kojac 0.9.1 → 0.11.0

data/app/policies/kojac_base_policy.rb

@@ -0,0 +1,114 @@
+class KojacBasePolicy
+  attr_reader :user, :record, :op
+
+  def initialize(user, record, op=nil)
+	  raise Pundit::NotAuthorizedError, "must be logged in" unless user
+    @user = user
+    @record = record
+	  @op = op
+  end
+
+  def unauthorized!(aMessage=nil)
+	  raise Pundit::NotAuthorizedError, aMessage||"You are not authorized to perform this action"
+  end
+
+  #def self.write_op_filter(aCurrentUser,aSafeFields,aSourceFields)
+		#	ring = aCurrentUser.ring
+		#	has_owner = !!self.column_names.include?('owner_id')
+		#	has_dealership = !!self.column_names.include?('dealership_id')
+		#	# default to user
+		#	if ring <= SALES_RING
+		#		aSafeFields['owner_id'] ||= aCurrentUser.owner_id if has_owner
+		#		aSafeFields['dealership_id'] ||= aCurrentUser.dealership_id if has_dealership
+		#	end
+		#	if ring > SYSADMIN_RING
+		#		unauthorized! if aSafeFields['owner_id'] != aCurrentUser.owner_id if has_owner
+		#	end
+		#	if ring > OWNER_ADMIN_RING
+		#		unauthorized! if aSafeFields['dealership_id'] != aCurrentUser.dealership_id if has_dealership
+		#	end
+		#end
+
+  def query_ring
+	  user.ring
+  end
+
+  # kojac methods
+  def read?
+	  record.class.ring_can?(query_ring,:read)
+  end
+
+  def write?
+	  record.class.ring_can?(query_ring,:write)
+  end
+
+  # rails methods
+  def index?
+	  record.class.ring_can?(query_ring,:read)
+  end
+
+  def show?
+	  record.class.ring_can?(query_ring,:read)
+  end
+
+  def create?
+	  record.class.ring_can?(query_ring,:create)
+  end
+
+  def new?
+	  record.class.ring_can?(query_ring,:create)
+  end
+
+  def update?
+	  record.class.ring_can?(query_ring,:write)
+  end
+
+  def edit?
+	  record.class.ring_can?(query_ring,:write)
+  end
+
+  def destroy?
+	  record.class.ring_can?(query_ring,:destroy)
+  end
+
+  def scope
+    Pundit.policy_scope!(user, record.class)
+  end
+
+	def permitted_attributes(aAbility=nil)
+		raise "ability not given" unless (@op && @op[:verb]) || aAbility
+		if !aAbility && @op
+			aAbility = case @op[:verb]
+				when 'CREATE'
+				when 'UPDATE'
+					:write
+				when 'READ'
+					:read
+				when 'ADD'
+					:add
+				when 'REMOVE'
+					:remove
+				when 'CREATE_ON'
+					:create_on
+			end
+		end
+		cls = record.is_a?(Class) ? record : record.class
+		cls.permitted(query_ring,aAbility)
+	end
+
+  def permitted_fields(aAbility=nil)
+	  result = permitted_attributes(aAbility)
+	  cls = record.is_a?(Class) ? record : record.class
+		result.delete_if { |f| cls.reflections.has_key? f }
+		result
+	end
+
+	def permitted_associations(aAbility=nil)
+	  result = permitted_attributes(aAbility)
+	  cls = record.is_a?(Class) ? record : record.class
+		result.delete_if { |f| !cls.reflections.has_key? f }
+		result
+	end
+
+end
+

data/app/serializers/kojac_base_serializer.rb

@@ -0,0 +1,35 @@
+class KojacBaseSerializer < ActiveModel::Serializer
+
+	self.root = false
+
+	def initialize(object, options={})
+		super(object,options)
+	end
+
+	SERIALIZABLE_TYPES = [NilClass,FalseClass,TrueClass,Fixnum,Bignum,String,Symbol,Hash,Array]
+
+	def attributes
+		attrs = nil
+		source = if policy = Kojac::policy(scope,object)
+			attrs = policy.permitted_attributes(:read).map(&:to_s)
+			object.attributes
+		elsif object.respond_to? :attributes
+			object.attributes
+		elsif object.is_a? Hash
+			object
+		end
+		result = {}
+		source.each do |k,v|
+			k_s = k.to_s
+			next if attrs && !attrs.include?(k_s)
+			if SERIALIZABLE_TYPES.include? v.class
+				result[k_s] = v
+			else
+				result[k_s] = KojacUtils.to_jsono(v,scope: scope)
+			end
+		end
+		result
+	end
+
+	alias_method :serializable_object, :serializable_hash
+end

data/kojac.gemspec

@@ -21,15 +21,17 @@ Gem::Specification.new do |s|
   s.test_files    = s.files.grep(%r{^(test|spec|features)/})
   s.require_paths = ["lib"]
   
-  s.add_dependency "underscore_plus"
-  s.add_dependency "jquery-rails"
-  s.add_dependency 'strong_parameters'
+  s.add_runtime_dependency "buzztools", '~> 0.0.5'
+  s.add_runtime_dependency "underscore_plus", '~> 0.9.1'
+  s.add_runtime_dependency "pundit", '~> 0.2.3'
+  s.add_runtime_dependency "active_model_serializers", '= 0.9.0.alpha1'
 
-  s.add_development_dependency "rails", "~> 3.2"
-  s.add_development_dependency "rspec-rails"
-  s.add_development_dependency "canjs-rails"
-  s.add_development_dependency "ember-rails"
-  s.add_development_dependency "jquery-rails"
-  s.add_development_dependency "capybara"
-  s.add_development_dependency "sqlite3"
+  #s.add_runtime_dependency "jquery-rails"
+  #s.add_runtime_dependency "rails", ">= 3.1"
+  # s.add_development_dependency "rspec-rails"
+  # s.add_development_dependency "canjs-rails"
+  # s.add_development_dependency "ember-rails"
+  # s.add_development_dependency "jquery-rails"
+  # s.add_development_dependency "capybara"
+  # s.add_development_dependency "sqlite3"
 end

data/lib/kojac/app_serialize.rb

@@ -1,29 +1,31 @@
-require 'active_record/serializer_override'
-
-def app_serialize(aObject,aScope)
-	result = case aObject.class
-		when Fixnum then aObject.to_s
-		when Bignum then aObject.to_s
-		when Array
-			sz_class = ActiveModel::ArraySerializer
-			sz_class.new(aObject).to_json(:scope => aScope, :root => false)
-		when String then aObject
-		when FalseClass then 'false'
-		when TrueClass then 'true'
-		when Symbol then aObject.to_s
-		#when Hash
-			#sz_class = ActiveModel::Serializer
-			#sz_class.new(aObject).to_json(:scope => aScope, :root => false)
-
-		else
-			sz_class = aObject.respond_to?(:active_model_serializer) && aObject.send(:active_model_serializer)
-			sz_class = DefaultKojacSerializer if !sz_class && aObject.is_a?(ActiveModel)
-			if sz_class
-				sz_class.new(aObject).to_json(:scope => aScope, :root => false)
-			else
-				aObject.to_json
-			end
-
-	end
-	result
-end
+## http://matthewrobertson.org/blog/2013/08/06/active-record-serializers-from-scratch/
+#
+#if Rails::VERSION::STRING.split('.').first.to_i < 4
+#	require 'active_record/serializer_override'
+#end
+#
+#def app_serialize(aObject,aScope)
+#	result = case aObject.class
+#		when Fixnum then aObject.to_s
+#		when Bignum then aObject.to_s
+#		when Array
+#			sz_class = ActiveModel::ArraySerializer
+#			sz_class.new(aObject).to_json(:scope => aScope, :root => false)
+#		when String then aObject
+#		when FalseClass then 'false'
+#		when TrueClass then 'true'
+#		when Symbol then aObject.to_s
+#		#when Hash
+#			#sz_class = ActiveModel::Serializer
+#			#sz_class.new(aObject).to_json(:scope => aScope, :root => false)
+#		else
+#			sz_class = aObject.respond_to?(:active_model_serializer) && aObject.send(:active_model_serializer)
+#			sz_class = DefaultKojacSerializer if !sz_class && aObject.is_a?(ActiveModel)
+#			if sz_class
+#				sz_class.new(aObject).to_json(:scope => aScope, :root => false)
+#			else
+#				aObject.to_json
+#			end
+#	end
+#	result
+#end

data/lib/kojac/concentric.rb

@@ -0,0 +1,152 @@
+#concentric
+#
+#Assists implementation of ring level security (http://en.wikipedia.org/wiki/Ring_(computer_security)) with Rails 4 (or Rails 3 with gem) Strong Parameters.
+#
+#Ring Level Security is a simpler alternative to Role Based Security. Rings are arranged in a concentric hierarchy from most-privileged innermost Ring 0 to the least privileged highest ring number. Users have their own ring level which gives them access to that ring and below.
+#
+#For example, a sysadmin could have Ring 0, a website manager ring 1, a customer ring 2, and anonymous users ring 3. A customer would have all the capabilities of anonymous users, and more. Likewise, a website manager has all the capabilities of a customer, and more etc.
+#
+#This inheritance of capabilities of outer rings, and the simple assigning of users to rings, makes security rules less repetitive and easier to write and maintain, minimising dangerous mistakes.
+#
+#This gem does not affect or replace or prevent the standard strong parameters methods from being used in parallel, it merely generates arguments for the standard strong parameters methods.
+#
+#
+#
+#BASIC_FIELDS = [:name, :address]
+#
+#class Deal
+#  ring 1, :write, BASIC_FIELDS
+#  ring 1, :write, :phone
+#  ring 1, :delete
+#  ring 2, :read, BASIC_FIELDS
+#end
+#
+#
+#class DealsController
+#
+#  def update
+#    ring_fields(:write,model)
+#    if ring_can(:write,model,:name)
+#    if ring_can(:delete,model)
+#    model.update(params.permit( ring_fields(:write,model) ))
+#  end
+#
+#end
+
+
+
+class Concentric
+
+	cattr_accessor :config
+
+	def self.lookup_ring(aRingName)
+		return nil if !aRingName
+		return aRingName if aRingName.is_a?(Fixnum)
+		if ring_names = Concentric.config[:ring_names]
+			return ring_names[aRingName.to_sym]
+		else
+			return nil
+		end
+	end
+
+	def self.ring_name(aRing)
+		ring_names = Concentric.config[:ring_names]
+		ring_names.key(aRing)
+	end
+
+	def self.ring_text(aRing)
+		return 'none' if !aRing
+		ring_name(aRing).to_s.humanize
+	end
+end
+
+
+# see http://yehudakatz.com/2009/11/12/better-ruby-idioms/ re class and instance methods and modules
+
+module Concentric::Model
+
+	def self.included(aClass)
+		aClass.cattr_accessor :rings_abilities
+    aClass.rings_abilities = []  # [1] => {read: [:name,:address], delete: true}
+    aClass.send :extend, ClassMethods
+  end
+
+	module ClassMethods
+
+		# supports different formats :
+		# ring :sales, :write => [:name,:address]   ie. sales can write the name and address fields
+		# ring :sales, :read                        ie. sales can read this model
+		# ring :sales, [:read, :create, :destroy]   ie. sales can read, create and destroy this model
+		def ring(aRing,aAbilities)
+			#aRing.each {|r| ring(r,aAbilities)} and return if aRing.is_a? Array shouldn't need this because of ring system
+			aRing = Concentric.lookup_ring(aRing)
+			raise "aRing must be a number or a symbol defined in Concentric.config.ring_names" if !aRing.is_a?(Fixnum)
+			raise "aAbilities must be a Hash" unless aAbilities.is_a? Hash # eg. :write => [:name,:address]
+
+			ring_rec = self.rings_abilities[aRing]
+				aAbilities.each do |abilities,fields|
+					abilities = [abilities] unless abilities.is_a?(Array)
+					fields = [fields] unless fields.is_a?(Array)
+				next if fields.empty?
+					abilities.each do |a|
+						a = a.to_sym
+					ring_rec ||= {}
+					if fields==[:this]
+						ring_rec[a] = true unless ring_rec[a].to_nil
+					else
+						ring_fields = ring_rec[a]
+						ring_fields = [] unless ring_fields.is_a? Array
+						ring_fields = ring_fields + fields.map(&:to_sym)
+						ring_fields.uniq!
+						ring_fields.sort!
+						ring_rec[a] = ring_fields
+					end
+				end
+				self.rings_abilities[aRing] = ring_rec
+			end
+		end
+
+		# returns properties that this ring can use this ability on
+		def permitted(aRing,aAbility)
+			aRing = Concentric.lookup_ring(aRing)
+			raise "aRing must be a number or a symbol defined in Concentric.config.ring_names" if !aRing.is_a?(Fixnum)
+			return [] unless aRing and rings_abilities = self.respond_to?(:rings_abilities) && self.rings_abilities.to_nil
+
+			fields = []
+			aRing.upto(rings_abilities.length-1) do |i|
+				next unless ring_rec = rings_abilities[i]
+				if af = ring_rec[aAbility.to_sym]
+					next if af==true
+					fields += af if af.is_a?(Array)
+				end
+			end
+			fields.uniq!
+			fields.sort!
+			fields
+		end
+
+		# Query
+		def ring_can?(aRing,aAbility,aFields=nil)
+			if aFields
+				pf = permitted(aRing,aAbility)
+				if aFields.is_a? Array
+					return (aFields - pf).empty?
+				else
+					return pf.include? aFields
+				end
+			end
+
+			aRing = Concentric.lookup_ring(aRing)
+			return [] unless aRing and rings_abilities = self.respond_to?(:rings_abilities).to_nil && self.rings_abilities
+
+			aRing.upto(rings_abilities.length-1) do |i|
+				next unless ring_rec = rings_abilities[i]
+				return true if ring_rec[aAbility.to_sym].to_nil
+			end
+			return false
+		end
+
+	end
+
+end
+

data/lib/kojac/kojac_policy.rb

@@ -0,0 +1,70 @@
+#require "pundit/version"
+require "pundit/policy_finder"
+#require "active_support/concern"
+#require "active_support/core_ext/string/inflections"
+#require "active_support/core_ext/object/blank"
+
+module Kojac
+  #class NotAuthorizedError < StandardError; end
+  #class NotDefinedError < StandardError; end
+
+  extend ActiveSupport::Concern
+
+  class << self
+    def policy_scope(user, scope, op=nil)
+      policy = Pundit::PolicyFinder.new(scope).scope
+      policy.new(user, scope, op).resolve if policy
+    end
+
+    def policy_scope!(user, scope, op=nil)
+	    Pundit::PolicyFinder.new(scope).scope!.new(user, scope, op).resolve
+    end
+
+    def policy(user, record, op=nil)
+      scope = Pundit::PolicyFinder.new(record).policy
+      scope.new(user, record, op) if scope
+    end
+
+    def policy!(user, record, op=nil)
+	    Pundit::PolicyFinder.new(record).policy!.new(user, record, op)
+    end
+  end
+
+  included do
+    if respond_to?(:helper_method)
+      helper_method :policy_scope
+      helper_method :policy
+    end
+    if respond_to?(:hide_action)
+      hide_action :authorize
+      hide_action :verify_authorized
+      hide_action :verify_policy_scoped
+    end
+  end
+
+  def verify_authorized
+    raise NotAuthorizedError unless @_policy_authorized
+  end
+
+  def verify_policy_scoped
+    raise NotAuthorizedError unless @_policy_scoped
+  end
+
+  def authorize(record, query=nil)
+    query ||= params[:action].to_s + "?"
+    @_policy_authorized = true
+    unless policy(record).public_send(query)
+      raise NotAuthorizedError, "not allowed to #{query} this #{record}"
+    end
+    true
+  end
+
+  def policy_scope(scope)
+    @_policy_scoped = true
+    Pundit::Pundit.policy_scope!(current_user, scope, op)
+  end
+
+  def policy(record)
+	  Pundit::Pundit.policy!(current_user, record, op)
+  end
+end