cm-admin 1.5.53 → 1.5.54

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d136db7d97b8cb78d65d3dc1a2e27f709dd4065c142e9219e8969c33bb9e491a
-  data.tar.gz: 7991bc93af63655d1ad93bf5604b834fd9ffd36e072e918d91fc88e5685ade5b
+  metadata.gz: 48f4b0a9c698fe7b2cfd60cfe47a12e0afa0d3bbcf64d67cadd584dab2532de0
+  data.tar.gz: 14a61034d53f304b0f4c8e8fe9a419983ae04d08097df6bc7d05fbeac012c7a1
 SHA512:
-  metadata.gz: bace0b999baec89fc23fd5dac17b0a2248cbc5b330ff987db45208eb12463592cca7821b98f72423b536dece0fc7727592a431540d6f8ba3debe38594f23be5a
-  data.tar.gz: 5e0e8358a5840e14ffc9c29f2264f97c40f345c2079d0deef52d1d136bdf79bf4db70e8d3bc7797235cac66897b9cbecb6847faf32c21a3c00b7f8eada96ddcd
+  metadata.gz: bfc1c6bda642cf1d3d45e8216f326150a6faf3d0aedc3ba84f607244ae394104a7ceb26f8a02476e4ac5c4da641fac86831668b3d951d08d6d416525dcacee89
+  data.tar.gz: ccdc8978d2195022972491299e9bc78eee5b615ab209f8cc649dcf0f0894edc33672232a7e1730396c8ac00ff9eff53a8c70ad1a60f25b4331daeeb2e7cad5fd

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    cm-admin (1.5.53)
+    cm-admin (1.5.54)
       caxlsx_rails
       cocoon (~> 1.2.15)
       csv-importer (~> 0.8.2)

data/app/assets/javascripts/cm_admin/scaffolds.js

@@ -68,6 +68,41 @@ $(document).on("click", ".destroy-attachment button", function (e) {
   );
 });
 
+$(document).on(
+  "click",
+  '[data-behaviour="permission-check-box"]',
+  function (e) {
+    var form_check = $(this).closest('.form-check')
+    var form_field = $(this).closest('.form-field')
+    if($(this).is(':checked')){
+      form_check.find('.cm-select-tag').removeClass('hidden')
+    } else {
+      form_check.find('.cm-select-tag').addClass('hidden')
+    }
+    if (form_field.find('[data-behaviour="permission-check-box"]:checked').length == form_field.find('[data-behaviour="permission-check-box"]').length) {
+      form_field.find('[data-behaviour="permission-check-all"]').prop('checked', true)
+    }
+    else {
+      form_field.find('[data-behaviour="permission-check-all"]').prop('checked', false)
+    }
+  }
+);
+
+$(document).on(
+  "click",
+  '[data-behaviour="permission-check-all"]',
+  function (e) {
+    var form_field = $(this).closest('.form-field')
+    if($(this).is(':checked')){
+      form_field.find('[data-behaviour="permission-check-box"]').prop('checked', true)
+      form_field.find('.cm-select-tag').removeClass('hidden')
+    } else {
+      form_field.find('[data-behaviour="permission-check-box"]').prop('checked', false)
+      form_field.find('.cm-select-tag').addClass('hidden')
+    }
+  }
+);
+
 window.addEventListener("popstate", (e) => window.location.reload());
 
 function setup_select_2_ajax() {

data/app/assets/stylesheets/cm_admin/cm_admin.css.scss

@@ -4,6 +4,7 @@
 @import "./helpers/index.scss";
 @import "./pages/import_page";
 @import "./pages/history_page";
+@import "./pages/permission_page";
 @import "./base/table";
 @import "./base/navbar";
 @import "./base/sidebar";

data/app/assets/stylesheets/cm_admin/pages/permission_page.scss

@@ -0,0 +1,28 @@
+.permission-form {
+  // Margin negative since we are using tab as form.
+  margin: -24px !important;
+  .form-container__inner {
+    padding: 16px !important;
+  }
+  .form-check {
+    display: flex;
+    margin-bottom: 16px !important;
+  }
+  .select2-container {
+    width: 124px !important;
+  }
+  &__checkbox-wrapper {
+    padding-top: 6px;
+  }
+
+  .cm-checkbox-label {
+    .action-name {
+      float: left;
+      margin-right: 10px;
+    }
+    .cm-select-tag {
+      float: left;
+    }
+  }
+  
+}

data/app/controllers/cm_admin/resource_controller.rb

@@ -8,6 +8,7 @@ module CmAdmin
     def cm_index(params)
       @current_action = CmAdmin::Models::Action.find_by(@model, name: 'index')
       # Based on the params the filter and pagination object to be set
+      authorize @ar_object, policy_class: "CmAdmin::#{controller_name.classify}Policy".constantize if defined? "CmAdmin::#{controller_name.classify}Policy".constantize
       records = "CmAdmin::#{@model.name}Policy::Scope".constantize.new(Current.user, @model.name.constantize).resolve
       records = apply_scopes(records)
       if (['table', 'card'].include?(params[:view_type]) || [:table, :card].include?(@current_action.view_type))

data/app/models/cm_permission.rb

@@ -0,0 +1,2 @@
+class CmPermission < ApplicationRecord
+end

data/app/models/cm_role.rb

@@ -0,0 +1,9 @@
+class CmRole < ApplicationRecord
+  include CmAdmin::CmRole
+
+  has_many :cm_permissions
+
+  validates :name, uniqueness: true, presence: true
+
+  has_paper_trail
+end

data/app/models/concerns/cm_admin/cm_role.rb

@@ -0,0 +1,56 @@
+module CmAdmin::CmRole
+  extend ActiveSupport::Concern
+  included do
+    cm_admin do
+      actions only: []
+      set_icon "fa fa-database"
+      cm_index do
+        page_title 'Role'
+
+        filter [:name], :search, placeholder: 'Search'
+
+        column :name
+        column :created_at, field_type: :date, format: '%d %b, %Y'
+        column :updated_at, field_type: :date, format: '%d %b, %Y'
+      end
+
+      cm_show page_title: :name do
+        custom_action name: 'create_role_permission', route_type: 'member', verb: 'post', path: ':id/create_role_permission',
+                      display_type: :route do
+          # allowed_params = params.permit(role_permission: []).to_h
+          @role = CmRole.find(params[:id])
+          params[:role_permission].except(:submit).each do |model_name, action_arr|
+            @role.cm_permissions.where(ar_model_name: model_name).where.not(action_name: action_arr.select{ |k,v| k if v.has_key?('is_checked')}.keys).destroy_all
+            action_arr.each do |action_name, selected_option|
+              if selected_option.has_key?('is_checked')
+                permission = @role.cm_permissions.where(action_name: action_name, ar_model_name: model_name).first_or_create
+                permission.update(scope_name: selected_option['scope_name'])
+              end
+            end
+          end
+          @role
+        end
+        tab :profile, '' do
+          cm_show_section 'Role details' do
+            field :name
+            field :created_at, field_type: :date, format: '%d %b, %Y'
+            field :updated_at, field_type: :date, format: '%d %b, %Y'    
+          end
+        end
+        tab :permissions, 'permissions', layout_type: 'cm_association_show', partial: '/cm_admin/roles/permissions'
+      end
+
+      cm_new page_title: 'Add Role', page_description: 'Enter all details to add role' do
+        cm_section 'Details' do
+          form_field :name, input_type: :string
+        end
+      end
+
+      cm_edit page_title: 'Edit Role', page_description: 'Enter all details to edit role' do
+        cm_section 'Details' do
+          form_field :name, input_type: :string
+        end
+      end
+    end
+  end
+end

data/app/views/cm_admin/roles/permissions.html.slim

@@ -0,0 +1,37 @@
+.form-page.permission-form
+  .form-page__body
+    .form-container
+      = form_for CmPermission.new, url: cm_admin.send('cm_role_create_role_permission_path', @ar_object), method: :post do |f|
+        - CmAdmin.config.cm_admin_models.each do |model|
+          - next if model.override_policy == true
+          .row
+            .col.form-container
+              p.form-title
+                = model.model_name
+              .form-container__inner
+                .row
+                  .col
+                    .form-field.disabled
+                      .form-check
+                        .permission-form__checkbox-wrapper
+                          - saved_permission = @ar_object.cm_permissions.where(ar_model_name: model.name)
+                          - available_actions = model.available_actions.reject {|x| ['custom_action_modal', 'custom_action', 'create', 'update'].include?(x.name)}
+                          - is_checked = (saved_permission.count == available_actions.count)
+                          input.form-check-input[type="checkbox" value="" data-behaviour="permission-check-all" checked=is_checked]
+                          .cm-checkbox-label
+                            span.action-name
+                              | All
+                      - model.available_actions.each do |action|
+                        - permission = @ar_object.cm_permissions.where(ar_model_name: model.name, action_name: action.name).first
+                        - unless ['custom_action_modal', 'custom_action', 'create', 'update'].include?(action.name)
+                          .form-check
+                            .permission-form__checkbox-wrapper
+                              input.form-check-input[type="checkbox" value="#{action.name}" checked=permission.present? name="role_permission[#{model.name}][#{action.name}][is_checked]" data-behaviour="permission-check-box"]
+                              .cm-checkbox-label
+                                span.action-name
+                                  = action.display_name || action.name.titleize
+                            .cm-select-tag class="#{permission.present? ? '' : 'hidden'}"
+                              = select_tag(:policy_scope_name, options_for_select(model.policy_scopes.map{|policy_hash| [policy_hash[:display_name], policy_hash[:scope_name]]}, permission&.scope_name), {name: "role_permission[#{model.name}][#{action.name}][scope_name]", class: 'select-2', id: "policy-scope-#{model.name}-#{action.name}"})
+                div
+        = f.submit 'Save Changes', class: "btn-cta"
+        = link_to 'Discard', cm_admin.send('cm_role_index_path'), class: "btn btn-outline-dark ml-10"

data/docs/RoleManagement.md

@@ -0,0 +1,78 @@
+# Role and Permission Management
+
+## Overview
+
+We can manage the roles and permission through CmAdmin. CmAdmin creates pundit policies dynamically and helps us the manage the permission through a interface. 
+
+## Features
+
+- **Create Role:** We can create any role we want on the application
+- **Manage Permissions:** All the possible actions are listed for each role and we can enable or disable permission for each role.
+
+## Usage
+
+- To add role and permission table
+
+```
+  rake cm_admin:install_role
+```
+
+- Rake task creates a default migration
+
+- Create a role column on the user table. Note: The column name has to be `cm_role_id` else policy will fail
+
+```
+rails g migration AddCmRoleToUser cm_role:references
+```
+
+- Assign the role to the user. Right now only one role can be assigned to a user.
+
+- Assigning the params in the current attribute.
+```
+In the `app/models/current.rb` add request_params as attribure
+
+In the `app/controllers/concerns/authentation.rb` set the request_params. This helps cm-admin identify which action is being performed in the pundit policy.
+
+module Authentication
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :check_current_user
+    before_action :set_params
+  end
+  ...
+  def set_params
+    if params
+      Current.request_params = params
+    end
+  end
+end
+```
+
+
+## Override policy
+
+By default, the Roles and policy gets enabled for all the models on the application. We can override the policy with the following
+
+```
+  ...
+    cm_admin do
+      actions only: []
+      set_icon "fa fa-user"
+      override_pundit_policy true
+      cm_index do
+        page_title 'User'
+  ....
+```
+
+and create a policy file on the application for the respective model. eg: `app/policies/cm_admin/user_policy.rb`
+```
+class CmAdmin::UserPolicy < ApplicationPolicy
+
+
+  def index?
+    true
+  end
+  ...
+end
+```

data/lib/cm_admin/model.rb

@@ -30,7 +30,8 @@ module CmAdmin
     include CmAdmin::Engine.routes.url_helpers
 
     attr_accessor :available_actions, :actions_set, :available_fields, :additional_permitted_fields,
-                  :current_action, :params, :filters, :available_tabs, :icon_name, :bulk_actions, :display_name, :alerts
+                  :current_action, :params, :filters, :available_tabs, :icon_name, :bulk_actions, :display_name,
+                  :policy_scopes, :override_policy, :alerts
     attr_reader :name, :ar_model, :is_visible_on_sidebar, :importer
 
     def initialize(entity, &block)
@@ -45,12 +46,15 @@ module CmAdmin
       @available_tabs ||= []
       @available_fields ||= { index: [], show: [], edit: [], new: [] }
       @params = nil
+      @override_policy = false
       @filters ||= []
+      @policy_scopes ||= [{display_name: 'Full Access', scope_name: 'all'}]
       @alerts = []
       instance_eval(&block) if block_given?
       actions unless @actions_set
       $available_actions = @available_actions.dup
       define_controller
+      define_pundit_policy(@ar_model) unless @override_policy
     end
 
     class << self
@@ -102,6 +106,10 @@ module CmAdmin
       @icon_name = name
     end
 
+    def override_pundit_policy(override_status=false)
+      @override_policy = override_status
+    end
+
     def set_display_name(name)
       @display_name = name
     end
@@ -122,6 +130,10 @@ module CmAdmin
       @display_name.present? ? @display_name : @name
     end
 
+    def set_policy_scopes(scopes=[])
+      @policy_scopes = ([{display_name: 'Full Access', scope_name: 'all'}] + scopes).uniq
+    end
+
     # Shared between export controller and resource controller
     def filter_params(params)
       # OPTIMIZE: Need to check if we can permit the filter_params in a better way
@@ -167,5 +179,45 @@ module CmAdmin
       end if $available_actions.present?
       CmAdmin.const_set "#{@name}Controller", klass
     end
+
+    def define_pundit_policy(ar_model)
+      klass = Class.new(ApplicationPolicy) do
+
+        $available_actions.each do |action|
+          define_method "#{action.name}?".to_sym do
+
+            return false unless Current.user.respond_to?(:cm_role_id)
+            return false if Current.user.cm_role.nil?
+
+            Current.user.cm_role.cm_permissions.where(action_name: action.name, ar_model_name: ar_model.name).present?
+          end
+        end
+
+      end if $available_actions.present?
+      policy = CmAdmin.const_set "#{ar_model.name}Policy", klass
+
+      klass =  Class.new(policy) do
+        def initialize(user, scope)
+          @user = user
+          @scope = scope
+        end
+    
+        define_method :resolve do
+          action_name = Current.request_params.dig("action")
+          permission = Current.user.cm_role.cm_permissions.find_by(action_name: action_name, ar_model_name: ar_model.name)
+          if permission.present? && permission.scope_name.present?
+            scope.send(permission.scope_name)
+          else
+            scope.all
+          end
+        end
+    
+        private
+    
+        attr_reader :user, :scope
+      end
+
+      policy.const_set 'Scope', klass
+    end
   end
 end

data/lib/cm_admin/version.rb

@@ -1,3 +1,3 @@
 module CmAdmin
-  VERSION = '1.5.53'
+  VERSION = '1.5.54'
 end

data/lib/generators/cm_admin/install_role_generator.rb

@@ -0,0 +1,28 @@
+require 'rails/generators'
+
+module CmAdmin
+  module Generators
+    class InstallRoleGenerator < Rails::Generators::Base
+      source_root File.expand_path('templates', __dir__)
+
+      def create_migration
+        generate 'migration', 'CreateCmRole name:string'
+        generate 'migration', 'CreateCmPermission action_name:string action_display_name:string ar_model_name:string scope_name:string cm_role:references'
+        rake 'db:migrate'
+        puts "Created migration"
+      end
+
+      def create_default_role
+        ::CmRole.create(name: 'Admin')
+        CmAdmin.config.cm_admin_models.each do |model|
+          model.available_actions.each do |action|
+            next if ['custom_action_modal', 'custom_action', 'create', 'update'].include?(action.name)
+
+            ::CmRole.find_by(name: 'Admin').cm_permissions.where(ar_model_name: model.name, action_name: action.name).first_or_create!
+          end
+        end
+        puts "Created default role"
+      end
+    end
+  end
+end