moat 0.0.8 → 0.1

data/Rakefile

@@ -1,10 +1,3 @@
-# -*- ruby -*-
-
-require 'rubygems'
-require 'hoe'
-
-Hoe.spec 'moat' do
-  developer('Bryan Woods', 'bryanwoods4e@gmail.com')
-end
-
-# vim: syntax=ruby
+require "rspec/core/rake_task"
+RSpec::Core::RakeTask.new(:spec)
+task default: :spec

data/lib/moat.rb

@@ -1,41 +1,117 @@
 module Moat
-  FILENAME = "#{ENV['HOME']}/.moatfile"
-  SITES = {}
+  POLICY_CLASS_SUFFIX = "Policy".freeze
 
-  def set(credentials)
-    SITES[credentials[:site]] = {
-      :username => credentials[:username],
-      :password => credentials[:password]
-    }
+  class Error < StandardError; end
+  class PolicyNotAppliedError < Error; end
+  class NotFoundError < Error; end
+  class ActionNotFoundError < NotFoundError
+    attr_reader :action, :resource, :policy, :user
+
+    def initialize(options = {})
+      return super if options.is_a?(String)
+      @action = options[:action]
+      @resource = options[:resource]
+      @policy = options[:policy]
+      @user = options[:user]
+
+      message = options.fetch(:message) { "#{policy.name}##{action}" }
+      super(message)
+    end
+  end
+
+  class PolicyNotFoundError < NotFoundError; end
+  class NotAuthorizedError < Error
+    attr_reader :action, :resource, :policy, :user
+
+    def initialize(options = {})
+      return super if options.is_a?(String)
+      @action = options[:action]
+      @resource = options[:resource]
+      @policy = options[:policy]
+      @user = options[:user]
+
+      message = options.fetch(:message) { "unauthorized #{policy.name}##{action} for #{resource}" }
+      super(message)
+    end
+  end
+
+  def policy_filter(scope, action = action_name, user: moat_user, policy: find_policy(scope))
+    apply_policy(scope, action, user: user, policy: policy::Filter)
+  end
+
+  def authorize(resource, action = "#{action_name}?", user: moat_user, policy: find_policy(resource))
+    if apply_policy(resource, action, user: user, policy: policy::Authorization)
+      resource
+    else
+      fail NotAuthorizedError, action: action, resource: resource, policy: policy, user: user
+    end
   end
 
-  def username(site)
-    SITES[site][:username]
+  def moat_user
+    current_user
   end
 
-  def password(site)
-    SITES[site][:password]
+  def verify_policy_applied
+    fail PolicyNotAppliedError unless @_moat_policy_applied
   end
 
-  def save_passwords
-    File.open(FILENAME, "w") {|file| file.puts SITES.to_yaml }
+  def skip_verify_policy_applied
+    @_moat_policy_applied = true
   end
 
-  def load_passwords
-    if File.exists?(FILENAME)
-      SITES.merge!(YAML::load(File.open(FILENAME)))
+  private
+
+  alias policy_applied skip_verify_policy_applied
+
+  def apply_policy(scope_or_resource, action, user:, policy:)
+    policy_instance = policy.new(user, scope_or_resource)
+    fail(ActionNotFoundError, action: action, policy: policy) unless policy_instance.respond_to?(action)
+
+    policy_applied
+    policy_instance.public_send(action)
+  end
+
+  def find_policy(object)
+    policy = if object.nil?
+      nil
+    elsif object.respond_to?(:policy_class)
+      object.policy_class
+    elsif object.class.respond_to?(:policy_class)
+      object.class.policy_class
     else
-      {}
+      infer_policy(object)
+    end
+
+    policy || fail(PolicyNotFoundError)
+  end
+
+  # Infer the policy from the object's type. If it is not found from the
+  # object's class directly, go up the ancestor chain.
+  def infer_policy(object)
+    initial_policy_inference_class = policy_inference_class(object)
+    policy_inference_class = initial_policy_inference_class
+    while policy_inference_class
+      policy = load_policy_from_class(policy_inference_class)
+      return policy if policy
+      policy_inference_class = policy_inference_class.superclass
     end
+
+    fail PolicyNotFoundError, initial_policy_inference_class.name
   end
 
-  def generate(length = 9)
-    lowercase_letters = ('a'..'z').to_a
-    uppercase_letters = ('A'..'Z').to_a
-    numbers = ('0'..'9').to_a
-    alphanumeric_array = lowercase_letters + uppercase_letters + numbers
-    alphanumeric_array.shuffle[0..length].join
+  def load_policy_from_class(klass)
+    Object.const_get("#{policy_inference_class(klass).name}#{POLICY_CLASS_SUFFIX}")
+  rescue NameError
+    nil
   end
 
+  def policy_inference_class(object)
+    if object.respond_to?(:model) # For ActiveRecord::Relation
+      object.model
+    elsif object.is_a?(Class)
+      object
+    else
+      object.class
+    end
+  end
 end
-

data/lib/moat/rspec.rb

@@ -0,0 +1,202 @@
+module Moat
+  module RSpec
+    module PolicyMatchers
+      extend ::RSpec::Matchers::DSL
+
+      matcher :permit_all_authorizations do
+        match do |policy_class|
+          @incorrectly_denied = policy_authorizations - permitted_authorizations(policy_class)
+          @incorrectly_denied.empty?
+        end
+        failure_message do
+          generate_failure_message(incorrectly_denied: @incorrectly_denied)
+        end
+
+        match_when_negated do
+          false
+        end
+        failure_message_when_negated do
+          "Cannot negate `permit_all_authorizations`: Use `only_permit_authorizations` instead"
+        end
+      end
+
+      matcher :deny_all_authorizations do
+        match do |policy_class|
+          @incorrectly_permitted = permitted_authorizations(policy_class)
+          @incorrectly_permitted.empty?
+        end
+        failure_message do
+          generate_failure_message(incorrectly_permitted: @incorrectly_permitted)
+        end
+
+        match_when_negated do
+          false
+        end
+        failure_message_when_negated do
+          "Cannot negate `deny_all_authorizations`: Use `only_permit_authorizations` instead"
+        end
+      end
+
+      matcher :only_permit_authorizations do |*authorizations_to_permit|
+        match do |policy_class|
+          permitted_authorizations = permitted_authorizations(policy_class)
+          @incorrectly_permitted = permitted_authorizations - authorizations_to_permit
+          @incorrectly_denied = authorizations_to_permit - permitted_authorizations
+          @incorrectly_permitted.empty? && @incorrectly_denied.empty?
+        end
+        failure_message do
+          generate_failure_message(
+            incorrectly_permitted: @incorrectly_permitted,
+            incorrectly_denied: @incorrectly_denied
+          )
+        end
+
+        match_when_negated do
+          false
+        end
+        failure_message_when_negated do
+          "Cannot negate `only_permit_authorizations`: Specify all permitted authorizations instead"
+        end
+      end
+
+      matcher :permit_through_all_filters do
+        match do |policy_class|
+          @incorrectly_denied = policy_filters - permitted_through_filters(policy_class)
+          @incorrectly_denied.empty?
+        end
+        failure_message do
+          generate_failure_message(incorrectly_denied: @incorrectly_denied)
+        end
+
+        match_when_negated do
+          false
+        end
+        failure_message_when_negated do
+          "Cannot negate `permit_through_all_filters`: Use `only_permit_through_filters` instead"
+        end
+      end
+
+      matcher :deny_through_all_filters do
+        match do |policy_class|
+          @incorrectly_permitted = permitted_through_filters(policy_class)
+          @incorrectly_permitted.empty?
+        end
+        failure_message do
+          generate_failure_message(incorrectly_permitted: @incorrectly_permitted)
+        end
+
+        match_when_negated do
+          false
+        end
+        failure_message_when_negated do
+          "Cannot negate `deny_through_all_filters`: Use `only_permit_through_filters` instead"
+        end
+      end
+
+      matcher :only_permit_through_filters do |*filter_whitelist|
+        match do |policy_class|
+          permitted_through_filters = permitted_through_filters(policy_class)
+          @incorrectly_permitted = permitted_through_filters - filter_whitelist
+          @incorrectly_denied = filter_whitelist - permitted_through_filters
+          @incorrectly_permitted.empty? && @incorrectly_denied.empty?
+        end
+        failure_message do
+          generate_failure_message(
+            incorrectly_denied: @incorrectly_denied,
+            incorrectly_permitted: @incorrectly_permitted
+          )
+        end
+
+        match_when_negated do
+          false
+        end
+        failure_message_when_negated do
+          "Cannot negate `only_permit_through_filters`: Specify permitted filters instead"
+        end
+      end
+
+      def generate_failure_message(incorrectly_permitted: [], incorrectly_denied: [])
+        failure_descriptions = []
+        unless incorrectly_permitted.empty?
+          failure_descriptions << "Incorrectly permitted to #{role}: #{incorrectly_permitted.to_sentence}"
+        end
+        unless incorrectly_denied.empty?
+          failure_descriptions << "Incorrectly denied to #{role}: #{incorrectly_denied.to_sentence}"
+        end
+        failure_descriptions.join("\n")
+      end
+
+      def role
+        ::RSpec.current_example.metadata.fetch(:role)
+      end
+
+      def permitted_authorizations(policy_class)
+        policy_instance = policy_class::Authorization.new(public_send(role), policy_example_resource)
+        policy_authorizations.select do |authorization|
+          policy_instance.public_send(authorization)
+        end
+      end
+
+      def permitted_through_filters(policy_class)
+        policy_instance = policy_class::Filter.new(public_send(role), policy_example_resource.class.all)
+        policy_filters.select do |filter|
+          policy_instance.public_send(filter).include?(policy_example_resource)
+        end
+      end
+    end
+
+    module PolicyExampleGroup
+      include Moat::RSpec::PolicyMatchers
+
+      def self.included(base_class)
+        base_class.metadata[:type] = :policy
+
+        class << base_class
+          def roles(*roles, &block)
+            roles.each do |role|
+              describe(role.to_s, role: role, caller: caller) { instance_eval(&block) }
+            end
+          end
+          alias_method :role, :roles
+
+          def resource(&block)
+            fail ArgumentError, "#resource called without a block" if block.nil?
+            let(:policy_example_resource) { instance_eval(&block) }
+          end
+
+          def policy_filters(*filters)
+            let(:policy_filters) { filters }
+          end
+
+          def policy_authorizations(*authorizations)
+            let(:policy_authorizations) { authorizations }
+          end
+        end
+
+        base_class.class_eval do
+          subject { described_class }
+
+          let(:policy_authorizations) do
+            fail NotImplementedError, "List of policy_authorizations undefined"
+          end
+
+          let(:policy_filters) do
+            fail NotImplementedError, "List of policy_filters undefined"
+          end
+
+          let(:policy_example_resource) do
+            fail NotImplementedError, "A resource has not been defined"
+          end
+        end
+      end
+    end
+  end
+end
+
+RSpec.configure do |config|
+  config.include(
+    Moat::RSpec::PolicyExampleGroup,
+    type: :policy,
+    file_path: %r{spec/policies}
+  )
+end

data/lib/moat/version.rb

@@ -0,0 +1,3 @@
+module Moat
+  VERSION = "0.1".freeze
+end

data/moat.gemspec

@@ -1,17 +1,20 @@
-require 'rubygems'
+require File.expand_path("lib/moat/version", __dir__)
 
-SPEC = Gem::Specification.new do |s|
-  s.name = "moat"
-  s.version = "0.0.8"
-  s.author = "Bryan Woods"
-  s.email = "bryanwoods4e@gmail.com"
-  s.platform = Gem::Platform::RUBY
-  s.description = "Brain-dead simple password storage. Improved."
-  s.summary = "Brain-dead simple password storage. Improved."
-  s.rubyforge_project = "moat"
-  s.homepage = "http://github.com/bryanwoods/moat"
-  s.files = Dir.glob("**/*")
-  s.executables << "moat"
-  s.require_path = "lib"
-  s.has_rdoc = false
+Gem::Specification.new do |gem|
+  gem.name               = "moat"
+  gem.version            = Moat::VERSION
+  gem.license            = "MIT"
+  gem.authors            = ["Poll Everywhere"]
+  gem.email              = ["geeks@polleverywhere.com"]
+  gem.homepage           = "https://github.com/polleverywhere/moat"
+  gem.summary            = "A small authorization library"
+  gem.description        = "Moat is an small authorization library built for Ruby (primarily Rails) web applications"
+  gem.files              = `git ls-files`.split("\n")
+  gem.test_files         = `git ls-files -- spec/*`.split("\n")
+  gem.require_paths      = ["lib"]
+  gem.extra_rdoc_files   = ["README.md"]
+  gem.rdoc_options       = ["--main", "README.md"]
+
+  gem.add_development_dependency("rspec", "~> 3.5")
+  gem.add_development_dependency("rubocop", "~> 0.57.2")
 end

data/spec/moat_spec.rb

@@ -0,0 +1,296 @@
+# require "spec_helper"
+require_relative "../lib/moat"
+
+# Will typically be a Rails controller
+class MoatConsumerClass
+  include Moat
+
+  def current_user
+    @current_user ||= Object.new
+  end
+
+  def action_name
+    :read
+  end
+end
+
+class IntegerPolicy
+  class Filter
+    attr_reader :user, :scope
+
+    def initialize(user, scope)
+      @user = user
+      @scope = scope
+    end
+
+    def read
+      if user == "specified user"
+        scope
+      else
+        scope.select(&:even?)
+      end
+    end
+
+    def show
+      scope.select(&:odd?)
+    end
+  end
+
+  class Authorization
+    attr_reader :resource, :user
+
+    def initialize(user, resource)
+      @user = user
+      @resource = resource
+    end
+
+    def read?
+      resource.even? || user == "specified user"
+    end
+
+    def show?
+      resource.odd?
+    end
+  end
+end
+
+class OtherIntegerPolicy
+  class Filter
+    attr_reader :user, :scope
+
+    def initialize(user, scope)
+      @user = user
+      @scope = scope
+    end
+
+    def read
+      scope.select(&:odd?)
+    end
+
+    def show
+      scope.select(&:even?)
+    end
+  end
+
+  class Authorization
+    attr_reader :user, :resource
+
+    def initialize(user, resource)
+      @user = user
+      @resource = resource
+    end
+
+    def read?
+      resource.odd?
+    end
+
+    def show?
+      resource.even?
+    end
+  end
+end
+
+describe Moat do
+  let(:moat_consumer) { MoatConsumerClass.new }
+
+  describe "#moat_user" do
+    it "returns the value of #current_user" do
+      expect(moat_consumer.moat_user).to eql(moat_consumer.current_user)
+    end
+  end
+
+  describe "#policy_filter" do
+    it "fails if scope is nil" do
+      expect { moat_consumer.policy_filter(nil) }.
+        to raise_error(Moat::PolicyNotFoundError)
+    end
+
+    it "fails if a corresponding policy can't be found" do
+      expect { moat_consumer.policy_filter(Hash) }.
+        to raise_error(Moat::PolicyNotFoundError, "Hash")
+      expect { moat_consumer.policy_filter({}) }.
+        to raise_error(Moat::PolicyNotFoundError, "Hash")
+    end
+
+    it "fails if a corresponding action can't be found" do
+      expect { moat_consumer.policy_filter([1, 2, 3], :invalid_action, policy: IntegerPolicy) }.
+        to raise_error(Moat::ActionNotFoundError, "IntegerPolicy::Filter#invalid_action")
+    end
+
+    it "returns the value of applying a policy scope filter to the original scope" do
+      expect(moat_consumer.policy_filter([1, 2, 3, 4, 5], policy: IntegerPolicy)).to eql([2, 4])
+    end
+
+    it "uses specified action" do
+      expect(moat_consumer.policy_filter([2, 3], :show, policy: IntegerPolicy)).to eql([3])
+    end
+
+    it "uses specified policy" do
+      expect(moat_consumer.policy_filter([2, 3], policy: OtherIntegerPolicy)).
+        to eql([3])
+    end
+
+    it "uses specified user" do
+      expect(moat_consumer.policy_filter([2, 3], user: "specified user", policy: IntegerPolicy)).to eql([2, 3])
+    end
+  end
+
+  describe "#authorize" do
+    it "fails if resource is nil" do
+      expect { moat_consumer.authorize(nil) }.
+        to raise_error(Moat::PolicyNotFoundError)
+    end
+
+    it "fails if a corresponding policy can't be found" do
+      expect { moat_consumer.authorize(Hash) }.
+        to raise_error(Moat::PolicyNotFoundError, "Hash")
+      expect { moat_consumer.authorize({}) }.
+        to raise_error(Moat::PolicyNotFoundError, "Hash")
+    end
+
+    it "fails if a corresponding action can't be found" do
+      expect { moat_consumer.authorize([1, 2, 3], :invalid_action?, policy: IntegerPolicy) }.
+        to raise_error(Moat::ActionNotFoundError, "IntegerPolicy::Authorization#invalid_action?")
+    end
+
+    it "fails when the value of calling the policy method is false" do
+      expect { moat_consumer.authorize(3) }.
+        to raise_error(Moat::NotAuthorizedError, "unauthorized IntegerPolicy#read? for 3")
+    end
+
+    it "returns the initial resource value when the value of calling the policy method is true" do
+      expect(moat_consumer.authorize(4)).to eql(4)
+    end
+
+    it "uses specified action" do
+      expect(moat_consumer.authorize(3, :show?)).to eql(3)
+    end
+
+    it "uses specified policy" do
+      expect(moat_consumer.authorize(3, policy: OtherIntegerPolicy)).to eql(3)
+    end
+
+    it "uses specified user" do
+      expect(moat_consumer.authorize(3, user: "specified user")).to eql(3)
+    end
+  end
+
+  describe "#verify_policy_applied" do
+    context "authorize called" do
+      it "does not raise an exception" do
+        moat_consumer.authorize(4)
+        expect { moat_consumer.verify_policy_applied }.not_to raise_error
+      end
+    end
+    context "policy_filter called" do
+      it "does not raise an exception" do
+        moat_consumer.policy_filter([1, 2], policy: IntegerPolicy)
+        expect { moat_consumer.verify_policy_applied }.not_to raise_error
+      end
+    end
+    context "neither authorize nor policy_filter called" do
+      it "raises an exception" do
+        expect { moat_consumer.verify_policy_applied }.
+          to raise_error(Moat::PolicyNotAppliedError)
+      end
+    end
+  end
+
+  describe "#skip_verify_policy_applied" do
+    it "does not raise an exception when the policy was not applied" do
+      moat_consumer.skip_verify_policy_applied
+      expect { moat_consumer.verify_policy_applied }.not_to raise_error
+    end
+  end
+
+  describe "policy lookup" do
+    class FakePolicy
+      class Filter
+        attr_reader :scope
+
+        def initialize(_user, scope)
+          @scope = scope
+        end
+
+        def read
+          scope.to_a
+        end
+      end
+    end
+
+    it "allows an object to specify a policy class" do
+      class DefinesPolicyClass
+        def self.to_a
+          [1, 2]
+        end
+
+        def self.policy_class
+          FakePolicy
+        end
+      end
+
+      expect(moat_consumer.policy_filter(DefinesPolicyClass)).to eql([1, 2])
+    end
+
+    it "allows an object's class to specify a policy class" do
+      class DefinesPolicyClass
+        def self.policy_class
+          FakePolicy
+        end
+
+        def to_a
+          [3, 4]
+        end
+      end
+
+      expect(moat_consumer.policy_filter(DefinesPolicyClass.new)).to eql([3, 4])
+    end
+
+    it "infers a policy if object is a class" do
+      class Fake
+        def self.to_a
+          [5, 6]
+        end
+      end
+
+      expect(moat_consumer.policy_filter(Fake)).to eql([5, 6])
+    end
+
+    it "infers a policy from an object's ancestor" do
+      class Fake
+        def self.to_a
+          [7, 8]
+        end
+      end
+      class FakeChild < Fake
+      end
+
+      expect(moat_consumer.policy_filter(FakeChild)).to eql([7, 8])
+    end
+
+    it "infers a policy from an object's class's ancestor" do
+      class Fake
+      end
+      class FakeChild < Fake
+        def to_a
+          [9, 10]
+        end
+      end
+
+      expect(moat_consumer.policy_filter(FakeChild.new)).to eql([9, 10])
+    end
+
+    it "infers a policy from an object's `model` method" do
+      class DefinesModelName
+        def self.model
+          Fake
+        end
+
+        def self.to_a
+          [11, 12]
+        end
+      end
+      expect(moat_consumer.policy_filter(DefinesModelName)).to eql([11, 12])
+    end
+  end
+end