ddr-core 0.2.1

data/lib/ddr/auth/ability_definitions/superuser_ability_definitions.rb

@@ -0,0 +1,9 @@
+module Ddr::Auth
+  class SuperuserAbilityDefinitions < AbilityDefinitions
+
+    def call
+      can :manage, :all
+    end
+
+  end
+end

data/lib/ddr/auth/ability_factory.rb

@@ -0,0 +1,10 @@
+module Ddr::Auth
+  class AbilityFactory
+
+    def self.call(user = nil, env = nil)
+      auth_context = AuthContextFactory.call(user, env)
+      auth_context.ability
+    end
+
+  end
+end

data/lib/ddr/auth/abstract_ability.rb

@@ -0,0 +1,48 @@
+require 'cancan'
+
+module Ddr::Auth
+  # @abstract
+  class AbstractAbility
+    include CanCan::Ability
+
+    class_attribute :ability_definitions
+    self.ability_definitions = []
+
+    # CanCan default aliases:
+    #
+    #   alias_action :index, :show, :to => :read
+    #   alias_action :new, :to => :create
+    #   alias_action :edit, :to => :update
+    #
+    class_attribute :exclude_default_aliases
+    self.exclude_default_aliases = false
+
+    attr_reader :auth_context
+
+    delegate :anonymous?, :authenticated?, :metadata_manager?,
+             :user, :groups, :agents, :member_of?,
+             :authorized_to_act_as_superuser?,
+             to: :auth_context
+
+    def initialize(auth_context)
+      @auth_context = auth_context
+      if exclude_default_aliases
+        clear_aliased_actions
+      end
+      apply_ability_definitions
+    end
+
+    def cache
+      @cache ||= {}
+    end
+
+    def apply_ability_definitions
+      ability_definitions.reduce(self, :apply)
+    end
+
+    def apply(ability_def)
+      ability_def.call(self)
+    end
+
+  end
+end

data/lib/ddr/auth/affiliation.rb

@@ -0,0 +1,14 @@
+module Ddr::Auth
+  module Affiliation
+
+    FACULTY   = "faculty".freeze
+    STAFF     = "staff".freeze
+    STUDENT   = "student".freeze
+    EMERITUS  = "emeritus".freeze
+    AFFILIATE = "affiliate".freeze
+    ALUMNI    = "alumni".freeze
+
+    ALL = [ FACULTY, STAFF, STUDENT, EMERITUS, AFFILIATE, ALUMNI ].freeze
+
+  end
+end

data/lib/ddr/auth/affiliation_groups.rb

@@ -0,0 +1,20 @@
+module Ddr::Auth
+  class AffiliationGroups
+
+    all = []
+
+    Affiliation::ALL.each do |affiliation|
+      group = Group.new "duke.#{affiliation}",
+                        label: "Duke #{affiliation.capitalize}" do |auth_context|
+        auth_context.affiliation.include? affiliation
+      end
+
+      const_set affiliation.upcase, group
+
+      all << const_get(affiliation.upcase)
+    end
+
+    ALL = all.freeze
+
+  end
+end

data/lib/ddr/auth/anonymous_ability.rb

@@ -0,0 +1,7 @@
+module Ddr::Auth
+  class AnonymousAbility < AbstractAbility
+
+    self.ability_definitions = Ability.ability_definitions.dup
+    
+  end
+end

data/lib/ddr/auth/auth_context.rb

@@ -0,0 +1,109 @@
+module Ddr::Auth
+  # @abstract
+  class AuthContext
+
+    attr_reader :user, :env
+
+    def initialize(user = nil, env = nil)
+      @user = user
+      @env = env
+    end
+
+    def ability
+      if anonymous?
+        AnonymousAbility.new(self)
+      elsif superuser?
+        SuperuserAbility.new(self)
+      else
+        default_ability_class.new(self)
+      end
+    end
+
+    def default_ability_class
+      Ddr::Auth::default_ability.constantize
+    end
+
+    # Return whether a user is absent from the auth context.
+    # @return [Boolean]
+    def anonymous?
+      user.nil?
+    end
+
+    # Return whether a user is present in the auth context.
+    # @return [Boolean]
+    def authenticated?
+      !anonymous?
+    end
+
+    # Return whether context is authenticated in superuser scope.
+    # @return [Boolean]
+    def superuser?
+      env && env.key?("warden") && env["warden"].authenticate?(scope: :superuser)
+    end
+
+    def metadata_manager?
+      member_of? Ddr::Auth.metadata_managers_group
+    end
+
+    # Return the user agent for this context.
+    # @return [String] or nil, if auth context is anonymous/
+    def agent
+      anonymous? ? nil : user.agent
+    end
+
+    # Is the authenticated agent a Duke identity?
+    # @return [Boolean]
+    def duke_agent?
+      !!(agent =~ /@duke\.edu\z/)
+    end
+
+    # Return the list of groups for this context.
+    # @return [Array<Group>]
+    def groups
+      @groups ||= Groups.call(self)
+    end
+
+    # Is the user associated with the auth context a member of the group?
+    # @param group [Group, String] group object or group id
+    # @return [Boolean]
+    def member_of?(group)
+      if group.is_a? Group
+        groups.include? group
+      else
+        member_of? Group.new(group)
+      end
+    end
+
+    # Is the auth context authorized to act as superuser?
+    #   This is separate from whether the context is authenticated in superuser scope.
+    # @return [Boolean]
+    def authorized_to_act_as_superuser?
+      member_of? Ddr::Auth.superuser_group
+    end
+
+    # Return the combined user and group agents for this context.
+    # @return [Array<String>]
+    def agents
+      groups.map(&:agent).push(agent).compact
+    end
+
+    # The IP address associated with the context.
+    # @return [String]
+    def ip_address
+      nil
+    end
+
+    # The affiliation values associated with the context.
+    # @return [Array<String>]
+    def affiliation
+      []
+    end
+
+    # The remote group values associated with the context.
+    # @return [Array<String>]
+    def ismemberof
+      []
+    end
+
+  end
+end

data/lib/ddr/auth/auth_context_factory.rb

@@ -0,0 +1,13 @@
+module Ddr::Auth
+  class AuthContextFactory
+
+    def self.call(user = nil, env = nil)
+      if env
+        WebAuthContext.new(user, env)
+      else
+        DetachedAuthContext.new(user)
+      end
+    end
+
+  end
+end

data/lib/ddr/auth/detached_auth_context.rb

@@ -0,0 +1,19 @@
+module Ddr::Auth
+  class DetachedAuthContext < AuthContext
+
+    def affiliation
+      anonymous? ? super : ldap_result.affiliation
+    end
+
+    def ismemberof
+      anonymous? ? super : ldap_result.ismemberof
+    end
+
+    private
+
+    def ldap_result
+      @ldap_result ||= Ddr::Auth.ldap_gateway.find(user.user_key)
+    end
+
+  end
+end

data/lib/ddr/auth/dynamic_groups.rb

@@ -0,0 +1,13 @@
+module Ddr::Auth
+  class DynamicGroups
+
+    ALL = ([Groups::PUBLIC, Groups::REGISTERED, Groups::DUKE_ALL] + AffiliationGroups::ALL).freeze
+
+    # @param auth_context [AuthContext]
+    # @return [Array<Group>]
+    def self.call(auth_context)
+      ALL.select { |group| group.has_member?(auth_context) }
+    end
+
+  end
+end

data/lib/ddr/auth/effective_permissions.rb

@@ -0,0 +1,12 @@
+module Ddr::Auth
+  class EffectivePermissions
+
+    # @param obj [Object] an object that receives :roles and returns a RoleSet
+    # @param agents [String, Array<String>] agent(s) to match roles
+    # @return [Array<Symbol>]
+    def self.call(obj, agents)
+      EffectiveRoles.call(obj, agents).map(&:permissions).flatten.uniq
+    end
+
+  end
+end

data/lib/ddr/auth/effective_roles.rb

@@ -0,0 +1,9 @@
+module Ddr::Auth
+  class EffectiveRoles
+
+    def self.call(obj, agents)
+      ( obj.resource_roles | obj.inherited_roles ).select { |r| agents.include?(r.agent) }
+    end
+
+  end
+end

data/lib/ddr/auth/failure_app.rb

@@ -0,0 +1,16 @@
+module Ddr
+  module Auth
+    class FailureApp < Devise::FailureApp
+
+      def respond
+        if scope == :user && Ddr::Auth.require_shib_user_authn
+          store_location!
+          redirect_to user_omniauth_authorize_path(:shibboleth)
+        else
+          super
+        end
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/group.rb

@@ -0,0 +1,40 @@
+require "delegate"
+
+module Ddr
+  module Auth
+    # Wraps a String
+    class Group < SimpleDelegator
+
+      attr_reader :rule
+
+      def initialize(id, opts={}, &rule)
+        super(id)
+        @label = opts[:label]
+        @rule = rule
+        freeze
+      end
+
+      # @param user [Ddr::Auth::AuthContext]
+      def has_member?(auth_context)
+        rule ? instance_exec(auth_context, &rule) : auth_context.member_of?(self)
+      end
+
+      def id
+        __getobj__
+      end
+
+      def label
+        @label || id
+      end
+
+      def agent
+        to_s
+      end
+
+      def inspect
+        "#<#{self.class.name} id=#{id.inspect}, label=#{label.inspect}>"
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/grouper_gateway.rb

@@ -0,0 +1,70 @@
+require 'grouper-rest-client'
+require "delegate"
+
+module Ddr
+  module Auth
+    class GrouperGateway < SimpleDelegator
+
+      SUBJECT_ID_RE = Regexp.new('[^@]+(?=@duke\.edu)')
+      DEFAULT_TIMEOUT = 5
+
+      def self.repository_groups(*args)
+        new.repository_groups(*args)
+      end
+
+      def self.user_groups(*args)
+        new.user_groups(*args)
+      end
+
+      def initialize
+        super Grouper::Rest::Client::Resource.new(ENV["GROUPER_URL"],
+                                                  user: ENV["GROUPER_USER"],
+                                                  password: ENV["GROUPER_PASSWORD"],
+                                                  timeout: ENV.fetch("GROUPER_TIMEOUT", DEFAULT_TIMEOUT).to_i)
+      end
+
+      # List of all grouper groups for the repository
+      def repository_groups(raw = false)
+        repo_groups = groups(REPOSITORY_GROUP_FILTER)
+        if ok?
+          return repo_groups if raw
+          repo_groups.map do |g|
+            Group.new(g["name"], label: g["displayExtension"])
+          end
+        else
+          []
+        end
+      end
+
+      def user_groups(user, raw = false)
+        groups = []
+        subject_id = user.principal_name.scan(SUBJECT_ID_RE).first
+        return groups unless subject_id
+        begin
+          request_body = {
+            "WsRestGetGroupsRequest" => {
+              "subjectLookups" => [{"subjectIdentifier" => subject_id}]
+            }
+          }
+          # Have to use :call b/c grouper-rest-client :subjects method doesn't support POST
+          response = call("subjects", :post, request_body)
+          if ok?
+            result = response["WsGetGroupsResults"]["results"].first
+            # Have to manually filter results b/c Grouper WS version 1.5 does not support filter parameter
+            if result && result["wsGroups"]
+              groups = result["wsGroups"].select { |g| g["name"] =~ /^#{REPOSITORY_GROUP_FILTER}/ }
+            end
+          end
+        rescue StandardError => e
+          # XXX Should we raise a custom exception?
+          Rails.logger.error e
+        end
+        return groups if raw
+        groups.map do |g|
+          Group.new(g["name"], label: g["displayExtension"])
+        end
+      end
+
+    end
+  end
+end

data/lib/ddr/auth/groups.rb

@@ -0,0 +1,32 @@
+module Ddr
+  module Auth
+    module Groups
+
+      PUBLIC = Group.new "public", label: "Public" do |auth_context|
+        true
+      end
+      
+      REGISTERED = Group.new "registered", label: "Registered Users" do |auth_context|
+        auth_context.authenticated?
+      end
+      
+      DUKE_ALL = Group.new "duke.all", label: "Duke NetIDs" do |auth_context|
+        auth_context.duke_agent?
+      end
+
+      # Return the list of all groups available for use in the repository,
+      #   i.e., that can be used to assert access controls.
+      # @return [Array<Group>] the groups
+      def self.all
+        DynamicGroups::ALL + Ddr::Auth.grouper_gateway.repository_groups
+      end
+
+      # @param auth_context [AuthContext]
+      # @return [Array<Group>]
+      def self.call(auth_context)
+        DynamicGroups.call(auth_context) + RemoteGroups.call(auth_context)
+      end
+
+    end
+  end
+end