mass_assignment 1.0.0

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2009 Lance Ivy
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.textile

@@ -0,0 +1,129 @@
+h2. MassAssignment
+
+Copyright (c) 2009 Lance Ivy, released under the MIT license
+
+From initial discussion at http://groups.google.com/group/rubyonrails-core/browse_thread/thread/3b6818496d0d07f1
+
+h3. What It Is
+
+A robust mass assignment method with a small and obvious syntax.
+
+The normal mass assignment protection comes from attr_protected and attr_accessible. There are a few problems with this approach:
+
+* Often never implemented, leaving a wide-open system. And once implemented, easy to forget when adding new attributes, leading to bugs (in an attr_accessible system) or security holes (in an attr_protected system).
+* Restricts coding syntax. You can't easily use update_attributes() or attributes= because your whitelist/blacklist gets in your own way.
+* Not contextual. The list of allowed attributes can't change to accomodate different user permissions or situations.
+
+This plugin's solution is to let you specify an obvious list of allowed attributes when you mass assign attributes.
+
+* The list of allowed attributes is in your controller at calltime, so it's easier to remember and update (it's not a hidden, magical system).
+* The list of allowed attributes is optional, so it doesn't get in your way.
+* Your controller can easily enforce permissions by evaluating the current user (Admin Controller) or the current situation (creates vs updates).
+
+And as a bonus, permission plugins have a much easier time of things. The list of allowed attributes may be pulled from a permissions table without any awkward User.current class or thread variables.
+
+For those who would still like attr_protected- and attr_accessible-like functionality, this plugin offers mass assignment policies. You may choose to a default mass assignment protection as open or closed as you like using familiar :only/:except syntax. But you may also specify regular expressions such as /_id$/ to reject all id fields by default, and since these policies inherit, you may set them globally on ActiveRecord::Base. See the examples below.
+
+h3. Example
+
+Let's take a very plausible situation where you would want three separate lists of allowed attributes. You have users that sign up to your application. But after they have signed up, they may not change their username. Admins, however, may manually change a username as needed.
+
+<pre><code>
+  class UsersController < ApplicationController
+    def create
+      @user = User.new
+      # during signup a user may pick a username
+      @user.assign(params[:user], [:username, :email, :password, :password_confirmation])
+      @user.save!
+      ...
+    end
+
+    def update
+      @user = User.find(params[:id])
+      # username is no longer accepted later
+      @user.assign(params[:user], [:email, :password, :password_confirmation])
+      @user.save!
+      ...
+    end
+  end
+
+  class Admin::UsersController < ApplicationController
+    before_filter :admin_required
+
+    def update
+      @user = User.find(params[:id])
+      # admins, on the other hand, may change the username as needed, but may not set passwords
+      @user.assign(:params[:user], [:username, :email])
+      @user.save!
+      ...
+    end
+  end
+</code></pre>
+
+If you don't always want to set attribute lists, you may use the mass_assignment_policy API to configure defaults whitelists or blacklists.
+
+<pre><code>
+  class User < ActiveRecord::Base
+    # The boring usage. You may as well specify attributes at calltime.    
+    mass_assignment_policy :only => [:email, :username]
+    
+    # More interesting. No id fields!
+    mass_assignment_policy :except => /_id$/
+  end
+  
+  # Hardcore. Disables mass assignment globally unless overridden!
+  ActiveRecord::Base.mass_assignment_policy :except => :all
+</code></pre>
+
+Note that mass_assignment_policy only applies to usage of methods supplied in this plugin.
+
+h3. Nested Assignment
+
+Nested assignment is supported by passing hashes and arrays for the whitelist.
+
+<pre><code>
+  class Pirate < ActiveRecord::Base
+    accepts_nested_attributes_for :ships
+  end
+  
+  class PiratesController < ApplicationController
+    def update
+      @pirate = Pirate.find(params[:id])
+      @pirate.assign(params[:pirate], [:name, :eyepatch, {:ships_attributes => [:id, :_destroy, :name, :cannons, :capacity]}])
+      @pirate.save!
+      ...
+    end
+  end
+</code></pre>
+
+As you can see, the punctuation gets messy. I'm interested in better options.
+
+h3. Deep Assignment
+
+Sometimes nested assignment isn't completely appropriate but you still need to assign attributes to associated objects. Try the block syntax:
+
+<pre><code>
+  class ShipsController < ApplicationController
+    def update
+      @ship = Ship.find(params[:id])
+      @ship.assign(params[:ship], [:name, :cannons, :capacity]) do |ship_params|
+        @ship.pirate.assign(ship_params[:pirate], [:name, :eyepatch])
+      end
+    end
+  end
+</code></pre>
+
+The major benefit here is that the block won't yield unless the params exist, so you don't need to check 'if params[:ship] && params[:ship][:pirate]'.
+
+h3. Feedback
+
+I can think of a couple alternate implementations for this API. Consider:
+
+  @user.assign(params[:user], [:username, :email])
+
+vs
+
+  @user.assign(params[:user], :only => [:username, :email])
+  @user.assign(params[:user], :except => [:admin])
+  
+I personally prefer the former because I think that blacklists are inherently less safe than whitelists, with no compensating advantage. But I'd love to hear some other use cases and get feedback on this! Fork this repo and send pull requests or just contact me (github.com/cainlevy). Let's talk.

data/Rakefile

@@ -0,0 +1,23 @@
+require 'rake'
+require 'rake/testtask'
+require 'rake/rdoctask'
+
+desc 'Default: run unit tests.'
+task :default => :test
+
+desc 'Test the mass_assignment plugin.'
+Rake::TestTask.new(:test) do |t|
+  t.libs << 'lib'
+  t.libs << 'test'
+  t.pattern = 'test/**/*_test.rb'
+  t.verbose = true
+end
+
+desc 'Generate documentation for the mass_assignment plugin.'
+Rake::RDocTask.new(:rdoc) do |rdoc|
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title    = 'MassAssignment'
+  rdoc.options << '--line-numbers' << '--inline-source'
+  rdoc.rdoc_files.include('README')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/lib/mass_assignment.rb

@@ -0,0 +1,91 @@
+module MassAssignment
+  VERSION = '1.0.0'
+
+  def self.included(base)
+    base.class_eval do extend ClassMethods end
+  end
+
+  # Basic Example:
+  #
+  #   @user = User.new
+  #   @user.assign(params[:user], [:username, :email, :password, :password_confirmation])
+  #   @user.save!
+  #
+  # Nested Assignment:
+  #
+  #   @user = User.find_by_id(params[:id])
+  #   @user.assign(params[:user], [:username, :email, {:dog_attributes => [:id, :_destroy, :name, :color]}])
+  #   @user.save!
+  #
+  # Deep Assignment:
+  #
+  #   @user = User.find_by_id(params[:id])
+  #   @user.assign(params[:user], [:username, :email]) do |user_params|
+  #     @user.dog.assign(user_params[:dog], [:name, :color])
+  #   end
+  #   @user.save!
+  def assign(attributes, allowed_attributes = nil, &block)
+    return unless attributes and attributes.is_a? Hash
+  
+    if allowed_attributes
+      safe_attributes = filter_attributes(attributes, :only => allowed_attributes)
+      yield attributes if block_given?
+      self.send("attributes=", safe_attributes, false)
+    else
+      if policy = self.class.get_mass_assignment_policy
+        safe_attributes = filter_attributes(attributes, policy)
+        self.send("attributes=", safe_attributes, false)
+      else
+        # backwards compatibility. use attr_protected and attr_accessible.
+        self.attributes = attributes
+      end
+    end
+  end
+  
+  private
+
+  def filter_attributes(attributes, options = {}) # could surely be refactored.
+    attributes = attributes.stringify_keys
+  
+    if options[:only]
+      if options[:only].is_a? Regexp
+        attributes.reject { |k, v| !k.gsub(/\(.+/, "").match(options[:only]) }
+      elsif options[:only] == :all
+        attributes
+      else
+        whitelist = options[:only].map{|i| i.is_a?(Hash) ? i.keys.first.to_s : i.to_s}
+        options[:only].each do |i|
+          next unless i.is_a? Hash
+          name = i.keys.first.to_s
+          next unless attributes[name].is_a? Hash
+          attributes[name] = filter_attributes(attributes[name], :only => i.values.first)
+        end
+        attributes.reject { |k, v| !whitelist.include?(k.gsub(/\(.+/, "")) }
+      end
+    elsif options[:except]
+      if options[:except].is_a? Regexp
+        attributes.reject { |k, v| k.gsub(/\(.+/, "").match(options[:except]) }
+      elsif options[:except] == :all
+        {}
+      else
+        blacklist = options[:except].map(&:to_s)
+        attributes.reject { |k, v| blacklist.include?(k.gsub(/\(.+/, "")) }
+      end
+    else
+      attributes
+    end
+  end
+  
+  module ClassMethods
+    # sets a default mass assignment policy for your model's attributes. you may choose to start from a
+    # closed state that allows no mass assignment, an open state that allows any mass assignment (this is
+    # activerecord's default), or somewhere inbetween.
+    def mass_assignment_policy(val)
+      write_inheritable_attribute :mass_assignment_policy, val
+    end
+    
+    def get_mass_assignment_policy
+      read_inheritable_attribute :mass_assignment_policy
+    end
+  end
+end

data/rails/init.rb

@@ -0,0 +1 @@
+ActiveRecord::Base.class_eval do include MassAssignment end

data/test/mass_assignment_test.rb

@@ -0,0 +1,146 @@
+require File.dirname(__FILE__) + '/test_helper'
+
+class User < ActiveRecord::Base
+  class << self
+    def columns
+      @columns ||= [
+        ActiveRecord::ConnectionAdapters::Column.new("name", nil, "varchar(100)", true),
+        ActiveRecord::ConnectionAdapters::Column.new("email", nil, "varchar(100)", true),
+        ActiveRecord::ConnectionAdapters::Column.new("role_id", nil, "integer(11)", false)
+      ]
+    end
+  end
+  
+  def friend
+    @friend ||= User.new
+  end
+  
+  def friend_attributes=(attributes)
+    friend.attributes = attributes
+  end
+end
+
+class ProtectedUser < User
+  attr_protected :role_id
+end
+
+class ClosedUser < User
+  mass_assignment_policy :except => :all
+end
+
+class SemiClosedUser < User
+  mass_assignment_policy :except => /_id$/
+end
+
+class OpenUser < User
+  mass_assignment_policy :only => :all
+end
+
+class MassAssignmentTest < ActiveSupport::TestCase
+  def setup
+    @user = ProtectedUser.new
+    @attributes = {"name" => "Bob", "email" => "bob@example.com"}
+    ActiveRecord::Base.logger = stub('debug' => true)
+  end
+  
+  test "assigning nothing" do
+    params = {}
+    assert_nothing_raised do
+      @user.assign(params[:user])
+    end
+  end
+  
+  test "assigning a string" do
+    params = {:user => "well this is embarrassing"}
+    assert_nothing_raised do
+      @user.assign(params[:user])
+    end
+  end
+
+  test "assigning attributes" do
+    @user.assign(@attributes)
+    assert_equal "Bob", @user.name
+    assert_equal "bob@example.com", @user.email
+  end
+  
+  test "assigning protected attributes" do
+    @user.assign(@attributes.merge(:role_id => 1))
+    assert_equal "Bob", @user.name
+    assert_nil @user.role_id
+  end
+  
+  test "overriding protected attributes" do
+    @user.assign(@attributes.merge(:role_id => 1), [:name, :email, :role_id])
+    assert_equal "Bob", @user.name
+    assert_equal 1, @user.role_id
+  end
+  
+  test "assigning unallowed attributes" do
+    @user.assign(@attributes.merge(:role_id => 1), [:name, :email])
+    assert_equal "Bob", @user.name
+    assert_nil @user.role_id
+  end
+  
+  test "nested assignment" do
+    @user.assign(@attributes.merge(:friend_attributes => {:name => 'Joe', :role_id => 1}), [:name, :role_id, {:friend_attributes => [:name]}])
+    assert_equal "Joe", @user.friend.name
+    assert_nil @user.friend.role_id
+  end
+  
+  test "deep assignment" do
+    @user.assign(@attributes.merge(:friend => {:name => 'Joe', :role_id => 1}), [:name, :role_id]) do |params|
+      @user.friend.assign(params[:friend], [:name])
+    end
+    assert_equal "Joe", @user.friend.name
+    assert_nil @user.friend.role_id
+  end
+end
+
+class MassAssignmentPolicyTest < ActiveSupport::TestCase
+  def setup
+    @attributes = {"name" => "Bob", "role_id" => 1}
+    ActiveRecord::Base.logger = stub('debug' => true)
+  end
+  
+  test "an open policy" do
+    @user = OpenUser.new
+    @user.assign(@attributes)
+    assert_equal "Bob", @user.name
+    assert_equal 1, @user.role_id
+  end
+  
+  test "an overridden open policy" do
+    @user = OpenUser.new
+    @user.assign(@attributes, [:name])
+    assert_equal "Bob", @user.name
+    assert_nil @user.role_id
+  end
+  
+  test "a closed policy" do
+    @user = ClosedUser.new
+    @user.assign(@attributes)
+    assert_nil @user.name
+    assert_nil @user.role_id
+  end
+  
+  test "an overridden closed policy" do
+    @user = ClosedUser.new
+    @user.assign(@attributes, [:name, :role_id])
+    assert_equal "Bob", @user.name
+    assert_equal 1, @user.role_id
+  end
+  
+  test "a semi-closed policy" do
+    @user = SemiClosedUser.new
+    @user.assign(@attributes)
+    assert_equal "Bob", @user.name
+    assert_nil @user.role_id
+  end
+  
+  test "an overridden semi-closed policy" do
+    @user = SemiClosedUser.new
+    @user.assign(@attributes, [:name, :role_id])
+    assert_equal "Bob", @user.name
+    assert_equal 1, @user.role_id
+  end
+end

data/test/test_helper.rb

@@ -0,0 +1,12 @@
+require 'rubygems'
+require 'test/unit'
+gem 'rails', '3.0.6'
+require 'active_support'
+require 'active_support/test_case'
+require 'active_record'
+
+PLUGIN_ROOT = File.dirname(__FILE__) + '/../'
+ActiveSupport::Dependencies.autoload_paths << File.join(PLUGIN_ROOT, 'lib')
+require 'rails/init'
+
+require 'mocha'

metadata

@@ -0,0 +1,87 @@
+--- !ruby/object:Gem::Specification 
+name: mass_assignment
+version: !ruby/object:Gem::Version 
+  hash: 23
+  prerelease: false
+  segments: 
+  - 1
+  - 0
+  - 0
+  version: 1.0.0
+platform: ruby
+authors: 
+- Lance Ivy
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2011-04-13 00:00:00 -07:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: mocha
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  type: :development
+  version_requirements: *id001
+description: An alternative to attr_protected that supports a simpler, more secure params assignment mindset while also encouraging obviousness.
+email: lance@cainlevy.net
+executables: []
+
+extensions: []
+
+extra_rdoc_files: []
+
+files: 
+- lib/mass_assignment.rb
+- LICENSE
+- README.textile
+- Rakefile
+- rails/init.rb
+- test/test_helper.rb
+- test/mass_assignment_test.rb
+has_rdoc: true
+homepage: http://github.com/cainlevy/mass_assignment
+licenses: []
+
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.7
+signing_key: 
+specification_version: 3
+summary: Simple and secure params assignment for ActiveRecord
+test_files: 
+- test/test_helper.rb
+- test/mass_assignment_test.rb