nexus_cqrs_auth 0.0.0 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3fe50086ea1962e4813c846b561aa4f6eaaac1fea932fec62c7344cde12a26e4
-  data.tar.gz: c8e3d4d182efe23bf2d23ca0024be3d08ffc1c4f6fe97daf42b7bd67d4c91f1b
+  metadata.gz: ba5ea106ddd9ac8566584d353c718a1b2a861c1308301c855d758e54a3928bad
+  data.tar.gz: 461fda9b1ffa501529c8e07d91acface837f7bbbfba1dd1de193eb85b9f4c207
 SHA512:
-  metadata.gz: d0016666660572c0d12788c1636076112179aecfdb07fa147a434d30c6750e0054d5a2c2f6de706d4fba16eeefb9427d5e247c468abd60fc03bae6898ae1754b
-  data.tar.gz: 3666dcbd9cdf2e2bac16c4d643ffac1b3220261cdcfac31b53fb6b605f307b380297214fb10c9a5e159b1a037164927e9773d1944764d19a5d6749a193d7fd8a
+  metadata.gz: 313f9218ba94bee5cd4e62b79eca24774582de4023f072670f6e7f3683c95ab6e113b0199020da152ecebc9b5cb5f06e9d765d471a2708e87a481236610b2489
+  data.tar.gz: 0b735178b3e5ab4b428a7fd6b29d8451dc95ec4d5f2aaf4d9631ff347adab6f0e9f04e5c76581542303c34eba3d877fbb6f140402a4a2e93e5f3ca5802f66e06

data/.gitignore

@@ -9,3 +9,4 @@
 /.gem
 /spec/lib/tmp
 *.gem
+Gemfile.lock

data/.gitlab-ci.yml

@@ -0,0 +1,36 @@
+image: "ruby:2.7"
+
+stages:
+  - release
+  - test
+
+before_script:
+  - gem install bundler --no-document
+  - bundle install --jobs $(nproc)  "${FLAGS[@]}"
+
+rspec:
+  script:
+    - bundle exec rspec
+
+rubocop:
+  script:
+    - bundle exec rubocop
+
+release:
+  stage: release
+  rules:
+    - if: '$CI_COMMIT_TAG'
+  script:
+    - mkdir -p ~/.gem
+    - cp /builds/pub/nexus_cqrs_auth.tmp/RUBYGEMS_CREDENTIALS ~/.gem/credentials
+    - chmod 0600 ~/.gem/credentials
+    - gem update --system
+    - ruby --version
+    - gem env version
+    - sed -i "s/0.0.0/$CI_COMMIT_TAG/g" lib/nexus_cqrs_auth/version.rb
+    - gem build nexus_cqrs_auth.gemspec
+    - gem push nexus_cqrs_auth*.gem
+  artifacts:
+    paths:
+      - nexus_cqrs_auth*.gem
+    expire_in: 30 days

data/Gemfile

@@ -6,7 +6,3 @@ gem 'rubocop'
 gem 'rubocop-shopify', "~> 1.0.4", require: false
 
 gem 'rspec'
-
-gem 'nexus_cqrs'
-gem 'pundit'
-gem 'strings-case'

data/README.md

@@ -1 +1,149 @@
-nexus_cqrs_auth
+# nexus_cqrs_auth
+
+Authorisation for the Nexus CQRS pattern.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'nexus_cqrs_auth'
+```
+
+And then execute:
+
+    $ bundle install
+
+Or install it yourself as:
+
+    $ gem install nexus_cqrs_auth
+
+## Usage
+
+When setting up the message bus, attach the authorisation middleware to it:
+
+```ruby
+middleware_stack = Middleware::Builder.new do |b|
+  b.use NexusCqrsAuth::AuthMiddleware
+end
+
+bus = Bus.new(middleware: middleware_stack)
+```
+
+You will also need to set metadata on each message (command/query) before dispatching it to the bus:
+
+```ruby
+command.set_metadata(:current_user, user)
+execute(command)
+```
+
+How you set this data, and where you get the current user from is application specific.
+
+For example, a helper included in all GraphQL types could look like this:
+
+```ruby
+module GraphQlCqrsHelpers
+  def execute(command)
+    command_executor.execute(enrich_message(command))
+  end
+
+  def query(query)
+    query_executor.execute(enrich_message(query))
+  end
+
+  def command_executor
+    @command_executor ||= $COMMAND_EXECUTOR
+  end
+
+  def query_executor
+    @query_executor ||= $QUERY_EXECUTOR
+  end
+
+  private
+
+  def enrich_message(message)
+    message.set_metadata(:current_user, @context[:current_user])
+    message
+  end
+end
+```
+
+You can then write various policies to setup authorisation in CQRS flows.
+
+More information about policies can be found in the [Pundit documentation](https://github.com/varvet/pundit).
+
+Remember to create a base policy at: `app/policies/application_policy.rb`
+
+### Bus level policy
+
+Create a policy class in `app/policies/my_message_policy.rb`
+
+```ruby
+class MyMessagePolicy < ApplicationPolicy
+  def initialize(user, message)
+    @user = user
+    @query = message
+  end
+  
+  def authorise?
+    true
+  end
+end
+```
+
+The `authorise?` method will be called before the message handler. If `authorise?` returns false, execution of the bus
+will halt and a `Pundit::NotAuthorizedError` will be raised.
+
+### Record level policy
+
+You can write policies for records:
+
+```ruby
+class PostPolicy < ApplicationPolicy
+  def initialize(user, post)
+    @user = user
+    @post = post
+  end
+  
+  def publish_post?
+    true
+  end
+end
+```
+
+You can then authorise a particular `Post`s by calling the policy from a command handler:
+
+```ruby
+class PublishPostHandler < NexusCqrs::BaseCommandHandler
+  include NexusCqrsAuth
+
+  # @param [Commands::PublishPost] command
+  def call(command)
+    post = Post.find(command.post_id)
+    authorize(command, post)
+    post.is_published = true
+    post.save
+  end
+end
+```
+
+The `NexusCqrsAuth` module must be included in the handler.
+
+`authorize` should be called with the domain message (e.g. command) and the record. The policy for that record type
+(e.g. `PostPolicy`) will be called and the scope with the same name as the command (`PublishPost` -> `publish_post?`)
+will be called.
+
+If the scope returns false, then a `Pundit::NotAuthorizedError` will be raised.
+
+## Development
+
+To contribute to this gem, simple clone the repository, run `bundle install` and run tests:
+
+```shell script
+    bundle exec rspec
+    bundle exec rubocop
+```
+
+## Releasing
+
+The release process is tied to the git tags. Simply creating a new tag and pushing will trigger a new release to rubygems.

data/lib/nexus_cqrs_auth/helper.rb

@@ -1,4 +1,5 @@
 require 'pundit'
+require 'strings-case'
 
 module NexusCqrsAuth
   include Pundit
@@ -11,6 +12,12 @@ module NexusCqrsAuth
   end
 
   def pundit_user
-    @command_user || super
+    @command_user || super || nil
+  end
+
+  def current_user
+    return super if defined?(super)
+
+    nil
   end
 end

data/lib/nexus_cqrs_auth/middleware.rb

@@ -7,7 +7,9 @@ module NexusCqrsAuth
     include NexusCqrsAuth
 
     def call(message)
-      authorize(message, message, :authorise?)
+      if Pundit::PolicyFinder.new(message).policy
+        authorize(message, message, :authorise?)
+      end
       @next.call(message)
     end
   end

data/lib/nexus_cqrs_auth/version.rb

@@ -1,3 +1,3 @@
 module NexusCqrsAuth
-  VERSION = '0.0.0'
+  VERSION = '0.0.5'
 end

data/nexus_cqrs_auth.gemspec

@@ -15,4 +15,7 @@ Gem::Specification.new do |spec|
     %x(git ls-files -z).split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
   end
   spec.require_paths = ['lib']
+  spec.add_dependency('nexus_cqrs', '~>0.1.1')
+  spec.add_dependency('pundit')
+  spec.add_dependency('strings-case')
 end

metadata

@@ -1,15 +1,57 @@
 --- !ruby/object:Gem::Specification
 name: nexus_cqrs_auth
 version: !ruby/object:Gem::Version
-  version: 0.0.0
+  version: 0.0.5
 platform: ruby
 authors:
 - Chris Harrison
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-29 00:00:00.000000000 Z
-dependencies: []
+date: 2021-05-25 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: nexus_cqrs
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.1.1
+- !ruby/object:Gem::Dependency
+  name: pundit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: strings-case
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: 
 email:
 - chris.harrison@nexusmods.com
@@ -18,10 +60,10 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitignore"
+- ".gitlab-ci.yml"
 - ".rspec"
 - ".rubocop.yml"
 - Gemfile
-- Gemfile.lock
 - README.md
 - lib/nexus_cqrs_auth.rb
 - lib/nexus_cqrs_auth/helper.rb
@@ -46,7 +88,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.2.17
 signing_key: 
 specification_version: 4
 summary: Authorisation for the Nexus CQRS pattern

data/Gemfile.lock

@@ -1,77 +0,0 @@
-PATH
-  remote: .
-  specs:
-    nexus_cqrs_auth (1.0.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activesupport (6.0.3.3)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-      zeitwerk (~> 2.2, >= 2.2.2)
-    ast (2.4.1)
-    concurrent-ruby (1.1.7)
-    diff-lcs (1.4.4)
-    i18n (1.8.5)
-      concurrent-ruby (~> 1.0)
-    minitest (5.14.2)
-    nexus_cqrs (0.0.13)
-    parallel (1.19.2)
-    parser (2.7.1.5)
-      ast (~> 2.4.1)
-    pundit (2.1.0)
-      activesupport (>= 3.0.0)
-    rainbow (3.0.0)
-    regexp_parser (1.8.1)
-    rexml (3.2.4)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.2)
-      rspec-support (~> 3.9.3)
-    rspec-expectations (3.9.2)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.1)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.3)
-    rubocop (0.89.1)
-      parallel (~> 1.10)
-      parser (>= 2.7.1.1)
-      rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.7)
-      rexml
-      rubocop-ast (>= 0.3.0, < 1.0)
-      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 2.0)
-    rubocop-ast (0.7.1)
-      parser (>= 2.7.1.5)
-    rubocop-shopify (1.0.5)
-      rubocop (~> 0.89.0)
-    ruby-progressbar (1.10.1)
-    strings-case (0.3.0)
-    thread_safe (0.3.6)
-    tzinfo (1.2.7)
-      thread_safe (~> 0.1)
-    unicode-display_width (1.7.0)
-    zeitwerk (2.4.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  nexus_cqrs
-  nexus_cqrs_auth!
-  pundit
-  rspec
-  rubocop
-  rubocop-shopify (~> 1.0.4)
-  strings-case
-
-BUNDLED WITH
-   1.17.2