codeprimate-cancan 1.6.5

data/init.rb

@@ -0,0 +1 @@
+require 'cancan'

data/lib/cancan.rb

@@ -0,0 +1,13 @@
+require 'cancan/ability'
+require 'cancan/rule'
+require 'cancan/controller_resource'
+require 'cancan/controller_additions'
+require 'cancan/model_additions'
+require 'cancan/exceptions'
+require 'cancan/inherited_resource'
+
+require 'cancan/model_adapters/abstract_adapter'
+require 'cancan/model_adapters/default_adapter'
+require 'cancan/model_adapters/active_record_adapter' if defined? ActiveRecord
+require 'cancan/model_adapters/data_mapper_adapter' if defined? DataMapper
+require 'cancan/model_adapters/mongoid_adapter' if defined?(Mongoid) && defined?(Mongoid::Document)

data/lib/cancan/ability.rb

@@ -0,0 +1,298 @@
+module CanCan
+
+  # This module is designed to be included into an Ability class. This will
+  # provide the "can" methods for defining and checking abilities.
+  #
+  #   class Ability
+  #     include CanCan::Ability
+  #
+  #     def initialize(user)
+  #       if user.admin?
+  #         can :manage, :all
+  #       else
+  #         can :read, :all
+  #       end
+  #     end
+  #   end
+  #
+  module Ability
+    # Check if the user has permission to perform a given action on an object.
+    #
+    #   can? :destroy, @project
+    #
+    # You can also pass the class instead of an instance (if you don't have one handy).
+    #
+    #   can? :create, Project
+    #
+    # Nested resources can be passed through a hash, this way conditions which are
+    # dependent upon the association will work when using a class.
+    #
+    #   can? :create, @category => Project
+    #
+    # Any additional arguments will be passed into the "can" block definition. This
+    # can be used to pass more information about the user's request for example.
+    #
+    #   can? :create, Project, request.remote_ip
+    #
+    #   can :create Project do |project, remote_ip|
+    #     # ...
+    #   end
+    #
+    # Not only can you use the can? method in the controller and view (see ControllerAdditions),
+    # but you can also call it directly on an ability instance.
+    #
+    #   ability.can? :destroy, @project
+    #
+    # This makes testing a user's abilities very easy.
+    #
+    #   def test "user can only destroy projects which he owns"
+    #     user = User.new
+    #     ability = Ability.new(user)
+    #     assert ability.can?(:destroy, Project.new(:user => user))
+    #     assert ability.cannot?(:destroy, Project.new)
+    #   end
+    #
+    # Also see the RSpec Matchers to aid in testing.
+    def can?(action, subject, *extra_args)
+      match = relevant_rules_for_match(action, subject).detect do |rule|
+        rule.matches_conditions?(action, subject, extra_args)
+      end
+      match ? match.base_behavior : false
+    end
+
+    # Convenience method which works the same as "can?" but returns the opposite value.
+    #
+    #   cannot? :destroy, @project
+    #
+    def cannot?(*args)
+      !can?(*args)
+    end
+
+    # Defines which abilities are allowed using two arguments. The first one is the action
+    # you're setting the permission for, the second one is the class of object you're setting it on.
+    #
+    #   can :update, Article
+    #
+    # You can pass an array for either of these parameters to match any one.
+    # Here the user has the ability to update or destroy both articles and comments.
+    #
+    #   can [:update, :destroy], [Article, Comment]
+    #
+    # You can pass :all to match any object and :manage to match any action. Here are some examples.
+    #
+    #   can :manage, :all
+    #   can :update, :all
+    #   can :manage, Project
+    #
+    # You can pass a hash of conditions as the third argument. Here the user can only see active projects which he owns.
+    #
+    #   can :read, Project, :active => true, :user_id => user.id
+    #
+    # See ActiveRecordAdditions#accessible_by for how to use this in database queries. These conditions
+    # are also used for initial attributes when building a record in ControllerAdditions#load_resource.
+    #
+    # If the conditions hash does not give you enough control over defining abilities, you can use a block
+    # along with any Ruby code you want.
+    #
+    #   can :update, Project do |project|
+    #     project.groups.include?(user.group)
+    #   end
+    #
+    # If the block returns true then the user has that :update ability for that project, otherwise he
+    # will be denied access. The downside to using a block is that it cannot be used to generate
+    # conditions for database queries.
+    #
+    # You can pass custom objects into this "can" method, this is usually done with a symbol
+    # and is useful if a class isn't available to define permissions on.
+    #
+    #   can :read, :stats
+    #   can? :read, :stats # => true
+    #
+    # IMPORTANT: Neither a hash of conditions or a block will be used when checking permission on a class.
+    #
+    #   can :update, Project, :priority => 3
+    #   can? :update, Project # => true
+    #
+    # If you pass no arguments to +can+, the action, class, and object will be passed to the block and the
+    # block will always be executed. This allows you to override the full behavior if the permissions are
+    # defined in an external source such as the database.
+    #
+    #   can do |action, object_class, object|
+    #     # check the database and return true/false
+    #   end
+    #
+    def can(action = nil, subject = nil, conditions = nil, &block)
+      rules << Rule.new(true, action, subject, conditions, block)
+    end
+
+    # Defines an ability which cannot be done. Accepts the same arguments as "can".
+    #
+    #   can :read, :all
+    #   cannot :read, Comment
+    #
+    # A block can be passed just like "can", however if the logic is complex it is recommended
+    # to use the "can" method.
+    #
+    #   cannot :read, Product do |product|
+    #     product.invisible?
+    #   end
+    #
+    def cannot(action = nil, subject = nil, conditions = nil, &block)
+      rules << Rule.new(false, action, subject, conditions, block)
+    end
+
+    # Alias one or more actions into another one.
+    #
+    #   alias_action :update, :destroy, :to => :modify
+    #   can :modify, Comment
+    #
+    # Then :modify permission will apply to both :update and :destroy requests.
+    #
+    #   can? :update, Comment # => true
+    #   can? :destroy, Comment # => true
+    #
+    # This only works in one direction. Passing the aliased action into the "can?" call
+    # will not work because aliases are meant to generate more generic actions.
+    #
+    #   alias_action :update, :destroy, :to => :modify
+    #   can :update, Comment
+    #   can? :modify, Comment # => false
+    #
+    # Unless that exact alias is used.
+    #
+    #   can :modify, Comment
+    #   can? :modify, Comment # => true
+    #
+    # The following aliases are added by default for conveniently mapping common controller actions.
+    #
+    #   alias_action :index, :show, :to => :read
+    #   alias_action :new, :to => :create
+    #   alias_action :edit, :to => :update
+    #
+    # This way one can use params[:action] in the controller to determine the permission.
+    def alias_action(*args)
+      target = args.pop[:to]
+      aliased_actions[target] ||= []
+      aliased_actions[target] += args
+    end
+
+    # Returns a hash of aliased actions. The key is the target and the value is an array of actions aliasing the key.
+    def aliased_actions
+      @aliased_actions ||= default_alias_actions
+    end
+
+    # Removes previously aliased actions including the defaults.
+    def clear_aliased_actions
+      @aliased_actions = {}
+    end
+
+    def model_adapter(model_class, action)
+      adapter_class = ModelAdapters::AbstractAdapter.adapter_class(model_class)
+      adapter_class.new(model_class, relevant_rules_for_query(action, model_class))
+    end
+
+    # See ControllerAdditions#authorize! for documentation.
+    def authorize!(action, subject, *args)
+      message = nil
+      if args.last.kind_of?(Hash) && args.last.has_key?(:message)
+        message = args.pop[:message]
+      end
+      if cannot?(action, subject, *args)
+        message ||= unauthorized_message(action, subject)
+        raise AccessDenied.new(message, action, subject)
+      end
+      subject
+    end
+
+    def unauthorized_message(action, subject)
+      keys = unauthorized_message_keys(action, subject)
+      variables = {:action => action.to_s}
+      variables[:subject] = (subject.class == Class ? subject : subject.class).to_s.underscore.humanize.downcase
+      message = I18n.translate(nil, variables.merge(:scope => :unauthorized, :default => keys + [""]))
+      message.blank? ? nil : message
+    end
+
+    def attributes_for(action, subject)
+      attributes = {}
+      relevant_rules(action, subject).map do |rule|
+        attributes.merge!(rule.attributes_from_conditions) if rule.base_behavior
+      end
+      attributes
+    end
+
+    def has_block?(action, subject)
+      relevant_rules(action, subject).any?(&:only_block?)
+    end
+
+    def has_raw_sql?(action, subject)
+      relevant_rules(action, subject).any?(&:only_raw_sql?)
+    end
+
+    private
+
+    def unauthorized_message_keys(action, subject)
+      subject = (subject.class == Class ? subject : subject.class).name.underscore unless subject.kind_of? Symbol
+      [subject, :all].map do |try_subject|
+        [aliases_for_action(action), :manage].flatten.map do |try_action|
+          :"#{try_action}.#{try_subject}"
+        end
+      end.flatten
+    end
+
+    # Accepts an array of actions and returns an array of actions which match.
+    # This should be called before "matches?" and other checking methods since they
+    # rely on the actions to be expanded.
+    def expand_actions(actions)
+      actions.map do |action|
+        aliased_actions[action] ? [action, *expand_actions(aliased_actions[action])] : action
+      end.flatten
+    end
+
+    # Given an action, it will try to find all of the actions which are aliased to it.
+    # This does the opposite kind of lookup as expand_actions.
+    def aliases_for_action(action)
+      results = [action]
+      aliased_actions.each do |aliased_action, actions|
+        results += aliases_for_action(aliased_action) if actions.include? action
+      end
+      results
+    end
+
+    def rules
+      @rules ||= []
+    end
+
+    # Returns an array of Rule instances which match the action and subject
+    # This does not take into consideration any hash conditions or block statements
+    def relevant_rules(action, subject)
+      rules.reverse.select do |rule|
+        rule.expanded_actions = expand_actions(rule.actions)
+        rule.relevant? action, subject
+      end
+    end
+
+    def relevant_rules_for_match(action, subject)
+      relevant_rules(action, subject).each do |rule|
+        if rule.only_raw_sql?
+          raise Error, "The can? and cannot? call cannot be used with a raw sql 'can' definition. The checking code cannot be determined for #{action.inspect} #{subject.inspect}"
+        end
+      end
+    end
+
+    def relevant_rules_for_query(action, subject)
+      relevant_rules(action, subject).each do |rule|
+        if rule.only_block?
+          raise Error, "The accessible_by call cannot be used with a block 'can' definition. The SQL cannot be determined for #{action.inspect} #{subject.inspect}"
+        end
+      end
+    end
+
+    def default_alias_actions
+      {
+        :read => [:index, :show],
+        :create => [:new],
+        :update => [:edit],
+      }
+    end
+  end
+end

data/lib/cancan/controller_additions.rb

@@ -0,0 +1,389 @@
+module CanCan
+
+  # This module is automatically included into all controllers.
+  # It also makes the "can?" and "cannot?" methods available to all views.
+  module ControllerAdditions
+    module ClassMethods
+      # Sets up a before filter which loads and authorizes the current resource. This performs both
+      # load_resource and authorize_resource and accepts the same arguments. See those methods for details.
+      #
+      #   class BooksController < ApplicationController
+      #     load_and_authorize_resource
+      #   end
+      #
+      def load_and_authorize_resource(*args)
+        cancan_resource_class.add_before_filter(self, :load_and_authorize_resource, *args)
+      end
+
+      # Sets up a before filter which loads the model resource into an instance variable.
+      # For example, given an ArticlesController it will load the current article into the @article
+      # instance variable. It does this by either calling Article.find(params[:id]) or
+      # Article.new(params[:article]) depending upon the action. The index action will
+      # automatically set @articles to Article.accessible_by(current_ability).
+      #
+      # If a conditions hash is used in the Ability, the +new+ and +create+ actions will set
+      # the initial attributes based on these conditions. This way these actions will satisfy
+      # the ability restrictions.
+      #
+      # Call this method directly on the controller class.
+      #
+      #   class BooksController < ApplicationController
+      #     load_resource
+      #   end
+      #
+      # A resource is not loaded if the instance variable is already set. This makes it easy to override
+      # the behavior through a before_filter on certain actions.
+      #
+      #   class BooksController < ApplicationController
+      #     before_filter :find_book_by_permalink, :only => :show
+      #     load_resource
+      #
+      #     private
+      #
+      #     def find_book_by_permalink
+      #       @book = Book.find_by_permalink!(params[:id)
+      #     end
+      #   end
+      #
+      # If a name is provided which does not match the controller it assumes it is a parent resource. Child
+      # resources can then be loaded through it.
+      #
+      #   class BooksController < ApplicationController
+      #     load_resource :author
+      #     load_resource :book, :through => :author
+      #   end
+      #
+      # Here the author resource will be loaded before each action using params[:author_id]. The book resource
+      # will then be loaded through the @author instance variable.
+      #
+      # That first argument is optional and will default to the singular name of the controller.
+      # A hash of options (see below) can also be passed to this method to further customize it.
+      #
+      # See load_and_authorize_resource to automatically authorize the resource too.
+      #
+      # Options:
+      # [:+only+]
+      #   Only applies before filter to given actions.
+      #
+      # [:+except+]
+      #   Does not apply before filter to given actions.
+      #
+      # [:+through+]
+      #   Load this resource through another one. This should match the name of the parent instance variable or method.
+      #
+      # [:+through_association+]
+      #   The name of the association to fetch the child records through the parent resource. This is normally not needed
+      #   because it defaults to the pluralized resource name.
+      #
+      # [:+shallow+]
+      #   Pass +true+ to allow this resource to be loaded directly when parent is +nil+. Defaults to +false+.
+      #
+      # [:+singleton+]
+      #   Pass +true+ if this is a singleton resource through a +has_one+ association.
+      #
+      # [:+parent+]
+      #   True or false depending on if the resource is considered a parent resource. This defaults to +true+ if a resource
+      #   name is given which does not match the controller.
+      #
+      # [:+class+]
+      #   The class to use for the model (string or constant).
+      #
+      # [:+instance_name+]
+      #   The name of the instance variable to load the resource into.
+      #
+      # [:+find_by+]
+      #   Find using a different attribute other than id. For example.
+      #
+      #     load_resource :find_by => :permalink # will use find_by_permlink!(params[:id])
+      #
+      # [:+collection+]
+      #   Specify which actions are resource collection actions in addition to :+index+. This
+      #   is usually not necessary because it will try to guess depending on if the id param is present.
+      #
+      #     load_resource :collection => [:sort, :list]
+      #
+      # [:+new+]
+      #   Specify which actions are new resource actions in addition to :+new+ and :+create+.
+      #   Pass an action name into here if you would like to build a new resource instead of
+      #   fetch one.
+      #
+      #     load_resource :new => :build
+      #
+      # [:+prepend+]
+      #   Passing +true+ will use prepend_before_filter instead of a normal before_filter.
+      #
+      def load_resource(*args)
+        cancan_resource_class.add_before_filter(self, :load_resource, *args)
+      end
+
+      # Sets up a before filter which authorizes the resource using the instance variable.
+      # For example, if you have an ArticlesController it will check the @article instance variable
+      # and ensure the user can perform the current action on it. Under the hood it is doing
+      # something like the following.
+      #
+      #   authorize!(params[:action].to_sym, @article || Article)
+      #
+      # Call this method directly on the controller class.
+      #
+      #   class BooksController < ApplicationController
+      #     authorize_resource
+      #   end
+      #
+      # If you pass in the name of a resource which does not match the controller it will assume
+      # it is a parent resource.
+      #
+      #   class BooksController < ApplicationController
+      #     authorize_resource :author
+      #     authorize_resource :book
+      #   end
+      #
+      # Here it will authorize :+show+, @+author+ on every action before authorizing the book.
+      #
+      # That first argument is optional and will default to the singular name of the controller.
+      # A hash of options (see below) can also be passed to this method to further customize it.
+      #
+      # See load_and_authorize_resource to automatically load the resource too.
+      #
+      # Options:
+      # [:+only+]
+      #   Only applies before filter to given actions.
+      #
+      # [:+except+]
+      #   Does not apply before filter to given actions.
+      #
+      # [:+parent+]
+      #   True or false depending on if the resource is considered a parent resource. This defaults to +true+ if a resource
+      #   name is given which does not match the controller.
+      #
+      # [:+class+]
+      #   The class to use for the model (string or constant). This passed in when the instance variable is not set.
+      #   Pass +false+ if there is no associated class for this resource and it will use a symbol of the resource name.
+      #
+      # [:+instance_name+]
+      #   The name of the instance variable for this resource.
+      #
+      # [:+through+]
+      #   Authorize conditions on this parent resource when instance isn't available.
+      #
+      # [:+prepend+]
+      #   Passing +true+ will use prepend_before_filter instead of a normal before_filter.
+      #
+      def authorize_resource(*args)
+        cancan_resource_class.add_before_filter(self, :authorize_resource, *args)
+      end
+
+      # Skip both the loading and authorization behavior of CanCan for this given controller. This is primarily
+      # useful to skip the behavior of a superclass. You can pass :only and :except options to specify which actions
+      # to skip the effects on. It will apply to all actions by default.
+      #
+      #   class ProjectsController < SomeOtherController
+      #     skip_load_and_authorize_resource :only => :index
+      #   end
+      #
+      # You can also pass the resource name as the first argument to skip that resource.
+      def skip_load_and_authorize_resource(*args)
+        skip_load_resource(*args)
+        skip_authorize_resource(*args)
+      end
+
+      # Skip the loading behavior of CanCan. This is useful when using +load_and_authorize_resource+ but want to
+      # only do authorization on certain actions. You can pass :only and :except options to specify which actions to
+      # skip the effects on. It will apply to all actions by default.
+      #
+      #   class ProjectsController < ApplicationController
+      #     load_and_authorize_resource
+      #     skip_load_resource :only => :index
+      #   end
+      #
+      # You can also pass the resource name as the first argument to skip that resource.
+      def skip_load_resource(*args)
+        options = args.extract_options!
+        name = args.first
+        cancan_skipper[:load][name] = options
+      end
+
+      # Skip the authorization behavior of CanCan. This is useful when using +load_and_authorize_resource+ but want to
+      # only do loading on certain actions. You can pass :only and :except options to specify which actions to
+      # skip the effects on. It will apply to all actions by default.
+      #
+      #   class ProjectsController < ApplicationController
+      #     load_and_authorize_resource
+      #     skip_authorize_resource :only => :index
+      #   end
+      #
+      # You can also pass the resource name as the first argument to skip that resource.
+      def skip_authorize_resource(*args)
+        options = args.extract_options!
+        name = args.first
+        cancan_skipper[:authorize][name] = options
+      end
+
+      # Add this to a controller to ensure it performs authorization through +authorized+! or +authorize_resource+ call.
+      # If neither of these authorization methods are called, a CanCan::AuthorizationNotPerformed exception will be raised.
+      # This is normally added to the ApplicationController to ensure all controller actions do authorization.
+      #
+      #   class ApplicationController < ActionController::Base
+      #     check_authorization
+      #   end
+      #
+      # See skip_authorization_check to bypass this check on specific controller actions.
+      #
+      # Options:
+      # [:+only+]
+      #   Only applies to given actions.
+      #
+      # [:+except+]
+      #   Does not apply to given actions.
+      #
+      # [:+if+]
+      #   Supply the name of a controller method to be called. The authorization check only takes place if this returns true.
+      #
+      #     check_authorization :if => :admin_controller?
+      #
+      # [:+unless+]
+      #   Supply the name of a controller method to be called. The authorization check only takes place if this returns false.
+      #
+      #     check_authorization :unless => :devise_controller?
+      #
+      def check_authorization(options = {})
+        self.after_filter(options.slice(:only, :except)) do |controller|
+          next if controller.instance_variable_defined?(:@_authorized)
+          next if options[:if] && !controller.send(options[:if])
+          next if options[:unless] && controller.send(options[:unless])
+          raise AuthorizationNotPerformed, "This action failed the check_authorization because it does not authorize_resource. Add skip_authorization_check to bypass this check."
+        end
+      end
+
+      # Call this in the class of a controller to skip the check_authorization behavior on the actions.
+      #
+      #   class HomeController < ApplicationController
+      #     skip_authorization_check :only => :index
+      #   end
+      #
+      # Any arguments are passed to the +before_filter+ it triggers.
+      def skip_authorization_check(*args)
+        self.before_filter(*args) do |controller|
+          controller.instance_variable_set(:@_authorized, true)
+        end
+      end
+
+      def skip_authorization(*args)
+        raise ImplementationRemoved, "The CanCan skip_authorization method has been renamed to skip_authorization_check. Please update your code."
+      end
+
+      def cancan_resource_class
+        if ancestors.map(&:to_s).include? "InheritedResources::Actions"
+          InheritedResource
+        else
+          ControllerResource
+        end
+      end
+
+      def cancan_skipper
+        @_cancan_skipper ||= {:authorize => {}, :load => {}}
+      end
+    end
+
+    def self.included(base)
+      base.extend ClassMethods
+      base.helper_method :can?, :cannot?, :current_ability
+    end
+
+    # Raises a CanCan::AccessDenied exception if the current_ability cannot
+    # perform the given action. This is usually called in a controller action or
+    # before filter to perform the authorization.
+    #
+    #   def show
+    #     @article = Article.find(params[:id])
+    #     authorize! :read, @article
+    #   end
+    #
+    # A :message option can be passed to specify a different message.
+    #
+    #   authorize! :read, @article, :message => "Not authorized to read #{@article.name}"
+    #
+    # You can also use I18n to customize the message. Action aliases defined in Ability work here.
+    #
+    #   en:
+    #     unauthorized:
+    #       manage:
+    #         all: "Not authorized to %{action} %{subject}."
+    #         user: "Not allowed to manage other user accounts."
+    #       update:
+    #         project: "Not allowed to update this project."
+    #
+    # You can rescue from the exception in the controller to customize how unauthorized
+    # access is displayed to the user.
+    #
+    #   class ApplicationController < ActionController::Base
+    #     rescue_from CanCan::AccessDenied do |exception|
+    #       redirect_to root_url, :alert => exception.message
+    #     end
+    #   end
+    #
+    # See the CanCan::AccessDenied exception for more details on working with the exception.
+    #
+    # See the load_and_authorize_resource method to automatically add the authorize! behavior
+    # to the default RESTful actions.
+    def authorize!(*args)
+      @_authorized = true
+      current_ability.authorize!(*args)
+    end
+
+    def unauthorized!(message = nil)
+      raise ImplementationRemoved, "The unauthorized! method has been removed from CanCan, use authorize! instead."
+    end
+
+    # Creates and returns the current user's ability and caches it. If you
+    # want to override how the Ability is defined then this is the place.
+    # Just define the method in the controller to change behavior.
+    #
+    #   def current_ability
+    #     # instead of Ability.new(current_user)
+    #     @current_ability ||= UserAbility.new(current_account)
+    #   end
+    #
+    # Notice it is important to cache the ability object so it is not
+    # recreated every time.
+    def current_ability
+      @current_ability ||= ::Ability.new(current_user)
+    end
+
+    # Use in the controller or view to check the user's permission for a given action
+    # and object.
+    #
+    #   can? :destroy, @project
+    #
+    # You can also pass the class instead of an instance (if you don't have one handy).
+    #
+    #   <% if can? :create, Project %>
+    #     <%= link_to "New Project", new_project_path %>
+    #   <% end %>
+    #
+    # If it's a nested resource, you can pass the parent instance in a hash. This way it will
+    # check conditions which reach through that association.
+    #
+    #   <% if can? :create, @category => Project %>
+    #     <%= link_to "New Project", new_project_path %>
+    #   <% end %>
+    #
+    # This simply calls "can?" on the current_ability. See Ability#can?.
+    def can?(*args)
+      current_ability.can?(*args)
+    end
+
+    # Convenience method which works the same as "can?" but returns the opposite value.
+    #
+    #   cannot? :destroy, @project
+    #
+    def cannot?(*args)
+      current_ability.cannot?(*args)
+    end
+  end
+end
+
+if defined? ActionController
+  ActionController::Base.class_eval do
+    include CanCan::ControllerAdditions
+  end
+end