ixtlan-guard 0.7.2 → 0.8.0

data/lib/ixtlan/guard/guard_config.rb

@@ -11,8 +11,7 @@ module Ixtlan
 
       def allowed_groups(resource, action)
         if resource && action
-          resource = resource.to_s
-          groups = send(@load_method, resource)
+          groups = send(@load_method, resource.to_s)
           groups[action.to_s] || groups["defaults"] || []
         else
           []

data/lib/ixtlan/guard/guard_rails.rb

@@ -1,74 +1,220 @@
 module Ixtlan
-  module ActionController #:nodoc:
-    module Guard #:nodoc:
+  module Guard
+    module ActionController
       def self.included(base)
         base.send(:include, InstanceMethods)
         base.send(:include, GroupsMethod)
       end
 
+      class Filter
+        attr_reader :block
+        def initialize(method, options, &block)
+          @only = options[:only]
+          @except = options[:except] || []
+          @reference = options[:reference]
+          @reference = @reference.to_sym if @reference
+          @block = block
+          @method = method.to_sym if method
+          raise "illegal arguments: either block or method name #{method}" if block && method
+        end
+        
+        def proc(base, reference = nil)
+          if @block
+            if reference
+              Proc.new do |groups|
+                @block.call(groups, reference)
+              end
+            elsif @reference
+              Proc.new do |groups|
+                 @block.call(groups, base.send(@reference))
+              end
+            else
+              @block
+            end
+          else
+            if base.respond_to?(@method) || base.private_methods.include?(@method.to_s)
+              if reference
+                Proc.new do |groups|
+                  base.send(@method, groups, reference)
+                end
+              elsif @reference
+                Proc.new do |groups|
+                  base.send(@method, groups, base.send(@reference))
+                end
+              else
+                base.method(@method)
+              end
+            else
+              if @reference
+                Proc.new do |groups|
+                  base.class.send(@method, groups, base.send(@reference))
+                end
+              else
+                base.class.method(@method)
+              end
+            end
+          end
+        end
+
+        def allowed?(action)
+          action = action.to_sym
+          (@only && @only.member?(action)) ||
+            ((@only.nil? || @only.empty?) && ! @except.member?(action))
+        end
+      end
+
       module GroupsMethod
 
         protected
 
-        def groups_for_current_user
-          if respond_to?(:current_user) && current_user
-            current_user.groups
-          else
-            []
-          end
+        def current_groups
+          @current_groups ||= 
+            if respond_to?(:current_user) && current_user
+              current_user.groups
+            else
+              []
+            end
         end
       end
 
       module RootGroup
         protected
 
-        def groups_for_current_user
+        def current_groups
           ['root']
         end
       end
 
       module InstanceMethods #:nodoc:
 
+        def self.included(base)
+          base.class_eval do
+
+            def self.guard_filter(*args, &block)
+              method = nil#"_intern_#{guard_filters.size}"
+              options = {}
+              case args.size
+              when 1
+                if args[0].is_a? Symbol
+                  method = args[0]
+                else
+                  options = args[0]
+                end
+              when 2
+                method = args[0].to_sym
+                options = args[1]
+              else
+                raise "argument error, expected (Symbol, Hash) or (Symbol) or (Hash)"
+              end
+              
+              guard_filters << Filter.new(method, options, &block)
+            end
+
+            def self.guard_filters
+              @_guard_filters ||= []
+            end
+
+            def self.guard
+              Rails.application.config.guard
+            end
+
+            def self.allowed?(action, current_groups, reference = nil)
+              filter = guard_filters.detect do |f|
+                f.allowed?(action)
+              end
+              if filter
+                guard.check(self.controller_name, 
+                            action,
+                            current_groups || []) do |groups|
+                  filter.proc(self, reference).call(groups)
+                end
+              else
+                # TODO maybe do something with the reference
+                guard.check(controller_name, 
+                            action,
+                            current_groups || [])
+              end
+            end
+          end
+        end
+
         protected
 
         def guard
-          Rails.application.config.guard
+          self.class.guard
         end
 
-        def check(association = nil, &block)
-          group_method = respond_to?(:current_user_groups) ? :current_user_groups : :groups_for_current_user
-          unless guard.allowed?(params[:controller], 
-                                params[:action],
-                                send(group_method),
-                                association, 
-                                &block)
-            if association
-              raise ::Ixtlan::Guard::PermissionDenied.new("permission denied for '#{params[:controller]}##{params[:action]}##{association.class}(#{association.id})'")
-            else
-              raise ::Ixtlan::Guard::PermissionDenied.new("permission denied for '#{params[:controller]}##{params[:action]}'")
+        def allowed?(action_or_actions, 
+                     controller = params[:controller], 
+                     reference = nil,
+                     &block)
+          case action_or_actions
+          when Array
+            action_or_actions.detect do |action|
+              check(action, controller, reference, &block) != nil
             end
+          else
+            check(action_or_actions, controller, reference, &block) != nil
           end
-          true
         end
-        alias :authorize :check
 
-        def authorization
-          warn "DEPRECATED: use 'authorize' instead"
-          check
+        def check(action = params[:action], 
+                  controller = params[:controller],
+                  reference = nil,
+                  &block)
+          unless block
+            filter = self.class.guard_filters.detect do |f|
+              f.allowed?(action)
+            end
+          end
+
+          if filter
+            guard.check(controller, 
+                        action,
+                        current_groups || []) do |groups|
+              filter.proc(self).call(groups)
+            end
+          else
+            # TODO maybe do something with the reference
+            guard.check(controller, 
+                        action,
+                        current_groups || [],
+                        &block)
+          end
+        end
+
+        def authorize
+          unless check
+            raise ::Ixtlan::Guard::PermissionDenied.new("permission denied for '#{params[:controller]}##{params[:action]}'")
+          end
+          true
         end
       end
     end
-  end
 
-  module Allowed #:nodoc:
-    # Inclusion hook to make #allowed available as method
-    def self.included(base)
-      base.send(:include, InstanceMethods)
-    end
+    module Allowed
+      # Inclusion hook to make #allowed available as method
+      def self.included(base)
+        base.send(:include, InstanceMethods)
+      end
     
-    module InstanceMethods #:nodoc:
-      def allowed?(resource, action)
-        controller.send(:guard).allowed?(resource, action, controller.send(:groups_for_current_user))
+      module InstanceMethods #:nodoc:
+        def allowed?(resource, action, reference = nil)
+          if resource.to_s != controller.class.controller_name || reference
+            other = "#{resource}Controller".classify.constantize
+            if other.respond_to?(:allowed?)
+              if reference
+                other.send(:allowed?, action, controller.current_groups, reference)
+              else
+                other.send(:allowed?, action, controller.current_groups)
+              end
+            else
+              raise "can not find 'allowed?' on #{other}"
+            end
+          else
+            controller.send(:allowed?, action, resource)
+          end
+        end
       end
     end
   end

data/lib/ixtlan/guard/railtie.rb

@@ -1,5 +1,5 @@
 require 'rails'
-require 'ixtlan/guard/guard_ng'
+require 'ixtlan/guard/guard'
 require 'ixtlan/guard/guard_rails'
 require 'logger'
 require 'fileutils'
@@ -10,6 +10,9 @@ module Ixtlan
 
       config.before_configuration do |app|
         app.config.guards_dir = File.join(Rails.root, "app", "guards")
+        # needs to be here ?!?
+        ::ActionController::Base.send(:include, Ixtlan::Guard::ActionController)
+        ::ActionView::Base.send(:include, Ixtlan::Guard::Allowed)
       end
       
       config.after_initialize do |app|
@@ -20,11 +23,11 @@ module Ixtlan
         }
         options[:logger] = logger unless defined?(Slf4r)
         FileUtils.mkdir_p(app.config.guards_dir)
-        app.config.guard = Ixtlan::Guard::GuardNG.new(options)
 
-        ::ActionController::Base.send(:include, Ixtlan::ActionController::Guard)
-        ::ActionController::Base.send(:before_filter, :authorize)
-        ::ActionView::Base.send(:include, Ixtlan::Allowed)
+        controller = ::ApplicationController rescue ::ActionController::Base
+        controller.send(:before_filter, :authorize)
+
+        app.config.guard = Ixtlan::Guard::Guard.new(options)
       end
       
       config.generators do

data/spec/guard_cache_spec.rb

@@ -1,5 +1,5 @@
 require 'spec_helper'
-require 'ixtlan/guard/guard_ng'
+require 'ixtlan/guard/guard'
 require 'logger'
 require 'fileutils'
 
@@ -12,11 +12,11 @@ def $logger.debug(&block)
 #  info("\n\t[debug] " + block.call)
 end
 
-describe Ixtlan::Guard::GuardNG do
+describe Ixtlan::Guard::Guard do
 
   context "without caching" do
     def not_cached
-      $not_cached ||= Ixtlan::Guard::GuardNG.new(:guards_dir => File.dirname($target), 
+      $not_cached ||= Ixtlan::Guard::Guard.new(:guards_dir => File.dirname($target), 
                                                  :logger => $logger )
     end
       
@@ -37,7 +37,7 @@ describe Ixtlan::Guard::GuardNG do
 
   context "with caching" do
     def cached
-      $cached ||= Ixtlan::Guard::GuardNG.new(:guards_dir => File.dirname($target), 
+      $cached ||= Ixtlan::Guard::Guard.new(:guards_dir => File.dirname($target), 
                                              :logger => $logger,
                                              :cache => true)
     end

data/spec/guard_export_spec.rb

@@ -1,21 +1,38 @@
 require 'spec_helper'
-require 'ixtlan/guard/guard_ng'
+require 'ixtlan/guard/guard'
 require 'logger'
 
-describe Ixtlan::Guard::GuardNG do
+describe Ixtlan::Guard::Guard do
+
+  def assert(expected, perms)
+    map = {}
+    expected.each do |e|
+      map[e[:permission][:resource]] = e
+      if e[:permission][:actions]
+        e[:permission][:actions].sort!{ |n,m| n[:action][:name] <=> m[:action][:name] }
+      end
+    end
+    perms.each do |perm|
+      if perm[:actions]
+        perm[:actions].sort!{ |n,m| n.content[:name] <=> m.content[:name] }
+      end
+      map[perm[:resource].to_s].should == perm
+    end
+  end
 
   subject do
     logger = Logger.new(STDOUT)
     def logger.debug(&block)
    #   info("\n\t[debug] " + block.call)
     end
-    Ixtlan::Guard::GuardNG.new(:guards_dir => File.join(File.dirname(__FILE__), "guards"), :logger => logger )
+    Ixtlan::Guard::Guard.new(:guards_dir => File.join(File.dirname(__FILE__), "guards"), :logger => logger )
   end
   
   context '#permissions' do
     
     it 'should deny all without defaults but wildcard "*" actions' do
-      subject.permissions(['unknown_group']).sort { |n,m| n[:resource] <=> m[:resource] }.should == [
+      perm = subject.permissions(['unknown_group'])
+      expected = [
          #allow nothing
          {:permission=>{:resource=>"accounts", :actions=>[], :deny=>false}},
          # allow anything but index
@@ -41,9 +58,12 @@ describe Ixtlan::Guard::GuardNG do
          {:permission=>{:resource=>"regions", :actions=>[], :deny=>false}},
          #allow nothing
          {:permission=>{:resource=>"users", :actions=>[], :deny=>false}}]
+
+      assert(expected, perm)
     end
     it 'should deny some without defaults but wildcard "*" actions' do
-      subject.permissions(['no_admin']).sort { |n,m| n[:resource] <=> m[:resource] }.should == [
+      perm = subject.permissions(['no_admin'])
+      expected = [
          #allow nothing
          {:permission=>{:resource=>"accounts", :actions=>[], :deny=>false}},
          # allow anything but index
@@ -72,9 +92,12 @@ describe Ixtlan::Guard::GuardNG do
          {:permission=>{:resource=>"regions", :actions=>[], :deny=>false}},
          #allow nothing
          {:permission=>{:resource=>"users", :actions=>[], :deny=>false}}]
+
+      assert(expected, perm)
     end
     it 'should allow "root"' do
-      subject.permissions(['root']).sort { |n,m| n[:resource] <=> m[:resource] }.should == [
+      perm = subject.permissions(['root'])
+      expected = [
          {:permission=>{:resource=>"accounts", :actions=>[], :deny=>true}},
          {:permission=>{:resource=>"allow_all_defaults", :actions=>[], :deny=>true}},
          {:permission=>{:resource=>"defaults", :actions=>[], :deny=>true}},
@@ -83,9 +106,13 @@ describe Ixtlan::Guard::GuardNG do
          {:permission=>{:resource=>"person", :actions=>[], :deny=>true}},
          {:permission=>{:resource=>"regions", :actions=>[], :deny=>true}},
          {:permission=>{:resource=>"users", :actions=>[], :deny=>true}}]
-    end   
+
+      assert(expected, perm)
+    end
+
     it 'should allow with default group' do
-      subject.permissions(['_master']).sort { |n,m| n[:resource] <=> m[:resource] }.should == [
+      perm = subject.permissions(['_master'])
+      expected = [
          #allow nothing
          {:permission=>{:resource=>"accounts", :actions=>[], :deny=>false}},
          # allow anything but index
@@ -112,10 +139,13 @@ describe Ixtlan::Guard::GuardNG do
          {:permission=>{:resource=>"regions", :actions=>[], :deny=>false}},
          #allow nothing
          {:permission=>{:resource=>"users", :actions=>[], :deny=>false}}]
+
+      assert(expected, perm)
     end
 
     it 'should allow with non-default group' do
-      subject.permissions(['_admin']).sort { |n,m| n[:resource] <=> m[:resource] }.should == [
+      perm = subject.permissions(['_admin'])
+      expected = [
          #allow nothing
          {:permission=>{:resource=>"accounts", :actions=>[], :deny=>false}},
          # allow anything but index
@@ -143,6 +173,8 @@ describe Ixtlan::Guard::GuardNG do
          {:permission=>{:resource=>"regions", :actions=>[], :deny=>false}},
          #allow nothing
          {:permission=>{:resource=>"users", :actions=>[], :deny=>false}}]
+
+      assert(expected, perm)
     end
 
     it 'should allow with association' do
@@ -150,18 +182,12 @@ describe Ixtlan::Guard::GuardNG do
       def group.name
         "region"
       end
-      subject.permissions([group])do |resource, action, groups|
+      perm = subject.permissions([group])do |resource, groups|
         if resource == 'regions'
-          case action
-          when 'show'
-            {:associations => [:europe, :asia]}
-          else
-            {}
-          end
-        else
-          {}
+          [:europe, :asia]
         end
-      end.sort { |n,m| n[:resource] <=> m[:resource] }.should == [
+      end
+      expected = [
          #allow nothing
          {:permission=>{:resource=>"accounts", :actions=>[], :deny=>false}},
          # allow anything but index
@@ -194,10 +220,12 @@ describe Ixtlan::Guard::GuardNG do
           {:resource=>"regions",
            :actions=>
             [{:action=>{:name=>"show", :associations=>[:europe, :asia]}},
-             {:action=>{:name=>"create"}}],
+             {:action=>{:name=>"create", :associations=>[:europe, :asia]}}],
            :deny=>false}},
          #allow nothing
          {:permission=>{:resource=>"users", :actions=>[], :deny=>false}}]
+
+      assert(expected, perm)
     end
   end
 end