glib-web 0.4.24 → 0.4.25

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 94f1a8366e5cece6ec76d5ea2bd1d540cbfc25aa
-  data.tar.gz: 448751b5cedab8ced7afc9c1b532522528dbec37
+  metadata.gz: 6a78169ee4aa218427c3afb3fdb50fd77280f627
+  data.tar.gz: d86539782b4e6c0a50cbba7e5ac5b39565e9feb5
 SHA512:
-  metadata.gz: '036089a9ccfc6432ec3d4197ae9037eddb049ac6d5fade3830b9e5b2a0b015ae1d9a3e4262ecbf4b5873d1f3441efe2e3f58af0038337f2867788540dae5cc11'
-  data.tar.gz: b256a373e8443457af3a210898fe3277f618c573ba46d367c4a9c81a40c741c550b76d91135000d099ee52bfb3ef1634dd4134ff8b2c4e49b13d5659c1a49a2c
+  metadata.gz: 495d37ef44d6fbad0a970f0f3b3bf35effe81b5ceb866c5eeb1606d179f217f747365d1987caaf910d83c0f26cec6d50ee147bfdcfe0581df583dd367e154d6b
+  data.tar.gz: e8942b48722e047778a7bbb8ed9d84734b14ad048700efc05edf835e1770bbeb08e4e63ebe4e43e1212363f16748c51e93167a49332b06d6373f80872e0b4647

data/app/controllers/concerns/glib/auth/policy.rb

@@ -15,28 +15,38 @@ module Glib::Auth
       # after_action :verify_authorized
 
       helper_method :policy, :can?, :cannot?
-
     end
 
     module Overrides
+
       public  # Override
-      def policy(record)
+      def policy(record, policy_name = nil)
+        policy_name ||= record
+
         @__pundit_policies ||= {}
-        return @__pundit_policies[record] if @__pundit_policies[record]
+        return @__pundit_policies[policy_name] if @__pundit_policies[policy_name]
 
-        if record.is_a?(Symbol) && record.to_s.ends_with?('_admin')
+        if policy_name.is_a?(Symbol) && policy_name.to_s.ends_with?('_admin')
           policy_class = CommonAdminPolicy
         else
-          policy_class = Pundit::PolicyFinder.new(record).policy
+          policy_class = Pundit::PolicyFinder.new(policy_name).policy
         end
-        raise "Policy not found for #{record.class}" unless policy_class
-        @__pundit_policies[record] = policy_class.new(current_user, record, self, request, params, *policy_class.args_builder.call(self))
+
+        raise "Policy not found for #{policy_name.is_a?(Symbol) || policy_name.is_a?(Class) ? policy_name : policy_name.class}" unless policy_class
+
+        @__pundit_policies[policy_name] = policy_class.new(current_user, record, policy_name, self, request, params, *policy_class.args_builder.call(self))
+      end
+
+      # Expose protected method
+      public  # Override
+      def policy_scope(*args)
+        super
       end
     end
 
-    public
-    def raise_access_denied(record)
-      raise UnauthorizedError.new(record: record, policy: policy(record), query: "#{action_name}?")
+    private
+    def raise_access_denied(record, policy)
+      raise UnauthorizedError.new(record: record, policy: policy, query: "#{action_name}?")
     end
 
     public
@@ -49,6 +59,34 @@ module Glib::Auth
       !policy(record).send("#{action}?")
     end
 
+    # Inspired from https://github.com/ryanb/cancan/wiki/Non-RESTful-Controllers
+    public
+    def glib_authorize_resource(*args)
+      options = args.extract_options!
+      resource_name = args.first
+
+      resource_name ||= controller_name.split('/').last.singularize
+
+      if (resource_key = options[:class]).nil?
+        policy_name = resource_name.camelize.constantize
+      else
+        policy_name = case resource_key
+        when false
+          resource_name.to_sym
+        when Symbol, Class
+          resource_key
+        else
+          raise "Invalid resource class: #{resource_key}"
+        end
+      end
+
+      resource_instance = instance_variable_get("@#{resource_name}") || policy_name
+
+      query = "#{action_name}?"
+      policy_instance = policy(resource_instance, policy_name)
+      raise_access_denied(resource_instance, policy_instance) unless policy_instance.public_send(query)
+    end
+
 
 
     class UnauthorizedError < Pundit::NotAuthorizedError
@@ -57,7 +95,19 @@ module Glib::Auth
 
 
     module ClassMethods
-      # Inspired from https://github.com/ryanb/cancan/wiki/Non-RESTful-Controllers
+      def glib_auth_init
+        before_action :glib_load_resource
+        before_action :glib_authorize_resource
+        # glib_authorize_resource
+      end
+
+      # def __glib_load_resource
+      #   case action_name.to_sym
+      #     # glib_load_resource
+      #   end
+      # end
+
+      # TODO: Consider deprecating
       public
       def authorize_resource(*args)
         options = args.extract_options!

data/app/controllers/glib/home_controller.rb

@@ -1,5 +1,7 @@
 module Glib
   class HomeController < ApplicationController
+    skip_before_action :glib_load_resource
+    skip_before_action :glib_authorize_resource
 
     def json_ui_garage
       @path_prefix = 'json_ui/garage'

data/app/helpers/glib/json_ui/list_builders.rb

@@ -24,9 +24,15 @@ module Glib
           string :imageUrl
           action :onClick
 
-          # NOTE: Experimental. Still deciding whether this needs to be a full blown panel or 
-          # an array of badges (with relevant properties, e.g. text, color, etc)
-          views :accessoryViews
+          # # NOTE: Experimental. Still deciding whether this needs to be a full blown panel or 
+          # # an array of badges (with relevant properties, e.g. text, color, etc)
+          # views :accessoryViews
+          
+          def chips(block)
+            json.chips do
+              block.call page.menu_builder
+            end
+          end
         end
 
         class Featured < Thumbnail

data/app/helpers/glib/json_ui/menu_builder.rb

@@ -13,6 +13,7 @@ module Glib
         icon :icon
         action :onClick
         bool :disabled
+        color :color
 
         def created
           json.type 'button'

data/app/helpers/glib/json_ui/page_helper.rb

@@ -75,7 +75,7 @@ module Glib
             # json.leftItems do
             #   options[:leftItems]&.call @menu_builder
             # end
-            json.logoUrl "http://localhost:3000/assets/logo_dark-02d9b6a91fdbf22515da7b921d31367b70696214415f6789d2f90232e4a287b7.svg"
+            # json.logoUrl "http://localhost:3000/assets/logo_dark-02d9b6a91fdbf22515da7b921d31367b70696214415f6789d2f90232e4a287b7.svg"
             json.rightItems do
               options[:rightItems]&.call @menu_builder
             end

data/app/policies/glib/application_policy.rb

@@ -1,148 +1,158 @@
-# The main purpose of this is for security. If it is important to display useful error message or to provide a "banana", then
-# it's better to perform an explicit check (e.g. as a validation in the model or using a before_action).
-module Glib
-  class ApplicationPolicy
-    attr_reader :user, :record, :controller, :request, :params
-
-    private
-    def initialize(user, record, controller, request, params)
-      @user = user
-      @record = record
-      @controller = controller
-      @request = request
-      # Don't get params from request because we might not have a proper request object. This might execute in Sidekiq. 
-      # See Presenter::Model::inside_mock_controller()
-      @params = params
-    end
-    
-    class << self
-      attr_reader :catch_all
-
-      # This is to define the authorization logic for an action (or a group of actions). It's different from controller's 
-      # authorize().
-      private  # Used by child
-      def authorize(*actions, &block)
-        actions.each do |action|
-          if action == :manage
-            # Serve as a catch-all to all actions that have not been specified in the policy.
-            @catch_all = block
-          else
-            method_name = "#{action}?"
-            # Avoid accidentally redefining multiple times from child policies. But it's okay if the child policy
-            # wants to override the parent's authorization method.
-            raise "Action authorization has been declared: #{action}" if instance_methods(false).include?(method_name.to_sym)
-            define_method method_name, &block
-          end
-        end
-      end
-    end
-    
-    private
-    def catch_all
-      self.class.catch_all
-    end
-    
-    private
-    # To ensure the block is called on the policy's instance instead class.
-    def call_catch_all
-      instance_eval(&catch_all)
-    end
-
-    authorize :index do
-      # We need this line because in `index` action, this method will be called instead of method_missing().
-      # Having this line ensures that the catch_all behaviour works according to the priority below:
-      # - child_policy#index?
-      # - child_policy#manage? -- catch_all
-      # - application_policy@index?
-      return call_catch_all if catch_all
-
-      false
-    end
-
-    authorize :show do
-      return call_catch_all if catch_all
-
-      scope.where(id: record.id).exists?
-    end
-
-    authorize :create do
-      return call_catch_all if catch_all
-      
-      false
-    end
-
-    authorize :new do
-      return call_catch_all if catch_all
-      
-      create?
-    end
-
-    authorize :update do
-      return call_catch_all if catch_all
-      
-      false
-    end
-
-    authorize :edit do
-      return call_catch_all if catch_all
-      
-      update?
-    end
-
-    authorize :destroy do
-      return call_catch_all if catch_all
-      
-      false
-    end
-
-    public
-    def method_missing(name, *args, &block)
-      if name.to_s.end_with?('?') && catch_all
-        call_catch_all
-      else
-        super
-      end
-    end
-
-    public
-    def scope
-      Pundit.policy_scope!(user, record.class)
-    end
-
-    private  # Used by child
-    def public?
-      true
-    end
-
-    # # TODO: Revise because it seems there is no justification for allowing owner to see any of the deleted entities, which include User, Guild, and Post
-    # private  # Used by child
-    # def not_deleted_unless_owner_or_moderator?(&block)
-    #   block ||= lambda { |unused_arg| @user.moderator? }
-    #   !@record.deleted? || (@user && (@user.id == @record.user_owner_id || block.call(@record)))
-    # end
-
-    # private  # Used by child
-    # def not_deleted_unless_moderator?(&block)
-    #   block ||= lambda { |unused_arg| @user.moderator? }
-    #   !@record.deleted? || (@user && block.call(@record))
-    # end
-
-    public
-    def self.args_builder
-      Proc.new { |controller| [] }
-    end
-    
-    class Scope
-      attr_reader :user, :scope
-
-      def initialize(user, scope)
-        @user = user
-        @scope = scope
-      end
-
-      def resolve
-        scope
-      end
-    end
-  end
-end
+# The main purpose of this is for security. If it is important to display useful error message or to provide a "banana", then
+# it's better to perform an explicit check (e.g. as a validation in the model or using a before_action).
+module Glib
+  class ApplicationPolicy
+    attr_reader :user, :record, :policy_name, :controller, :request, :params
+
+    private
+    def initialize(user, record, policy_name, controller, request, params)
+      @user = user
+      @record = record
+      @controller = controller
+      @request = request
+      # Don't get params from request because we might not have a proper request object. This might execute in Sidekiq.
+      # See Presenter::Model::inside_mock_controller()
+      @params = params
+      @policy_name = policy_name
+    end
+
+    class << self
+      attr_reader :catch_all
+
+      # This is to define the authorization logic for an action (or a group of actions). It's different from controller's
+      # authorize().
+      private  # Used by child
+      def authorize(*actions, &block)
+        actions.each do |action|
+          if action == :manage
+            # Serve as a catch-all to all actions that have not been specified in the policy.
+            @catch_all = block
+          else
+            method_name = "#{action}?"
+            # Avoid accidentally redefining multiple times from child policies. But it's okay if the child policy
+            # wants to override the parent's authorization method.
+            raise "Action authorization has been declared: #{action}" if instance_methods(false).include?(method_name.to_sym)
+            define_method method_name, &block
+          end
+        end
+      end
+    end
+
+    private
+    def catch_all
+      self.class.catch_all
+    end
+
+    private
+    # To ensure the block is called on the policy's instance instead class.
+    def call_catch_all
+      instance_eval(&catch_all)
+    end
+
+    authorize :index do
+      # We need this line because in `index` action, this method will be called instead of method_missing().
+      # Having this line ensures that the catch_all behaviour works according to the priority below:
+      # - child_policy#index?
+      # - child_policy#manage? -- catch_all
+      # - application_policy@index?
+      return call_catch_all if catch_all
+
+      false
+    end
+
+    authorize :show do
+      return call_catch_all if catch_all
+
+      scope.where(id: record.id).exists?
+    end
+
+    authorize :create do
+      return call_catch_all if catch_all
+
+      false
+    end
+
+    authorize :new do
+      return call_catch_all if catch_all
+
+      create?
+    end
+
+    authorize :update do
+      return call_catch_all if catch_all
+
+      false
+    end
+
+    authorize :edit do
+      return call_catch_all if catch_all
+
+      update?
+    end
+
+    authorize :destroy do
+      return call_catch_all if catch_all
+
+      false
+    end
+
+    public
+    def method_missing(name, *args, &block)
+      if name.to_s.end_with?('?') && catch_all
+        call_catch_all
+      else
+        super
+      end
+    end
+
+    public
+    def scope
+      policy_scope_class = Pundit::PolicyFinder.new(@policy_name).scope
+      return unless policy_scope_class
+
+      controller.policy_scope(record.class, policy_scope_class: policy_scope_class)
+    end
+
+    # TODO: Remove. Deprecated
+    private  # Used by child
+    def public?
+      true
+    end
+
+    private  # Used by child
+    def everyone
+      true
+    end
+
+    # # TODO: Revise because it seems there is no justification for allowing owner to see any of the deleted entities, which include User, Guild, and Post
+    # private  # Used by child
+    # def not_deleted_unless_owner_or_moderator?(&block)
+    #   block ||= lambda { |unused_arg| @user.moderator? }
+    #   !@record.deleted? || (@user && (@user.id == @record.user_owner_id || block.call(@record)))
+    # end
+
+    # private  # Used by child
+    # def not_deleted_unless_moderator?(&block)
+    #   block ||= lambda { |unused_arg| @user.moderator? }
+    #   !@record.deleted? || (@user && block.call(@record))
+    # end
+
+    public
+    def self.args_builder
+      Proc.new { |controller| [] }
+    end
+
+    class Scope
+      attr_reader :user, :scope
+
+      def initialize(user, scope)
+        @user = user
+        @scope = scope
+      end
+
+      def resolve
+        scope.none
+      end
+    end
+  end
+end

data/app/views/json_ui/garage/lists/templating.json.jbuilder

@@ -16,13 +16,14 @@ json_ui_page json do |page|
       template.thumbnail title: 'Item with thumbnail image', subtitle: 'Item subtitle', imageUrl: glib_json_image_standard_url
       template.featured title: 'Featured with featured image', subtitle: 'Item subtitle', imageUrl: glib_json_image_standard_url
 
-      template.thumbnail title: 'Item with accessories (Experimental)', subtitle: 'Item subtitle', accessoryViews: ->(thumbnail) do
-        thumbnail.panels_horizontal childViews: ->(horizontal) do
-          horizontal.chip text: 'finished'
-          horizontal.spacer width: 10
-          horizontal.chip text: 'succeeded'
-        end
-      end
+      # TODO
+      # template.thumbnail title: 'Item with accessories (Experimental)', subtitle: 'Item subtitle', accessoryViews: ->(thumbnail) do
+      #   thumbnail.panels_horizontal childViews: ->(horizontal) do
+      #     horizontal.chip text: 'finished'
+      #     horizontal.spacer width: 10
+      #     horizontal.chip text: 'succeeded'
+      #   end
+      # end
 
     end
   end

data/app/views/json_ui/garage/views/images.json.jbuilder

@@ -3,7 +3,8 @@ json.title 'Views'
 page = json_ui_page json
 render "#{@path_prefix}/nav_menu", json: json, page: page
 
-small_image_url = 'https://icons-for-free.com/iconfiles/png/128/of+thrones+game+thrones+series+character+avatar+jon+snow-1320568555745862611.png'
+# small_image_url = 'https://icons-for-free.com/iconfiles/png/128/of+thrones+game+thrones+series+character+avatar+jon+snow-1320568555745862611.png'
+small_image_url = 'https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSGQpSWjtELISLBlmugOZ6wzl1JamYXQvbFeYywpfg3E8b8DrO0Kg&s'
 
 page.scroll padding: glib_json_padding_body, childViews: ->(scroll) do
   scroll.h2 text: 'Avatar'
@@ -33,7 +34,7 @@ page.scroll padding: glib_json_padding_body, childViews: ->(scroll) do
 
   scroll.spacer height: 60
   scroll.hr
-  
+
   scroll.spacer height: 60
   scroll.h2 text: 'Original size'
   scroll.spacer height: 6
@@ -49,7 +50,7 @@ page.scroll padding: glib_json_padding_body, childViews: ->(scroll) do
   scroll.h2 text: 'fit: clip (default) to full width (scale down)'
   scroll.spacer height: 6
   scroll.image width: 'matchParent', url: glib_json_image_standard_url
-  
+
   scroll.spacer height: 20
   scroll.h2 text: 'fit: clip (default) to full width (scale up)'
   scroll.spacer height: 6
@@ -58,35 +59,31 @@ page.scroll padding: glib_json_padding_body, childViews: ->(scroll) do
   scroll.spacer height: 20
   scroll.h2 text: 'fit: clip (default) to width (scale down)'
   scroll.spacer height: 6
-  scroll.image width: 100, url: glib_json_image_standard_url
-  
-  # TODO: Make sure this is the same as https://docs.imgix.com/apis/url/size/fit#clip
+  scroll.image width: 320, url: glib_json_image_standard_url
+
   scroll.spacer height: 20
   scroll.h2 text: 'fit: clip (default) to height (scale down)'
   scroll.spacer height: 6
-  scroll.image height: 100, url: glib_json_image_standard_url
-  
+  scroll.image height: 320, url: glib_json_image_standard_url
+
   scroll.spacer height: 20
   scroll.h2 text: 'fit: clip (default) to width (scale up)'
   scroll.spacer height: 6
-  scroll.image width: 240, url: small_image_url
-  
-  # TODO: Make sure this is the same as https://docs.imgix.com/apis/url/size/fit#clip
+  scroll.image width: 320, url: small_image_url
+
   scroll.spacer height: 20
   scroll.h2 text: 'fit: clip (default) to height (scale up)'
   scroll.spacer height: 6
-  scroll.image height: 240, url: small_image_url
-  
-  # TODO: Make sure this is the same as https://docs.imgix.com/apis/url/size/fit#crop
+  scroll.image height: 320, url: small_image_url
+
   # Reference: https://docs.imgix.com/apis/url/size/fit#crop
   scroll.spacer height: 20
   scroll.h2 text: 'fit: crop to width'
   scroll.spacer height: 6
-  scroll.image width: 100, url: glib_json_image_standard_url, fit: :crop
-  
-  # TODO: Make sure this is the same as https://docs.imgix.com/apis/url/size/fit#crop
+  scroll.image width: 200, url: glib_json_image_standard_url, fit: :crop
+
   scroll.spacer height: 20
   scroll.h2 text: 'fit: crop to height'
   scroll.spacer height: 6
-  scroll.image height: 100, url: glib_json_image_standard_url, fit: :crop
+  scroll.image height: 200, url: glib_json_image_standard_url, fit: :crop
 end

data/lib/glib/json_crawler/action_crawlers/nav_initiate.rb

@@ -10,4 +10,4 @@ module Glib
       end
     end
   end
-end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: glib-web
 version: !ruby/object:Gem::Version
-  version: 0.4.24
+  version: 0.4.25
 platform: ruby
 authors:
 - ''