mdarby-restful_acl 1.1.0 → 1.2

data/lib/restful_acl.rb

@@ -16,14 +16,14 @@ module RestfulAcl
 
         # Load the object requested if the param[:id] exists
         object = klass.find(params[:id]) unless params[:id].blank?
-        
+            
         # Let's let the Model decide what is acceptable
         permission_denied unless case params[:action] 
           when "index"          then klass.is_readable_by(current_user)
           when "show"           then klass.is_readable_by(current_user, object)
           when "edit", "update" then object.is_updatable_by(current_user)
-          when "new", "create"  then klass.is_creatable_by(current_user)
           when "destroy"        then object.is_deletable_by(current_user)
+          when "new", "create"  then creatable_action(klass)            
           else klass.is_readable_by(current_user)
         end
       
@@ -36,6 +36,48 @@ module RestfulAcl
 
     private
 
+    def creatable_action(klass)
+      begin
+        parent_object = get_parent_resource(klass, request.request_uri)
+        klass.is_creatable_by(current_user, parent_object)
+      rescue
+        issue_is_creatable_by_deprecation_warning(klass)
+      end
+    end
+
+    def issue_is_creatable_by_deprecation_warning(klass)
+      logger.info <<-END
+        [RESTful_ACL] -- *Deprecation Warning!*"
+        RESTful_ACL's #is_creatable_by method now requires an extra parameter.
+        Please update your model's #is_creatable_by method to the following format:
+
+        def self.is_creatable_by(user, parent_object = nil)
+          ...
+        end
+        
+        Offending class: #{klass}
+        
+        Please see the http://github.com/mdarby/restful_acl for further info
+        
+      END
+      
+      false
+    end
+
+    def get_parent_resource(target_klass, path)
+      # Convert the requested path into hash form
+      hash = ActionController::Routing::Routes.recognize_path(path, :method => :get)
+      
+      # Loop through path keys and see if any end in '_id' and our kid class belongs_to the associated AR Class
+      pair = hash.detect{|k, v| k.to_s.ends_with?("_id") && target_klass.columns_hash.has_key?(k.to_s)}
+      
+      # Load up the AR class based on the matching path pair
+      klass = pair[0].to_s[0...-3].classify.constantize
+      
+      # Find and return the target parent object
+      klass.find(pair[1])
+    end
+
     def permission_denied
       logger.info("[ACL] Permission denied to %s at %s for %s" %
       [(logged_in? ? current_user.login : 'guest'), Time.now, request.request_uri])

data/lib/restful_acl_helper.rb

@@ -1,9 +1,9 @@
 module RestfulAclHelper
 
-  def creatable
+  def creatable(parent_object = nil)
     return true if admin_enabled
     
-    klass.is_creatable_by(current_user)
+    klass.is_creatable_by(current_user, parent_object)
   end
   alias_method :createable, :creatable
   

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: mdarby-restful_acl
 version: !ruby/object:Gem::Version 
-  version: 1.1.0
+  version: "1.2"
 platform: ruby
 authors: 
 - Matt Darby
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2008-12-14 00:00:00 -08:00
+date: 2009-01-03 00:00:00 -08:00
 default_executable: 
 dependencies: []