_permissions & [self.path, self.path_with_namespace]).any?
+      elsif @group.schema.config.namespace
+        found_permission = user_proxy.granted_permissions.include?(self.path_with_namespace)
+      else
+        found_permission = user_proxy.granted_permissions.include?(self.path)
+      end
+
+      unless found_permission
         @group.schema.logger.info "`#{self.path}` not granted to #{user_proxy.description}"
         error = PermissionDeniedError.new('PermissionNotGranted', "User has not been granted the '#{self.path}' permission", self)
         error.user = user_proxy.user

data/lib/checken/permission_group.rb

@@ -111,6 +111,7 @@ module Checken
         raise PermissionNotFoundError, "Must provide a permission path"
       end
 
+      path = parse_namespace(path)
       path_parts = path.split('.').map(&:to_sym)
       last_group_or_permission = self
       while part = path_parts.shift
@@ -180,5 +181,32 @@ module Checken
       )
     end
 
+    private
+
+    # Parse the namespace from the path
+    # Depending on the schema configuration, the namespace may be optional or required.
+    # If the namespace is required, the namespace must match the schema namespace.
+    # If the namespace is optional, the namespace may be omitted.
+    # On success the namespace will be removed from the path and the remaining path will be returned.
+    #
+    # @param path [String]
+    # @return [String]
+    def parse_namespace(path)
+      match_data = path.match(/^(.*)#{@schema.config.namespace_delimiter}(.*)$/)
+
+      if match_data.nil? && @schema.config.namespace && !@schema.config.namespace_optional?
+        raise PermissionNotFoundError, "Namespace: '#{@schema.config.namespace}' is missing in path: '#{path}'"
+      elsif match_data.nil?
+        return path
+      end
+
+      namespace, remaining_path = match_data.captures
+      if namespace && namespace != @schema.config.namespace
+        raise PermissionNotFoundError, "Namespace: '#{namespace}' does not match the schema namespace: '#{@schema.config.namespace}'"
+      end
+
+      remaining_path || path
+    end
+
   end
 end

data/lib/checken/schema.rb

@@ -32,48 +32,11 @@ module Checken
     # @param permission_path [String]
     # @param user [User]
     # @param object [Object]
-    def check_permission!(permission_path, user_proxy, object = nil)
-      permissions = @root_group.find_permissions_from_path(permission_path)
-
-      if permissions.size == 1
-        # If we only have a single permission, we'll just run the check
-        # as normal through the check process. This will work as normal and raise
-        # and return directly.
-        permissions.first.check!(user_proxy, object)
-
-      elsif permissions.size == 0
-        # No permissions found
-        raise Checken::NoPermissionsFoundError, "No permissions found matching #{permission_path}"
-
+    def check_permission!(permission_path, user_proxy, object = nil, strict: true)
+      if strict # permission(s) for the path are expected to be defined within the Checken Schema
+        handle_strict_permission_check!(permission_path, user_proxy, object)
       else
-        # If we have multiple permissions, we need to loop through each permission
-        # and handle them as appropriate.
-        granted_permissions = []
-        ungranted_permissions = 0
-        permissions.each do |permission|
-          begin
-            permission.check!(user_proxy, object).each do |permission|
-              granted_permissions << permission
-            end
-          rescue Checken::PermissionDeniedError => e
-            if e.code == 'PermissionNotGranted'
-              # If the permission isn't granted, update the counter so we can
-              # keep track of the number of ungranted permissions.
-              ungranted_permissions += 1
-            else
-              # Raise other errors as normal
-              raise
-            end
-          end
-        end
-
-        if permissions.size == ungranted_permissions
-          # If the user is ungranted to all the found permissions, they do not
-          # have access and should be denied.
-          raise PermissionDeniedError.new('PermissionNotGranted', "User does not have any permissions #{permissions.map(&:path).join(', ')} permission.", permissions.first)
-        else
-          granted_permissions
-        end
+        handle_unstrict_permission_check!(permission_path, user_proxy)
       end
     end
 
@@ -144,5 +107,67 @@ module Checken
       @schema.sort.to_h
     end
 
+    private
+
+    def handle_strict_permission_check!(permission_path, user_proxy, object)
+      permissions = @root_group.find_permissions_from_path(permission_path)
+
+      if permissions.size == 1
+        # If we only have a single permission, we'll just run the check
+        # as normal through the check process. This will work as normal and raise
+        # and return directly.
+        permissions.first.check!(user_proxy, object)
+
+      elsif permissions.size == 0
+        # No permissions found
+        raise Checken::NoPermissionsFoundError, "No permissions found matching #{permission_path}"
+
+      else
+        # If we have multiple permissions, we need to loop through each permission
+        # and handle them as appropriate.
+        granted_permissions = []
+        ungranted_permissions = 0
+        permissions.each do |permission|
+          begin
+            permission.check!(user_proxy, object).each do |permission|
+              granted_permissions << permission
+            end
+          rescue Checken::PermissionDeniedError => e
+            if e.code == 'PermissionNotGranted'
+              # If the permission isn't granted, update the counter so we can
+              # keep track of the number of ungranted permissions.
+              ungranted_permissions += 1
+            else
+              # Raise other errors as normal
+              raise
+            end
+          end
+        end
+
+        if permissions.size == ungranted_permissions
+          # If the user is ungranted to all the found permissions, they do not
+          # have access and should be denied.
+          raise PermissionDeniedError.new('PermissionNotGranted', "User does not have any permissions #{permissions.map(&:path).join(', ')} permission.", permissions.first)
+        else
+          granted_permissions
+        end
+      end
+    end
+
+    def handle_unstrict_permission_check!(permission_path, user_proxy)
+      if permission_path.include?('*')
+        raise Checken::PermissionNotFoundError, "Permission path cannot contain wildcards when strict is false"
+      end
+
+      unless user_proxy.is_a?(Checken::UserProxy)
+        user_proxy = config.user_proxy_class.new(user_proxy)
+      end
+      return [permission_path] if user_proxy.granted_permissions.include?(permission_path)
+
+      error = PermissionDeniedError.new('PermissionNotGranted', "User has not been granted the '#{permission_path}' permission")
+      error.user = user_proxy.user
+      raise error
+    end
+
   end
 end

data/lib/checken/user.rb

@@ -21,8 +21,9 @@ module Checken
         raise Error, "Could not determine a schema. Make sure you set Checken.current_schema or pass :schema to can? methods."
       end
 
+      strict = options.delete(:strict) { true }
       user_proxy = schema.config.user_proxy_class.new(self)
-      schema.check_permission!(permission_path, user_proxy, object)
+      schema.check_permission!(permission_path, user_proxy, object, strict: strict)
     end
 
     def can?(*args)

data/lib/checken/version.rb

@@ -1,3 +1,3 @@
 module Checken
-  VERSION = '0.0.4'
+  VERSION = '0.0.5'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: checken
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.5
 platform: ruby
 authors:
 - Adam Cooke
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-27 00:00:00.000000000 Z
+date: 2025-04-01 00:00:00.000000000 Z
 dependencies: []
 description: An authorization framework for Ruby & Rails applications.
 email:
@@ -41,7 +41,7 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'false'
-  changelog_uri: https://github.com/krystal/checken/CHANGELOG.md
+  changelog_uri: https://github.com/krystal/checken/blob/master/CHANGELOG.md
 post_install_message:
 rdoc_options: []
 require_paths: