mumukit-auth 7.10.0 → 7.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 517de6c84d1b25e0b31a83da4dbf8f0d5c234eb05c9c23476d2e721fa19b6049
-  data.tar.gz: 3e2ae789e5dff9857e63f298c126fffe69a815b63649fdf1b7346c18f583e29a
+  metadata.gz: 5a77054a911454b7372cadecd8bda02e894ff80bd24ee5d19eb4b9086fb17dcc
+  data.tar.gz: 69b57019319e45c0a2c49425fea3964d9e270c5452c61c3f20d374ee41077464
 SHA512:
-  metadata.gz: c28eac074b926567be11f09700623e3fdbd9eb1379ba22c794f87f3b06fd901fb5bb9cb436e56fbbb0985a55bb708651a9632003e4ea3849cb43408d61038717
-  data.tar.gz: 253cc4b87c062b9e97e4ba350fbcef2922c198c396cea345675b490532d7b1528ade0d257cc872cc663cf47cd374b9338a5c3a656b62daaea298bce5c7927892
+  metadata.gz: 36a9d0459ed2513e94851f01312aab4ed88e8abcf17707c2c9c7bb3a86a9be406e8b5d43ac6d7194d568118622bb2801125aba27996c4eff7b12dd6824c538f6
+  data.tar.gz: e16a35c4478a206125c1d489b24ea79c84e0ba5d0082057363deb0d653c44d09e1bf7cc6e86f31268fad9b76d66c3d240eaf1b6f5643121dd7930f4765963289

data/lib/mumukit/auth/permissions.rb

@@ -2,18 +2,15 @@ class Mumukit::Auth::Permissions
   include Mumukit::Auth::Roles
   include Mumukit::Auth::Protection
 
-  delegate :empty?, to: :scopes
-
   attr_accessor :scopes
 
   def initialize(scopes={})
-    raise 'invalid scopes' if scopes.any? { |key, value| value.class != Mumukit::Auth::Scope }
-
-    @scopes = scopes.with_indifferent_access
+    @scopes = {}.with_indifferent_access
+    add_scopes! scopes
   end
 
   def has_permission?(role, resource_slug)
-    Mumukit::Auth::Role.parse(role).allows?(resource_slug, self)
+    role.to_mumukit_role.allows?(resource_slug, self)
   end
 
   def role_allows?(role, resource_slug)
@@ -28,6 +25,21 @@ class Mumukit::Auth::Permissions
     self.scopes[role] ||= Mumukit::Auth::Scope.new
   end
 
+  def empty?
+    scopes.all? { |_, it| it.empty? }
+  end
+
+  def compact!
+    old_scopes = @scopes.dup
+    @scopes = {}.with_indifferent_access
+
+    old_scopes.each do |role, scope|
+      scope.grants.each do |grant|
+        push_and_compact! role, grant
+      end
+    end
+  end
+
   # Deprecated: use `student_granted_organizations` organizations instead
   def accessible_organizations
     warn "Don't use accessible_organizations, since this method is probably not doing what you would expect.\n" +
@@ -54,7 +66,13 @@ class Mumukit::Auth::Permissions
   end
 
   def add_permission!(role, *grants)
-    scope_for(role).add_grant! *grants
+    role = role.to_mumukit_role
+    grants.each { |grant| push_and_compact! role, grant }
+  end
+
+  def add_scopes!(scopes)
+    raise 'invalid scopes' if scopes.any? { |key, value| value.class != Mumukit::Auth::Scope }
+    scopes.each { |role, scope| add_permission! role, *scope.grants }
   end
 
   def merge(other)
@@ -146,4 +164,19 @@ class Mumukit::Auth::Permissions
     scope.grants.all? { |grant| has_permission? role, grant }
   end
 
+  def push_and_compact!(role, grant)
+    role = role.to_mumukit_role
+    grant = grant.to_mumukit_grant
+
+    scopes.each do |other_role, other_scope|
+      other_role = other_role.to_mumukit_role
+
+      if other_role.narrower_than?(role)
+        other_scope.remove_narrower_grants!(grant)
+      elsif other_role.broader_than?(role) && other_scope.has_broader_grant?(grant)
+        return
+      end
+    end
+    scope_for(role.to_sym).add_grant! grant
+  end
 end

data/lib/mumukit/auth/role.rb

@@ -1,3 +1,16 @@
+
+class String
+  def to_mumukit_role
+    Mumukit::Auth::Role.parse self
+  end
+end
+
+class Symbol
+  def to_mumukit_role
+    Mumukit::Auth::Role.parse self
+  end
+end
+
 module Mumukit::Auth
   class Role
     def initialize(symbol)
@@ -17,17 +30,36 @@ module Mumukit::Auth
       @symbol
     end
 
-    private
+    def broader_than?(other)
+      other.narrower_than? self
+    end
+
+    def narrower_than?(other)
+      other.class != self.class && _narrower_than_other?(other)
+    end
 
-    def self.parent(parent)
-      define_method(:parent) { self.class.parse(parent) }
+    def to_mumukit_role
+      self
     end
 
-    def self.parse(role)
-      @roles ||= {}
-      @roles[role] ||= "Mumukit::Auth::Role::#{role.to_s.camelize}".constantize.new(role.to_sym)
+    def _narrower_than_other?(other)
+      self.parent.class == other.class || self.parent._narrower_than_other?(other)
     end
 
+    class << self
+      def parent(parent)
+        define_method(:parent) { self.class.parse(parent) }
+      end
+
+      def parse(role)
+        @roles ||= {}
+        @roles[role.to_sym] ||= "Mumukit::Auth::Role::#{role.to_s.camelize}".constantize.new(role.to_sym)
+      end
+    end
+
+    class ExStudent < Role
+      parent :student
+    end
     class Student < Role
       parent :teacher
     end
@@ -61,6 +93,10 @@ module Mumukit::Auth
       def parent_allows?(*)
         false
       end
+
+      def _narrower_than_other?(*)
+        false
+      end
     end
   end
 end

data/lib/mumukit/auth/roles.rb

@@ -1,6 +1,6 @@
 module Mumukit::Auth
   module Roles
-    ROLES = [:student, :teacher, :headmaster, :writer, :editor, :janitor, :moderator, :forum_supervisor, :admin, :owner]
+    ROLES = [:ex_student, :student, :teacher, :headmaster, :writer, :editor, :janitor, :moderator, :forum_supervisor, :admin, :owner]
 
     ROLES.each do |role|
       define_method "#{role}?" do |scope = Mumukit::Auth::Slug.any|

data/lib/mumukit/auth/scope.rb

@@ -20,6 +20,10 @@ module Mumukit::Auth
       self.grants.delete(grant)
     end
 
+    def empty?
+      grants.empty?
+    end
+
     def merge(other)
       self.class.new grants + other.grants
     end
@@ -54,6 +58,14 @@ module Mumukit::Auth
       to_s
     end
 
+    def remove_narrower_grants!(grant)
+      grants.reject! { |it| grant.allows? it }
+    end
+
+    def has_broader_grant?(grant)
+      grants.any? { |it| it.allows? grant }
+    end
+
     private
 
     def any_grant?(&block)
@@ -66,13 +78,5 @@ module Mumukit::Auth
       remove_narrower_grants! grant
       grants << grant
     end
-
-    def remove_narrower_grants!(grant)
-      grants.reject! { |it| grant.allows? it }
-    end
-
-    def has_broader_grant?(grant)
-      grants.any? { |it| it.allows? grant }
-    end
   end
 end

data/lib/mumukit/auth/slug.rb

@@ -35,11 +35,11 @@ module Mumukit::Auth
     end
 
     def ==(o)
-      self.class == o.class && self.normalize.eql?(o.normalize)
+      o.is_a?(Mumukit::Auth::Slug) && self.normalize.eql?(o.normalize)
     end
 
     def eql?(o)
-      self.class == o.class && to_s == o.to_s
+      o.is_a?(Mumukit::Auth::Slug) && to_s == o.to_s
     end
 
     def hash
@@ -57,7 +57,15 @@ module Mumukit::Auth
     end
 
     def normalize
-      dup.normalize!
+      Normalized.new(first, second)
+    end
+
+    def normalized_s
+      normalize.to_s
+    end
+
+    def normalized?
+      normalize.eql? self
     end
 
     def inspect
@@ -99,7 +107,7 @@ module Mumukit::Auth
     end
 
     def self.normalize(first, second)
-      new(first, second).normalize!
+      Normalized.new(first, second)
     end
 
     private
@@ -117,11 +125,29 @@ module Mumukit::Auth
         raise Mumukit::Auth::InvalidSlugFormatError, "Invalid slug: #{slug}. It must be in first/second format"
       end
     end
+
+    class Normalized < Slug
+      alias_method :_normalize!, :normalize!
+
+      def initialize(*)
+        super
+        _normalize!
+      end
+
+      def normalize
+        self
+      end
+
+      def normalize!
+        self
+      end
+
+      def normalized?
+        true
+      end
+    end
   end
 
   class InvalidSlugFormatError < StandardError
   end
 end
-
-
-

data/lib/mumukit/auth/token.rb

@@ -2,7 +2,7 @@ module Mumukit::Auth
   class Token
     attr_reader :jwt, :client
 
-    def initialize(jwt, client)
+    def initialize(jwt = {}, client = Mumukit::Auth::Client.new)
       @jwt = jwt
       @client = client
     end
@@ -15,6 +15,22 @@ module Mumukit::Auth
       @uid ||= jwt['uid'] || jwt['email'] || jwt['sub']
     end
 
+    def organization
+      @organization ||= jwt['org']
+    end
+
+    def expiration
+      @expiration ||= Time.at jwt['exp']
+    end
+
+    def subject_id
+      @subject_id ||= jwt['sbid']
+    end
+
+    def subject_type
+      @subject_type ||= jwt['sbt']
+    end
+
     def verify_client!
       raise Mumukit::Auth::InvalidTokenError.new('aud mismatch') if client.id != jwt['aud']
     end
@@ -23,12 +39,13 @@ module Mumukit::Auth
       client.encode jwt
     end
 
-    def self.from_rack_env(env)
-      new(env.dig('omniauth.auth', 'extra', 'raw_info') || {})
+    def encode_header
+      'Bearer ' + encode
     end
 
     def self.encode(uid, metadata, client = Mumukit::Auth::Client.new)
-      new({aud: client.id, metadata: metadata, uid: uid}, client).encode
+      warn "Deprecated: please use build and then encode"
+      build(uid, client, metadata: metadata).encode
     end
 
     def self.decode(encoded, client = Mumukit::Auth::Client.new)
@@ -38,7 +55,8 @@ module Mumukit::Auth
     end
 
     def self.encode_header(uid, metadata)
-      'Bearer ' + encode(uid, metadata)
+      warn "Deprecated: please use build and then encode_header"
+      'Bearer ' + build(uid, metadata: metadata).encode_header
     end
 
     def self.decode_header(header, client = Mumukit::Auth::Client.new)
@@ -50,6 +68,30 @@ module Mumukit::Auth
       header.split(' ').last
     end
 
+    def self.build(uid, client = Mumukit::Auth::Client.new,
+                   expiration: nil, organization: nil,
+                   subject_id: nil, subject_type: nil,
+                   metadata: {})
+      new({
+          'uid' => uid,
+          'aud' => client.id,
+          'exp' => expiration&.to_i,
+          'org' => organization,
+          'metadata' => metadata,
+          'sbid' => subject_id,
+          'sbt' => subject_type
+        }.compact,
+        client)
+    end
+
+    def self.load(encoded)
+      if encoded.present?
+        decode encoded rescue nil
+      end
+    end
+
+    def self.dump(decoded)
+      decoded.encode
+    end
   end
 end
-

data/lib/mumukit/auth/version.rb

@@ -1,5 +1,5 @@
 module Mumukit
   module Auth
-    VERSION = '7.10.0'
+    VERSION = '7.13.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mumukit-auth
 version: !ruby/object:Gem::Version
-  version: 7.10.0
+  version: 7.13.0
 platform: ruby
 authors:
 - Franco Leonardo Bulgarelli
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-20 00:00:00.000000000 Z
+date: 2022-07-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler