nexus_cqrs_auth 0.0.5 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ba5ea106ddd9ac8566584d353c718a1b2a861c1308301c855d758e54a3928bad
-  data.tar.gz: 461fda9b1ffa501529c8e07d91acface837f7bbbfba1dd1de193eb85b9f4c207
+  metadata.gz: 81a584f66bd17223f77be8efc9e55cd688776ef5bbafda83a287dcfdd9d56930
+  data.tar.gz: 482568a0f4bcb831714d0a97939d24392b174c0ccd14d12a61322501ed708fe7
 SHA512:
-  metadata.gz: 313f9218ba94bee5cd4e62b79eca24774582de4023f072670f6e7f3683c95ab6e113b0199020da152ecebc9b5cb5f06e9d765d471a2708e87a481236610b2489
-  data.tar.gz: 0b735178b3e5ab4b428a7fd6b29d8451dc95ec4d5f2aaf4d9631ff347adab6f0e9f04e5c76581542303c34eba3d877fbb6f140402a4a2e93e5f3ca5802f66e06
+  metadata.gz: bc0c0a9191fa3b5972264806b164fdaa8c67f1c290d7918700de636f6d2d32dfe250392c98bdf06ca5fbee919c87a7b0f31c857534b14934137e0f154d9d4594
+  data.tar.gz: 69b83b159ef8202a0fe65b21aeb5848e5aa3e326f6677033c51c72507b97fb2c5bb6d428279dc6f5b4a0330fa6c06395cf669305fa7863e1fdaa3fc486f149ff

data/.gitlab-ci.yml

@@ -22,7 +22,7 @@ release:
     - if: '$CI_COMMIT_TAG'
   script:
     - mkdir -p ~/.gem
-    - cp /builds/pub/nexus_cqrs_auth.tmp/RUBYGEMS_CREDENTIALS ~/.gem/credentials
+    - cp $RUBYGEMS_CREDENTIALS ~/.gem/credentials
     - chmod 0600 ~/.gem/credentials
     - gem update --system
     - ruby --version

data/Gemfile

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 source 'https://rubygems.org'
 
 gemspec

data/lib/nexus_cqrs_auth/helper.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'pundit'
 require 'strings-case'
 
@@ -6,13 +7,21 @@ module NexusCqrsAuth
   def authorize(command, record, query = nil, policy_class: nil)
     query ||= Strings::Case.snakecase(command.demodularised_class_name) + '?'
     @command_user = command.metadata[:current_user]
+    @global_permissions = command.metadata[:global_permissions]
     super_ = super(record, query, policy_class: policy_class)
     @command_user = nil
+    @global_permissions = nil
     super_
   end
 
+  # Helper method for creating a permissions provider object from a query object. This allows certain permissions
+  # to be checked inside the command handler, as opposed to inside the policy
+  def permission_provider(query)
+    PermissionProvider.new(query.metadata[:current_user], query.metadata[:global_permissions])
+  end
+
   def pundit_user
-    @command_user || super || nil
+    UserContext.new(@command_user, @global_permissions)
   end
 
   def current_user

data/lib/nexus_cqrs_auth/middleware.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'nexus_cqrs'
 require 'pundit'
 

data/lib/nexus_cqrs_auth/ownable.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+# Concern used to integrate models to the permissions system. Including this module to a model will assume the
+# model can be "owned" by a user. When the model is created, permissions will automatically be assigned to the user
+# and permissions can be validated and "repaired" retroactively.
+module NexusCqrsAuth
+  module Ownable
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :granted_permissions, default: {}
+
+      # Default relationship to <class>_permissions
+      class_attribute :permissions_relation, default: top_ancestor_class.name.downcase + "_permissions"
+      class_attribute :owner_column, default: :user_id
+
+      before_create :assign_permissions
+
+      define_model_callbacks :create_permissions
+    end
+
+    module ClassMethods
+      # Gets the class that this module is included in
+      def top_ancestor_class
+        ancestors.first
+      end
+    end
+
+    def assign_permissions
+      # As we are doing this on before_create, we must "build" this association, as opposed to creating it. This
+      # ensures validation is passed before saving this parent Collection.
+      granted_permissions.each do |p|
+        unless permissions.where(permission: p, entity_id: id, user_id: owner_id).exists?
+          permissions.build(user_id: owner_id, permission: p)
+        end
+      end
+    end
+
+    def validate_owner_permissions
+    end
+
+    def owner_id
+      send(owner_column)
+    end
+
+    def permissions
+      if respond_to?(permissions_relation)
+        return send(permissions_relation)
+      end
+
+      raise OwnableRelationshipNotSet, "Permissions relation not set.
+Set it on your model with `self.permissions_relation = :xxx_permissions`, and ensure the relationship has been created"
+    end
+  end
+
+  class OwnableRelationshipNotSet < StandardError
+  end
+end

data/lib/nexus_cqrs_auth/permission_provider.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+module NexusCqrsAuth
+  class PermissionProvider
+    def initialize(user_id, global_permissions)
+      @user_id = user_id
+      @global_permissions = parse_permissions_array(global_permissions)
+    end
+
+    # Returns true if the current user has the requested permission on the requested entity (if passed), or globally
+    #
+    # @param [String] permission_key Permission key to check against
+    # @param [ApplicationRecord] permission_model Permission model
+    # @param [Integer] entity_id ID of the entity
+    # @return [Boolean] Returns true if the current user has this permission on this entity
+    # @example Check for permission
+    #   permissions.has_permission?('collection:publish', CollectionPermissions, collection.id) #=> true
+    def has_permission?(permission_key, permission_model = nil, entity_id = nil)
+      return false if @user_id.nil?
+
+      return true if @global_permissions.include?(permission_key)
+
+      # check entity-specific permissions
+      unless permission_model.nil?
+        return true if permission_model.where(permission: permission_key, entity_id: entity_id,
+user_id: @user_id).exists?
+      end
+
+      false
+    end
+
+    # Retrieves a list of permissions assigned to a user for a specific entity
+    #
+    # @param [ApplicationRecord] permission_model Permission model
+    # @param [Integer] entity_id ID of the entity
+    # @return [Array] Returns an array of hashes representing permission keys, along with their global status
+    # @example Get a list of permissions
+    #   permissions.for_user(CollectionPermissions, collection.id) #=>
+    #     [
+    #       {:global=>false, :key=>"collection:discard"},
+    #       {:global=>false, :key=>"collection:publish"},
+    #       {:global=>false, :key=>"collection:view_under_moderation"},
+    #       {:global=>false, :key=>"collection:set_status"}
+    #     ]
+    def for_user_on_entity(permission_model, entity_id)
+      return [] if @user_id.nil?
+
+      # retrieve entity-specific permissions from DB and map to hash
+      entity_permissions = permission_model.where(user_id: @user_id, entity_id: entity_id)
+        .map { |p| { global: false, key: p.permission } }
+
+      # Map global permissions to hash
+      global_permissions = @global_permissions.map { |p| { global: true, key: p } }
+
+      # Combine hashes and ensure global permissions take priority
+      (global_permissions + entity_permissions).uniq { |p| p[:key] }
+    end
+
+    private
+
+    def parse_permissions_array(permissions_array)
+      return [] if permissions_array.nil?
+
+      permissions = []
+
+      permissions_array.each do |entity, action_array|
+        action_array.each do |action|
+          permissions << entity + ":" + action
+        end
+      end
+
+      permissions
+    end
+  end
+end

data/lib/nexus_cqrs_auth/user_context.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+module NexusCqrsAuth
+  # Class used to provide additional context into pundit. This enables us to not only pass the user model, but also the
+  # global permissions for that user - as those are pulled from the user's request, not the model.
+  class UserContext
+    attr_reader :user, :global_permissions
+
+    def initialize(user, global_permissions)
+      @user = user
+      @global_permissions = global_permissions
+    end
+  end
+end

data/lib/nexus_cqrs_auth/version.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module NexusCqrsAuth
-  VERSION = '0.0.5'
+  VERSION = '1.2.0'
 end

data/lib/nexus_cqrs_auth.rb

@@ -1,2 +1,6 @@
+# frozen_string_literal: true
 require 'nexus_cqrs_auth/helper'
 require 'nexus_cqrs_auth/middleware'
+require 'nexus_cqrs_auth/permission_provider'
+require 'nexus_cqrs_auth/user_context'
+require 'nexus_cqrs_auth/ownable'

data/nexus_cqrs_auth.gemspec

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require_relative 'lib/nexus_cqrs_auth/version'
 
 Gem::Specification.new do |spec|
@@ -15,7 +16,7 @@ Gem::Specification.new do |spec|
     %x(git ls-files -z).split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
   end
   spec.require_paths = ['lib']
-  spec.add_dependency('nexus_cqrs', '~>0.1.1')
+  spec.add_dependency('nexus_cqrs', '~>0.2')
   spec.add_dependency('pundit')
   spec.add_dependency('strings-case')
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: nexus_cqrs_auth
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 1.2.0
 platform: ruby
 authors:
 - Chris Harrison
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-25 00:00:00.000000000 Z
+date: 2021-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nexus_cqrs
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: '0.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.1
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: pundit
   requirement: !ruby/object:Gem::Requirement
@@ -68,6 +68,9 @@ files:
 - lib/nexus_cqrs_auth.rb
 - lib/nexus_cqrs_auth/helper.rb
 - lib/nexus_cqrs_auth/middleware.rb
+- lib/nexus_cqrs_auth/ownable.rb
+- lib/nexus_cqrs_auth/permission_provider.rb
+- lib/nexus_cqrs_auth/user_context.rb
 - lib/nexus_cqrs_auth/version.rb
 - nexus_cqrs_auth.gemspec
 homepage: 
@@ -88,7 +91,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.17
+rubygems_version: 3.2.30
 signing_key: 
 specification_version: 4
 summary: Authorisation for the Nexus CQRS pattern