ez-permissions 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5514714fbd59dcc2567a76cf7170c88ba2493ad654aa232ee464b386d7d73ca9
-  data.tar.gz: 988f18fad5072711f3699cbd78386647822745975314ef57bb6ab4848ea66cf6
+  metadata.gz: cab72e814bf5bc7883df8e8f069958543d29a009eff5f3f1449c8f601417b731
+  data.tar.gz: 415e76d721038d89e81515b240bbe81fee10dbbe04e4781c6b3fa42adc9e340a
 SHA512:
-  metadata.gz: 547ec67bb10c87d4d4b6c04258d1491afaa8cd1f4c85b17403502d82b29fc7574b2f96c2327d12064be5dd0385cc6cfc4395b635a9c88bba2cb7a5f97d33d91a
-  data.tar.gz: a24ca354fd87426c2fee1aa94b660e410886288218dcb29dfe4439e68735a7b582ea2c2627d54c6d74ee1fa9efdc7d64eb26efeb489af409bb46f960168e5e1d
+  metadata.gz: 726fd87afd239f261fb02c3c8ed57ab178807bd31fb5b46bfbad8b08e9e860cdc9066f2fa297c0208d9ad7717e63a147964d92a24db008b193d91516a3d68122
+  data.tar.gz: 620fbc36e4b13bc1e3f4a07636d13515decc9ff380cc76b199373e6cb28ca472f338571e2a474535780225ee0ea58eb59999fb0d5254ef812023f27021c6379d

data/README.md

@@ -157,7 +157,7 @@ Permissions.list_by_role(:manager, scoped: project)
 # Create a role
 Permissions.create_role(:user)
 
-# Grant role's possibility to have action per resource
+# Grant role's ability to have action per resource
 Permissions.grant_permission(:user, :read, :projects)
 
 # Grant all defined actions per resource
@@ -200,7 +200,7 @@ Permissions.can?(user, :create, :users, scoped: project) => # false
 If in one HTTP request (e.g. navigation menu rendering) you don't want to hit the database with dozens of queries, you can cache all user permission in a hash
 
 ```ruby
-user_permissions =  Permissions.model_permissions_map(user)
+user_permissions =  Permissions.model_permissions(user)
 user_permissions # => #<Ez::Permissions::API::Authorize::ModelPermissions...
 
 # You can fetch permissions as a hash
@@ -214,6 +214,7 @@ end
 # or user #can? and #authorize! helper methods
 user_permissions.can?(:read, :users) # => true
 user_permissions.can?(:create, :users) # => false
+user_permissions.can?(:create, :users, scoped: project) # => false
 user_permissions.authorize!(:create, :users) # => raise Ez::Permissions::NotAuthorized
 ```
 
@@ -280,8 +281,6 @@ Of course, you can use them as mixins, but it's up to you.
 
 ## TODO
 - [ ] Add helper methods for seed grant permissions
-- [ ] Cached permissions. If single UI has multiple checks for one user - we can cache it!
-- [ ] Not all permissions should be manageable through UI, like roles and permissions.
 
 ## Contributing
 Contribution directions go here.

data/app/models/ez/permissions/model.rb

@@ -7,16 +7,16 @@ module Ez
       def self.included(base)
         base.has_many :assigned_roles,
                       class_name: 'Ez::Permissions::ModelRole',
-                      as: :model
+                      as:         :model
 
         base.has_many :roles,
                       -> { distinct },
-                      through: :assigned_roles,
+                      through:    :assigned_roles,
                       class_name: 'Ez::Permissions::Role'
 
         base.has_many :permissions,
                       -> { distinct },
-                      through: :roles,
+                      through:    :roles,
                       class_name: 'Ez::Permissions::Permission'
       end
       # rubocop:enable Metrics/MethodLength

data/app/models/ez/permissions/role.rb

@@ -5,7 +5,7 @@ module Ez
     class Role < ApplicationRecord
       self.table_name = Ez::Permissions.config.roles_table_name
 
-      has_and_belongs_to_many :permissions
+      has_and_belongs_to_many :permissions, join_table: Ez::Permissions.config.permissions_roles_table_name
 
       validates :name, presence: true
       validates :name, uniqueness: true

data/lib/ez/permissions/api/authorize/godmode_permissions.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Ez
+  module Permissions
+    module API
+      module Authorize
+        class GodmodPermissions < ModelPermissions
+          def can?(_action_name, _resource_name, **)
+            true
+          end
+
+          def authorize!(_action_name, _resource_name, **)
+            true
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ez/permissions/api/authorize/model_permissions.rb

@@ -11,20 +11,21 @@ module Ez
             @permissions_map = permissions_map
           end
 
-          def can?(action_name, resource_name)
-            permissions_map[to_key(action_name, resource_name)] == true
+          def can?(action_name, resource_name, scoped: nil)
+            permissions_map[to_key(action_name, resource_name, scoped)] == true
           end
 
-          def authorize!(action_name, resource_name)
-            permissions_map.fetch(to_key(action_name, resource_name))
+          def authorize!(action_name, resource_name, scoped: nil)
+            permissions_map.fetch(to_key(action_name, resource_name, scoped))
           rescue KeyError
             raise Ez::Permissions::NotAuthorizedError
           end
 
           private
 
-          def to_key(action_name, resource_name)
-            "#{action_name}_#{resource_name}".to_sym
+          def to_key(action_name, resource_name, scoped = nil)
+            scoped_key = [scoped&.class, scoped&.id].compact.join('_')
+            "#{action_name}_#{resource_name}_#{scoped_key}".to_sym
           end
         end
       end

data/lib/ez/permissions/api/authorize.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'authorize/model_permissions'
+require_relative 'authorize/godmode_permissions'
 
 module Ez
   module Permissions
@@ -8,12 +9,19 @@ module Ez
       module Authorize
         def model_permissions(model)
           ModelPermissions.new(
-            model.permissions.each_with_object({}) do |permission, acum|
-              acum["#{permission.action}_#{permission.resource}".to_sym] = true
+            model.class.includes(assigned_roles: { role: :permissions }).find(model.id).assigned_roles.each_with_object({}) do |assigned_role, acum|
+              scoped_key = [assigned_role.scoped_type, assigned_role.scoped_id].compact.join('_')
+              assigned_role.role.permissions.each do |permission|
+                acum["#{permission.action}_#{permission.resource}_#{scoped_key}".to_sym] = true
+              end
             end
           )
         end
 
+        def godmode_permissions
+          GodmodPermissions.new({})
+        end
+
         def authorize!(model, *actions, resource, scoped: nil, &block)
           authorize(model, *actions, resource, scoped: scoped, raise_exception: true, &block)
         end
@@ -53,9 +61,9 @@ module Ez
           permission_ids = Ez::Permissions::PermissionRole.where(role_id: role_ids).pluck(:permission_id)
 
           Ez::Permissions::Permission.where(
-            id: permission_ids,
+            id:       permission_ids,
             resource: resource,
-            action: actions.map(&:to_s)
+            action:   actions.map(&:to_s)
           )
         end
 

data/lib/ez/permissions/api/models.rb

@@ -8,8 +8,8 @@ module Ez
           role = Ez::Permissions::API.get_role!(role_name)
 
           Ez::Permissions::ModelRole.find_or_create_by!(
-            role: role,
-            model: model,
+            role:   role,
+            model:  model,
             scoped: scoped
           )
         end
@@ -30,7 +30,7 @@ module Ez
           role = Ez::Permissions::API.get_role!(role_name)
 
           Ez::Permissions::ModelRole.where(
-            role: role,
+            role:   role,
             scoped: scoped
           ).map(&:model)
         end
@@ -39,8 +39,8 @@ module Ez
 
         def model_role(role, model, scoped)
           Ez::Permissions::ModelRole.find_by(
-            role: role,
-            model: model,
+            role:   role,
+            model:  model,
             scoped: scoped
           )
         end

data/lib/ez/permissions/api/permissions.rb

@@ -28,7 +28,7 @@ module Ez
           permission = get_permission!(action, resource)
 
           Ez::Permissions::PermissionRole.find_by(
-            role: role,
+            role:       role,
             permission: permission
           )&.delete
         end
@@ -37,7 +37,7 @@ module Ez
 
         def grant_single_permission(role, permission)
           Ez::Permissions::PermissionRole.find_or_create_by!(
-            role: role,
+            role:       role,
             permission: permission
           )
         end

data/lib/ez/permissions/dsl.rb

@@ -62,7 +62,7 @@ module Ez
         resource.actions.each do |action|
           Ez::Permissions::Permission.where(
             resource: resource.name,
-            action: action
+            action:   action
           ).first_or_create!
         end
       end

data/lib/ez/permissions/version.rb

@@ -2,6 +2,6 @@
 
 module Ez
   module Permissions
-    VERSION = '0.6.1'
+    VERSION = '0.7.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ez-permissions
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.7.0
 platform: ruby
 authors:
 - Volodya Sveredyuk
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-07 00:00:00.000000000 Z
+date: 2021-11-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ez-core
@@ -176,6 +176,7 @@ files:
 - lib/ez/permissions.rb
 - lib/ez/permissions/api.rb
 - lib/ez/permissions/api/authorize.rb
+- lib/ez/permissions/api/authorize/godmode_permissions.rb
 - lib/ez/permissions/api/authorize/model_permissions.rb
 - lib/ez/permissions/api/models.rb
 - lib/ez/permissions/api/permissions.rb