faalis 1.0.0.alpha1 → 1.0.0.alpha2

data/app/assets/javascripts/faalis/dashboard/services/resource_factory.js.coffee

@@ -0,0 +1,48 @@
+Resource = angular.module "Faalis.ResourceFactory", []
+
+Resource.provider "Resources", [->
+
+  # resources should be an array of resource factories
+  @resources = undefined
+
+  # This field will specify the main resource class
+  # for current functionality. First element of
+  # @resource will be used if `main_resource` was undefined
+  @main_resource = undefined
+
+
+  this.$get = [->
+
+    main_resource = @main_resources || @resources[0]
+    resources = @resources
+
+    # Public injector to inject required services into
+    # resources `initialize` method.
+
+    #deps = window.STATIC_REQUIREMENTS.concat(window.dashboard_dependencies)
+    #$injector = angular.injector(deps)
+    $injector = angular.injector(['ng', 'Errors', 'gettext'])
+
+    obj = {}
+
+    for resource in resources
+      unless resource.__name__?
+        throw "Resource '" + resource + "' does not have a 'name'"
+
+      unless resource.__init__?
+        throw "Resource '" + resource.name + "' does not have '__init__' method."
+
+      Faalis.$injector.invoke(resource.__init__, resource)
+
+      obj[resource.__name__.underscore()] = resource
+
+    obj.main_resource = ->
+      return main_resource
+
+    obj.all = ->
+      return resources
+
+    return obj
+  ]
+  return
+]

data/app/assets/javascripts/faalis/dashboard/services/user.js.coffee

@@ -0,0 +1,4 @@
+User = angular.module("User")
+  .service "$user", ->
+    can: (object, perm)->
+      return true

data/app/assets/javascripts/faalis/dashboard/variables.js.erb

@@ -17,3 +17,8 @@ window.templates_path = "/templates/";
 // Any element of this queue will be appear as error after load event
 window.ErrorQueue = [];
 window.DashboardURL = "<%= url.modules_path %>";
+window.Faalis = {};
+
+window.STATIC_REQUIREMENTS = ["gettext", "Modules", "ui.select2", 'Errors',
+                              "ngAnimate", "ui.router", "restangular", "ngQuickDate",
+                              "Errors", "Profile", "Permissions", 'ng'];

data/app/controllers/faalis/api/v1/groups_controller.rb

@@ -1,75 +1,71 @@
-require_dependency "faalis/api_controller"
+require_dependency 'faalis/api_controller'
 
-module Faalis
-  class API::V1::GroupsController < ::APIController
-    # TODO: Use strong params
-    # TODO: implement authorization
+class Faalis::API::V1::GroupsController < ::APIController
+  # TODO: Use strong params
+  after_action :verify_authorized, :except => :index
 
-    # GET /api/v1/groups
-    def index
-      @groups = Group.includes(:permissions).to_a
-      authorize! :read, Faalis::Group
-      respond_with(@groups)
-    end
-
-    def create
-      authorize! :create, Faalis::Group
+  # GET /api/v1/groups
+  def index
+    @groups = Faalis::Group.includes(:permissions).all
+    authorize @groups
+    respond_with(@groups)
+  end
 
-      permissions = [];
+  def create
 
-      (params[:permissions] || []).each do |perm_string|
-        perm, model = perm_string.split "|"
-        permission = Permission.find_or_create_by_model_and_permission_type(model, perm)
-        permissions << permission
-      end
+    authorize Faalis::Group, :create?
+    permissions = [];
 
-      @group = Group.new({
-                           name: params[:name],
-                           permissions: permissions,
-                         })
-      if @group.save
-        respond_with(@group)
-      else
-        respond_to do |format|
-          format.json { render :json => {:fields => @group.errors}, :status => :unprocessable_entity }
-        end
-      end
+    (params[:permissions] || []).each do |perm_string|
+      perm, model = perm_string.split "|"
+      permission = Faalis::Permission.find_or_create_by_model_and_permission_type(model, perm)
+      permissions << permission
     end
 
-    def show
-      @group = Group.find(params[:id])
-      authorize! :read, @group
+    @group = Faalis::Group.new({ name: params[:name],
+                                 permissions: permissions })
+    if @group.save
       respond_with(@group)
+    else
+      respond_to do |format|
+        format.json { render json: { fields: @group.errors },
+                      status: :unprocessable_entity }
+      end
     end
+  end
 
-    def update
-
-      @group = Group.find(params[:id])
-      authorize! :update, @group
+  def show
+    @group = Faalis::Group.find(params[:id])
+    authorize @group
+    respond_with(@group)
+  end
 
-      permissions = [];
-      (params[:permissions] || []).each do |perm_string|
-        perm, model = perm_string.split "|"
-        permission = Permission.find_or_create_by_model_and_permission_type(model, perm)
-        permissions << permission
-      end
+  def update
+    @group = Faalis::Group.find(params[:id])
+    authorize @group
 
-      if @group.update(:name => params[:name],
-                    :permissions => permissions)
-        respond_with(@group)
-      else
-        respond_to do |format|
-          format.json { render :json => {:fields => @group.errors}, :status => :unprocessable_entity }
-        end
-      end
+    permissions = [];
+    (params[:permissions] || []).each do |perm_string|
+      perm, model = perm_string.split '|'
+      permission = Faalis::Permission.find_or_create_by_model_and_permission_type(model, perm)
+      permissions << permission
     end
 
-    def destroy
-      ids = params[:id].split(",")
-      @groups = Group.where(:id => ids)
-      authorize! :destory, @groups
-      @groups.destroy_all
+    if @group.update(:name => params[:name],
+                     :permissions => permissions)
+      respond_with(@group)
+    else
+      respond_to do |format|
+        format.json { render json: { fields: @group.errors },
+                      status: :unprocessable_entity }
+      end
     end
   end
 
+  def destroy
+    ids = params[:id].split(",")
+    @groups = Faalis::Group.where(:id => ids)
+    authorize @groups
+    @groups.destroy_all
+  end
 end

data/app/controllers/faalis/api/v1/permissions_controller.rb

@@ -3,29 +3,46 @@ require_dependency "faalis/application_controller"
 module Faalis
   class API::V1::PermissionsController < ::APIController
 
+    respond_to :json
+
     class DummyPerm
       attr_accessor :model, :permission_type
     end
 
-    # @api GET permissions
-    # @return All permissions
+    # api GET permissions
+    # return All permissions
     def index
-      @permissions = Faalis::Discovery::Permissions.all_permissions
+      @permissions = {}
+
+      Faalis::Permission.each do |perm|
+        if @permissions.include? perm.model
+          @permissions[perm.model] << perm.action
+        else
+          @permissions[perm.model] = [perm.action]
+        end
+      end
+
       respond_with(@permissions)
     end
 
-    # @api GET permissions/user
-    # @return current user permissions
+    # api GET permissions/user
+    # return current user permissions
     def user_permissions
+
       @permissions = {}
-      perms = []
-      current_user.permissions do |perm|
-        tmp = DummyPerm.new
-        tmp.model = perm.model
-        tmp.permission_type = perm.permission_type
-        perms << tmp
+      current_user.permissions.each do |perm|
+        if @permissions.include? perm.model
+          @permissions[perm.model] << perm.action
+        else
+          @permissions[perm.model] = [perm.action]
+        end
       end
-      perms.uniq!
+
+      respond_with(@permissions)
+      return
+
+      @permissions = {}
+      perms = []
 
       # Generate a suitable Hash for permissions
       perms.each do |perm|

data/app/controllers/faalis/api_controller.rb

@@ -24,30 +24,34 @@ module Faalis
   # which inherit from this class.
   class APIController < Faalis::ApplicationController
 
+
+    include Pundit
+
     # Only support `json` format
     respond_to :json
 
+    protect_from_forgery
+    skip_before_action :verify_authenticity_token, if: :api_request?
+
     # Authenticate user before any action take place
-    before_filter :authenticate_filter
+    before_action :authenticate_filter
 
     # Check for any presence of filtering query, In querystring and load
     # resource using them
-    before_filter :load_resource_by_query, :only => [:index]
-
-    protect_from_forgery
+    before_action :load_resource_by_query, :only => [:index]
 
     # Set csrf cookie after any action
-    after_filter :set_csrf_cookie_for_ng
+    after_action :set_csrf_cookie_for_ng
 
     # Rescue from any access denied exception raised from cancan and
     # returns a useful error message in json
-    rescue_from CanCan::AccessDenied do |exception|
-      render :status => 403, :json => {
-        :error => _('You don\'t have access to this page'),
-        :orig_msg => exception.message,
-        :action => exception.action
-      }
-    end
+ #   rescue_from CanCan::AccessDenied do |exception|
+ #     render :status => 403, :json => {
+ #       :error => _('You don\'t have access to this page'),
+ #       :orig_msg => exception.message,
+ #       :action => exception.action
+ #     }
+ #   end
 
     def set_csrf_cookie_for_ng
       cookies['XSRF-TOKEN'] = form_authenticity_token if protect_against_forgery?
@@ -143,5 +147,8 @@ module Faalis
       super || form_authenticity_token == request.headers['X-XSRF-TOKEN']
     end
 
+    def api_request?
+      request.format.json?
+    end
   end
 end

data/app/controllers/faalis/application_controller.rb

@@ -18,16 +18,17 @@
 # -----------------------------------------------------------------------------
 class Faalis::ApplicationController < ActionController::Base
   include FastGettext::Translation
+
   before_filter :set_locale
 
  def set_locale
-      FastGettext.add_text_domain 'faalis', :path => "#{Faalis::Engine.root}/config/locales", :type => :po
-      # All languages you want to allow
-      FastGettext.default_available_locales = Faalis::Engine.locales
-      FastGettext.default_text_domain = 'faalis'
+   FastGettext.add_text_domain 'faalis', :path => "#{Faalis::Engine.root}/config/locales", :type => :po
+   # All languages you want to allow
+   FastGettext.default_available_locales = Faalis::Engine.locales
+   FastGettext.default_text_domain = 'faalis'
 
-      lang = request.env['lang'] || params[:locale] || session[:locale] || I18n.default_locale
-      FastGettext.set_locale(lang.to_s)
-      session[:locale] = I18n.locale = :"#{lang}"
+   lang = request.env['lang'] || params[:locale] || session[:locale] || I18n.default_locale
+   FastGettext.set_locale(lang.to_s)
+   session[:locale] = I18n.locale = :"#{lang}"
  end
 end

data/app/controllers/faalis/dashboard_controller.rb

@@ -1,4 +1,4 @@
-require_dependency "faalis/application_controller"
+require_dependency 'faalis/application_controller'
 
 
 module Faalis
@@ -13,29 +13,23 @@ module Faalis
 
     def jstemplate
       if user_signed_in?
-        render :template => "angularjs_templates/#{params[:path]}", :layout => nil
+        render template: "angular/#{params[:path]}", layout: nil
       else
         render :login_required_page
       end
     end
 
     def index
-      if params.include? :signin
-        redirect_to dashboard_path
-      end
+      redirect_to dashboard_path if params.include? :signin
       @jstemplates_path = '/templates'
     end
 
     def modules
       dashboard_modules = []
       Faalis::Engine.dashboard_modules.each do |module_name, attrs|
-        if not attrs.include? :title
-          attrs[:title] = _(module_name.to_s)
-        end
 
-        if not attrs.include? :resource
-          attrs[:resource] = module_name.to_s
-        end
+        attrs[:title] = _(module_name.to_s) if not attrs.include? :title
+        attrs[:resource] = module_name.to_s if not attrs.include? :resource
 
         # If class did not given by user in settings
         # Faalis tries to guess the class name

data/app/models/faalis/{user → concerns/user}/auth_definitions.rb

@@ -1,5 +1,5 @@
 module Faalis
-  module User::AuthDefinitions
+  module Concerns::User::AuthDefinitions
 
     def self.included(base)
 
@@ -29,6 +29,10 @@ module Faalis
       name
     end
 
+    def admin?
+      # TODO: Find a better way to 'admin?'
+      groups.where(role: 'admin').exists?
+    end
 
     # Confirmation not required when using omniauth
     def confirmation_required?
@@ -43,6 +47,7 @@ module Faalis
       end
     end
 
+    # Omniauth users does not need password
     def password_required?
       # TODO: nil? is not suitable for here we should use empty? or blink?
       if Devise.omniauth_configs.any?

data/app/models/faalis/{user → concerns/user}/mongoid_fields.rb

@@ -1,6 +1,6 @@
 module Faalis
   # This module contains all the **Mongoid** related definitions
-  module User::MongoidFields
+  module Concerns::User::MongoidFields
     extend ActiveSupport::Concern
 
     included do
@@ -43,7 +43,7 @@ module Faalis
       if not Devise.omniauth_providers.empty?
         # Service
         field :provider, type: String, default: ''
-        field :uid, type: String
+        field :uid,      type: String
       end
 
       if Rails.env.production?
@@ -66,6 +66,12 @@ module Faalis
       index({ authentication_token: 1 },
             { unique: true, background: true })
 
+      # To fix the issue with new mongo
+      #def self.serialize_from_session(key, salt)
+      #  record = to_adapter.get(key[0]["$oid"])
+      #  record if record && record.authenticatable_salt == salt
+      #end
+
       if Rails.env.production?
         index({ confirmation_token: 1 },
               { unique: true, background: true })

data/app/models/faalis/concerns/user/permission.rb

@@ -0,0 +1,24 @@
+module Faalis
+  # This concern contains all the permission related methods
+  # to use within `Faalis::User`
+  module Concerns::User::Permission
+    extend ActiveSupport::Concern
+
+    def have_permission? action, obj
+      perm = self.groups.includes(:permissions)
+        .where(faalis_permissions: { model: obj, permission_type: action })
+        .count
+      perm == 1
+    end
+
+    def can_not? action, obj
+      !have_permission? action, obj
+    end
+
+    alias_method :can?, :have_permission?
+
+    def permissions
+      groups.includes(:permissions).map(&:permissions).flatten.uniq
+    end
+  end
+end