nexus_cqrs_auth 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 94d379370fd1bbf839449f70e7e1cd89c9b25329b676c1677af766fa367f0c50
-  data.tar.gz: e4d381029b3088546bee61e8cfa025c186389d9f45a2dc41cc115f0ccc101f24
+  metadata.gz: 81a584f66bd17223f77be8efc9e55cd688776ef5bbafda83a287dcfdd9d56930
+  data.tar.gz: 482568a0f4bcb831714d0a97939d24392b174c0ccd14d12a61322501ed708fe7
 SHA512:
-  metadata.gz: 87b9c424f4f467ffcd0ea920055f38233ba76b0fb44347efb02b9c8673fbac46117b4b81509dc97c475451f0d68fd36125fd8590dc8ad60bbababdc853e16163
-  data.tar.gz: 17a6d172b728387267afe182d2259b7d76000fd9a9486619265046704d265e02b8bbbf7b9482bf9222ad72e9e670d2aa2169fb22be8f92e2aa09cb6a551781a2
+  metadata.gz: bc0c0a9191fa3b5972264806b164fdaa8c67f1c290d7918700de636f6d2d32dfe250392c98bdf06ca5fbee919c87a7b0f31c857534b14934137e0f154d9d4594
+  data.tar.gz: 69b83b159ef8202a0fe65b21aeb5848e5aa3e326f6677033c51c72507b97fb2c5bb6d428279dc6f5b4a0330fa6c06395cf669305fa7863e1fdaa3fc486f149ff

data/lib/nexus_cqrs_auth/ownable.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+# Concern used to integrate models to the permissions system. Including this module to a model will assume the
+# model can be "owned" by a user. When the model is created, permissions will automatically be assigned to the user
+# and permissions can be validated and "repaired" retroactively.
+module NexusCqrsAuth
+  module Ownable
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :granted_permissions, default: {}
+
+      # Default relationship to <class>_permissions
+      class_attribute :permissions_relation, default: top_ancestor_class.name.downcase + "_permissions"
+      class_attribute :owner_column, default: :user_id
+
+      before_create :assign_permissions
+
+      define_model_callbacks :create_permissions
+    end
+
+    module ClassMethods
+      # Gets the class that this module is included in
+      def top_ancestor_class
+        ancestors.first
+      end
+    end
+
+    def assign_permissions
+      # As we are doing this on before_create, we must "build" this association, as opposed to creating it. This
+      # ensures validation is passed before saving this parent Collection.
+      granted_permissions.each do |p|
+        unless permissions.where(permission: p, entity_id: id, user_id: owner_id).exists?
+          permissions.build(user_id: owner_id, permission: p)
+        end
+      end
+    end
+
+    def validate_owner_permissions
+    end
+
+    def owner_id
+      send(owner_column)
+    end
+
+    def permissions
+      if respond_to?(permissions_relation)
+        return send(permissions_relation)
+      end
+
+      raise OwnableRelationshipNotSet, "Permissions relation not set.
+Set it on your model with `self.permissions_relation = :xxx_permissions`, and ensure the relationship has been created"
+    end
+  end
+
+  class OwnableRelationshipNotSet < StandardError
+  end
+end

data/lib/nexus_cqrs_auth/permission_provider.rb

@@ -6,11 +6,14 @@ module NexusCqrsAuth
       @global_permissions = parse_permissions_array(global_permissions)
     end
 
+    # Returns true if the current user has the requested permission on the requested entity (if passed), or globally
     #
-    # has_permission? 'collection:destroy'
-    #
-    # has_permission? 'collection:edit', CollectionPermission, collection.id
-    #
+    # @param [String] permission_key Permission key to check against
+    # @param [ApplicationRecord] permission_model Permission model
+    # @param [Integer] entity_id ID of the entity
+    # @return [Boolean] Returns true if the current user has this permission on this entity
+    # @example Check for permission
+    #   permissions.has_permission?('collection:publish', CollectionPermissions, collection.id) #=> true
     def has_permission?(permission_key, permission_model = nil, entity_id = nil)
       return false if @user_id.nil?
 
@@ -25,6 +28,33 @@ user_id: @user_id).exists?
       false
     end
 
+    # Retrieves a list of permissions assigned to a user for a specific entity
+    #
+    # @param [ApplicationRecord] permission_model Permission model
+    # @param [Integer] entity_id ID of the entity
+    # @return [Array] Returns an array of hashes representing permission keys, along with their global status
+    # @example Get a list of permissions
+    #   permissions.for_user(CollectionPermissions, collection.id) #=>
+    #     [
+    #       {:global=>false, :key=>"collection:discard"},
+    #       {:global=>false, :key=>"collection:publish"},
+    #       {:global=>false, :key=>"collection:view_under_moderation"},
+    #       {:global=>false, :key=>"collection:set_status"}
+    #     ]
+    def for_user_on_entity(permission_model, entity_id)
+      return [] if @user_id.nil?
+
+      # retrieve entity-specific permissions from DB and map to hash
+      entity_permissions = permission_model.where(user_id: @user_id, entity_id: entity_id)
+        .map { |p| { global: false, key: p.permission } }
+
+      # Map global permissions to hash
+      global_permissions = @global_permissions.map { |p| { global: true, key: p } }
+
+      # Combine hashes and ensure global permissions take priority
+      (global_permissions + entity_permissions).uniq { |p| p[:key] }
+    end
+
     private
 
     def parse_permissions_array(permissions_array)

data/lib/nexus_cqrs_auth/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module NexusCqrsAuth
-  VERSION = '1.1.0'
+  VERSION = '1.2.0'
 end

data/lib/nexus_cqrs_auth.rb

@@ -3,3 +3,4 @@ require 'nexus_cqrs_auth/helper'
 require 'nexus_cqrs_auth/middleware'
 require 'nexus_cqrs_auth/permission_provider'
 require 'nexus_cqrs_auth/user_context'
+require 'nexus_cqrs_auth/ownable'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: nexus_cqrs_auth
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Chris Harrison
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-10-21 00:00:00.000000000 Z
+date: 2021-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nexus_cqrs
@@ -68,6 +68,7 @@ files:
 - lib/nexus_cqrs_auth.rb
 - lib/nexus_cqrs_auth/helper.rb
 - lib/nexus_cqrs_auth/middleware.rb
+- lib/nexus_cqrs_auth/ownable.rb
 - lib/nexus_cqrs_auth/permission_provider.rb
 - lib/nexus_cqrs_auth/user_context.rb
 - lib/nexus_cqrs_auth/version.rb
@@ -90,7 +91,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.29
+rubygems_version: 3.2.30
 signing_key: 
 specification_version: 4
 summary: Authorisation for the Nexus CQRS pattern