gsterndale-warrant 0.0.0 → 0.2.0

data/README.textile

@@ -0,0 +1,93 @@
+h1. Warrant
+
+Simple ActiveRecord authorization and attribute obfuscation scheme.
+
+h2. Gem installation (Rails 2.1+)
+
+In config/environment.rb:
+
+    config.gem 'mocha', 
+       :version => '>= 0.9.4'
+    config.gem 'quietbacktrace', 
+       :version => '>= 0.1.1'
+    config.gem 'thoughtbot-factory_girl', 
+       :lib => 'factory_girl', 
+       :source => 'http://gems.github.com', 
+       :version => '>= 1.1.5'
+    config.gem 'thoughtbot-shoulda', 
+       :lib => 'shoulda', 
+       :source => 'http://gems.github.com', 
+       :version => '>= 2.0.6'
+    config.gem 'Warrant', 
+       :lib => 'Warrant', 
+       :source => 'http://gems.github.com'
+
+Then:
+
+    rake gems:install
+    rake gems:unpack
+
+h2. Usage: models which require authorization
+
+Warrant works by mixing behavior into models. To protect your models with authorization add:
+
+    class Post < ActiveRecord::Base
+      include Warrant::App::Models::Warrantable
+
+Warrant makes some assumptions about your model. By default:
+
+* instances of your Warrantable model can be created and found
+* instances of your Warrantable model cannot be updated or destroyed unless that model is related to the current_user
+
+You can easily override the default settings by redefining self.create?, self.find?, self.update? and self.destroy? in your model. Warrant also provides instance methods for create?, find?, update? and destroy? for you to redefine as needed.
+
+h2. Usage: authorization based on the current_user
+
+You may want to authorize various methods and attributes based on who is using your application. By mixing behavior into your application controller Warrant makes this easy:
+
+    class ApplicationController < ActionController::Base
+      include Warrant::App::Controllers::ApplicationController
+
+Warrant assumes you have a current_user method already defined in your application controller. For great, RESTful authentication, check out "Clearance":http://github.com/thoughtbot/clearance.
+
+For your convenience Warrant will save your current_user on all of your ActiveRecord classes in a current_user class attribute, also accessible as an instance method.
+
+h2. Usage: MyClass.create?, MyClass.find?, MyClass.update?, MyClass.destroy?
+
+TODO
+
+h2. Usage: my_instance.create?, my_instance.find?, my_instance.update?, my_instance.destroy?
+
+TODO
+
+h2. Usage: MyClass.current_user, my_instance.current_user
+
+TODO
+
+h2. Usage: obscuring attributes
+
+Warrant allows you to obscure the value of your model's attributes. To protect your model's attributes add:
+
+    class Post < ActiveRecord::Base
+      include Warrant::App::Models::Warrantable
+      obscure :title
+      obscure :title, :if => :not_cool?
+      obscure :title, :with => 'shhhhh', :if => :not_cool?
+      obscure :title, :with => :sekret, :unless => :cool?
+      def cool?
+        false
+      end
+      def not_cool?
+        true
+      end
+      def sekret
+        "that's classified"
+      end
+
+h2. Tests
+
+The tests use "Mocha":http://mocha.rubyforge.org, "Shoulda":http://thoughtbot.com/projects/shoulda and "Factory Girl":http://thoughtbot.com/projects/factory_girl.
+
+h2. Usage: 
+
+TODO

data/VERSION.yml

@@ -1,4 +1,4 @@
 --- 
 :patch: 0
 :major: 0
-:minor: 0
+:minor: 2

data/lib/warrant/app/controllers/application_controller.rb

@@ -0,0 +1,25 @@
+module Warrant
+  module App
+    module Controllers
+      module ApplicationController
+    
+        def self.included(controller)
+          controller.class_eval do
+            
+            around_filter :use_current_user_for_activerecord
+            
+            protected
+            
+            def use_current_user_for_activerecord
+              ActiveRecord::Base.current_user = current_user
+              yield
+              ActiveRecord::Base.current_user = nil
+            end
+            
+          end
+        end
+        
+      end
+    end
+  end
+end

data/lib/warrant/app/models/warrantable.rb

@@ -0,0 +1,112 @@
+module Warrant
+  module App
+    module Models
+      module Warrantable
+        
+        def self.included(model)
+          
+          model.extend(ClassMethods)
+          
+          model.class_eval do
+            
+            class << self
+              alias_method :find_without_warrant, :find unless method_defined?(:find_without_warrant)
+              alias_method :find, :find_with_warrant
+              # alias_method_chain :find, :warrant
+            end
+            
+            # after_find taxes performance
+            before_create   :warrant!,  :unless => lambda { self.create? }
+            before_update   :warrant!,  :unless => lambda { self.update? }
+            before_destroy  :warrant!,  :unless => lambda { self.destroy? }
+            
+            def create?
+              self.class.create?
+            end
+            
+            def find?
+              self.class.find?
+            end
+            alias_method :read?, :find?
+            
+            def update?
+              self.class.update? || self.related_to_current_user?
+            end
+            
+            def destroy?
+              self.class.destroy? || self.related_to_current_user?
+            end
+            
+            # TODO memoize ???
+            def related_to_current_user?
+              return false unless self.current_user
+              self.current_user == self || 
+              self.respond_to?('user')  && self.current_user == self.user || 
+              self.respond_to?('users') && self.users.include?(self.current_user)
+            end
+            
+            def warrant!
+              raise Warrant::AuthorizationError 
+            end
+            
+          end
+        end
+        
+        module ClassMethods
+          
+          def find_with_warrant(*args)
+            found = find_without_warrant(*args)
+            found = case
+            when found.is_a?(Array) ; found.delete_if {|r| !r.find? }
+            when !found.find?       ; found.warrant!
+            else                      found
+            end
+          end
+          
+          def create?
+            true
+          end
+          
+          def find?
+            true
+          end
+          alias_method :read?, :find?
+          # TODO alias as find?
+          
+          def update?
+            false
+          end
+          
+          def destroy?
+            false
+          end
+          
+          # obscure :title, :with => 'shhhhh', :if => :not_cool?
+          # obscure :title, :with => :sekret, :unless => :cool?
+          # obscure :title, :unless => :cool?
+          def obscure(attribute, opts={})
+            opts[:with] ||= nil
+            opts.delete(:unless) if opts.key?(:if) # only one conditional allowed
+            
+            # TODO error unless attribute exists
+            # raise Warrant::AuthorizationError unless send(:instance_variable_get, :@attributes).include?(attribute.to_s)
+            
+            define_method(attribute.to_sym) do
+              if (  opts.key?(:if)     &&   send(opts[:if])     ) ||   # :if is specified and evaluates true
+                 (  opts.key?(:unless) &&  !send(opts[:unless]) ) ||   # :unless is specified and evaluates false
+                 ( !opts.key?(:if)     &&  !opts.key?(:unless)  )      # no conditional is specified
+                 
+                opts[:with].is_a?(Symbol) ? send(opts[:with]) : opts[:with]
+              else
+                # return value of instance variable
+                send(:instance_variable_get, :@attributes)[attribute.to_s]
+              end
+            end
+          end
+          
+        end
+        
+      end
+    end
+  end
+end

data/lib/warrant/lib/extensions/active_record.rb

@@ -0,0 +1,21 @@
+module Warrant
+  module Lib
+    module Extensions
+      module ActiveRecord
+        
+        def self.included(extension)
+          extension.class_eval do
+            
+            cattr_accessor :current_user
+            
+            def current_user
+              self.class.current_user
+            end
+            
+          end
+        end
+        
+      end
+    end
+  end
+end

data/lib/warrant/lib/warrant.rb

@@ -0,0 +1,7 @@
+module Warrant #:nodoc:
+  
+  # Raised when restricted method is access without authorization
+  class AuthorizationError < StandardError
+  end
+  
+end

data/lib/warrant/test/test_helper.rb

@@ -5,20 +5,7 @@ module Warrant
       def self.included(test_helper)
         test_helper.class_eval do
           
-          # def sign_in_as(user = nil)
-          #   unless user
-          #     user = Factory(:registered_user)
-          #     user.confirm_email!
-          #   end
-          #   @request.session[:user_id] = user.id
-          #   @request.session[:salt]    = user.salt
-          #   return user
-          # end
-          # 
-          # def sign_out 
-          #   @request.session[:user_id] = nil
-          #   @request.session[:salt]    = nil
-          # end
+# TODO
           
         end
       end

data/lib/warrant.rb

@@ -1 +1,5 @@
-require 'warrant/app/controllers/application_controller'
+require 'warrant/app/controllers/application_controller'
+require 'warrant/app/models/warrantable'
+require 'warrant/lib/extensions/active_record'
+require 'warrant/lib/warrant'
+require 'warrant/test/test_helper'

data/test/rails_root/Capfile

@@ -0,0 +1,3 @@
+load 'deploy' if respond_to?(:namespace) # cap2 differentiator
+Dir['vendor/plugins/*/recipes/*.rb'].each { |plugin| load(plugin) }
+load 'config/deploy'

data/test/rails_root/Rakefile

@@ -0,0 +1,10 @@
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require(File.join(File.dirname(__FILE__), 'config', 'boot'))
+
+require 'rake'
+require 'rake/testtask'
+require 'rake/rdoctask'
+
+require 'tasks/rails'

data/test/rails_root/app/controllers/application.rb

@@ -0,0 +1,8 @@
+class ApplicationController < ActionController::Base
+  helper :all
+  protect_from_forgery
+  include Warrant::App::Controllers::ApplicationController
+  
+  attr_accessor :current_user
+  
+end

data/test/rails_root/app/helpers/application_helper.rb

@@ -0,0 +1,5 @@
+module ApplicationHelper
+  def body_class
+    "#{controller.controller_name} #{controller.controller_name}-#{controller.action_name}"
+  end
+end

data/test/rails_root/app/models/post.rb

@@ -0,0 +1,23 @@
+class Post < ActiveRecord::Base
+  
+  belongs_to :user
+  include Warrant::App::Models::Warrantable
+  obscure :title
+  obscure :body,    :if     => :should_obscure_body?
+  obscure :keyword, :unless => :should_not_obscure_keyword?
+  obscure :spam,    :with   => :obscure_spam_with
+  
+  def should_not_obscure_keyword?
+    false
+  end
+  
+  def should_obscure_body?
+    true
+  end
+  
+  def obscure_spam_with
+    'Nothing to see here'
+  end
+  
+  
+end

data/test/rails_root/app/models/user.rb

@@ -0,0 +1,5 @@
+class User < ActiveRecord::Base
+  
+  # include Warrant::App::Models::Warrantable
+  
+end

data/test/rails_root/app/views/layouts/_flashes.erb

@@ -0,0 +1,5 @@
+<div id="flash">
+  <% flash.each do |key, value| -%>
+    <div id="flash_<%= key %>"><%=h value %></div>
+  <% end %>
+</div>

data/test/rails_root/app/views/layouts/application.html.erb

@@ -0,0 +1,14 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+  <head>
+    <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
+    <title>Warrant</title>
+    <%= stylesheet_link_tag 'screen', :media => 'all' %>
+    <%= javascript_include_tag :defaults %>
+  </head>
+  <body class="<%= body_class %>">
+    <%= render :partial => 'layouts/flashes' %>
+    <%= yield %>
+  </body>
+</html>

data/test/rails_root/config/boot.rb

@@ -0,0 +1,109 @@
+# Don't change this file!
+# Configure your app in config/environment.rb and config/environments/*.rb
+
+RAILS_ROOT = "#{File.dirname(__FILE__)}/.." unless defined?(RAILS_ROOT)
+
+module Rails
+  class << self
+    def boot!
+      unless booted?
+        preinitialize
+        pick_boot.run
+      end
+    end
+
+    def booted?
+      defined? Rails::Initializer
+    end
+
+    def pick_boot
+      (vendor_rails? ? VendorBoot : GemBoot).new
+    end
+
+    def vendor_rails?
+      File.exist?("#{RAILS_ROOT}/vendor/rails")
+    end
+
+    def preinitialize
+      load(preinitializer_path) if File.exist?(preinitializer_path)
+    end
+
+    def preinitializer_path
+      "#{RAILS_ROOT}/config/preinitializer.rb"
+    end
+  end
+
+  class Boot
+    def run
+      load_initializer
+      Rails::Initializer.run(:set_load_path)
+    end
+  end
+
+  class VendorBoot < Boot
+    def load_initializer
+      require "#{RAILS_ROOT}/vendor/rails/railties/lib/initializer"
+      Rails::Initializer.run(:install_gem_spec_stubs)
+    end
+  end
+
+  class GemBoot < Boot
+    def load_initializer
+      self.class.load_rubygems
+      load_rails_gem
+      require 'initializer'
+    end
+
+    def load_rails_gem
+      if version = self.class.gem_version
+        gem 'rails', version
+      else
+        gem 'rails'
+      end
+    rescue Gem::LoadError => load_error
+      $stderr.puts %(Missing the Rails #{version} gem. Please `gem install -v=#{version} rails`, update your RAILS_GEM_VERSION setting in config/environment.rb for the Rails version you do have installed, or comment out RAILS_GEM_VERSION to use the latest version installed.)
+      exit 1
+    end
+
+    class << self
+      def rubygems_version
+        Gem::RubyGemsVersion if defined? Gem::RubyGemsVersion
+      end
+
+      def gem_version
+        if defined? RAILS_GEM_VERSION
+          RAILS_GEM_VERSION
+        elsif ENV.include?('RAILS_GEM_VERSION')
+          ENV['RAILS_GEM_VERSION']
+        else
+          parse_gem_version(read_environment_rb)
+        end
+      end
+
+      def load_rubygems
+        require 'rubygems'
+        min_version = '1.1.1'
+        unless rubygems_version >= min_version
+          $stderr.puts %Q(Rails requires RubyGems >= #{min_version} (you have #{rubygems_version}). Please `gem update --system` and try again.)
+          exit 1
+        end
+
+      rescue LoadError
+        $stderr.puts %Q(Rails requires RubyGems >= #{min_version}. Please install RubyGems and try again: http://rubygems.rubyforge.org)
+        exit 1
+      end
+
+      def parse_gem_version(text)
+        $1 if text =~ /^[^#]*RAILS_GEM_VERSION\s*=\s*["']([!~<>=]*\s*[\d.]+)["']/
+      end
+
+      private
+        def read_environment_rb
+          File.read("#{RAILS_ROOT}/config/environment.rb")
+        end
+    end
+  end
+end
+
+# All that for this:
+Rails.boot!

data/test/rails_root/config/database.yml

@@ -0,0 +1,13 @@
+development:
+  adapter: sqlite3
+  database: ":memory:"
+  timeout: 5000
+
+# Warning: The database defined as "test" will be erased and
+# re-generated from your development database when you run "rake".
+# Do not set this db to the same as development or production.
+test:
+  adapter: sqlite3
+  database: ":memory:"
+  timeout: 5000
+

data/test/rails_root/config/environment.rb

@@ -0,0 +1,36 @@
+require File.join(File.dirname(__FILE__), 'boot')
+require 'md5' # Need this up here to generate the session[:secret] value down there
+
+Rails::Initializer.run do |config|
+  config.load_paths += Dir.glob(File.join(RAILS_ROOT, 'vendor', 'gems', '*', 'lib'))
+  config.time_zone = 'Eastern Time (US & Canada)'
+  config.action_controller.session = {
+    :session_key => "_warrant_session",
+    :secret      => ['warrant', 'random', 'words', 'here'].map {|k| Digest::MD5.hexdigest(k) }.join
+  }
+  config.gem 'mocha', 
+     :version => '>= 0.9.4'
+  config.gem 'quietbacktrace', 
+     :version => '>= 0.1.1'
+  config.gem 'thoughtbot-factory_girl', 
+     :lib => 'factory_girl', 
+     :source => 'http://gems.github.com', 
+     :version => '>= 1.1.5'
+  config.gem 'thoughtbot-shoulda', 
+     :lib => 'shoulda', 
+     :source => 'http://gems.github.com', 
+     :version => '>= 2.0.6'
+  config.gem "thoughtbot-clearance", 
+     :lib     => 'clearance', 
+     :source  => 'http://gems.github.com', 
+     :version => '>= 0.4.0'
+     
+  # This simulates loading the warrant gem, but without relying on vendor/gems
+  warrant_path = File.join(File.dirname(__FILE__), *%w(.. .. ..))
+  warrant_lib_path = File.join(warrant_path, "lib")
+  $LOAD_PATH.unshift(warrant_lib_path)
+  load File.join(warrant_path, 'rails', 'init.rb')
+
+end
+
+DO_NOT_REPLY = "donotreply@example.com"

data/test/rails_root/config/environments/development.rb

@@ -0,0 +1,19 @@
+# Settings specified here will take precedence over those in config/environment.rb
+
+# In the development environment your application's code is reloaded on
+# every request.  This slows down response time but is perfect for development
+# since you don't have to restart the webserver when you make code changes.
+config.cache_classes = false
+
+# Log error messages when you accidentally call methods on nil.
+config.whiny_nils = true
+
+# Show full error reports and disable caching
+config.action_controller.consider_all_requests_local = true
+config.action_controller.perform_caching             = false
+config.action_view.debug_rjs                         = true
+
+# Don't care if the mailer can't send
+config.action_mailer.raise_delivery_errors = false
+
+HOST = "localhost"

data/test/rails_root/config/environments/test.rb

@@ -0,0 +1,32 @@
+# Settings specified here will take precedence over those in config/environment.rb
+
+# The test environment is used exclusively to run your application's
+# test suite.  You never need to work with it otherwise.  Remember that
+# your test database is "scratch space" for the test suite and is wiped
+# and recreated between test runs.  Don't rely on the data there!
+config.cache_classes = true
+
+# Log error messages when you accidentally call methods on nil.
+config.whiny_nils = true
+
+# Show full error reports and disable caching
+config.action_controller.consider_all_requests_local = true
+config.action_controller.perform_caching             = false
+
+# Disable request forgery protection in test environment
+config.action_controller.allow_forgery_protection    = false
+
+# Tell ActionMailer not to deliver emails to the real world.
+# The :test delivery method accumulates sent emails in the
+# ActionMailer::Base.deliveries array.
+config.action_mailer.delivery_method = :test
+
+HOST = "localhost"
+
+config.gem 'ZenTest',
+           :lib => "test/rails"
+ 
+require 'quietbacktrace'
+require 'factory_girl'
+require 'mocha'
+# begin require 'redgreen'; rescue LoadError; end

data/test/rails_root/config/initializers/inflections.rb

@@ -0,0 +1,10 @@
+# Be sure to restart your server when you modify this file.
+
+# Add new inflection rules using the following format 
+# (all these examples are active by default):
+# Inflector.inflections do |inflect|
+#   inflect.plural /^(ox)$/i, '\1en'
+#   inflect.singular /^(ox)en/i, '\1'
+#   inflect.irregular 'person', 'people'
+#   inflect.uncountable %w( fish sheep )
+# end

data/test/rails_root/config/initializers/mime_types.rb

@@ -0,0 +1,5 @@
+# Be sure to restart your server when you modify this file.
+
+# Add new mime types for use in respond_to blocks:
+# Mime::Type.register "text/richtext", :rtf
+# Mime::Type.register_alias "text/html", :iphone

data/test/rails_root/config/initializers/requires.rb

@@ -0,0 +1,13 @@
+Dir[File.join(RAILS_ROOT, 'lib', 'extensions', '*.rb')].each do |f|
+  require f
+end
+
+Dir[File.join(RAILS_ROOT, 'lib', '*.rb')].each do |f|
+  require f
+end
+
+# Rails 2 doesn't like mocks
+
+Dir[File.join(RAILS_ROOT, 'test', 'mocks', RAILS_ENV, '*.rb')].each do |f|
+  require f
+end

data/test/rails_root/config/initializers/time_formats.rb

@@ -0,0 +1,4 @@
+# Example time formats
+{ :short_date => "%x", :long_date => "%a, %b %d, %Y" }.each do |k, v|
+  ActiveSupport::CoreExtensions::Time::Conversions::DATE_FORMATS.update(k => v)
+end

data/test/rails_root/config/routes.rb

@@ -0,0 +1,6 @@
+ActionController::Routing::Routes.draw do |map|
+
+  map.connect ':controller/:action/:id'
+  map.connect ':controller/:action/:id.:format'
+  
+end

data/test/rails_root/db/migrate/20090123181754_create_users.rb

@@ -0,0 +1,11 @@
+class CreateUsers < ActiveRecord::Migration
+  def self.up
+    create_table :users do |t|
+      t.string :name
+    end
+  end
+
+  def self.down
+    drop_table :users
+  end
+end

data/test/rails_root/db/migrate/20090123181755_create_posts.rb

@@ -0,0 +1,15 @@
+class CreatePosts < ActiveRecord::Migration
+  def self.up
+    create_table :posts do |t|
+      t.string :title
+      t.text   :body
+      t.string :keyword
+      t.string :spam
+      t.references :user
+    end
+  end
+
+  def self.down
+    drop_table :posts
+  end
+end