nexus_cqrs_auth 0.1.0 → 1.2.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile +1 -0
- data/lib/nexus_cqrs_auth/helper.rb +23 -5
- data/lib/nexus_cqrs_auth/middleware.rb +1 -0
- data/lib/nexus_cqrs_auth/ownable.rb +57 -0
- data/lib/nexus_cqrs_auth/permission_provider.rb +74 -0
- data/lib/nexus_cqrs_auth/user_context.rb +13 -0
- data/lib/nexus_cqrs_auth/version.rb +2 -1
- data/lib/nexus_cqrs_auth.rb +4 -0
- data/nexus_cqrs_auth.gemspec +1 -0
- metadata +6 -3
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: a4e4dd0ea8f63b000ef78595be9e6241dc162d50e644c24c7291a8150fa6e98f
|
4
|
+
data.tar.gz: 6f14589729a606b05c4792d8b3e7ca04d182f2961c9454303a77c2a4ea138e48
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: fd99e19cd0512e8905ae4d8d454ef6f70d428731e0d2b6afef7d3e7f023d91f5be2fb44443bcbdb2fec23c3fb67c2e0e635f1a8406a61d2bce153e10908f0aec
|
7
|
+
data.tar.gz: 0a47018533846a9c4500331e9c2ade3147d3059533f3dc2de1492a5d88d24c8c0f43520d6b1ec1bc4f777d4b542b54803708c47b19bdfe9619a85ff884904bb8
|
data/Gemfile
CHANGED
@@ -1,18 +1,36 @@
|
|
1
|
+
# frozen_string_literal: true
|
1
2
|
require 'pundit'
|
2
3
|
require 'strings-case'
|
3
4
|
|
4
5
|
module NexusCqrsAuth
|
5
6
|
include Pundit
|
6
7
|
def authorize(command, record, query = nil, policy_class: nil)
|
8
|
+
|
9
|
+
# Populate the query from the command, or the params if it's being overriden
|
7
10
|
query ||= Strings::Case.snakecase(command.demodularised_class_name) + '?'
|
8
|
-
|
9
|
-
|
10
|
-
|
11
|
-
|
11
|
+
|
12
|
+
# Retreive the policy class object from the type of record we are passing in
|
13
|
+
policy_class ||= PolicyFinder.new(record).policy
|
14
|
+
|
15
|
+
# Pull context variables from command
|
16
|
+
user = command.metadata[:current_user]
|
17
|
+
global_permissions = command.metadata[:global_permissions]
|
18
|
+
|
19
|
+
# Instantiate new policy class, with context
|
20
|
+
policy = policy_class.new(UserContext.new(user, global_permissions), record)
|
21
|
+
raise NotAuthorizedError, query: query, record: record, policy: policy unless policy.public_send(query)
|
22
|
+
|
23
|
+
record.is_a?(Array) ? record.last : record
|
24
|
+
end
|
25
|
+
|
26
|
+
# Helper method for creating a permissions provider object from a query object. This allows certain permissions
|
27
|
+
# to be checked inside the command handler, as opposed to inside the policy
|
28
|
+
def permission_provider(query)
|
29
|
+
PermissionProvider.new(query.metadata[:current_user], query.metadata[:global_permissions])
|
12
30
|
end
|
13
31
|
|
14
32
|
def pundit_user
|
15
|
-
|
33
|
+
nil
|
16
34
|
end
|
17
35
|
|
18
36
|
def current_user
|
@@ -0,0 +1,57 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
# Concern used to integrate models to the permissions system. Including this module to a model will assume the
|
3
|
+
# model can be "owned" by a user. When the model is created, permissions will automatically be assigned to the user
|
4
|
+
# and permissions can be validated and "repaired" retroactively.
|
5
|
+
module NexusCqrsAuth
|
6
|
+
module Ownable
|
7
|
+
extend ActiveSupport::Concern
|
8
|
+
|
9
|
+
included do
|
10
|
+
class_attribute :granted_permissions, default: {}
|
11
|
+
|
12
|
+
# Default relationship to <class>_permissions
|
13
|
+
class_attribute :permissions_relation, default: top_ancestor_class.name.downcase + "_permissions"
|
14
|
+
class_attribute :owner_column, default: :user_id
|
15
|
+
|
16
|
+
before_create :assign_permissions
|
17
|
+
|
18
|
+
define_model_callbacks :create_permissions
|
19
|
+
end
|
20
|
+
|
21
|
+
module ClassMethods
|
22
|
+
# Gets the class that this module is included in
|
23
|
+
def top_ancestor_class
|
24
|
+
ancestors.first
|
25
|
+
end
|
26
|
+
end
|
27
|
+
|
28
|
+
def assign_permissions
|
29
|
+
# As we are doing this on before_create, we must "build" this association, as opposed to creating it. This
|
30
|
+
# ensures validation is passed before saving this parent Collection.
|
31
|
+
granted_permissions.each do |p|
|
32
|
+
unless permissions.where(permission: p, entity_id: id, user_id: owner_id).exists?
|
33
|
+
permissions.build(user_id: owner_id, permission: p)
|
34
|
+
end
|
35
|
+
end
|
36
|
+
end
|
37
|
+
|
38
|
+
def validate_owner_permissions
|
39
|
+
end
|
40
|
+
|
41
|
+
def owner_id
|
42
|
+
send(owner_column)
|
43
|
+
end
|
44
|
+
|
45
|
+
def permissions
|
46
|
+
if respond_to?(permissions_relation)
|
47
|
+
return send(permissions_relation)
|
48
|
+
end
|
49
|
+
|
50
|
+
raise OwnableRelationshipNotSet, "Permissions relation not set.
|
51
|
+
Set it on your model with `self.permissions_relation = :xxx_permissions`, and ensure the relationship has been created"
|
52
|
+
end
|
53
|
+
end
|
54
|
+
|
55
|
+
class OwnableRelationshipNotSet < StandardError
|
56
|
+
end
|
57
|
+
end
|
@@ -0,0 +1,74 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
module NexusCqrsAuth
|
3
|
+
class PermissionProvider
|
4
|
+
def initialize(user_id, global_permissions)
|
5
|
+
@user_id = user_id
|
6
|
+
@global_permissions = parse_permissions_array(global_permissions)
|
7
|
+
end
|
8
|
+
|
9
|
+
# Returns true if the current user has the requested permission on the requested entity (if passed), or globally
|
10
|
+
#
|
11
|
+
# @param [String] permission_key Permission key to check against
|
12
|
+
# @param [ApplicationRecord] permission_model Permission model
|
13
|
+
# @param [Integer] entity_id ID of the entity
|
14
|
+
# @return [Boolean] Returns true if the current user has this permission on this entity
|
15
|
+
# @example Check for permission
|
16
|
+
# permissions.has_permission?('collection:publish', CollectionPermissions, collection.id) #=> true
|
17
|
+
def has_permission?(permission_key, permission_model = nil, entity_id = nil)
|
18
|
+
return false if @user_id.nil?
|
19
|
+
|
20
|
+
return true if @global_permissions.include?(permission_key)
|
21
|
+
|
22
|
+
# check entity-specific permissions
|
23
|
+
unless permission_model.nil?
|
24
|
+
return true if permission_model.where(permission: permission_key, entity_id: entity_id,
|
25
|
+
user_id: @user_id.id).exists?
|
26
|
+
end
|
27
|
+
|
28
|
+
false
|
29
|
+
end
|
30
|
+
|
31
|
+
# Retrieves a list of permissions assigned to a user for a specific entity
|
32
|
+
#
|
33
|
+
# @param [ApplicationRecord] permission_model Permission model
|
34
|
+
# @param [Integer] entity_id ID of the entity
|
35
|
+
# @return [Array] Returns an array of hashes representing permission keys, along with their global status
|
36
|
+
# @example Get a list of permissions
|
37
|
+
# permissions.for_user(CollectionPermissions, collection.id) #=>
|
38
|
+
# [
|
39
|
+
# {:global=>false, :key=>"collection:discard"},
|
40
|
+
# {:global=>false, :key=>"collection:publish"},
|
41
|
+
# {:global=>false, :key=>"collection:view_under_moderation"},
|
42
|
+
# {:global=>false, :key=>"collection:set_status"}
|
43
|
+
# ]
|
44
|
+
def for_user_on_entity(permission_model, entity_id)
|
45
|
+
return [] if @user_id.nil?
|
46
|
+
|
47
|
+
# retrieve entity-specific permissions from DB and map to hash
|
48
|
+
entity_permissions = permission_model.where(user_id: @user_id, entity_id: entity_id)
|
49
|
+
.map { |p| { global: false, key: p.permission } }
|
50
|
+
|
51
|
+
# Map global permissions to hash
|
52
|
+
global_permissions = @global_permissions.map { |p| { global: true, key: p } }
|
53
|
+
|
54
|
+
# Combine hashes and ensure global permissions take priority
|
55
|
+
(global_permissions + entity_permissions).uniq { |p| p[:key] }
|
56
|
+
end
|
57
|
+
|
58
|
+
private
|
59
|
+
|
60
|
+
def parse_permissions_array(permissions_array)
|
61
|
+
return [] if permissions_array.nil?
|
62
|
+
|
63
|
+
permissions = []
|
64
|
+
|
65
|
+
permissions_array.each do |entity, action_array|
|
66
|
+
action_array.each do |action|
|
67
|
+
permissions << entity + ":" + action
|
68
|
+
end
|
69
|
+
end
|
70
|
+
|
71
|
+
permissions
|
72
|
+
end
|
73
|
+
end
|
74
|
+
end
|
@@ -0,0 +1,13 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
module NexusCqrsAuth
|
3
|
+
# Class used to provide additional context into pundit. This enables us to not only pass the user model, but also the
|
4
|
+
# global permissions for that user - as those are pulled from the user's request, not the model.
|
5
|
+
class UserContext
|
6
|
+
attr_reader :user, :global_permissions
|
7
|
+
|
8
|
+
def initialize(user, global_permissions)
|
9
|
+
@user = user
|
10
|
+
@global_permissions = global_permissions
|
11
|
+
end
|
12
|
+
end
|
13
|
+
end
|
data/lib/nexus_cqrs_auth.rb
CHANGED
data/nexus_cqrs_auth.gemspec
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: nexus_cqrs_auth
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 1.2.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Chris Harrison
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2021-
|
11
|
+
date: 2021-11-02 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: nexus_cqrs
|
@@ -68,6 +68,9 @@ files:
|
|
68
68
|
- lib/nexus_cqrs_auth.rb
|
69
69
|
- lib/nexus_cqrs_auth/helper.rb
|
70
70
|
- lib/nexus_cqrs_auth/middleware.rb
|
71
|
+
- lib/nexus_cqrs_auth/ownable.rb
|
72
|
+
- lib/nexus_cqrs_auth/permission_provider.rb
|
73
|
+
- lib/nexus_cqrs_auth/user_context.rb
|
71
74
|
- lib/nexus_cqrs_auth/version.rb
|
72
75
|
- nexus_cqrs_auth.gemspec
|
73
76
|
homepage:
|
@@ -88,7 +91,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
88
91
|
- !ruby/object:Gem::Version
|
89
92
|
version: '0'
|
90
93
|
requirements: []
|
91
|
-
rubygems_version: 3.2.
|
94
|
+
rubygems_version: 3.2.30
|
92
95
|
signing_key:
|
93
96
|
specification_version: 4
|
94
97
|
summary: Authorisation for the Nexus CQRS pattern
|