langalex-totally-restful-authorization 0.0.2 → 0.0.3

data/README

@@ -6,21 +6,24 @@ This plugin adds an authorization layer to your rails app that is <del>completel
 How it works
 ============
 
-Include the PermisionCheck Module in your restful controller...
+Call _check_authorization_ in your restful controller...
 
 class ApplicationController < ActionController::Base
-  include PermissionCheck
+  check_authorization
 end
 
 ... and then declare the permissions in your model:
 
 class User
 	updatable_by :admin # updatable if updater.admin? return true
-	updatable_by :self, :except => [:admin] # special role self, allow all attributes except some to be updated
-	updatable_by :newbie, :only => [:description] # only allow some attribute to be updated
+	updatable_by :admin, :only => [:description] # only allow some attribute to be updated
+	updatable_by :self # special role self, allows the object to update itself
+	updatable_by :associated => :friend # allow user.friend to update the object
 	
 	viewable_by :anyone # special role, includes nil
-	viewable_by :developer, :condition => lambda{|user, viewer| user.non_developer? && viewer.account_activated?} # use conditions for more complex permissions
+	viewable_by :admin, :condition => lambda{|user, viewer| user.non_admin? && viewer.account_activated?} # use conditions for more complex permissions
+	
+	
 	
 	destroyable_by [:admin, :root] # declare multiple roles at once
 end

data/VERSION

@@ -1 +1 @@
-0.0.2
+0.0.3

data/lib/totally_restful_authorization/permission_dsl.rb

@@ -51,7 +51,7 @@ module TotallyRestfulAuthorization
       private
     
       def add_options(permissions, role, options)
-        if role.respond_to?(:each)
+        if role.is_a?(Array)
           role.each do |_role|
             add_options permissions, _role, options
           end
@@ -88,13 +88,15 @@ module TotallyRestfulAuthorization
   
     def check_permission(permission, role, user, field)
       permission.inject(false) do |result, role_options|
-        result || (user_has_role(user, role) && field_in_only_list(field, role_options) &&
+        result || (user_has_permission(user, role) && field_in_only_list(field, role_options) &&
           !field_in_except_list(field, role_options) && condition_met(user, role_options))
       end
     end
   
-    def user_has_role(user, role)
-      if role == :self
+    def user_has_permission(user, role)
+      if role.is_a?(Hash)
+        self.send(role[:associated]) == user
+      elsif role == :self
         user == self
       elsif role == :anyone
         true

data/test/unit/permission_dsl_test.rb

@@ -5,6 +5,7 @@ class PermissionDslTest < Test::Unit::TestCase
     include TotallyRestfulAuthorization::PermissionDsl
   end
   
+  
   def setup
     @clazz = Model
     @clazz.update_permissions.clear
@@ -35,6 +36,19 @@ class PermissionDslTest < Test::Unit::TestCase
     assert _self.updatable_by?(_self)
   end
   
+  def test_hash_with_associated_is_interpreted_as_attributes_on_the_object
+    @clazz.class_eval do
+      attr_accessor :user
+      updatable_by(:associated => :user)
+    end
+    
+    instance = @clazz.new
+    user = 'user'
+    instance.user = user
+    assert instance.updatable_by?(user)
+    assert !instance.updatable_by?('other user')
+  end
+  
   def test_special_role_anyone_is_interpreted_as_any_object
     @clazz.send :updatable_by, :anyone
     assert @clazz.new.updatable_by?('yet another object')
@@ -112,7 +126,7 @@ class PermissionDslTest < Test::Unit::TestCase
     assert @clazz.new.destroyable_by?(stub('admin', :admin? => true))
   end
   
-  def test_declarations_in_inherited_class_dont_interferce_with_superclass
+  def test_declarations_in_inherited_class_dont_interfere_with_superclass
     @clazz2 = Class.new @clazz
     @clazz2.send :destroyable_by, :admin
     assert !@clazz.new.destroyable_by?(stub('admin', :admin? => true))

data/totally-restful-authorization.gemspec

@@ -2,11 +2,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{totally-restful-authorization}
-  s.version = "0.0.2"
+  s.version = "0.0.3"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Alexander Lang"]
-  s.date = %q{2009-06-12}
+  s.date = %q{2009-06-17}
   s.email = %q{alex@upstream-berlin.com}
   s.extra_rdoc_files = [
     "LICENSE",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: langalex-totally-restful-authorization
 version: !ruby/object:Gem::Version 
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors: 
 - Alexander Lang
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-06-12 00:00:00 -07:00
+date: 2009-06-17 00:00:00 -07:00
 default_executable: 
 dependencies: []