objectbouncer 0.1.1 → 0.1.2

data/lib/objectbouncer/base.rb

@@ -1,3 +1,4 @@
+require 'thread'
 module ObjectBouncer
   def self.enforce!
     @enforce = true
@@ -25,9 +26,14 @@ module ObjectBouncer
       @current_user ||= self.class.current_user
     end
 
-    def apply_policies
-      policies.keys.each do |method|
-        self.class.protect_method!(method)
+
+    def apply_policies(key = nil)
+      if key && policies.keys.include?(key)
+        self.class.protect_method!(key, force = true)
+      else
+        policies.keys.each do |method|
+          self.class.protect_method!(method)
+        end
       end
     end
 
@@ -39,19 +45,16 @@ module ObjectBouncer
       klass.extend ClassMethods
       klass.overwrite_initialize
       klass.instance_eval do
-        def method_added(name)
-          overwrite_initialize if name == :initialize
-        end
       end
     end
 
     private
 
       def call_denied?(meth, *args)
-        if enforced? && current_user.nil?
+        if ObjectBouncer.enforced? && current_user.nil?
           raise ObjectBouncer::ArgumentError.new("You need to specify the user to execute the method as. e.g., #{self.class.to_s}.as(@some_user).#{meth.to_s}(....)")
         end
-        return false if current_user.nil? && !enforced?
+        return false if current_user.nil? && !ObjectBouncer.enforced?
         if meth_policies = policies[meth]
           if !meth_policies[:unless].empty?
             return false if meth_policies[:unless].detect{|policy| policy.call(current_user, self, *args) rescue nil}

data/lib/objectbouncer/class_methods.rb

@@ -1,6 +1,19 @@
 module ObjectBouncer
   module Doorman
     module ClassMethods
+
+      def ignoring_added_methods
+        ignoring_added_methods = @ignoring_added_methods
+        @ignoring_added_methods = true
+        yield
+      ensure
+        @ignoring_added_methods = ignoring_added_methods
+      end
+
+      def ignoring_added_methods?
+        @ignoring_added_methods
+      end
+
       def overwrite_initialize
         class_eval do
           unless method_defined?(:objectbouncer_initialize)
@@ -31,10 +44,6 @@ module ObjectBouncer
         { :if => [], :unless => [] }
       end
 
-      def enforced?
-        ObjectBouncer.enforced?
-      end
-
       def current_user=(user)
         @current_user = user
       end
@@ -75,16 +84,21 @@ module ObjectBouncer
         end
       end
 
-      def apply_policies
-        policies.keys.each do |method|
-          protect_method!(method)
+      def apply_policies(key = nil)
+        if key && policies.keys.include?(key)
+          protect_method!(key, force = true)
+        else
+          policies.keys.each do |method|
+            protect_method!(method)
+          end
         end
       end
 
-      def protect_method!(method)
+      def protect_method!(method, force = false)
         renamed_method = "#{method}_without_objectbouncer".to_sym
         if method_defined?(method)
           return if method_defined?(renamed_method)
+          return if !force && method_defined?(renamed_method)
           alias_method renamed_method, method
           define_method method do |*args, &block|
             if call_denied?(method, *args)
@@ -94,8 +108,18 @@ module ObjectBouncer
             end
           end
         end
+      end
 
+      def method_added(name)
+        return if ignoring_added_methods?
+        Thread.exclusive do
+          ignoring_added_methods do
+            overwrite_initialize if name == :initialize
+            apply_policies(name) if policies && policies.keys.include?(name)
+          end
+        end
       end
+
     end
   end
 end

data/test/objectbouncer/activerecord_test.rb

@@ -9,7 +9,12 @@ class Book < ActiveRecord::Base
   door_policy do
     deny :save,  :unless => Proc.new{|person| person.is_a?(Author) }
     deny :save!, :unless => Proc.new{|person| person.is_a?(Author) }
+    deny :destroy
   end
+
+  #def destroy
+  #  super
+  #end
 end
 
 class Author
@@ -65,6 +70,13 @@ class ActiveRecordTest < Test::Unit::TestCase
         @book_as_reader = Book.as(@author).find(@book.id)
       end
 
+      should "prevent all users from destroying (even with an overridden method)" do
+        @book.current_user = @author
+        assert_raise ObjectBouncer::PermissionDenied do
+          @book.destroy
+        end
+      end
+
       should "prevent reading of individual attributes" do
       end
 

metadata

@@ -2,7 +2,7 @@
 name: objectbouncer
 version: !ruby/object:Gem::Version 
   prerelease: 
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors: 
 - Glenn Gillen
@@ -10,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-04-12 00:00:00 +01:00
+date: 2011-04-13 00:00:00 +01:00
 default_executable: 
 dependencies: []