controlist 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 224e42ca7d06b607134503d787c8e37b4960f936
-  data.tar.gz: 0bfc1f31babcb7d2560d331321388480b5dbc207
+  metadata.gz: 641ff1fb7c170c5e3d33641eebb63e8d6ab42fcc
+  data.tar.gz: beb6c94f12192612b39df5b868ecc77a999eef68
 SHA512:
-  metadata.gz: e5283e1ddeb54abf1618664170e0262e0fe97ce30d38c7bd6e4d49c6b4378e2866ecca5d134cd815ad481c02ba36a9857ea90deb2e75cf2e62c204d121cecefe
-  data.tar.gz: 2b5d09192b442afbcd3c0c86cbc4584e3f781b79d7180722f4f275c5f17e6e05b0eb38a3c78d6751eebda873e1719ce9d4c371a78a4f865b37782bb4dd7e23d9
+  metadata.gz: 65809c604627384c839c55d55eae91dab922cb6c95999d129bf196647073d0bb5e5c4dd009708f4f5620ce5465d8ca5d3d54c832a5a6a4d07dd004ce47f7704a
+  data.tar.gz: 86817ef4ae15ce9409f099c54a8cf0913c4a2ff6d063fa85c7e3e86535e7005969acad42eda4e8e67e21abfffecb7754757b6a85778ae050e75ef38401c9ec76

data/README.md

@@ -59,7 +59,7 @@ Controlist.initialize YourManager #, attribute_proxy: "_val", value_object_proxy
 ## Example
 
 ```ruby
-Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+Controlist.permission_manager.set_permission_package(OrderedPackage.new(
   Controlist::Permission.new(User, READ, true, [
     SimpleConstrain.new("name", "Tom"),
     SimpleConstrain.new("name", ["Grade 1", "Grade 2"], relation: "clazz"),

data/lib/controlist.rb

@@ -8,10 +8,10 @@ module Controlist
 
   class << self
 
-    attr_accessor :permission_provider, :attribute_proxy, :value_object_proxy, :logger
+    attr_accessor :permission_manager, :attribute_proxy, :value_object_proxy, :logger
 
-    def initialize(permission_provider, config={})
-      @permission_provider = permission_provider
+    def initialize(permission_manager, config={})
+      @permission_manager = permission_manager
       @attribute_proxy = config[:attribute_proxy] || "_val"
       @value_object_proxy = config[:value_object_proxy] || "_value_object"
       @logger = config[:logger] || Logger.new(STDOUT)
@@ -19,14 +19,23 @@ module Controlist
     end
 
     def skip
-      @permission_provider.open_skip
-      yield
-      @permission_provider.close_skip
+      @permission_manager.enable_skip
+      result = yield
+      @permission_manager.disable_skip
+      result
     end
 
     def is_activerecord3?
       ActiveRecord::VERSION::MAJOR == 3
     end
+
+    def debug(*args, &block)
+      logger.debug *args, &block if @logger_enabled
+    end
+
+    def enable_logger
+      @logger_enabled = true
+    end
   end
 
 end

data/lib/controlist/interceptor.rb

@@ -56,9 +56,9 @@ module Controlist
           Array(methods).each do |method|
             ActiveRecord::Persistence.module_eval %Q{
               def #{method}_with_controlist(*args)
-                permission_provider = Controlist.permission_provider
-                unless permission_provider.skip?
-                  permission_package = permission_provider.get_permission_package
+                permission_manager = Controlist.permission_manager
+                unless permission_manager.skip?
+                  permission_package = permission_manager.get_permission_package
                   permissions = permission_package.list_#{operation}[self.class] if permission_package
                   if permissions.blank?
                     raise NoPermissionError
@@ -67,7 +67,7 @@ module Controlist
                     matched_permission = nil
                     permissions.each do |permission|
                       if permission.match_for_persistence(self, Controlist::Permission::#{operation.upcase})
-                        Controlist.logger.debug{"Controlist matched to \#{permission.is_allowed ? 'allow' : 'forbid'} \#{permission.inspect}"}
+                        Controlist.debug{"Controlist matched to \#{permission.is_allowed ? 'allow' : 'forbid'} \#{permission.inspect}"}
                         if permission.is_allowed
                           passed = true
                         end
@@ -76,9 +76,9 @@ module Controlist
                       end
                     end
                     if passed
-                      Controlist.logger.debug{"Controlist #{operation} checked: PASSED"}
+                      Controlist.debug{"Controlist #{operation} checked: PASSED"}
                     else
-                      Controlist.logger.debug{"Controlist #{operation} checked: FORBIDDEN"}
+                      Controlist.debug{"Controlist #{operation} checked: FORBIDDEN"}
                       if matched_permission.nil?
                         raise NoPermissionError
                       else
@@ -98,18 +98,9 @@ module Controlist
     def hook_read
       if Controlist.is_activerecord3?
         ActiveRecord::QueryMethods.module_eval do
-          def where!(opts, *rest)
-            return if opts.blank?
-            self.where_values += build_where(opts, rest)
-          end
           def _select!(*value)
             self.select_values += Array.wrap(value)
           end
-          def joins!(*args)
-            return if args.compact.blank?
-            args.flatten!
-            self.joins_values += args
-          end
         end
         ActiveRecord::IdentityMap.module_eval do
           def self.enabled?
@@ -131,31 +122,26 @@ module Controlist
         end
       end
       ActiveRecord::Relation.class_eval do
+        def real_build_arel_with_controlist
+          relation = self
+          permission_manager = Controlist.permission_manager
+          permission_package = permission_manager.get_permission_package
+          permissions = permission_package.list_read[@klass] if permission_package
+          if permissions.blank?
+            relation = self.where("1 != 1")
+          else
+            permissions.each do |permission|
+              relation = permission.handle_for_read relation
+            end
+          end
+          relation.send(:build_arel_without_controlist)
+        end
         def build_arel_with_controlist
-          permission_provider = Controlist.permission_provider
-          if permission_provider.skip? || @controlist_processing
+          permission_manager = Controlist.permission_manager
+          if permission_manager.skip?
             build_arel_without_controlist
           else
-            if @controlist_done
-              raise Controlist::NotReuseableError.new("The relation has built a sql, you can't reuse it, or you can clone it before sql building", self)
-            else
-              @controlist_processing = true
-              permission_provider = Controlist.permission_provider
-              unless permission_provider.skip?
-                permission_package = permission_provider.get_permission_package
-                permissions = permission_package.list_read[@klass] if permission_package
-                if permissions.blank?
-                  self.where!("1 != 1")
-                else
-                  permissions.each do |permission|
-                    permission.handle_for_read self
-                  end
-                end
-              end
-              @controlist_processing = false
-              @controlist_done = true
-              build_arel_without_controlist
-            end
+            self.real_build_arel_with_controlist
           end
         end
         alias_method_chain :build_arel, :controlist unless method_defined? :build_arel_without_controlist

data/lib/controlist/managers/base_manager.rb

@@ -16,11 +16,11 @@ module Controlist
           raise NotImplementedError
         end
 
-        def open_skip
+        def enable_skip
           raise NotImplementedError
         end
 
-        def close_skip
+        def disable_skip
           raise NotImplementedError
         end
 

data/lib/controlist/managers/thread_based_manager.rb

@@ -16,11 +16,11 @@ module Controlist
           Thread.current[:skip_controlist] == true
         end
 
-        def open_skip
+        def enable_skip
           Thread.current[:skip_controlist] = true
         end
 
-        def close_skip
+        def disable_skip
           Thread.current[:skip_controlist] = nil
         end
 

data/lib/controlist/permission.rb

@@ -10,7 +10,7 @@ module Controlist
     # properties is hash with property and value pair, operation READ only need keys
     attr_accessor :klass, :operations, :is_allowed, :constrains, :clause, :joins, :properties, :procs_read
 
-    def initialize(klass, operations, is_allowed = true, constrains=nil)
+    def initialize(klass, operations=nil, is_allowed = true, constrains=nil)
       self.procs_read = []
       self.klass = klass
       unless operations.nil?
@@ -49,17 +49,14 @@ module Controlist
 
     def handle_for_read(relation)
       relation._select!(*self.properties.keys) unless self.properties.blank?
-      relation.joins!(*self.joins) if self.joins.size > 0
-      relation.where!("#{self.clause}") if self.clause
+      relation = relation.joins(*self.joins) if self.joins.size > 0
+      relation = relation.where("#{self.clause}") if self.clause
       unless self.procs_read.blank?
-        # Only support ActiveRecord 4
-        merging_relation = self.klass.unscoped
         self.procs_read.each do |proc|
-          merging_relation = proc.call(merging_relation)
+          relation = proc.call(relation)
         end
-        ActiveRecord::Relation::Merger.new(relation, merging_relation).merge
       end
-
+      relation
     end
 
     def match_for_persistence(object, operation)
@@ -78,7 +75,7 @@ module Controlist
           break
         end
       end
-      Controlist.logger.debug{"Controlist #{operation} properties checked: #{properties_matched}"}
+      Controlist.debug{"Controlist #{operation} properties checked: #{properties_matched}"}
       properties_matched
     end
 
@@ -108,7 +105,7 @@ module Controlist
           inner_matched
         end
       end
-      Controlist.logger.debug{"Controlist #{operation} constrains checked: #{constrain_matched}"}
+      Controlist.debug{"Controlist #{operation} constrains checked: #{constrain_matched}"}
       constrain_matched
     end
 
@@ -127,11 +124,15 @@ module Controlist
       self.constrains = constrains
     end
 
-    def match_value(left, right, operator)
+    def match_value(target, value, operator)
       if operator.nil?
-        left == right
+        if value.is_a? Array
+          value.include? target
+        else
+          target == value
+        end
       else
-        left.send(operator.to_sym, right)
+        target.send(operator.to_sym, value)
       end
     end
 

data/lib/controlist/permissions/advanced_constrain.rb

@@ -10,12 +10,8 @@ module Controlist
         self.table_name = hash[:table_name]
         self.operator = hash[:operator]
         self.clause = hash[:clause]
-        if Controlist.is_activerecord3? && (hash.has_key?(:proc_read) || hash.has_key?(:proc_persistence))
-          raise NotImplementedError, "Skip proc_read and proc_persistence, that features only be supported in ActiveRecord 4 or later"
-        else
-          self.proc_read = hash[:proc_read]
-          self.proc_persistence = hash[:proc_persistence]
-        end
+        self.proc_read = hash[:proc_read]
+        self.proc_persistence = hash[:proc_persistence]
       end
 
     end

data/lib/controlist/version.rb

@@ -1,3 +1,3 @@
 module Controlist
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

data/test/feature_test.rb

@@ -20,7 +20,7 @@ class FeatureTest < ActiveSupport::TestCase
   end
 
   def test_read_constrains
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(User, READ, true, [
         SimpleConstrain.new("name", "Tom"),
         AdvancedConstrain.new(property: "name", value: ["Grade 1", "Grade 2"], relation: "clazz"),
@@ -29,40 +29,34 @@ class FeatureTest < ActiveSupport::TestCase
         SimpleConstrain.new("age", [1,2,3]),
         SimpleConstrain.new("clazz_id", -> { Clazz.select(:id).map(&:id) }),
         AdvancedConstrain.new(clause: "age != 100"),
-        Controlist.is_activerecord3? ?  nil : AdvancedConstrain.new(proc_read: lambda{|relation| relation.order("id DESC").limit(3) })
+        AdvancedConstrain.new(proc_read: lambda{|relation| relation.order("id DESC").limit(3) })
       ])))
 
     relation = User.unscoped
-    relation.to_sql
-    assert_equal [:clazz], relation.joins_values
-    assert_equal ["(users.name = 'Tom') and (clazzs.name in ('Grade 1','Grade 2'))" +
-                  " and (users.age >= 5) and (users.age is null) and (users.age in (1,2,3))" +
-                  " and (users.clazz_id in (1,2)) and (age != 100)"], relation.where_values
-    unless Controlist.is_activerecord3?
-      assert_equal 3, relation.limit_value
-      assert_equal ["id DESC"], relation.order_values
-    end
+    sql = relation.to_sql.gsub(/ +/, " ")
+    puts sql
+    assert_equal true, sql.include?("((users.name = 'Tom') and (clazzs.name in ('Grade 1','Grade 2')) and (users.age >= 5) and (users.age is null) and (users.age in (1,2,3)) and (users.clazz_id in (1,2,3)) and (age != 100)) ORDER BY id DESC LIMIT 3")
   end
 
   def test_permission_empty
-    Controlist.permission_provider.set_permission_package(nil)
+    Controlist.permission_manager.set_permission_package(nil)
     relation = User.unscoped
-    relation.to_sql
-    assert_equal ["1 != 1"], relation.where_values
+    sql = relation.to_sql
+    assert_equal true, sql.include?("1 != 1")
   end
 
   def test_read_constrains_sql_only
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(User, READ, true, "age != 100")
     ))
     relation = User.unscoped
-    relation.to_sql
-    assert_equal ["age != 100"], relation.where_values
+    sql = relation.to_sql
+    assert_equal true, sql.include?("age != 100")
   end
 
 
   def test_read_apply_properties
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(User, READ).apply(:name)
     ))
 
@@ -70,7 +64,7 @@ class FeatureTest < ActiveSupport::TestCase
     assert_nil relation.first._value_object.clazz_id
     assert_nil relation.first._val(:clazz_id)
     assert_raise(ActiveModel::MissingAttributeError) { assert_nil relation.first.clazz_id }
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(User, READ)
     ))
 
@@ -81,7 +75,7 @@ class FeatureTest < ActiveSupport::TestCase
   end
 
   def test_update_fail_without_permissions
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(User, READ)
     ))
     user = User.find 1
@@ -92,33 +86,32 @@ class FeatureTest < ActiveSupport::TestCase
   end
 
   def test_persistence_constrains
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(Clazz, READ),
       Controlist::Permission.new(User, READ),
       Controlist::Permission.new(User, UPDATE, false, AdvancedConstrain.new(property: "name", value: "To", operator: "include?")),
-      Controlist.is_activerecord3? ?  nil : Controlist::Permission.new(User, UPDATE, false, AdvancedConstrain.new(proc_persistence: lambda{|object, operation| object.name == "Block"})),
-      Controlist::Permission.new(User, [UPDATE, DELETE], false, AdvancedConstrain.new(property: "name", value: "Grade 1", relation: "clazz")),
+      Controlist::Permission.new(User, UPDATE, false, AdvancedConstrain.new(proc_persistence: lambda{|object, operation| object.name == "Block"})),
+      Controlist::Permission.new(User, [UPDATE, DELETE], false, AdvancedConstrain.new(property: "name", value: ["Grade 1", "Grade 3"], relation: "clazz")),
       Controlist::Permission.new(User, UPDATE)
     ))
 
     user = User.find 3
     assert_not_equal "Tom", user.name
     assert_not_equal "Grade 1", user.clazz.name
+    assert_not_equal "Grade 3", user.clazz.name
     user.name = "Test"
     assert_equal true, user.save
 
-    unless Controlist.is_activerecord3?
-      assert_raise(Controlist::PermissionForbidden) {
-        user.name = "Block"
-        user.save
-      }
-    end
+    assert_raise(Controlist::PermissionForbidden) {
+      user.name = "Block"
+      user.save
+    }
 
     assert_raise(Controlist::NoPermissionError) {
       user.destroy
     }
 
-    Controlist.permission_provider.get_permission_package.add_permissions(Controlist::Permission.new(User, DELETE))
+    Controlist.permission_manager.get_permission_package.add_permissions(Controlist::Permission.new(User, DELETE))
     assert_instance_of User, user.destroy
 
     assert_raise(Controlist::PermissionForbidden) {
@@ -144,7 +137,7 @@ class FeatureTest < ActiveSupport::TestCase
   end
 
   def test_persistence_apply_properties
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(User, READ),
       Controlist::Permission.new(User, UPDATE, true, SimpleConstrain.new("name", "Tom")).apply(name: "Test", clazz_id: [1, 2]),
     ))
@@ -180,13 +173,13 @@ class FeatureTest < ActiveSupport::TestCase
   end
 
   def test_modify_permissions_on_the_fly
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(User, READ),
     ))
 
     assert_instance_of User, User.find(1)
 
-    package = Controlist.permission_provider.get_permission_package
+    package = Controlist.permission_manager.get_permission_package
     package.remove_permissions package.permissions.last
 
     assert_raise(ActiveRecord::RecordNotFound) {
@@ -199,34 +192,20 @@ class FeatureTest < ActiveSupport::TestCase
 
   def test_constrains_argument_error
     assert_raise(ArgumentError) {
-      Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+      Controlist.permission_manager.set_permission_package(OrderedPackage.new(
         Controlist::Permission.new(User, READ, true, Object.new)
       ))
     }
   end
 
-  def test_relation_not_reuseable
-    assert_raise(Controlist::NotReuseableError) {
-      relation = User.unscoped
-      relation.to_sql
-      relation_new = relation.where("1 = 1")
-      relation_new.to_sql
-    }
-    relation = User.unscoped
-    reuseable_relation = relation.clone
-    relation.to_sql
-    relation_new = reuseable_relation.where("1 = 1")
-    relation_new.to_sql
-  end
-
   def test_skip
-    Controlist.permission_provider.set_permission_package(OrderedPackage.new(
+    Controlist.permission_manager.set_permission_package(OrderedPackage.new(
       Controlist::Permission.new(User, READ, true, "age != 100")
     ))
     Controlist.skip do
       relation = User.unscoped
-      relation.to_sql
-      assert_equal [], relation.where_values
+      sql = relation.to_sql
+      assert_equal "SELECT \"users\".* FROM \"users\"", sql.strip
     end
   end
 

data/test/fixtures/clazz.yml

@@ -4,3 +4,6 @@ one:
 two:
   id: 2
   name: Grade 2
+three:
+  id: 3
+  name: Grade 3

data/test/test_helper.rb

@@ -24,7 +24,7 @@ ActiveRecord::Base.logger = Logger.new(STDOUT)
 
 require 'controlist'
 require 'controlist/managers/thread_based_manager'
-#Controlist.initialize Controlist::Manager::ThreadBasedManager, attribute_proxy: "_val", value_object_proxy: "_value_object", logger: Logger.new(STDOUT)
+#Controlist.initialize Controlist::Managers::ThreadBasedManager, attribute_proxy: "_val", value_object_proxy: "_value_object", logger: Logger.new(STDOUT)
 Controlist.initialize Controlist::Managers::ThreadBasedManager
 
 unless Controlist.is_activerecord3?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: controlist
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Leon Li
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-03 00:00:00.000000000 Z
+date: 2015-07-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -193,7 +193,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: Fine-grained access control library for Ruby ActiveRecord
@@ -206,3 +206,4 @@ test_files:
 - test/models/user.rb
 - test/test.sqlite3
 - test/test_helper.rb
+has_rdoc: