dead_simple_authorization 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9812fb35a08d8185c0b59b0d0a5f2bf01e14f026
-  data.tar.gz: 7254a679a00df1c9dc5f848a4c7c8be61456034f
+  metadata.gz: 094811cb3c6a7c29d7de9eaf841554e4179d2919
+  data.tar.gz: 493f517f366e9f935de8c848879639154cda8e88
 SHA512:
-  metadata.gz: 9861dffc528326f8d3ebcea54599497dfd3cad1f812328031f4488d547bd237ab3f6f8ec252c0a33c2f28a47d1b5f7f10356bb7a64865111e56ff85e57fdc359
-  data.tar.gz: 86f35c2ce743d69cda9a40523c16272a46c5239334ae29cc87190a2427c2b606f84973edb4ae1bf3b7012395a066509bb3418d7e040eccb14b6f451456977dd5
+  metadata.gz: b99b566cad0ec612eb2a71b2dcb6a1d35856943fade47fe092426e536929be1af09bf429686bd5e5dc2db8631be50e3cc81556ed1f8084b54c4c34552e774487
+  data.tar.gz: 09b0919c5faa86f439ac8f850d7777c4c9ac59af366824e07f4d87396bd71e79add34afe2909fdcc7a4097c278f7980f1b671cc4dbe6b4f1529c820122057ed4

data/README.md

@@ -1,2 +1,43 @@
 # dead_simple_authorization
-A Very simple authorization gem
+
+## What is dead_simple_authorization?
+It's a simple gem for authorization. The main concepts around dead_simple_authorization are: users, resources and permissions. Using a couple of simple naming conventions, it organizes the way in which access to a resource (an activerecord model for example) by a user (e.g. a web application's user) is checked.
+
+## What's included
+The juice of this gems are the methods can? and authorize included in the module DeadSimpleAuthorization::Helpers. Both methods accept 3 arguments: a user, an action and a resource. For example can?(user, :update, post) checks if a user has the permission to update a post. The authorize method is the stricter of the two, as if the user doesn't have permission, it raises a DeadSimpleAuthorization::Errors::NotAuthorized error, while can? method only returns a boolean.
+
+## Example usage
+Think of a web application (e.g. a rails app), a blog for example, where there are Users and Posts and a user can be the owner of a Post. How would we create a simple authorization mechanism in this case?
+
+Assume a Post contains the following (among other things):
+
+```ruby
+class Post < ActiveRecord::Base
+  belongs_to :user
+end
+```
+
+What we need is a place to put the rules for dead_simple_authorization. The convention is that a PostPolicy class holds those rules. This policy class inherits from DeadSimpleAuthorization::Policy::Base:
+
+```ruby
+class PostPolicy < DeadSimpleAuthorization::Policy::Base
+  def update?
+    user == resource.user
+  end
+end
+```
+
+Note that the Policy objects are instantiated with user and resource, so in this case user holds the user passed to the can? or authorize methods and resource a Post instance. That's it! Now, by including DeadSimpleAuthorization::Helpers in a controller for example, we can check permissions with either can? or authorize method this way:
+
+```ruby
+can?(current_user, :update, post)
+```
+or
+
+```ruby
+authorize(current_user, :update, post)
+```
+
+The convention when creating permission methods in PostPolicy is to have end in question mark, so by creating a rule such as update? the action that needs to be provided to authorize and can? methods is :update (i.e. the question mark needs to be removed and a symbol needs to be used).
+
+That's pretty much it.

data/lib/dead_simple_authorization/helpers.rb

@@ -24,6 +24,7 @@ module DeadSimpleAuthorization
     # error, but returns the boolean outcome of the check
     #
     def can?(user, action, resource)
+      action = action.to_sym if action.is_a? String
       policy_class = "#{resource.class}Policy"
       policy = Object::const_get(policy_class).new(resource, user)
       policy.send("#{action.to_s}?")

data/lib/dead_simple_authorization/version.rb

@@ -1,3 +1,3 @@
 module DeadSimpleAuthorization
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dead_simple_authorization
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Pantelis Vratsalis
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-05 00:00:00.000000000 Z
+date: 2015-03-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -100,4 +100,3 @@ summary: A pretty simple solution for permissions on resources - framework agnos
 test_files:
 - spec/helpers_spec.rb
 - spec/spec_helper.rb
-has_rdoc: