graphql-pundit 0.4.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rspec +2 -1
- data/.rubocop.yml +7 -18
- data/.rubocop_enabled.yml +48 -56
- data/.travis.yml +9 -3
- data/README.md +2 -0
- data/graphql-pundit.gemspec +7 -3
- data/lib/graphql-pundit.rb +16 -8
- data/lib/graphql-pundit/instrumenters/authorization.rb +54 -35
- data/lib/graphql-pundit/instrumenters/scope.rb +47 -30
- data/lib/graphql-pundit/version.rb +1 -1
- metadata +76 -20
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: a644c29c51d4a66d193bc9417a85b22b9573c495
|
|
4
|
+
data.tar.gz: c913a8f1fe165bf091dbc3a20dfd29074a237601
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 9ab7475fa807ec3ac98123d462a2e86894fdd3f3c10f0d4bd90e1de668ec74c73b97026e1fd8b6a8a12f9ca0afbcee75b95891acae9382713b0a32bbc3ee0b7a
|
|
7
|
+
data.tar.gz: f062e98925ee41433ef60d6d04ed660109d07dbcf806489d020ac9c0481200f9822ef58305d82306d2677e5ded5573726c4351705276bcd78374f8c6eb0a7a77
|
data/.rspec
CHANGED
data/.rubocop.yml
CHANGED
|
@@ -16,13 +16,11 @@ AllCops:
|
|
|
16
16
|
TargetRubyVersion: 2.4
|
|
17
17
|
# Include common Ruby source files.
|
|
18
18
|
Include:
|
|
19
|
-
- '**/*.gemspec'
|
|
20
19
|
- '**/*.podspec'
|
|
21
20
|
- '**/*.jbuilder'
|
|
22
21
|
- '**/*.rake'
|
|
23
22
|
- '**/*.opal'
|
|
24
23
|
- '**/config.ru'
|
|
25
|
-
- '**/Gemfile'
|
|
26
24
|
- '**/Rakefile'
|
|
27
25
|
- '**/Capfile'
|
|
28
26
|
- '**/Guardfile'
|
|
@@ -35,6 +33,8 @@ AllCops:
|
|
|
35
33
|
- '**/Fastfile'
|
|
36
34
|
- '**/*Fastfile'
|
|
37
35
|
Exclude:
|
|
36
|
+
- '**/*.gemspec'
|
|
37
|
+
- '**/Gemfile'
|
|
38
38
|
- 'bin/bundle'
|
|
39
39
|
- 'bin/rails'
|
|
40
40
|
- 'bin/rake'
|
|
@@ -471,17 +471,6 @@ Style/EmptyMethod:
|
|
|
471
471
|
- compact
|
|
472
472
|
- expanded
|
|
473
473
|
|
|
474
|
-
# Checks whether the source file has a utf-8 encoding comment or not
|
|
475
|
-
# AutoCorrectEncodingComment must match the regex
|
|
476
|
-
# /#.*coding\s?[:=]\s?(?:UTF|utf)-8/
|
|
477
|
-
Style/Encoding:
|
|
478
|
-
EnforcedStyle: never
|
|
479
|
-
SupportedStyles:
|
|
480
|
-
- when_needed
|
|
481
|
-
- always
|
|
482
|
-
- never
|
|
483
|
-
AutoCorrectEncodingComment: '# encoding: utf-8'
|
|
484
|
-
|
|
485
474
|
Layout/EndOfLine:
|
|
486
475
|
# The `native` style means that CR+LF (Carriage Return + Line Feed) is
|
|
487
476
|
# enforced on Windows, and LF is enforced on other platforms. The other styles
|
|
@@ -500,7 +489,7 @@ Layout/ExtraSpacing:
|
|
|
500
489
|
# When true, forces the alignment of `=` in assignments on consecutive lines.
|
|
501
490
|
ForceEqualSignAlignment: false
|
|
502
491
|
|
|
503
|
-
|
|
492
|
+
Naming/FileName:
|
|
504
493
|
# File names listed in `AllCops:Include` are excluded by default. Add extra
|
|
505
494
|
# excludes here.
|
|
506
495
|
Exclude: ['lib/graphql-pundit.rb']
|
|
@@ -731,7 +720,7 @@ Style/MethodDefParentheses:
|
|
|
731
720
|
- require_no_parentheses
|
|
732
721
|
- require_no_parentheses_except_multiline
|
|
733
722
|
|
|
734
|
-
|
|
723
|
+
Naming/MethodName:
|
|
735
724
|
EnforcedStyle: snake_case
|
|
736
725
|
SupportedStyles:
|
|
737
726
|
- snake_case
|
|
@@ -902,7 +891,7 @@ Style/PercentQLiterals:
|
|
|
902
891
|
- lower_case_q # Use `%q` when possible, `%Q` when necessary
|
|
903
892
|
- upper_case_q # Always use `%Q`
|
|
904
893
|
|
|
905
|
-
|
|
894
|
+
Naming/PredicateName:
|
|
906
895
|
# Predicate name prefixes.
|
|
907
896
|
NamePrefix:
|
|
908
897
|
- is_
|
|
@@ -1169,13 +1158,13 @@ Style/TrivialAccessors:
|
|
|
1169
1158
|
- to_s
|
|
1170
1159
|
- to_sym
|
|
1171
1160
|
|
|
1172
|
-
|
|
1161
|
+
Naming/VariableName:
|
|
1173
1162
|
EnforcedStyle: snake_case
|
|
1174
1163
|
SupportedStyles:
|
|
1175
1164
|
- snake_case
|
|
1176
1165
|
- camelCase
|
|
1177
1166
|
|
|
1178
|
-
|
|
1167
|
+
Naming/VariableNumber:
|
|
1179
1168
|
EnforcedStyle: normalcase
|
|
1180
1169
|
SupportedStyles:
|
|
1181
1170
|
- snake_case
|
data/.rubocop_enabled.yml
CHANGED
|
@@ -338,13 +338,59 @@ Layout/TrailingWhitespace:
|
|
|
338
338
|
StyleGuide: '#no-trailing-whitespace'
|
|
339
339
|
Enabled: true
|
|
340
340
|
|
|
341
|
-
####################
|
|
341
|
+
#################### Naming ##############################
|
|
342
342
|
|
|
343
|
-
|
|
343
|
+
Naming/AccessorMethodName:
|
|
344
344
|
Description: Check the naming of accessor methods for get_/set_.
|
|
345
345
|
StyleGuide: '#accessor_mutator_method_names'
|
|
346
346
|
Enabled: true
|
|
347
347
|
|
|
348
|
+
Naming/AsciiIdentifiers:
|
|
349
|
+
Description: 'Use only ascii symbols in identifiers.'
|
|
350
|
+
StyleGuide: '#english-identifiers'
|
|
351
|
+
Enabled: true
|
|
352
|
+
|
|
353
|
+
Naming/BinaryOperatorParameterName:
|
|
354
|
+
Description: 'When defining binary operators, name the argument other.'
|
|
355
|
+
StyleGuide: '#other-arg'
|
|
356
|
+
Enabled: true
|
|
357
|
+
|
|
358
|
+
Naming/ClassAndModuleCamelCase:
|
|
359
|
+
Description: 'Use CamelCase for classes and modules.'
|
|
360
|
+
StyleGuide: '#camelcase-classes'
|
|
361
|
+
Enabled: true
|
|
362
|
+
|
|
363
|
+
Naming/ConstantName:
|
|
364
|
+
Description: 'Constants should use SCREAMING_SNAKE_CASE.'
|
|
365
|
+
StyleGuide: '#screaming-snake-case'
|
|
366
|
+
Enabled: true
|
|
367
|
+
|
|
368
|
+
Naming/FileName:
|
|
369
|
+
Description: 'Use snake_case for source file names.'
|
|
370
|
+
StyleGuide: '#snake-case-files'
|
|
371
|
+
Enabled: true
|
|
372
|
+
|
|
373
|
+
Naming/MethodName:
|
|
374
|
+
Description: 'Use the configured style when naming methods.'
|
|
375
|
+
StyleGuide: '#snake-case-symbols-methods-vars'
|
|
376
|
+
Enabled: true
|
|
377
|
+
|
|
378
|
+
Naming/PredicateName:
|
|
379
|
+
Description: 'Check the names of predicate methods.'
|
|
380
|
+
StyleGuide: '#bool-methods-qmark'
|
|
381
|
+
Enabled: true
|
|
382
|
+
|
|
383
|
+
Naming/VariableName:
|
|
384
|
+
Description: 'Use the configured style when naming variables.'
|
|
385
|
+
StyleGuide: '#snake-case-symbols-methods-vars'
|
|
386
|
+
Enabled: true
|
|
387
|
+
|
|
388
|
+
Naming/VariableNumber:
|
|
389
|
+
Description: 'Use the configured style when numbering variables.'
|
|
390
|
+
Enabled: true
|
|
391
|
+
|
|
392
|
+
#################### Style ###############################
|
|
393
|
+
|
|
348
394
|
Style/Alias:
|
|
349
395
|
Description: 'Use alias instead of alias_method.'
|
|
350
396
|
StyleGuide: '#alias-method'
|
|
@@ -365,11 +411,6 @@ Style/AsciiComments:
|
|
|
365
411
|
StyleGuide: '#english-comments'
|
|
366
412
|
Enabled: true
|
|
367
413
|
|
|
368
|
-
Style/AsciiIdentifiers:
|
|
369
|
-
Description: 'Use only ascii symbols in identifiers.'
|
|
370
|
-
StyleGuide: '#english-identifiers'
|
|
371
|
-
Enabled: true
|
|
372
|
-
|
|
373
414
|
Style/Attr:
|
|
374
415
|
Description: 'Checks for uses of Module#attr.'
|
|
375
416
|
StyleGuide: '#attr'
|
|
@@ -412,11 +453,6 @@ Style/CharacterLiteral:
|
|
|
412
453
|
StyleGuide: '#no-character-literals'
|
|
413
454
|
Enabled: true
|
|
414
455
|
|
|
415
|
-
Style/ClassAndModuleCamelCase:
|
|
416
|
-
Description: 'Use CamelCase for classes and modules.'
|
|
417
|
-
StyleGuide: '#camelcase-classes'
|
|
418
|
-
Enabled: true
|
|
419
|
-
|
|
420
456
|
Style/ClassAndModuleChildren:
|
|
421
457
|
Description: 'Checks style of children classes and modules.'
|
|
422
458
|
Enabled: true
|
|
@@ -459,11 +495,6 @@ Style/ConditionalAssignment:
|
|
|
459
495
|
of assigning that variable inside of each branch.
|
|
460
496
|
Enabled: true
|
|
461
497
|
|
|
462
|
-
Style/ConstantName:
|
|
463
|
-
Description: 'Constants should use SCREAMING_SNAKE_CASE.'
|
|
464
|
-
StyleGuide: '#screaming-snake-case'
|
|
465
|
-
Enabled: true
|
|
466
|
-
|
|
467
498
|
Style/DefWithParentheses:
|
|
468
499
|
Description: 'Use def with parentheses when there are arguments.'
|
|
469
500
|
StyleGuide: '#method-parens'
|
|
@@ -519,11 +550,6 @@ Style/EvenOdd:
|
|
|
519
550
|
StyleGuide: '#predicate-methods'
|
|
520
551
|
Enabled: true
|
|
521
552
|
|
|
522
|
-
Style/FileName:
|
|
523
|
-
Description: 'Use snake_case for source file names.'
|
|
524
|
-
StyleGuide: '#snake-case-files'
|
|
525
|
-
Enabled: true
|
|
526
|
-
|
|
527
553
|
Style/FrozenStringLiteralComment:
|
|
528
554
|
Description: >-
|
|
529
555
|
Add the frozen_string_literal comment to the top of files
|
|
@@ -634,11 +660,6 @@ Style/MethodDefParentheses:
|
|
|
634
660
|
StyleGuide: '#method-parens'
|
|
635
661
|
Enabled: true
|
|
636
662
|
|
|
637
|
-
Style/MethodName:
|
|
638
|
-
Description: 'Use the configured style when naming methods.'
|
|
639
|
-
StyleGuide: '#snake-case-symbols-methods-vars'
|
|
640
|
-
Enabled: true
|
|
641
|
-
|
|
642
663
|
Style/MethodMissing:
|
|
643
664
|
Description: 'Avoid using `method_missing`.'
|
|
644
665
|
StyleGuide: '#no-method-missing'
|
|
@@ -768,11 +789,6 @@ Style/OneLineConditional:
|
|
|
768
789
|
StyleGuide: '#ternary-operator'
|
|
769
790
|
Enabled: true
|
|
770
791
|
|
|
771
|
-
Style/OpMethod:
|
|
772
|
-
Description: 'When defining binary operators, name the argument other.'
|
|
773
|
-
StyleGuide: '#other-arg'
|
|
774
|
-
Enabled: true
|
|
775
|
-
|
|
776
792
|
Style/OptionalArguments:
|
|
777
793
|
Description: >-
|
|
778
794
|
Checks for optional arguments that do not appear at the end
|
|
@@ -809,11 +825,6 @@ Style/PerlBackrefs:
|
|
|
809
825
|
StyleGuide: '#no-perl-regexp-last-matchers'
|
|
810
826
|
Enabled: true
|
|
811
827
|
|
|
812
|
-
Style/PredicateName:
|
|
813
|
-
Description: 'Check the names of predicate methods.'
|
|
814
|
-
StyleGuide: '#bool-methods-qmark'
|
|
815
|
-
Enabled: true
|
|
816
|
-
|
|
817
828
|
Style/PreferredHashMethods:
|
|
818
829
|
Description: 'Checks use of `has_key?` and `has_value?` Hash methods.'
|
|
819
830
|
StyleGuide: '#hash-key'
|
|
@@ -988,15 +999,6 @@ Style/VariableInterpolation:
|
|
|
988
999
|
StyleGuide: '#curlies-interpolate'
|
|
989
1000
|
Enabled: true
|
|
990
1001
|
|
|
991
|
-
Style/VariableName:
|
|
992
|
-
Description: 'Use the configured style when naming variables.'
|
|
993
|
-
StyleGuide: '#snake-case-symbols-methods-vars'
|
|
994
|
-
Enabled: true
|
|
995
|
-
|
|
996
|
-
Style/VariableNumber:
|
|
997
|
-
Description: 'Use the configured style when numbering variables.'
|
|
998
|
-
Enabled: true
|
|
999
|
-
|
|
1000
1002
|
Style/WhenThen:
|
|
1001
1003
|
Description: 'Use when x then ... for one-line cases.'
|
|
1002
1004
|
StyleGuide: '#one-line-cases'
|
|
@@ -1217,16 +1219,6 @@ Lint/InheritException:
|
|
|
1217
1219
|
Description: 'Avoid inheriting from the `Exception` class.'
|
|
1218
1220
|
Enabled: true
|
|
1219
1221
|
|
|
1220
|
-
Lint/InvalidCharacterLiteral:
|
|
1221
|
-
Description: >-
|
|
1222
|
-
Checks for invalid character literals with a non-escaped
|
|
1223
|
-
whitespace character.
|
|
1224
|
-
Enabled: true
|
|
1225
|
-
|
|
1226
|
-
Lint/LiteralInCondition:
|
|
1227
|
-
Description: 'Checks of literals used in conditions.'
|
|
1228
|
-
Enabled: true
|
|
1229
|
-
|
|
1230
1222
|
Lint/LiteralInInterpolation:
|
|
1231
1223
|
Description: 'Checks for literals used in interpolation.'
|
|
1232
1224
|
Enabled: true
|
data/.travis.yml
CHANGED
|
@@ -1,15 +1,21 @@
|
|
|
1
|
-
sudo:
|
|
1
|
+
sudo: false
|
|
2
2
|
dist: trusty
|
|
3
3
|
|
|
4
4
|
language: ruby
|
|
5
5
|
|
|
6
6
|
rvm:
|
|
7
7
|
- 2.2.7
|
|
8
|
-
- 2.3.
|
|
8
|
+
- 2.3.5
|
|
9
9
|
- 2.4.2
|
|
10
|
+
- 2.5.0
|
|
10
11
|
|
|
11
12
|
notifications:
|
|
12
13
|
email: false
|
|
13
14
|
|
|
15
|
+
matrix:
|
|
16
|
+
fast_finish: true
|
|
17
|
+
allow_failures:
|
|
18
|
+
- rvm: 2.5.0
|
|
19
|
+
|
|
14
20
|
script:
|
|
15
|
-
- bundle exec
|
|
21
|
+
- bundle exec rspec --format progress
|
data/README.md
CHANGED
|
@@ -83,6 +83,8 @@ field :createUser
|
|
|
83
83
|
end
|
|
84
84
|
```
|
|
85
85
|
|
|
86
|
+
You can also pass a `lambda` as a record. This receives the usual three arguments (parent value, arguments, context) and returns the value to be used as a record.
|
|
87
|
+
|
|
86
88
|
You might have also noticed the use of `authorize!` instead of `authorize` in this example. The difference between the two is this:
|
|
87
89
|
|
|
88
90
|
- `authorize` will set the field to `nil` if authorization fails
|
data/graphql-pundit.gemspec
CHANGED
|
@@ -26,11 +26,15 @@ Gem::Specification.new do |spec|
|
|
|
26
26
|
spec.add_dependency 'graphql', '>= 1.6.4', '< 1.8.0'
|
|
27
27
|
spec.add_dependency 'pundit', '~> 1.1.0'
|
|
28
28
|
|
|
29
|
-
spec.add_development_dependency 'pry', '~> 0.11.0'
|
|
30
29
|
spec.add_development_dependency 'bundler', '~> 1.14'
|
|
30
|
+
spec.add_development_dependency 'codecov', '~> 0.1.10'
|
|
31
|
+
spec.add_development_dependency 'fuubar', '~> 2.2.0'
|
|
32
|
+
spec.add_development_dependency 'pry', '~> 0.11.0'
|
|
33
|
+
spec.add_development_dependency 'pry-byebug', '~> 3.5.0'
|
|
34
|
+
spec.add_development_dependency 'pry-rescue', '~> 1.4.4'
|
|
35
|
+
spec.add_development_dependency 'pry-stack_explorer', '~> 0.4.9.2'
|
|
31
36
|
spec.add_development_dependency 'rake', '~> 12.0'
|
|
32
37
|
spec.add_development_dependency 'rspec', '~> 3.6'
|
|
33
|
-
spec.add_development_dependency 'rubocop', '~> 0.
|
|
38
|
+
spec.add_development_dependency 'rubocop', '~> 0.51.0'
|
|
34
39
|
spec.add_development_dependency 'simplecov', '~> 0.15.1'
|
|
35
|
-
spec.add_development_dependency 'codecov', '~> 0.1.10'
|
|
36
40
|
end
|
data/lib/graphql-pundit.rb
CHANGED
|
@@ -5,10 +5,17 @@ require 'graphql-pundit/version'
|
|
|
5
5
|
|
|
6
6
|
require 'graphql'
|
|
7
7
|
|
|
8
|
-
#
|
|
8
|
+
# Defines authorization related helpers
|
|
9
9
|
module GraphQL
|
|
10
|
-
|
|
11
|
-
|
|
10
|
+
# Defines `authorize` and `authorize!` helpers
|
|
11
|
+
class AuthorizationHelper
|
|
12
|
+
attr_reader :raise_unauthorized
|
|
13
|
+
|
|
14
|
+
def initialize(raise_unauthorized)
|
|
15
|
+
@raise_unauthorized = raise_unauthorized
|
|
16
|
+
end
|
|
17
|
+
|
|
18
|
+
def call(defn, query = nil, policy: nil, record: nil)
|
|
12
19
|
opts = {record: record,
|
|
13
20
|
query: query || defn.name,
|
|
14
21
|
policy: policy,
|
|
@@ -21,14 +28,15 @@ module GraphQL
|
|
|
21
28
|
end
|
|
22
29
|
end
|
|
23
30
|
|
|
24
|
-
|
|
25
|
-
|
|
31
|
+
# Defines `scope` helper
|
|
32
|
+
class ScopeHelper
|
|
33
|
+
def call(defn, proc = :infer_scope)
|
|
26
34
|
Define::InstanceDefinable::AssignMetadataKey.new(:scope).
|
|
27
35
|
call(defn, proc)
|
|
28
36
|
end
|
|
29
37
|
end
|
|
30
38
|
|
|
31
|
-
Field.accepts_definitions(authorize:
|
|
32
|
-
authorize!:
|
|
33
|
-
scope:
|
|
39
|
+
Field.accepts_definitions(authorize: AuthorizationHelper.new(false),
|
|
40
|
+
authorize!: AuthorizationHelper.new(true),
|
|
41
|
+
scope: ScopeHelper.new)
|
|
34
42
|
end
|
|
@@ -7,6 +7,55 @@ module GraphQL
|
|
|
7
7
|
module Instrumenters
|
|
8
8
|
# Instrumenter that supplies `authorize`
|
|
9
9
|
class Authorization
|
|
10
|
+
# This does the actual Pundit authorization
|
|
11
|
+
class AuthorizationResolver
|
|
12
|
+
attr_reader :current_user, :old_resolver, :options
|
|
13
|
+
def initialize(current_user, old_resolver, options)
|
|
14
|
+
@current_user = current_user
|
|
15
|
+
@old_resolver = old_resolver
|
|
16
|
+
@options = options
|
|
17
|
+
end
|
|
18
|
+
|
|
19
|
+
def call(root, arguments, context)
|
|
20
|
+
unless authorize(root, arguments, context)
|
|
21
|
+
raise ::Pundit::NotAuthorizedError
|
|
22
|
+
end
|
|
23
|
+
old_resolver.call(root, arguments, context)
|
|
24
|
+
rescue ::Pundit::NotAuthorizedError
|
|
25
|
+
if options[:raise]
|
|
26
|
+
raise GraphQL::ExecutionError, "You're not authorized to do this"
|
|
27
|
+
end
|
|
28
|
+
end
|
|
29
|
+
|
|
30
|
+
private
|
|
31
|
+
|
|
32
|
+
def authorize(root, arguments, context)
|
|
33
|
+
if options[:proc]
|
|
34
|
+
options[:proc].call(root, arguments, context)
|
|
35
|
+
else
|
|
36
|
+
record = record(root, arguments, context)
|
|
37
|
+
::Pundit::PolicyFinder.new(policy(record)).policy!.
|
|
38
|
+
new(context[current_user], record).public_send(query)
|
|
39
|
+
end
|
|
40
|
+
end
|
|
41
|
+
|
|
42
|
+
def query
|
|
43
|
+
@query ||= options[:query].to_s + '?'
|
|
44
|
+
end
|
|
45
|
+
|
|
46
|
+
def policy(record)
|
|
47
|
+
options[:policy] || record
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
def record(root, arguments, context)
|
|
51
|
+
if options[:record].respond_to?(:call)
|
|
52
|
+
options[:record].call(root, arguments, context)
|
|
53
|
+
else
|
|
54
|
+
options[:record] || root
|
|
55
|
+
end
|
|
56
|
+
end
|
|
57
|
+
end
|
|
58
|
+
|
|
10
59
|
attr_reader :current_user
|
|
11
60
|
|
|
12
61
|
def initialize(current_user = :current_user)
|
|
@@ -15,42 +64,12 @@ module GraphQL
|
|
|
15
64
|
|
|
16
65
|
def instrument(_type, field)
|
|
17
66
|
return field unless field.metadata[:authorize]
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
67
|
+
old_resolver = field.resolve_proc
|
|
68
|
+
resolver = AuthorizationResolver.new(current_user,
|
|
69
|
+
old_resolver,
|
|
70
|
+
field.metadata[:authorize])
|
|
22
71
|
field.redefine do
|
|
23
|
-
resolve
|
|
24
|
-
end
|
|
25
|
-
end
|
|
26
|
-
|
|
27
|
-
# rubocop:disable Metrics/MethodLength, Metrics/AbcSize
|
|
28
|
-
def resolve_proc(current_user, old_resolve, options)
|
|
29
|
-
# rubocop:enable Metrics/MethodLength, Metrics/AbcSize
|
|
30
|
-
lambda do |obj, args, ctx|
|
|
31
|
-
begin
|
|
32
|
-
result = if options[:proc]
|
|
33
|
-
options[:proc].call(obj, args, ctx)
|
|
34
|
-
else
|
|
35
|
-
query = options[:query].to_s + '?'
|
|
36
|
-
record = options[:record] || obj
|
|
37
|
-
policy = options[:policy] || record
|
|
38
|
-
policy = ::Pundit::PolicyFinder.new(policy).policy!
|
|
39
|
-
policy = policy.new(ctx[current_user], record)
|
|
40
|
-
policy.public_send(query)
|
|
41
|
-
end
|
|
42
|
-
unless result
|
|
43
|
-
raise ::Pundit::NotAuthorizedError, query: query,
|
|
44
|
-
record: record,
|
|
45
|
-
policy: policy
|
|
46
|
-
end
|
|
47
|
-
old_resolve.call(obj, args, ctx)
|
|
48
|
-
rescue ::Pundit::NotAuthorizedError
|
|
49
|
-
if options[:raise]
|
|
50
|
-
raise GraphQL::ExecutionError,
|
|
51
|
-
"You're not authorized to do this"
|
|
52
|
-
end
|
|
53
|
-
end
|
|
72
|
+
resolve resolver
|
|
54
73
|
end
|
|
55
74
|
end
|
|
56
75
|
end
|
|
@@ -7,52 +7,69 @@ module GraphQL
|
|
|
7
7
|
module Instrumenters
|
|
8
8
|
# Instrumenter that supplies `scope`
|
|
9
9
|
class Scope
|
|
10
|
-
|
|
10
|
+
# Applies the scoping to the passed object
|
|
11
|
+
class ScopeResolver
|
|
12
|
+
attr_reader :current_user, :scope, :old_resolver
|
|
11
13
|
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
14
|
+
def initialize(current_user, scope, old_resolver)
|
|
15
|
+
@current_user = current_user
|
|
16
|
+
@old_resolver = old_resolver
|
|
15
17
|
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
18
|
+
unless valid_value?(scope)
|
|
19
|
+
raise ArgumentError, 'Invalid value passed to `scope`'
|
|
20
|
+
end
|
|
21
|
+
|
|
22
|
+
@scope = new_scope(scope)
|
|
23
|
+
end
|
|
24
|
+
|
|
25
|
+
def call(root, arguments, context)
|
|
26
|
+
new_scope = scope.call(root, arguments, context)
|
|
27
|
+
old_resolver.call(new_scope, arguments, context)
|
|
23
28
|
end
|
|
24
29
|
|
|
25
|
-
|
|
30
|
+
private
|
|
26
31
|
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
32
|
+
def new_scope(scope)
|
|
33
|
+
return scope if proc?(scope)
|
|
34
|
+
|
|
35
|
+
lambda do |root, _arguments, context|
|
|
36
|
+
unless inferred?(scope)
|
|
37
|
+
root.define_singleton_method(:policy_class) { scope }
|
|
38
|
+
end
|
|
39
|
+
|
|
40
|
+
::Pundit.policy_scope!(context[current_user], root)
|
|
30
41
|
end
|
|
42
|
+
end
|
|
31
43
|
|
|
32
|
-
|
|
44
|
+
def valid_value?(value)
|
|
45
|
+
value.is_a?(Class) || inferred?(value) || proc?(value)
|
|
33
46
|
end
|
|
34
|
-
scope_proc = scope if proc?(scope)
|
|
35
47
|
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
48
|
+
def proc?(value)
|
|
49
|
+
value.respond_to?(:call)
|
|
50
|
+
end
|
|
51
|
+
|
|
52
|
+
def inferred?(value)
|
|
53
|
+
value == :infer_scope
|
|
41
54
|
end
|
|
42
55
|
end
|
|
43
56
|
|
|
44
|
-
|
|
57
|
+
attr_reader :current_user
|
|
45
58
|
|
|
46
|
-
def
|
|
47
|
-
|
|
59
|
+
def initialize(current_user = :current_user)
|
|
60
|
+
@current_user = current_user
|
|
48
61
|
end
|
|
49
62
|
|
|
50
|
-
def
|
|
51
|
-
|
|
52
|
-
|
|
63
|
+
def instrument(_type, field)
|
|
64
|
+
scope = field.metadata[:scope]
|
|
65
|
+
return field unless scope
|
|
53
66
|
|
|
54
|
-
|
|
55
|
-
|
|
67
|
+
old_resolver = field.resolve_proc
|
|
68
|
+
resolver = ScopeResolver.new(current_user, scope, old_resolver)
|
|
69
|
+
|
|
70
|
+
field.redefine do
|
|
71
|
+
resolve resolver
|
|
72
|
+
end
|
|
56
73
|
end
|
|
57
74
|
end
|
|
58
75
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: graphql-pundit
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.5.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Ontohub Core Developers
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2017-10-
|
|
11
|
+
date: 2017-10-27 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: graphql
|
|
@@ -44,6 +44,48 @@ dependencies:
|
|
|
44
44
|
- - "~>"
|
|
45
45
|
- !ruby/object:Gem::Version
|
|
46
46
|
version: 1.1.0
|
|
47
|
+
- !ruby/object:Gem::Dependency
|
|
48
|
+
name: bundler
|
|
49
|
+
requirement: !ruby/object:Gem::Requirement
|
|
50
|
+
requirements:
|
|
51
|
+
- - "~>"
|
|
52
|
+
- !ruby/object:Gem::Version
|
|
53
|
+
version: '1.14'
|
|
54
|
+
type: :development
|
|
55
|
+
prerelease: false
|
|
56
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
57
|
+
requirements:
|
|
58
|
+
- - "~>"
|
|
59
|
+
- !ruby/object:Gem::Version
|
|
60
|
+
version: '1.14'
|
|
61
|
+
- !ruby/object:Gem::Dependency
|
|
62
|
+
name: codecov
|
|
63
|
+
requirement: !ruby/object:Gem::Requirement
|
|
64
|
+
requirements:
|
|
65
|
+
- - "~>"
|
|
66
|
+
- !ruby/object:Gem::Version
|
|
67
|
+
version: 0.1.10
|
|
68
|
+
type: :development
|
|
69
|
+
prerelease: false
|
|
70
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
71
|
+
requirements:
|
|
72
|
+
- - "~>"
|
|
73
|
+
- !ruby/object:Gem::Version
|
|
74
|
+
version: 0.1.10
|
|
75
|
+
- !ruby/object:Gem::Dependency
|
|
76
|
+
name: fuubar
|
|
77
|
+
requirement: !ruby/object:Gem::Requirement
|
|
78
|
+
requirements:
|
|
79
|
+
- - "~>"
|
|
80
|
+
- !ruby/object:Gem::Version
|
|
81
|
+
version: 2.2.0
|
|
82
|
+
type: :development
|
|
83
|
+
prerelease: false
|
|
84
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
85
|
+
requirements:
|
|
86
|
+
- - "~>"
|
|
87
|
+
- !ruby/object:Gem::Version
|
|
88
|
+
version: 2.2.0
|
|
47
89
|
- !ruby/object:Gem::Dependency
|
|
48
90
|
name: pry
|
|
49
91
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -59,89 +101,103 @@ dependencies:
|
|
|
59
101
|
- !ruby/object:Gem::Version
|
|
60
102
|
version: 0.11.0
|
|
61
103
|
- !ruby/object:Gem::Dependency
|
|
62
|
-
name:
|
|
104
|
+
name: pry-byebug
|
|
63
105
|
requirement: !ruby/object:Gem::Requirement
|
|
64
106
|
requirements:
|
|
65
107
|
- - "~>"
|
|
66
108
|
- !ruby/object:Gem::Version
|
|
67
|
-
version:
|
|
109
|
+
version: 3.5.0
|
|
68
110
|
type: :development
|
|
69
111
|
prerelease: false
|
|
70
112
|
version_requirements: !ruby/object:Gem::Requirement
|
|
71
113
|
requirements:
|
|
72
114
|
- - "~>"
|
|
73
115
|
- !ruby/object:Gem::Version
|
|
74
|
-
version:
|
|
116
|
+
version: 3.5.0
|
|
75
117
|
- !ruby/object:Gem::Dependency
|
|
76
|
-
name:
|
|
118
|
+
name: pry-rescue
|
|
77
119
|
requirement: !ruby/object:Gem::Requirement
|
|
78
120
|
requirements:
|
|
79
121
|
- - "~>"
|
|
80
122
|
- !ruby/object:Gem::Version
|
|
81
|
-
version:
|
|
123
|
+
version: 1.4.4
|
|
82
124
|
type: :development
|
|
83
125
|
prerelease: false
|
|
84
126
|
version_requirements: !ruby/object:Gem::Requirement
|
|
85
127
|
requirements:
|
|
86
128
|
- - "~>"
|
|
87
129
|
- !ruby/object:Gem::Version
|
|
88
|
-
version:
|
|
130
|
+
version: 1.4.4
|
|
89
131
|
- !ruby/object:Gem::Dependency
|
|
90
|
-
name:
|
|
132
|
+
name: pry-stack_explorer
|
|
91
133
|
requirement: !ruby/object:Gem::Requirement
|
|
92
134
|
requirements:
|
|
93
135
|
- - "~>"
|
|
94
136
|
- !ruby/object:Gem::Version
|
|
95
|
-
version:
|
|
137
|
+
version: 0.4.9.2
|
|
96
138
|
type: :development
|
|
97
139
|
prerelease: false
|
|
98
140
|
version_requirements: !ruby/object:Gem::Requirement
|
|
99
141
|
requirements:
|
|
100
142
|
- - "~>"
|
|
101
143
|
- !ruby/object:Gem::Version
|
|
102
|
-
version:
|
|
144
|
+
version: 0.4.9.2
|
|
103
145
|
- !ruby/object:Gem::Dependency
|
|
104
|
-
name:
|
|
146
|
+
name: rake
|
|
105
147
|
requirement: !ruby/object:Gem::Requirement
|
|
106
148
|
requirements:
|
|
107
149
|
- - "~>"
|
|
108
150
|
- !ruby/object:Gem::Version
|
|
109
|
-
version:
|
|
151
|
+
version: '12.0'
|
|
110
152
|
type: :development
|
|
111
153
|
prerelease: false
|
|
112
154
|
version_requirements: !ruby/object:Gem::Requirement
|
|
113
155
|
requirements:
|
|
114
156
|
- - "~>"
|
|
115
157
|
- !ruby/object:Gem::Version
|
|
116
|
-
version:
|
|
158
|
+
version: '12.0'
|
|
117
159
|
- !ruby/object:Gem::Dependency
|
|
118
|
-
name:
|
|
160
|
+
name: rspec
|
|
119
161
|
requirement: !ruby/object:Gem::Requirement
|
|
120
162
|
requirements:
|
|
121
163
|
- - "~>"
|
|
122
164
|
- !ruby/object:Gem::Version
|
|
123
|
-
version:
|
|
165
|
+
version: '3.6'
|
|
124
166
|
type: :development
|
|
125
167
|
prerelease: false
|
|
126
168
|
version_requirements: !ruby/object:Gem::Requirement
|
|
127
169
|
requirements:
|
|
128
170
|
- - "~>"
|
|
129
171
|
- !ruby/object:Gem::Version
|
|
130
|
-
version:
|
|
172
|
+
version: '3.6'
|
|
131
173
|
- !ruby/object:Gem::Dependency
|
|
132
|
-
name:
|
|
174
|
+
name: rubocop
|
|
133
175
|
requirement: !ruby/object:Gem::Requirement
|
|
134
176
|
requirements:
|
|
135
177
|
- - "~>"
|
|
136
178
|
- !ruby/object:Gem::Version
|
|
137
|
-
version: 0.
|
|
179
|
+
version: 0.51.0
|
|
138
180
|
type: :development
|
|
139
181
|
prerelease: false
|
|
140
182
|
version_requirements: !ruby/object:Gem::Requirement
|
|
141
183
|
requirements:
|
|
142
184
|
- - "~>"
|
|
143
185
|
- !ruby/object:Gem::Version
|
|
144
|
-
version: 0.
|
|
186
|
+
version: 0.51.0
|
|
187
|
+
- !ruby/object:Gem::Dependency
|
|
188
|
+
name: simplecov
|
|
189
|
+
requirement: !ruby/object:Gem::Requirement
|
|
190
|
+
requirements:
|
|
191
|
+
- - "~>"
|
|
192
|
+
- !ruby/object:Gem::Version
|
|
193
|
+
version: 0.15.1
|
|
194
|
+
type: :development
|
|
195
|
+
prerelease: false
|
|
196
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
197
|
+
requirements:
|
|
198
|
+
- - "~>"
|
|
199
|
+
- !ruby/object:Gem::Version
|
|
200
|
+
version: 0.15.1
|
|
145
201
|
description: Pundit authorization support for graphql
|
|
146
202
|
email:
|
|
147
203
|
- ontohub-dev-l@ovgu.de
|