checkpoint 0.2.2 → 1.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.envrc +1 -0
- data/.gitignore +18 -9
- data/.rspec +2 -0
- data/.rubocop.yml +30 -0
- data/.travis.yml +5 -0
- data/.yardopts +1 -0
- data/Gemfile +5 -1
- data/LICENSE.md +27 -0
- data/README.md +23 -0
- data/Rakefile +14 -0
- data/bin/console +18 -0
- data/bin/rake +21 -0
- data/bin/rspec +21 -0
- data/bin/sequel +21 -0
- data/bin/setup +8 -0
- data/bin/yard +21 -0
- data/bin/yardoc +21 -0
- data/checkpoint.gemspec +37 -19
- data/db/migrations/1_create_permits.rb +19 -0
- data/docs/Makefile +24 -0
- data/docs/_static/.gitkeep +0 -0
- data/docs/_templates/.gitkeep +0 -0
- data/docs/authentication.rst +18 -0
- data/docs/conf.py +46 -0
- data/docs/index.rst +28 -0
- data/docs/policies.rst +211 -0
- data/docs/requirements.txt +4 -0
- data/lib/checkpoint.rb +16 -2
- data/lib/checkpoint/agent.rb +93 -0
- data/lib/checkpoint/agent/resolver.rb +33 -0
- data/lib/checkpoint/agent/token.rb +52 -0
- data/lib/checkpoint/authority.rb +67 -0
- data/lib/checkpoint/credential.rb +82 -0
- data/lib/checkpoint/credential/permission.rb +27 -0
- data/lib/checkpoint/credential/resolver.rb +87 -0
- data/lib/checkpoint/credential/role.rb +26 -0
- data/lib/checkpoint/credential/token.rb +51 -0
- data/lib/checkpoint/db.rb +161 -0
- data/lib/checkpoint/db/permit.rb +24 -0
- data/lib/checkpoint/permission_mapper.rb +29 -0
- data/lib/checkpoint/permits.rb +133 -0
- data/lib/checkpoint/query.rb +42 -0
- data/lib/checkpoint/query/action_permitted.rb +40 -0
- data/lib/checkpoint/query/role_granted.rb +55 -0
- data/lib/checkpoint/railtie.rb +92 -71
- data/lib/checkpoint/resource.rb +138 -0
- data/lib/checkpoint/resource/all_of_any_type.rb +34 -0
- data/lib/checkpoint/resource/all_of_type.rb +50 -0
- data/lib/checkpoint/resource/any_entity.rb +25 -0
- data/lib/checkpoint/resource/any_entity_of_type.rb +29 -0
- data/lib/checkpoint/resource/resolver.rb +21 -0
- data/lib/checkpoint/resource/token.rb +65 -0
- data/lib/checkpoint/version.rb +3 -1
- data/lib/tasks/migrate.rake +75 -0
- metadata +260 -19
- data/Readme.markdown +0 -103
metadata
CHANGED
@@ -1,54 +1,295 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: checkpoint
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
5
|
-
prerelease:
|
4
|
+
version: 1.0.0
|
6
5
|
platform: ruby
|
7
6
|
authors:
|
8
|
-
-
|
7
|
+
- Noah Botimer
|
9
8
|
autorequire:
|
10
|
-
bindir:
|
9
|
+
bindir: exe
|
11
10
|
cert_chain: []
|
12
|
-
date:
|
13
|
-
dependencies:
|
11
|
+
date: 2018-03-05 00:00:00.000000000 Z
|
12
|
+
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: ettin
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - "~>"
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: '1.1'
|
20
|
+
type: :runtime
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - "~>"
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: '1.1'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: mysql2
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
30
|
+
requirements:
|
31
|
+
- - "~>"
|
32
|
+
- !ruby/object:Gem::Version
|
33
|
+
version: 0.4.10
|
34
|
+
type: :runtime
|
35
|
+
prerelease: false
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
37
|
+
requirements:
|
38
|
+
- - "~>"
|
39
|
+
- !ruby/object:Gem::Version
|
40
|
+
version: 0.4.10
|
41
|
+
- !ruby/object:Gem::Dependency
|
42
|
+
name: sequel
|
43
|
+
requirement: !ruby/object:Gem::Requirement
|
44
|
+
requirements:
|
45
|
+
- - "~>"
|
46
|
+
- !ruby/object:Gem::Version
|
47
|
+
version: '5.6'
|
48
|
+
type: :runtime
|
49
|
+
prerelease: false
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
51
|
+
requirements:
|
52
|
+
- - "~>"
|
53
|
+
- !ruby/object:Gem::Version
|
54
|
+
version: '5.6'
|
55
|
+
- !ruby/object:Gem::Dependency
|
56
|
+
name: bundler
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
58
|
+
requirements:
|
59
|
+
- - "~>"
|
60
|
+
- !ruby/object:Gem::Version
|
61
|
+
version: '1.16'
|
62
|
+
type: :development
|
63
|
+
prerelease: false
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
65
|
+
requirements:
|
66
|
+
- - "~>"
|
67
|
+
- !ruby/object:Gem::Version
|
68
|
+
version: '1.16'
|
69
|
+
- !ruby/object:Gem::Dependency
|
70
|
+
name: coveralls
|
71
|
+
requirement: !ruby/object:Gem::Requirement
|
72
|
+
requirements:
|
73
|
+
- - "~>"
|
74
|
+
- !ruby/object:Gem::Version
|
75
|
+
version: '0.8'
|
76
|
+
type: :development
|
77
|
+
prerelease: false
|
78
|
+
version_requirements: !ruby/object:Gem::Requirement
|
79
|
+
requirements:
|
80
|
+
- - "~>"
|
81
|
+
- !ruby/object:Gem::Version
|
82
|
+
version: '0.8'
|
83
|
+
- !ruby/object:Gem::Dependency
|
84
|
+
name: pry
|
85
|
+
requirement: !ruby/object:Gem::Requirement
|
86
|
+
requirements:
|
87
|
+
- - ">="
|
88
|
+
- !ruby/object:Gem::Version
|
89
|
+
version: '0'
|
90
|
+
type: :development
|
91
|
+
prerelease: false
|
92
|
+
version_requirements: !ruby/object:Gem::Requirement
|
93
|
+
requirements:
|
94
|
+
- - ">="
|
95
|
+
- !ruby/object:Gem::Version
|
96
|
+
version: '0'
|
97
|
+
- !ruby/object:Gem::Dependency
|
98
|
+
name: pry-byebug
|
99
|
+
requirement: !ruby/object:Gem::Requirement
|
100
|
+
requirements:
|
101
|
+
- - ">="
|
102
|
+
- !ruby/object:Gem::Version
|
103
|
+
version: '0'
|
104
|
+
type: :development
|
105
|
+
prerelease: false
|
106
|
+
version_requirements: !ruby/object:Gem::Requirement
|
107
|
+
requirements:
|
108
|
+
- - ">="
|
109
|
+
- !ruby/object:Gem::Version
|
110
|
+
version: '0'
|
111
|
+
- !ruby/object:Gem::Dependency
|
112
|
+
name: rake
|
113
|
+
requirement: !ruby/object:Gem::Requirement
|
114
|
+
requirements:
|
115
|
+
- - "~>"
|
116
|
+
- !ruby/object:Gem::Version
|
117
|
+
version: '10.0'
|
118
|
+
type: :development
|
119
|
+
prerelease: false
|
120
|
+
version_requirements: !ruby/object:Gem::Requirement
|
121
|
+
requirements:
|
122
|
+
- - "~>"
|
123
|
+
- !ruby/object:Gem::Version
|
124
|
+
version: '10.0'
|
125
|
+
- !ruby/object:Gem::Dependency
|
126
|
+
name: rspec
|
127
|
+
requirement: !ruby/object:Gem::Requirement
|
128
|
+
requirements:
|
129
|
+
- - "~>"
|
130
|
+
- !ruby/object:Gem::Version
|
131
|
+
version: '3.0'
|
132
|
+
type: :development
|
133
|
+
prerelease: false
|
134
|
+
version_requirements: !ruby/object:Gem::Requirement
|
135
|
+
requirements:
|
136
|
+
- - "~>"
|
137
|
+
- !ruby/object:Gem::Version
|
138
|
+
version: '3.0'
|
139
|
+
- !ruby/object:Gem::Dependency
|
140
|
+
name: rubocop
|
141
|
+
requirement: !ruby/object:Gem::Requirement
|
142
|
+
requirements:
|
143
|
+
- - "~>"
|
144
|
+
- !ruby/object:Gem::Version
|
145
|
+
version: '0.52'
|
146
|
+
type: :development
|
147
|
+
prerelease: false
|
148
|
+
version_requirements: !ruby/object:Gem::Requirement
|
149
|
+
requirements:
|
150
|
+
- - "~>"
|
151
|
+
- !ruby/object:Gem::Version
|
152
|
+
version: '0.52'
|
153
|
+
- !ruby/object:Gem::Dependency
|
154
|
+
name: rubocop-rails
|
155
|
+
requirement: !ruby/object:Gem::Requirement
|
156
|
+
requirements:
|
157
|
+
- - "~>"
|
158
|
+
- !ruby/object:Gem::Version
|
159
|
+
version: '1.1'
|
160
|
+
type: :development
|
161
|
+
prerelease: false
|
162
|
+
version_requirements: !ruby/object:Gem::Requirement
|
163
|
+
requirements:
|
164
|
+
- - "~>"
|
165
|
+
- !ruby/object:Gem::Version
|
166
|
+
version: '1.1'
|
167
|
+
- !ruby/object:Gem::Dependency
|
168
|
+
name: rubocop-rspec
|
169
|
+
requirement: !ruby/object:Gem::Requirement
|
170
|
+
requirements:
|
171
|
+
- - "~>"
|
172
|
+
- !ruby/object:Gem::Version
|
173
|
+
version: '1.16'
|
174
|
+
type: :development
|
175
|
+
prerelease: false
|
176
|
+
version_requirements: !ruby/object:Gem::Requirement
|
177
|
+
requirements:
|
178
|
+
- - "~>"
|
179
|
+
- !ruby/object:Gem::Version
|
180
|
+
version: '1.16'
|
181
|
+
- !ruby/object:Gem::Dependency
|
182
|
+
name: sqlite3
|
183
|
+
requirement: !ruby/object:Gem::Requirement
|
184
|
+
requirements:
|
185
|
+
- - "~>"
|
186
|
+
- !ruby/object:Gem::Version
|
187
|
+
version: '1.3'
|
188
|
+
type: :development
|
189
|
+
prerelease: false
|
190
|
+
version_requirements: !ruby/object:Gem::Requirement
|
191
|
+
requirements:
|
192
|
+
- - "~>"
|
193
|
+
- !ruby/object:Gem::Version
|
194
|
+
version: '1.3'
|
195
|
+
- !ruby/object:Gem::Dependency
|
196
|
+
name: yard
|
197
|
+
requirement: !ruby/object:Gem::Requirement
|
198
|
+
requirements:
|
199
|
+
- - "~>"
|
200
|
+
- !ruby/object:Gem::Version
|
201
|
+
version: '0.9'
|
202
|
+
type: :development
|
203
|
+
prerelease: false
|
204
|
+
version_requirements: !ruby/object:Gem::Requirement
|
205
|
+
requirements:
|
206
|
+
- - "~>"
|
207
|
+
- !ruby/object:Gem::Version
|
208
|
+
version: '0.9'
|
14
209
|
description:
|
15
210
|
email:
|
16
|
-
-
|
211
|
+
- botimer@umich.edu
|
17
212
|
executables: []
|
18
213
|
extensions: []
|
19
214
|
extra_rdoc_files: []
|
20
215
|
files:
|
21
|
-
- .
|
216
|
+
- ".envrc"
|
217
|
+
- ".gitignore"
|
218
|
+
- ".rspec"
|
219
|
+
- ".rubocop.yml"
|
220
|
+
- ".travis.yml"
|
221
|
+
- ".yardopts"
|
22
222
|
- Gemfile
|
223
|
+
- LICENSE.md
|
224
|
+
- README.md
|
23
225
|
- Rakefile
|
24
|
-
-
|
226
|
+
- bin/console
|
227
|
+
- bin/rake
|
228
|
+
- bin/rspec
|
229
|
+
- bin/sequel
|
230
|
+
- bin/setup
|
231
|
+
- bin/yard
|
232
|
+
- bin/yardoc
|
25
233
|
- checkpoint.gemspec
|
234
|
+
- db/migrations/1_create_permits.rb
|
235
|
+
- docs/Makefile
|
236
|
+
- docs/_static/.gitkeep
|
237
|
+
- docs/_templates/.gitkeep
|
238
|
+
- docs/authentication.rst
|
239
|
+
- docs/conf.py
|
240
|
+
- docs/index.rst
|
241
|
+
- docs/policies.rst
|
242
|
+
- docs/requirements.txt
|
26
243
|
- lib/checkpoint.rb
|
244
|
+
- lib/checkpoint/agent.rb
|
245
|
+
- lib/checkpoint/agent/resolver.rb
|
246
|
+
- lib/checkpoint/agent/token.rb
|
247
|
+
- lib/checkpoint/authority.rb
|
248
|
+
- lib/checkpoint/credential.rb
|
249
|
+
- lib/checkpoint/credential/permission.rb
|
250
|
+
- lib/checkpoint/credential/resolver.rb
|
251
|
+
- lib/checkpoint/credential/role.rb
|
252
|
+
- lib/checkpoint/credential/token.rb
|
253
|
+
- lib/checkpoint/db.rb
|
254
|
+
- lib/checkpoint/db/permit.rb
|
255
|
+
- lib/checkpoint/permission_mapper.rb
|
256
|
+
- lib/checkpoint/permits.rb
|
257
|
+
- lib/checkpoint/query.rb
|
258
|
+
- lib/checkpoint/query/action_permitted.rb
|
259
|
+
- lib/checkpoint/query/role_granted.rb
|
27
260
|
- lib/checkpoint/railtie.rb
|
261
|
+
- lib/checkpoint/resource.rb
|
262
|
+
- lib/checkpoint/resource/all_of_any_type.rb
|
263
|
+
- lib/checkpoint/resource/all_of_type.rb
|
264
|
+
- lib/checkpoint/resource/any_entity.rb
|
265
|
+
- lib/checkpoint/resource/any_entity_of_type.rb
|
266
|
+
- lib/checkpoint/resource/resolver.rb
|
267
|
+
- lib/checkpoint/resource/token.rb
|
28
268
|
- lib/checkpoint/version.rb
|
29
|
-
|
269
|
+
- lib/tasks/migrate.rake
|
270
|
+
homepage: https://github.com/mlibrary/checkpoint
|
30
271
|
licenses:
|
31
|
-
-
|
272
|
+
- BSD-3-Clause
|
273
|
+
metadata: {}
|
32
274
|
post_install_message:
|
33
275
|
rdoc_options: []
|
34
276
|
require_paths:
|
35
277
|
- lib
|
36
278
|
required_ruby_version: !ruby/object:Gem::Requirement
|
37
|
-
none: false
|
38
279
|
requirements:
|
39
|
-
- -
|
280
|
+
- - ">="
|
40
281
|
- !ruby/object:Gem::Version
|
41
282
|
version: '0'
|
42
283
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
43
|
-
none: false
|
44
284
|
requirements:
|
45
|
-
- -
|
285
|
+
- - ">="
|
46
286
|
- !ruby/object:Gem::Version
|
47
287
|
version: '0'
|
48
288
|
requirements: []
|
49
|
-
rubyforge_project:
|
50
|
-
rubygems_version:
|
289
|
+
rubyforge_project:
|
290
|
+
rubygems_version: 2.6.13
|
51
291
|
signing_key:
|
52
|
-
specification_version:
|
53
|
-
summary:
|
292
|
+
specification_version: 4
|
293
|
+
summary: Checkpoint provides a model and infrastructure for policy-based authorization,
|
294
|
+
especially in Rails applications.
|
54
295
|
test_files: []
|
data/Readme.markdown
DELETED
@@ -1,103 +0,0 @@
|
|
1
|
-
#Simple authorisation for Rails
|
2
|
-
|
3
|
-
##Installation
|
4
|
-
|
5
|
-
Add the following to your gem file:
|
6
|
-
|
7
|
-
```
|
8
|
-
gem 'checkpoint'
|
9
|
-
```
|
10
|
-
and then run bundle install from your shell.
|
11
|
-
|
12
|
-
## How to use
|
13
|
-
|
14
|
-
By default all users get denied access to everything.
|
15
|
-
|
16
|
-
To enable a user to access/use a resource you must specify an authorisation rule to grant access. This is done using the "authorise" (or "authorize" for americans) method in the application controller.
|
17
|
-
|
18
|
-
So if for instance you wanted to grant access (to all users) to your posts index action you could do the following:
|
19
|
-
|
20
|
-
```ruby
|
21
|
-
#grant access to your posts controller 'index' action to all users
|
22
|
-
authorise "PostsController::index"
|
23
|
-
|
24
|
-
#or authorize "PostsController::index"
|
25
|
-
|
26
|
-
```
|
27
|
-
|
28
|
-
Noticed how the pattern above is in the format of "ControllerName::action"
|
29
|
-
|
30
|
-
So if you wanted to grant action to your posts view action you could do the following:
|
31
|
-
|
32
|
-
```ruby
|
33
|
-
#grant access to your posts controller 'view' action to all users
|
34
|
-
authorise "PostsController::view"
|
35
|
-
```
|
36
|
-
|
37
|
-
If you want to grant access to all actions in your post controller you can use a wildcard ('*') char and do the following
|
38
|
-
|
39
|
-
```ruby
|
40
|
-
#grant access to your posts controller actions to all users
|
41
|
-
authorise "PostsController::*"
|
42
|
-
```
|
43
|
-
|
44
|
-
You can also do the same above by using a regular expression:
|
45
|
-
|
46
|
-
```ruby
|
47
|
-
#grant access to your posts controller actions to all users
|
48
|
-
authorise /\APostsController::.*\Z/
|
49
|
-
```
|
50
|
-
|
51
|
-
If you want to be able to grant access to your view action to only users who have signed in, you can do this by passing a block that returns true if the user is logged in.
|
52
|
-
|
53
|
-
```ruby
|
54
|
-
#grant access to your posts controller 'view' action to all users who have signed in
|
55
|
-
authorise "PostsController::view" do
|
56
|
-
!current_user.nil?
|
57
|
-
end
|
58
|
-
```
|
59
|
-
|
60
|
-
In the example above the block uses the bindings of the controller that is being called, so therefore it can access anything that that particular controller access e.g. your current params hash etc...
|
61
|
-
|
62
|
-
Similarly you could grant access to everything to all admin users by doing the following:
|
63
|
-
|
64
|
-
```ruby
|
65
|
-
#grant access to everything to all admin users
|
66
|
-
authorise "*" do
|
67
|
-
!current_user.nil? && current_user.admin?
|
68
|
-
end
|
69
|
-
```
|
70
|
-
|
71
|
-
Finally by passing an array you can authorise a range of controller actions in one go:
|
72
|
-
|
73
|
-
```ruby
|
74
|
-
#grant access your posts controller 'create' and 'update' actions to all users who have signed in
|
75
|
-
authorise ["PostsController::create", "PostsController::update"] do
|
76
|
-
!current_user.nil?
|
77
|
-
end
|
78
|
-
```
|
79
|
-
|
80
|
-
## FAQ
|
81
|
-
|
82
|
-
### How do I enable devise?
|
83
|
-
|
84
|
-
```ruby
|
85
|
-
authorise "Devise::*"
|
86
|
-
|
87
|
-
```
|
88
|
-
### How do I enable an API Key?
|
89
|
-
|
90
|
-
```ruby
|
91
|
-
#grant access to all controllers in the Api namespace for requests which have the API key as a param
|
92
|
-
authorize "Api::*" do
|
93
|
-
params[:api_key] == API_KEY
|
94
|
-
end
|
95
|
-
|
96
|
-
```
|
97
|
-
|
98
|
-
|
99
|
-
## License
|
100
|
-
|
101
|
-
Checkpoint is released under the MIT license:
|
102
|
-
|
103
|
-
* http://www.opensource.org/licenses/MIT
|