lockdown 0.5.22 → 0.6.0

data/lib/lockdown/database.rb

@@ -0,0 +1,108 @@
+module Lockdown
+  class Database
+    class << self
+      # This is very basic and could be handled better using orm specific
+      # functionality, but I wanted to keep it generic to avoid creating 
+      # an interface for each the different orm implementations. 
+      # We'll see how it works...
+      def sync_with_db
+
+        @permissions = Lockdown::System.get_permissions
+        @user_groups = Lockdown::System.get_user_groups
+
+        create_new_permissions
+
+        delete_extinct_permissions
+      
+        maintain_user_groups
+      rescue Exception => e
+        puts ">> Lockdown sync failed: #{e}" 
+      end
+
+      private
+
+      # Create permissions not found in the database
+      def create_new_permissions
+        @permissions.each do |key|
+          next if Lockdown::System.permission_assigned_automatically?(key)
+          str = Lockdown.get_string(key)
+          p = Permission.find(:first, :conditions => ["name = ?", str])
+          unless p
+            puts ">> Lockdown: Permission not found in db: #{str}, creating."
+            Permission.create(:name => str)
+          end
+        end
+      end
+
+      # Delete the permissions not found in init.rb
+      def delete_extinct_permissions
+        db_perms = Permission.find(:all).dup
+        db_perms.each do |dbp|
+          unless @permissions.include?(Lockdown.get_symbol(dbp.name))
+            puts ">> Lockdown: Permission no longer in init.rb: #{dbp.name}, deleting."
+            Lockdown.database_execute("delete from permissions_user_groups where permission_id = #{dbp.id}")
+            dbp.destroy
+          end
+        end
+      end
+
+      def maintain_user_groups
+        # Create user groups not found in the database
+        @user_groups.each do |key|
+          str = Lockdown.get_string(key)
+          unless ug = UserGroup.find(:first, :conditions => ["name = ?", str])
+            create_user_group(str)
+          else
+            # Remove permissions from user group not found in init.rb
+            remove_invalid_permissions(ug, key)
+
+            # Add in permissions from init.rb not found in database
+            add_valid_permissions(ug, key)
+          end
+        end
+      end
+
+      def create_user_group(name_str)
+        puts ">> Lockdown: UserGroup not in the db: #{name_str}, creating."
+        ug = UserGroup.create(:name => name_str)
+        #Inefficient, definitely, but shouldn't have any issues across orms.
+        Lockdown::System.permissions_for_user_group(key) do |perm|
+          p = Permission.find(:first, :conditions => ["name = ?", Lockdown.get_string(perm)])
+          Lockdown.database_execute <<-SQL 
+                insert into permissions_user_groups(permission_id, user_group_id)
+                values(#{p.id}, #{ug.id})
+          SQL
+        end
+      end
+
+      def remove_invalid_permissions(ug, key)
+        ug.permissions.each do |perm|
+          perm_sym = Lockdown.get_symbol(perm)
+          perm_string = Lockdown.get_string(perm)
+          unless @user_groups[key].include?(perm_sym)
+            puts ">> Lockdown: Permission: #{perm_string} no longer associated to User Group: #{ug.name}, deleting."
+            ug.permissions.delete(perm)
+          end
+        end
+      end
+
+      def add_valid_permissions(ug, key)
+        @user_groups[key].each do |perm|
+          perm_string = Lockdown.get_string(perm)
+          found = false
+          # see if permission exists
+          ug.permissions.each do |p|
+            found = true if Lockdown.get_string(p) == perm_string 
+          end
+          # if not found, add it
+          unless found
+            puts ">> Lockdown: Permission: #{perm_string} not found for User Group: #{ug.name}, adding it."
+            p = Permission.find(:first, :conditions => ["name = ?", perm_string])
+            ug.permissions << p
+          end
+        end
+      end
+
+    end # class block
+  end # Database
+end #Lockdown

data/lib/lockdown/frameworks/merb/controller.rb

@@ -0,0 +1,59 @@
+module Lockdown
+  module Frameworks
+    module Merb
+      module Controller
+
+        def available_actions(klass)
+          klass.callable_actions.keys
+        end
+
+        def controller_name(klass)
+          klass.controller_name
+        end
+        
+        # Locking methods
+        module Lock
+          def self.included(base)
+            base.send :include, Lockdown::Frameworks::Merb::Controller::Lock::InstanceMethods
+
+            base.before :set_current_user
+            base.before :configure_lockdown
+            base.before :check_request_authorization
+          end
+
+          module InstanceMethods
+            def self.included(base)
+              base.send :include, Lockdown::Controller::Core
+            end
+
+            def sent_from_uri
+              request.uri
+            end
+
+            def authorized?(path)
+              return true if current_user_is_admin?
+
+              path_allowed?(path)
+            end
+          
+            # Can log Error => e if desired, I don't desire to now.
+            # For now, just send home, but will probably make this configurable
+            def access_denied(e)
+              redirect Lockdown::System.fetch(:access_denied_path)
+            end
+          
+            def path_from_hash(hsh)
+              return hsh if hsh.is_a?(String)
+              hsh = hsh.to_hash if hsh.is_a?(Mash)
+              hsh['controller'].to_s + "/" + hsh['action'].to_s
+            end
+          
+            def redirect_back_or_default(default)
+              session[:prevpage] ? redirect(session[:prevpage]) : redirect(default)
+            end
+          end # InstanceMethods
+        end # Lock
+      end # Controller
+    end # Merb
+  end # Frameworks
+end # Lockdown

data/lib/lockdown/frameworks/merb/view.rb

@@ -0,0 +1,30 @@
+module Lockdown
+  module Frameworks
+    module Merb
+      module View
+        def self.included(base)
+          base.send :alias_method, :link_to_open,  :link_to
+          base.send :alias_method, :link_to,  :link_to_secured
+        end
+
+        def link_to_secured(name, url = '', options = {})
+          if authorized? url
+            return link_to_open(name, url, options)
+          end
+          return ""
+        end
+
+        def link_to_or_show(name, url = '', options = {})
+          lnk = link_to(name, url , options)
+          lnk.length == 0  ? name : lnk
+        end
+
+        def links(*lis)
+          rvalue = []
+          lis.each{|link| rvalue << link if link.length > 0 }
+          rvalue.join(" | ")
+        end
+      end # View
+    end # Merb
+  end # Frameworks
+end # Lockdown

data/lib/lockdown/frameworks/merb.rb

@@ -0,0 +1,74 @@
+require File.join(File.dirname(__FILE__), "merb", "controller")
+require File.join(File.dirname(__FILE__), "merb", "view")
+
+module Lockdown
+  module Frameworks
+    module Merb
+      class << self
+        def use_me?
+          Object.const_defined?("Merb") && ::Merb.const_defined?("AbstractController")
+        end
+
+        def included(mod)
+          mod.extend Lockdown::Frameworks::Merb::Environment
+          mixin
+        end
+
+        def mixin
+          Lockdown.controller_parent.send :include, Lockdown::Frameworks::Merb::Controller::Lock
+          Lockdown.view_helper.send :include, Lockdown::Frameworks::Merb::View
+          Lockdown::System.send :extend, Lockdown::Frameworks::Merb::System
+        end
+      end # class block
+
+
+      module Environment
+        def project_root
+          ::Merb.root
+        end
+
+        def controller_parent
+          ::Merb::Controller 
+        end
+
+        def view_helper
+          ::Merb::AssetsMixin
+        end
+
+        def controller_class_name(str)
+          if str.include?("__")
+            str.split("__").collect{|p| Lockdown.camelize(p)}.join("::")
+          else
+            Lockdown.camelize(str)
+          end
+        end
+      end
+
+      module System
+        include Lockdown::Frameworks::Merb::Controller
+
+        def load_controller_classes
+          @controller_classes = {}
+         
+          maybe_load_framework_controller_parent
+        
+          Dir.chdir("#{Lockdown.project_root}/app/controllers") do
+            Dir["**/*.rb"].sort.each do |c|
+              next if c == "application.rb"
+              lockdown_load(c) 
+            end
+          end
+        end
+ 
+        def maybe_load_framework_controller_parent
+          load("application.rb") unless const_defined?("Application")
+        end
+
+        def lockdown_load(file)
+          klass = Lockdown.class_name_from_file(file)
+          @controller_classes[klass] = Lockdown.qualified_const_get(klass) 
+        end
+      end # System
+    end # Merb
+  end # Frameworks
+end # Lockdown

data/lib/lockdown/frameworks/rails/controller.rb

@@ -0,0 +1,110 @@
+module Lockdown
+  module Frameworks
+    module Rails
+      module Controller
+        
+        def available_actions(klass)
+          klass.public_instance_methods - klass.hidden_actions
+        end
+
+        def controller_name(klass)
+          klass.controller_name
+        end
+
+        # Locking methods
+        module Lock
+          def self.included(base)
+            base.send :include, Lockdown::Frameworks::Rails::Controller::Lock::InstanceMethods
+
+            base.before_filter do |c|
+              c.set_current_user
+              c.configure_lockdown
+              c.check_request_authorization
+            end
+
+            base.send :helper_method, :authorized?
+
+            base.filter_parameter_logging :password, :password_confirmation
+      
+            base.rescue_from SecurityError, :with => proc{|e| access_denied(e)}
+          end
+
+          module InstanceMethods
+            def self.included(base)
+              base.send :include, Lockdown::Controller::Core
+            end
+
+            def sent_from_uri
+              request.request_uri
+            end
+        
+            def authorized?(url)
+              return false unless url
+              return true if current_user_is_admin?
+
+              url_parts = URI::split(url.strip)
+              # remove id from path, e.g.: /users/1/edit to  users/edit
+              path = url_parts[5].split("/").collect do |p|
+                p unless p =~ /\A\d+\z/ || p.strip.length == 0
+              end.compact.join("/")
+
+              ## See if path is known
+              return true if path_allowed?(path)
+
+              # Test for a named routed
+              begin
+                hsh = ActionController::Routing::Routes.recognize_path(path)
+                unless hsh.nil? || hsh[:id]
+                  return true if path_allowed?(path_from_hash(hsh)) 
+                end
+              rescue Exception 
+                # continue on
+              end
+
+              # Passing in different domain
+              return true if remote_url?(url_parts[2])
+              false
+            end
+      
+            def access_denied(e)
+
+              RAILS_DEFAULT_LOGGER.info "Access denied: #{e}"
+
+              if Lockdown::System.fetch(:logout_on_access_violation)
+                reset_session
+              end
+              respond_to do |format|
+                format.html do
+                  store_location
+                  redirect_to Lockdown::System.fetch(:access_denied_path)
+                  return
+                end
+                format.xml do
+                  headers["Status"] = "Unauthorized"
+                  headers["WWW-Authenticate"] = %(Basic realm="Web Password")
+                  render :text => e.message, :status => "401 Unauthorized"
+                  return
+                end
+              end
+            end
+
+            def path_from_hash(hsh)
+              hsh[:controller].to_s + "/" + hsh[:action].to_s
+            end
+
+            def remote_url?(domain = nil)
+              return false if domain.nil? || domain.strip.length == 0
+              request.host.downcase != domain.downcase
+            end
+
+            def redirect_back_or_default(default)
+              session[:prevpage] ? redirect_to(session[:prevpage]) : redirect_to(default)
+            end
+
+          end # InstanceMethods
+        end # Lock
+      end # Controller
+    end # Rails
+  end # Frameworks
+end # Lockdown
+

data/lib/lockdown/frameworks/rails/view.rb

@@ -0,0 +1,54 @@
+module Lockdown
+  module Frameworks
+    module Rails
+      module View
+        def self.included(base)
+          base.send :alias_method, :link_to_open,  :link_to
+          base.send :alias_method, :link_to,  :link_to_secured
+
+          base.send :alias_method, :button_to_open,  :button_to
+          base.send :alias_method, :button_to,  :button_to_secured
+        end
+    
+        def link_to_secured(name, options = {}, html_options = nil)
+          # Don't want to go through the url_for twice
+          url = url_for(options)
+          if authorized? test_path(url, html_options)
+            return link_to_open(name, url, html_options)
+          end
+          return ""
+        end
+
+        def link_to_or_show(name, options = {}, html_options = nil)
+          lnk = link_to(name, options, html_options)
+          lnk.length == 0 ? name : lnk
+        end
+    
+        def button_to_secured(name, options = {}, html_options = nil)
+          url = url_for(options)
+          if authorized? test_path(url, html_options)
+            return button_to_open(name, url, html_options)
+          end
+          return ""
+        end
+
+        def links(*lis)
+          rvalue = []
+          lis.each{|link| rvalue << link if link.length > 0 }
+          rvalue.join(" | ")
+        end
+    
+        private
+      
+        def test_path(url, html_options)
+          if html_options.is_a?(Hash) && html_options[:method] == :delete
+            url += "/destroy"
+          elsif url.split("/").last =~ /\A\d+\z/
+            url += "/show"
+          end
+          url 
+        end
+      end # View
+    end # Rails
+  end # Frameworks
+end # Lockdown

data/lib/lockdown/frameworks/rails.rb

@@ -0,0 +1,93 @@
+require File.join(File.dirname(__FILE__), "rails", "controller")
+require File.join(File.dirname(__FILE__), "rails", "view")
+
+module Lockdown
+  module Frameworks
+    module Rails
+      class << self
+        def use_me?
+          Object.const_defined?("ActionController") && ActionController.const_defined?("Base")
+        end
+
+        def included(mod)
+          mod.extend Lockdown::Frameworks::Rails::Environment
+          mixin
+        end
+
+        def mixin
+          Lockdown.controller_parent.send :include, Lockdown::Frameworks::Rails::Controller::Lock
+          Lockdown.view_helper.send :include, Lockdown::Frameworks::Rails::View
+          Lockdown::System.send :extend, Lockdown::Frameworks::Rails::System
+        end
+      end # class block
+
+      module Environment
+
+        def project_root
+          RAILS_ROOT
+        end
+
+        def controller_parent
+          ActionController::Base
+        end
+
+        def view_helper
+          ActionView::Base 
+        end
+
+        def controller_class_name(str)
+          str = "#{str}Controller"
+          if str.include?("__")
+            str.split("__").collect{|p| Lockdown.camelize(p)}.join("::")
+          else
+            Lockdown.camelize(str)
+          end
+        end
+      end
+
+      module System
+        include Lockdown::Frameworks::Rails::Controller
+
+        def load_controller_classes
+          @controller_classes = {}
+         
+          maybe_load_framework_controller_parent
+
+          Dir.chdir("#{Lockdown.project_root}/app/controllers") do
+            Dir["**/*.rb"].sort.each do |c|
+              next if c == "application.rb"
+              lockdown_load(c) 
+            end
+          end
+
+          if ENV['RAILS_ENV'] != 'production'
+            if ActiveSupport.const_defined?("Dependencies")
+              ActiveSupport::Dependencies.clear
+            else
+              Dependencies.clear
+            end
+          end
+        end
+
+        def maybe_load_framework_controller_parent
+          if ActiveSupport.const_defined?("Dependencies")
+            ActiveSupport::Dependencies.require_or_load("application.rb")
+          else
+            Dependencies.require_or_load("application.rb")
+          end
+        end
+
+        def lockdown_load(file)
+          klass = Lockdown.class_name_from_file(file)
+          if ActiveSupport.const_defined?("Dependencies")
+            ActiveSupport::Dependencies.require_or_load(file)
+          else
+            Dependencies.require_or_load(file)
+          end
+          @controller_classes[klass] = Lockdown.qualified_const_get(klass) 
+        end
+
+      end # System
+    end # Rails
+  end # Frameworks
+end # Lockdown

data/lib/lockdown/helper.rb

@@ -1,11 +1,11 @@
 module Lockdown
   module Helper
-    #
-    # If str_sym is a Symbol (:users), give me back "Users"
-    # If str_sym is a String ("Users"), give me back :users
-    #
-    # Was :to_title_sym for String and :to_title_str for Symbol
-    #
+    def class_name_from_file(str)
+      str.split(".")[0].split("/").collect{|s| camelize(s) }.join("::")
+    end
+
+    # If str_sym is a Symbol (:users), return "Users"
+    # If str_sym is a String ("Users"), return :users
     def convert_reference_name(str_sym)
       if str_sym.is_a?(Symbol)
         titleize(str_sym)
@@ -14,7 +14,7 @@ module Lockdown
       end
     end
 
-    def lockdown_string(value)
+    def get_string(value)
       if value.respond_to?(:name)
         string_name(value.name)
       else
@@ -22,7 +22,7 @@ module Lockdown
       end
     end
 
-    def lockdown_symbol(value)
+    def get_symbol(value)
       if value.respond_to?(:name)
         symbol_name(value.name)
       elsif value.is_a?(String)
@@ -42,12 +42,30 @@ module Lockdown
     end
 
     def administrator_group_string
-      string_name(:administrators)
+      string_name(administrator_group_symbol)
     end
 
     def administrator_group_symbol
       :administrators
     end
+
+    def qualified_const_defined?(klass)
+      if klass =~ /::/
+        namespace, klass = klass.split("::")
+        eval("#{namespace}.const_defined?(#{klass})") if const_defined?(namespace)
+      else
+        const_defined?(klass)
+      end
+    end
+
+    def qualified_const_get(klass)
+      if klass =~ /::/
+        namespace, klass = klass.split("::")
+        eval(namespace).const_get(klass)
+      else
+        const_get(klass)
+      end
+    end
     
     private
 
@@ -73,16 +91,5 @@ module Lockdown
         gsub(/([a-z\d])([A-Z])/,'\1_\2').
         tr("-", "_").downcase
     end
-
-    if Lockdown.rails_app?
-      def controller_class_name(str)
-        "#{str}Controller"
-      end
-    else
-      def controller_class_name(str)
-        str
-      end
-    end
   end
-
 end

data/lib/lockdown/orms/active_record.rb

@@ -0,0 +1,66 @@
+module Lockdown
+  module Orms
+    module ActiveRecord
+      class << self
+        def use_me?
+          Object.const_defined?("ActiveRecord") && ::ActiveRecord.const_defined?("Base")
+        end
+
+        def included(mod)
+          mod.extend Lockdown::Orms::ActiveRecord::Helper
+          mixin
+        end
+
+        def mixin
+          Lockdown.orm_parent.send :include, Lockdown::Orms::ActiveRecord::Stamps
+        end
+      end # class block
+
+      module Helper
+        def orm_parent
+          ::ActiveRecord::Base
+        end
+
+        def database_execute(query)
+          orm_parent.connection.execute(query)
+        end
+
+        def database_query(query)
+          orm_parent.connection.execute(query)
+        end
+
+        def database_table_exists?(klass)
+          klass.table_exists?
+        end
+      end
+
+      module Stamps
+        def self.included(base)
+          base.class_eval do
+            alias_method :create_without_stamps,  :create
+            alias_method :create,  :create_with_stamps
+            alias_method :update_without_stamps,  :update
+            alias_method :update,  :update_with_stamps
+          end
+        end
+
+        def current_profile_id
+          Thread.current[:profile_id]
+        end
+
+        def create_with_stamps
+          profile_id = current_profile_id || Profile::SYSTEM
+          self[:created_by] = profile_id if self.respond_to?(:created_by) 
+          self[:updated_by] = profile_id if self.respond_to?(:updated_by) 
+          create_without_stamps
+        end
+                  
+        def update_with_stamps
+          profile_id = current_profile_id || Profile::SYSTEM
+          self[:updated_by] = profile_id if self.respond_to?(:updated_by)
+          update_without_stamps
+        end
+      end
+    end
+  end
+end