grant 1.0.1

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2009 Near Infinity Corporation
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,73 @@
+= Grant
+
+Grant is a Ruby gem and Rails plugin that forces you to make explicit security decisions about the operations performed on your ActiveRecord models. It provides a declarative way to specify rules granting permission to perform CRUD operations on ActiveRecord objects. 
+
+Grant does not allow you to specify which operations are restricted. Instead, it restricts all CRUD operations unless they're explicitly granted to the user. It also restricts adding or removing items to/from has_many and has_and_belongs_to_many associations. Only allowing operations explicitly granted forces you to make conscious security decisions. Grant will not help you make those decisions, but it won't let you forget to.
+
+Additional information beyond that found in this README is available on the wiki[https://github.com/nearinfinity/grant/wiki].
+
+= Installation
+
+To install the Grant gem, simply run
+
+  gem install grant
+  
+To use it with a Rails 3 project or other project using Bundler, add the following line to your Gemfile
+
+  gem 'grant'
+  
+For your Rails 2.x project, add the following to your environment.rb file
+
+  config.gem 'grant'
+
+Lastly, Grant can also be installed as a Rails plugin
+  
+  script/plugin install git://github.com/nearinfinity/grant.git
+
+= Setup
+
+Grant needs to know who the current user is, but with no standard for doing so you'll have to do a little work to set things up. You simply need to set your current user model object as the Grant current user before any CRUD operations are performed. For example, in a Rails application you could add the following to your application_controller.rb
+
+  class ApplicationController < ActionController::Base
+    before_filter :set_current_user
+    
+    private
+    
+    def set_current_user
+      Grant::User.current_user = @current_user
+    end
+  end
+
+= Usage
+
+To enable model security you simply include the Grant::ModelSecurity module in your model class. In the example below you see three grant statements. The first grants find (aka read) permission all the time. The second example grants create, update, and destroy permission when the passed block evaluates to true, which in this case happens when the model is editable by the current user. Similarly, the third grant statement permits additions and removals from the tags association when it's block evaluates to true. A Grant::Error is raised if any grant block evaluates to false or nil.
+
+  class Book < ActiveRecord::Base
+    include Grant::ModelSecurity
+    
+    has_many :tags
+    grant(:find) { true }
+    grant(:create, :update, :destroy) { |user, model| model.editable_by_user? user }
+    grant(:add => :tags, :remove => :tags) { |user, model, associated_model| model.editable_by_user? user }
+    
+    def editable_by_user? user
+      user.administrator? || user.has_role?(:editor) 
+    end
+  end
+
+The valid actions to pass to a grant statement are :find, :create, :update, :destroy, :add, and :remove. The first four options are passed as symbols while :add and :remove are hash keys to association names they protect. Any number of options can be passed to a single grant statement, which is very useful if each of the actions share the same logic for determining access.
+
+= Integration
+
+There may be some instances where you need to perform an action on your model object without Grant stepping in and stopping you. In those cases you can include the Grant::Integration module for help.
+
+  class BooksController < ApplicationController
+    include Grant::Integration
+    
+    def update
+      book = Book.find(params[:id])
+      without_grant { book.update_attributes(params[:book]) } # Grant is disabled for the entire block
+    end
+  end
+
+Copyright (c) 2010 Near Infinity Corporation, released under the MIT license

data/lib/grant.rb

@@ -0,0 +1,8 @@
+require 'grant/integration'
+require 'grant/model_security'
+require 'grant/user'
+require 'grant/version'
+
+module Grant
+  class Error < StandardError; end
+end

data/lib/grant/config_parser.rb

@@ -0,0 +1,26 @@
+module Grant
+  class ConfigParser
+    
+    def self.extract_config(args)
+      hash = (args.pop if args.last.is_a?(::Hash)) || {}
+      normalize_config args, hash
+      validate_config args, hash
+      
+      [args, hash]
+    end
+    
+    private
+    
+      def self.normalize_config(actions, associations)
+        actions.each_with_index { |item, index| actions[index] = item.to_sym unless item.kind_of? Symbol }
+        associations.each_pair { |k, v| associations[k.to_sym] = associations.delete(k) unless k.kind_of? Symbol }
+      end
+    
+      def self.validate_config(actions, associations)
+        raise Grant::Error.new("at least one :create, :find, :update, or :destroy action must be specified") if actions.empty? && associations.empty?
+        raise Grant::Error.new(":create, :find, :update, and :destroy are the only valid actions") unless actions.all? { |a| [:create, :find, :update, :destroy].include? a }
+        raise Grant::Error.new(":add and :remove are the only valid association specifications") unless associations.keys.all? { |k| [:add, :remove].include? k }
+      end
+     
+  end
+end

data/lib/grant/integration.rb

@@ -0,0 +1,49 @@
+require 'grant/thread_status'
+
+module Grant
+  module Integration
+    
+    def without_grant
+      previously_disabled = grant_disabled?
+      disable_grant
+      
+      begin
+        result = yield if block_given?
+      ensure
+        enable_grant unless previously_disabled
+      end
+      
+      result
+    end
+    
+    def with_grant
+      previously_disabled = grant_disabled?
+      enable_grant
+      
+      begin
+        result = yield if block_given?
+      ensure
+        disable_grant if previously_disabled
+      end
+      
+      result
+    end
+    
+    def disable_grant
+      Grant::ThreadStatus.disable
+    end
+    
+    def enable_grant
+      Grant::ThreadStatus.enable
+    end
+    
+    def grant_disabled?
+      Grant::ThreadStatus.disabled?
+    end
+    
+    def grant_enabled?
+      Grant::ThreadStatus.enabled?
+    end
+    
+  end
+end

data/lib/grant/model_security.rb

@@ -0,0 +1,101 @@
+require 'grant/config_parser'
+require 'grant/user'
+require 'grant/thread_status'
+
+module Grant
+  module ModelSecurity
+    
+    def self.included(base)
+      [:create, :update, :destroy, :find].each do |action|
+        callback = (action == :find ? "after_#{action}" : "before_#{action}")
+        base.class_eval <<-RUBY
+          def grant_#{callback}
+            grant_raise_error(grant_current_user, '#{action}', self) unless grant_disabled?
+          end
+        RUBY
+        base.send callback.to_sym, "grant_#{callback}".to_sym
+      end
+    
+      base.extend ClassMethods
+    end
+  
+    # ActiveRecord won't call the after_find handler unless it see's a specific after_find method defined
+    def after_find; end
+  
+    def grant_current_user
+      Grant::User.current_user
+    end
+  
+    def grant_disabled?
+      Grant::ThreadStatus.disabled? || @grant_disabled
+    end
+    
+    def grant_raise_error(user, action, model, association_id=nil, associated_model=nil)
+      msg = ["#{action} permission",
+        "not granted to #{user.class.name}:#{user.id}",
+        "for resource #{model.class.name}:#{model.id}"]
+      msg.insert(1, "to #{association_id}:#{associated_model.class.name} association") if association_id && associated_model
+
+      raise Grant::Error.new(msg.join(' '))
+    end
+  
+    module ClassMethods
+      def grant(*args, &blk)
+        actions, associations = Grant::ConfigParser.extract_config(args)
+      
+        associations.each_pair do |action, association_ids|
+          Array(association_ids).each do |association_id|
+            grant_callback = "grant_#{action}_#{association_id}".to_sym
+            define_method(grant_callback) do |associated_model|
+              grant_raise_error(grant_current_user, action, self, association_id, associated_model) unless grant_disabled? || blk.call(grant_current_user, self, associated_model)
+            end
+          end
+        end
+      
+        actions.each do |action|
+          grant_callback = (action.to_sym == :find ? "grant_after_find" : "grant_before_#{action}").to_sym
+          define_method(grant_callback) do
+            grant_raise_error(grant_current_user, action, self) unless grant_disabled? || blk.call(grant_current_user, self)
+          end
+        end
+      end
+    
+      def has_and_belongs_to_many(association_id, options={}, &extension)
+        add_grant_association_callback(:add, association_id, options)
+        add_grant_association_callback(:remove, association_id, options)
+        super
+      end
+    
+      def has_many(association_id, options={}, &extension)
+        add_grant_association_callback(:add, association_id, options)
+        add_grant_association_callback(:remove, association_id, options)
+        super
+      end
+    
+      private
+    
+        def add_grant_association_callback(action, association_id, options)
+          callback_name = "before_#{action}".to_sym
+          callback = "grant_#{action}_#{association_id}".to_sym
+          unless self.instance_methods.include? callback.to_s
+            class_eval <<-RUBY
+              def #{callback}(associated_model)
+                grant_raise_error(grant_current_user, '#{action}', self, '#{association_id}', associated_model) unless grant_disabled?
+              end
+            RUBY
+          end
+      
+          if options.has_key? callback_name
+            if options[callback_name].kind_of? Array
+              options[callback_name].insert(0, callback)
+            else
+              options[callback_name] = [callback, options[callback_name]]
+            end
+          else
+            options[callback_name] = callback
+          end
+        end
+    
+    end
+  end
+end

data/lib/grant/spec_helpers.rb

@@ -0,0 +1,22 @@
+require 'grant/integration'
+
+module Grant
+  module SpecHelpers
+    include Grant::Integration
+  
+    def self.included(base)
+      base.class_eval do
+        before(:each) do
+          disable_grant
+        end
+      
+        after(:each) do
+          enable_grant
+        end
+      end
+    end
+    
+  end
+end
+
+

data/lib/grant/thread_local.rb

@@ -0,0 +1,18 @@
+module Grant
+  class ThreadLocal
+    
+    def initialize(initial_value)
+      @thread_symbol = "#{rand}#{Time.now.to_f}"
+      set initial_value
+    end
+    
+    def set(value)
+      Thread.current[@thread_symbol] = value
+    end
+    
+    def get
+      Thread.current[@thread_symbol]
+    end
+    
+  end
+end

data/lib/grant/thread_status.rb

@@ -0,0 +1,34 @@
+require 'grant/thread_local'
+
+module Grant
+  module ThreadStatus
+    
+    def self.enabled?
+      status
+    end
+    
+    def self.disabled?
+      !status
+    end
+    
+    def self.enable
+      set_status true
+    end
+    
+    def self.disable
+      set_status false
+    end
+    
+    private
+      def self.status
+        @status = Grant::ThreadLocal.new(true) if @status.nil?
+        @status.get
+      end
+      
+      def self.set_status(status)
+        @status = Grant::ThreadLocal.new(true) if @status.nil?
+        @status.set status
+      end
+    
+  end
+end

data/lib/grant/user.rb

@@ -0,0 +1,16 @@
+module Grant
+  module User
+    def current_user
+      Thread.current[@@current_user_symbol]
+    end
+
+    def current_user=(user)
+      Thread.current[@@current_user_symbol] = user
+    end
+    
+    module_function :current_user, :current_user=
+
+    private
+    @@current_user_symbol = :grant_current_user_symbol
+  end
+end

data/lib/grant/version.rb

@@ -0,0 +1,3 @@
+module Grant
+  VERSION = "1.0.1"
+end

data/spec/config_parser_spec.rb

@@ -0,0 +1,61 @@
+require File.dirname(__FILE__) + '/spec_helper'
+require 'grant'
+
+describe Grant::ConfigParser do
+  
+  describe 'Configuration' do
+    it "should parse actions and associations from a config array" do
+      config = Grant::ConfigParser.extract_config([:create, 'update', {:add => [:people, :places], 'remove' => :people}])
+      config.should_not be_nil
+      config.should have(2).items
+      config[0].should =~ [:create, :update]
+      config[1].should == {:add => [:people, :places], :remove => :people}
+    end
+  
+    it "should parse actions from a config array when associations are absent" do
+      config = Grant::ConfigParser.extract_config([:create, :update])
+      config.should_not be_nil
+      config.should have(2).items
+      config[0].should =~ [:create, :update]
+      config[1].should == {}
+    end
+    
+    it "should parse actions and associations from a config array when options are absent" do
+      config = Grant::ConfigParser.extract_config([:create, 'update', {:add => ['people', :places]}])
+      config.should_not be_nil
+      config.should have(2).items
+      config[0].should =~ [:create, :update]
+      config[1].should == {:add => ['people', :places]}
+    end
+    
+    it "should parse actions" do
+      config = Grant::ConfigParser.extract_config([:create])
+      config.should_not be_nil
+      config.should have(2).items
+      config[0].should =~ [:create]
+      config[1].should == {}
+    end
+
+  end
+  
+  describe 'Configuration Validation' do
+    it "should raise a Grant::Error if no action or association is specified" do
+      lambda {
+        Grant::ConfigParser.instance_eval { validate_config([], {}) }
+      }.should raise_error(Grant::Error)
+    end
+    
+    it "should raise a Grant::Error if an invalid action is specified" do
+      lambda {
+        Grant::ConfigParser.instance_eval { validate_config([:create, :udate], {:add => [:people, :places]}) }
+      }.should raise_error(Grant::Error)
+    end
+    
+    it "should raise a Grant::Error if an invalid association is specified" do
+      lambda {
+        Grant::ConfigParser.instance_eval { validate_config([:destroy], {:add => :people, :update => :places}) }
+      }.should raise_error(Grant::Error)
+    end
+  end
+  
+end

data/spec/integration_spec.rb

@@ -0,0 +1,66 @@
+require File.dirname(__FILE__) + '/spec_helper'
+require 'grant'
+
+describe Grant::Integration do
+  include Grant::Integration
+  
+  it "should have the ability to disable Grant" do
+    disable_grant
+    grant_disabled?.should be_true
+    Grant::ThreadStatus.should be_disabled
+  end
+  
+  it "should have the ability to enable Grant" do
+    disable_grant
+    enable_grant
+    grant_enabled?.should be_true
+    Grant::ThreadStatus.should be_enabled  
+  end
+  
+  it "should have the ability to check if grant is enabled" do
+    enable_grant
+    grant_enabled?.should be_true
+  end
+  
+  it "should have the ability to check if grant is disabled" do
+    disable_grant
+    grant_disabled?.should be_true
+  end
+  
+  it "should be able to execute a block of code with grant temporarily disabled but switched back to enabled afterwards" do
+    enable_grant
+    without_grant do
+      grant_disabled?.should be_true
+      Grant::ThreadStatus.should be_disabled
+    end
+    grant_enabled?.should be_true
+  end
+  
+  it "should be able to execute a block of code with grant disabled and remain disabled afterwards if it was beforehand" do
+    disable_grant
+    without_grant do
+      grant_disabled?.should be_true
+      Grant::ThreadStatus.should be_disabled
+    end
+    grant_disabled?.should be_true
+  end
+  
+  it "should be able to execute a block of code with grant temporarily enabled but switched back to disabled afterwards" do
+    disable_grant
+    with_grant do
+      grant_enabled?.should be_true
+      Grant::ThreadStatus.should be_enabled
+    end
+    grant_disabled?.should be_true
+  end
+  
+  it "should be able to execute a block of code with grant enabled and remain enabled afterwards if it was beforehand" do
+    enable_grant
+    with_grant do
+      grant_enabled?.should be_true
+      Grant::ThreadStatus.should be_enabled
+    end
+    grant_enabled?.should be_true
+  end
+  
+end

data/spec/model_security_spec.rb

@@ -0,0 +1,162 @@
+require File.dirname(__FILE__) + '/spec_helper'
+require 'grant'
+
+describe Grant::ModelSecurity do
+  
+  before(:each) do
+    Grant::User.current_user = (Class.new do
+      def id; 1 end
+    end).new
+  end
+  
+  describe 'module include' do
+    it 'should establish failing ActiveRecord callbacks for before_create, before_update, before_destroy, and after_find when included' do
+      verify_standard_callbacks(new_model_class.new)
+    end
+    
+    it 'should establish failing ActiveRecord callbacks for any has_many or has_and_belongs_to_many associations' do
+      c = new_model_class
+      c.instance_eval do
+        has_many :users
+        has_and_belongs_to_many :groups
+      end
+      verify_association_callbacks(c.new)
+    end
+  end
+  
+  describe '#grant' do
+    it 'should allow after_find callback to succeed when granted' do
+      c = new_model_class.instance_eval { grant(:find) { true }; self }
+      verify_standard_callbacks(c.new, :find)
+    end
+    
+    it 'should allow before_create callback to succeed when granted' do
+      c = new_model_class.instance_eval { grant(:create) { true }; self }
+      verify_standard_callbacks(c.new, :create)
+    end
+    
+    it 'should allow before_update callback to succeed when granted' do
+      c = new_model_class.instance_eval { grant(:update) { true }; self }
+      verify_standard_callbacks(c.new, :update)
+    end
+    
+    it 'should allow before_destroy callback to succeed when granted' do
+      c = new_model_class.instance_eval { grant(:destroy) { true }; self }
+      verify_standard_callbacks(c.new, :destroy)
+    end
+    
+    it 'should allow multiple callbacks to be specified with one grant statment' do
+      c = new_model_class.instance_eval { grant(:create, :update) { true }; self }
+      verify_standard_callbacks(c.new, :create, :update)
+      
+      c = new_model_class.instance_eval { grant(:create, :update, :destroy) { true }; self }
+      verify_standard_callbacks(c.new, :create, :update, :destroy)
+      
+      c = new_model_class.instance_eval { grant(:create, :update, :destroy, :find) { true }; self }
+      verify_standard_callbacks(c.new, :create, :update, :destroy, :find)
+    end
+    
+    it 'should allow adding to an association to succeed when granted' do
+      c = new_model_class
+      c.instance_eval do
+        has_many :users
+        has_and_belongs_to_many :groups
+        grant(:add => [:users, :groups]) { true }
+      end
+      verify_association_callbacks(c.new, :add_users, :add_groups)
+    end
+    
+    it 'should allow adding to an association to succeed when granted above association declarations' do
+      c = new_model_class
+      c.instance_eval do
+        grant(:add => [:users, :groups]) { true }
+        has_many :users
+        has_and_belongs_to_many :groups, :before_add => [:bogus1, :bogus2]
+        define_method(:bogus1) {}
+        define_method(:bogus2) {}
+      end
+      verify_association_callbacks(c.new, :add_users, :add_groups)
+    end
+    
+    it 'should allow removing from an association to succeed when granted' do
+      c = new_model_class
+      c.instance_eval do
+        has_many :users
+        has_and_belongs_to_many :groups, :before_remove => :bogus1
+        grant(:remove => [:users, :groups]) { true }
+        define_method(:bogus1) {}
+      end
+      verify_association_callbacks(c.new, :remove_users, :remove_groups)
+    end
+
+    it 'should allow removing from an association to succeed when granted above association declarations' do
+      c = new_model_class
+      c.instance_eval do
+        grant(:remove => [:users, :groups]) { true }
+        has_many :users
+        has_and_belongs_to_many :groups
+      end
+      verify_association_callbacks(c.new, :remove_users, :remove_groups)
+    end
+  end
+  
+  def verify_standard_callbacks(instance, *succeeding_callbacks)
+    verify_callbacks([:create, :update, :destroy, :find], instance, nil, succeeding_callbacks)
+  end
+  
+  def verify_association_callbacks(instance, *succeeding_callbacks)
+    verify_callbacks([:add_users, :remove_users, :add_groups, :remove_groups], instance, new_model_class.new, succeeding_callbacks)
+  end
+  
+  def verify_callbacks(all_actions, instance, associated_model, succeeding_callbacks)
+    all_actions.each do |action|
+      expectation = succeeding_callbacks.include?(action) ? :should_not : :should
+      lambda { instance.send(action, associated_model) }.send(expectation, raise_error(Grant::Error))
+    end
+  end
+  
+  def new_model_class
+    Class.new(ActiveRecordMock) do
+      include Grant::ModelSecurity
+    end
+  end
+  
+  class ActiveRecordMock
+    def id; 1 end
+    
+    def self.before_create(method)
+      define_method(:create) { send method }
+    end
+    
+    def self.before_update(method)
+      define_method(:update) { send method }
+    end
+    
+    def self.before_destroy(method)
+      define_method(:destroy) { send method }
+    end
+    
+    def self.after_find(method)
+      define_method(:find) { send method }
+    end
+    
+    def self.has_many(association_id, options, &extension)
+      define_method("add_#{association_id}".to_sym) do |associated_model|
+        Array(options[:before_add]).each { |callback| send(callback, associated_model) }
+      end
+      define_method("remove_#{association_id}".to_sym) do |associated_model|
+        Array(options[:before_remove]).each { |callback| send(callback, associated_model) }
+      end
+    end
+    
+    def self.has_and_belongs_to_many(association_id, options, &extension)
+      define_method("add_#{association_id}".to_sym) do |associated_model|
+        Array(options[:before_add]).each { |callback| send(callback, associated_model) }
+      end
+      define_method("remove_#{association_id}".to_sym) do |associated_model|
+        Array(options[:before_remove]).each { |callback| send(callback, associated_model) }
+      end
+    end
+  end
+  
+end

data/spec/spec_helper.rb

@@ -0,0 +1,45 @@
+require 'rspec'
+
+# Requires supporting files with custom matchers and macros, etc,
+# in ./support/ and its subdirectories.
+Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
+
+RSpec.configure do |config|
+  # If you're not using ActiveRecord you should remove these
+  # lines, delete config/database.yml and disable :active_record
+  # in your config/boot.rb
+  # config.use_transactional_fixtures = true
+  # config.use_instantiated_fixtures  = false
+
+  # == Fixtures
+  #
+  # You can declare fixtures for each example_group like this:
+  #   describe "...." do
+  #     fixtures :table_a, :table_b
+  #
+  # Alternatively, if you prefer to declare them only once, you can
+  # do so right here. Just uncomment the next line and replace the fixture
+  # names with your fixtures.
+  #
+  # config.global_fixtures = :all
+  #
+  # If you declare global fixtures, be aware that they will be declared
+  # for all of your examples, even those that don't use them.
+  #
+  # You can also declare which fixtures to use (for example fixtures for test/fixtures):
+  #
+  # config.fixture_path = RAILS_ROOT + '/spec/fixtures/'
+  #
+  # == Mock Framework
+  #
+  # RSpec uses it's own mocking framework by default. If you prefer to
+  # use mocha, flexmock or RR, uncomment the appropriate line:
+  #
+  # config.mock_with :mocha
+  # config.mock_with :flexmock
+  # config.mock_with :rr
+  #
+  # == Notes
+  #
+  # For more information take a look at Spec::Runner::Configuration and Spec::Runner
+end

data/spec/thread_local_spec.rb

@@ -0,0 +1,14 @@
+require File.dirname(__FILE__) + '/spec_helper'
+require 'grant/thread_local'
+
+describe Grant::ThreadLocal do
+  it "should properly set and get thread-local variables" do
+    val = "val"
+    tl = Grant::ThreadLocal.new(val)
+    tl.get.should == val
+    
+    val2 = "val2"
+    tl.set val2
+    tl.get.should == val2
+  end
+end

data/spec/thread_status_spec.rb

@@ -0,0 +1,16 @@
+require File.dirname(__FILE__) + '/spec_helper'
+require 'grant'
+
+describe Grant::ThreadStatus do
+  it "should be enabled if set to enabled" do
+    Grant::ThreadStatus.enable
+    Grant::ThreadStatus.should be_enabled
+    Grant::ThreadStatus.should_not be_disabled
+  end
+  
+  it "should be disabled if set to disabled" do
+    Grant::ThreadStatus.disable
+    Grant::ThreadStatus.should_not be_enabled
+    Grant::ThreadStatus.should be_disabled
+  end
+end

data/spec/user_spec.rb

@@ -0,0 +1,25 @@
+require File.dirname(__FILE__) + '/spec_helper'
+require 'grant/user'
+
+describe Grant::User do
+  it "should return the same user that's set on the same thread" do
+    user = "user"
+    Grant::User.current_user = user
+    Grant::User.current_user.should == user
+  end
+  
+  it "should not return the same user from a different thread" do
+    user = "user"
+    user2 = "user2"
+    
+    Grant::User.current_user = user
+    
+    Thread.new do
+      Grant::User.current_user.should be_nil
+      Grant::User.current_user = user2
+      Grant::User.current_user.should == user2
+    end
+    
+    Grant::User.current_user.should == user
+  end
+end

metadata

@@ -0,0 +1,106 @@
+--- !ruby/object:Gem::Specification 
+name: grant
+version: !ruby/object:Gem::Version 
+  hash: 21
+  prerelease: false
+  segments: 
+  - 1
+  - 0
+  - 1
+  version: 1.0.1
+platform: ruby
+authors: 
+- Jeff Kunkle
+- Matt Wizeman
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2010-12-29 00:00:00 -05:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: rspec
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  type: :development
+  version_requirements: *id001
+description: Grant is a Ruby gem and Rails plugin that forces you to make explicit security decisions about the operations performed on your ActiveRecord models.
+email: 
+executables: []
+
+extensions: []
+
+extra_rdoc_files: []
+
+files: 
+- lib/grant/config_parser.rb
+- lib/grant/integration.rb
+- lib/grant/model_security.rb
+- lib/grant/spec_helpers.rb
+- lib/grant/thread_local.rb
+- lib/grant/thread_status.rb
+- lib/grant/user.rb
+- lib/grant/version.rb
+- lib/grant.rb
+- LICENSE
+- README.rdoc
+- spec/config_parser_spec.rb
+- spec/integration_spec.rb
+- spec/model_security_spec.rb
+- spec/spec_helper.rb
+- spec/thread_local_spec.rb
+- spec/thread_status_spec.rb
+- spec/user_spec.rb
+has_rdoc: true
+homepage: http://github.com/nearinfinity/grant
+licenses: 
+- MIT
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 23
+      segments: 
+      - 1
+      - 3
+      - 6
+      version: 1.3.6
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.7
+signing_key: 
+specification_version: 3
+summary: Conscious security constraints for your ActiveRecord model objects
+test_files: 
+- spec/config_parser_spec.rb
+- spec/integration_spec.rb
+- spec/model_security_spec.rb
+- spec/spec_helper.rb
+- spec/thread_local_spec.rb
+- spec/thread_status_spec.rb
+- spec/user_spec.rb